Report - briope.com/?a=103&c=32739&s1=mixdes4322

Report Overview

Submitted URL
briope.com/?a=103&c=32739&s1=mixdes4322
IP
209.97.159.12
ASN
#14061 DIGITALOCEAN-ASN
Submitted
2024-04-26 12:52:08
Access
public
Website Title
My Family Benefit Guide
Final URL
benefitsforfamilies.com/?a=103&s1=mixdes4322
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
16

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
benefitsforfamilies.com	unknown	2023-09-01	2023-09-01	2024-04-10	4.1 kB	347 kB	172.67.170.34
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-26	438 B	31 kB	216.58.207.202
maxcdn.bootstrapcdn.com	724	2012-05-25	2014-06-18	2024-04-25	900 B	132 kB	104.18.11.207
use.fontawesome.com	942	2012-10-18	2017-01-30	2024-04-25	1.0 kB	353 kB	172.67.142.245
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-25	449 B	20 kB	104.17.25.14
briope.com	unknown	2018-03-22	2019-02-18	2024-03-28	493 B	561 B	209.97.159.12
ronikklab.com	unknown	2020-09-23	2020-09-25	2024-01-30	676 B	9.9 kB	146.190.156.148

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	benefitsforfamilies.com	Sinkholed
2024-04-26	medium	benefitsforfamilies.com	Sinkholed
2024-04-26	medium	benefitsforfamilies.com	Sinkholed
2024-04-26	medium	benefitsforfamilies.com	Sinkholed
2024-04-26	medium	benefitsforfamilies.com	Sinkholed
2024-04-26	medium	benefitsforfamilies.com	Sinkholed
2024-04-26	medium	benefitsforfamilies.com	Sinkholed
2024-04-26	medium	benefitsforfamilies.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (8)

	URL	Size	First Seen	Last Seen
	benefitsforfamilies.com/?a=103&s1=mixdes4322	374 B	2023-03-14	2024-04-26
Pretty URL benefitsforfamilies.com/?a=103&s1=mixdes4322 IP 172.67.170.34 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-14 01:42:52 Last Seen2024-04-26 14:52:08 Times Seen15 Hash a7806c50605aad3b91cd7cd78e36b6d2 efb4b2edd8998ddf30a077e26e30904aff36200b 1f0b07a406e97b436ccb2a7fc46792e5dcb4f2b37507bfaf0d8a803c1a176ba6 Loading...

	benefitsforfamilies.com/assets/js/jquery.mask.min.js	8.3 kB	2023-03-07	2024-05-06
Pretty URL benefitsforfamilies.com/assets/js/jquery.mask.min.js IP 172.67.170.34 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:41 Last Seen2024-05-06 07:27:53 Times Seen12919 Hash cc290e6c3aeecf5021dd82ad8df2512a fb983aecd3940e8ebbfe5e74c8099cee9223c957 2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995 Loading...

	benefitsforfamilies.com/assets/js/validate.js	10 kB	2024-04-26	2024-04-26
Pretty URL benefitsforfamilies.com/assets/js/validate.js IP 172.67.170.34 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 14:52:09 Last Seen2024-04-26 14:52:09 Times Seen1 Hash 96e120a28722b2e13ee2e1e349ac9d39 4a457100129283073a81a1567a1b64edca14ccc4 723a6699d266f109ecf6ee5c84255e09f8485259820413240950c5470b2f274a Loading...

	benefitsforfamilies.com/assets/js/regular.js	4.3 kB	2023-03-14	2024-04-26
Pretty URL benefitsforfamilies.com/assets/js/regular.js IP 172.67.170.34 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-14 14:46:59 Last Seen2024-04-26 14:52:09 Times Seen77 Hash 51508ddcfafb72210fcf197c41c3cb43 afeb96746b78054457b812f3e59b6d8fd2d7e5bc 644e600958552b05d4e3dd5f0f228ef0834749b7b7d3f42f1f968d77dc1e8fba Loading...

	benefitsforfamilies.com/?a=103&s1=mixdes4322	39 B	2023-03-08	2024-04-26
Pretty URL benefitsforfamilies.com/?a=103&s1=mixdes4322 IP 172.67.170.34 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 20:02:53 Last Seen2024-04-26 14:52:09 Times Seen67 Hash 61d2aca3788f2de1a0cc4addb3cacdf3 b7fb7a902baca3e45551dd7c5d6cd97f42103081 6cc3cd532e88787e1b1086b09e39921bb6a574b2a7fe1cae1387da08035b73c5 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js	87 kB	2023-03-07	2024-05-06
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js IP 216.58.207.202 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-05-06 18:17:19 Times Seen109022 Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Loading...

	cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	19 kB	2023-03-07	2024-05-06
Pretty URL cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:44 Last Seen2024-05-06 18:23:42 Times Seen113519 Hash 70d3fda195602fe8b75e0097eed74dde c3b977aa4b8dfb69d651e07015031d385ded964b a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Loading...

	maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	49 kB	2023-03-07	2024-05-06
Pretty URL maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js IP 104.18.11.207 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:44 Last Seen2024-05-06 18:23:42 Times Seen138752 Hash 14d449eb8876fa55e1ef3c2cc52b0c17 a9545831803b1359cfeed47e3b4d6bae68e40e99 e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Loading...

HTTP Transactions (17)

URL IP Response Size

briope.com/?a=103&c=32739&s1=mixdes4322

209.97.159.12

127 B

URL
briope.com/?a=103&c=32739&s1=mixdes4322
IP
209.97.159.12:0
ASN
#14061 DIGITALOCEAN-ASN

File type
HTML document, ASCII text, with no line terminators
Size
127 B (127 bytes)
Hash
75ea976bfa5bcea8bfff0c8360c6f8c0
1228563036f448ccf9f0f811011d312afb9d1909
d36030bf5c99b710d36759cff5aa1a6483d0edd3b913432a11d70d1a87c6f235

HTTP Headers

GET /?a=103&c=32739&s1=mixdes4322 HTTP/1.1
Host: briope.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 12:51:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=vajmh16a0dg57sbnj6t5a6na31; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Server: nginx, Apache/2.4.6 (CentOS) PHP/5.6.8
X-Powered-By: PHP/5.3.3, PHP/5.6.8
Content-Encoding: gzip

ronikklab.com/?a=103&c=32739&s1=mixdes4322

146.190.156.148

302 Found

172 B

URL User Request GET HTTP/1.1
ronikklab.com/?a=103&c=32739&s1=mixdes4322
IP
146.190.156.148:80
ASN
#14061 DIGITALOCEAN-ASN

File type
HTML document, ASCII text, with CRLF line terminators
Size
172 B (172 bytes)
Hash
8eb2b847410faf0578402bfc5d0836c9
b200bf77cd3b9966ec16d03bb450aac4d8b6939d
fe490fdd7d3cb9a8b48b2fb56feeda236449c168a59fbd325d8ca69d14a22398

HTTP Headers

GET /?a=103&c=32739&s1=mixdes4322 HTTP/1.1
Host: ronikklab.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
date: Fri, 26 Apr 2024 12:51:47 GMT
content-type: text/html; charset=utf-8
content-length: 172
cache-control: private
location: http://benefitsforfamilies.com/?a=103&s1=mixdes4322
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
set-cookie: st=misd/AizOdhw1x3oM0twXc2Tq3ZuMWtph5v5GWfGl0gxnMzVs6oe6A==; domain=.ronikklab.com; path=/; HttpOnly
tym=ZX8eU5xMmUFPv4EhUc+QvM2Tq3ZuMWtph5v5GWfGl0gxnMzVs6oe6A==; domain=.ronikklab.com; expires=Sun, 26-Apr-2026 12:51:47 GMT; path=/; HttpOnly

benefitsforfamilies.com/?a=103&s1=mixdes4322

172.67.170.34

200 OK

10 kB

URL User Request GET HTTP/2
benefitsforfamilies.com/?a=103&s1=mixdes4322
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (880)
Size
10 kB (10181 bytes)
Hash
6d4142c6d51c92f3124076e77a5759ab
0b5544fcbcfab6a482097ebe604dc0012996a759
e7872be54972aaa3f59f8db8d4f25b6ddcef6b915b09d1b1f2060fd9f4aa309f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?a=103&s1=mixdes4322 HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 12:51:47 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E5oI33dYxivQX8tFShWXuoTsFjAvndIbNUGVdk%2BrM8Z90d%2BFXhwDEaPFTGegYtoqOKAhOC6vTRYqydxcdu92aRUSJNJWvOqntu2rdPpcOudx5mrp4e93u%2FsICbLfvymxpxHMb%2BObYnBr%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a6b4cbee60568e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

216.58.207.202

200 OK

30 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
IP
216.58.207.202:443
ASN
#15169 GOOGLE

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
30 kB (30399 bytes)
Hash
a09e13ee94d51c524b7e2a728c7d4039
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

HTTP Headers

GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30399
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 11:06:17 GMT
expires: Fri, 25 Apr 2025 11:06:17 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 92730
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css

104.18.11.207

200 OK

81 kB

URL GET HTTP/2
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
IP
104.18.11.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63
ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT

File type
ASCII text, with very long lines (65325)
Size
81 kB (81395 bytes)
Hash
450fc463b8b1a349df717056fbb3e078
895125a4522a3b10ee7ada06ee6503587cbf95c5
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

HTTP Headers

GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 12:51:47 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"450fc463b8b1a349df717056fbb3e078"
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 10/31/2023 18:48:44
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 752
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 6f2d14e9436097e66447b103aa0360de
cdn-cache: HIT
cf-cache-status: HIT
age: 13246230
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 87a6b4d019fb5695-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

benefitsforfamilies.com/assets/img/logo-mfbg.png

172.67.170.34

200 OK

13 kB

URL GET HTTP/3
benefitsforfamilies.com/assets/img/logo-mfbg.png
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
PNG image data, 646 x 185, 8-bit/color RGBA, non-interlaced
Size
13 kB (13262 bytes)
Hash
92a40b4afb3ea928094dd10f57ac29e8
3df8d8607ea5d5cc92587e4bf885c0cdd0a80e53
2d60854d5b8888d23639b45b8d91ca1546f0db65deffe93a8f6bc20b0394f194

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/img/logo-mfbg.png HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: image/png
content-length: 13262
last-modified: Tue, 28 Mar 2023 17:28:43 GMT
etag: "642323cb-33ce"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pDJEw4Z%2BuqFu6F%2FpX%2B5jX4SS28w1nBmRwMkLAlNJ4zBiIk0ejyKkMMECdmTBIuVF%2Fjt%2BdI2L%2BxxRqQX%2B3olTputW4rxoW0Ey2801ayzQn2Rel4Xm83MFe0EFuTjYRobYgtjStlz9pVXb8A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a6b4cfe97c0b49-OSL
alt-svc: h3=":443"; ma=86400

use.fontawesome.com/releases/v5.1.0/css/all.css

172.67.142.245

200 OK

292 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.1.0/css/all.css
IP
172.67.142.245:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
ASCII text, with very long lines (45507)
Size
292 kB (292028 bytes)
Hash
826c57385f3d35cfed5478ba7b1f5c03
20d2d431065fc6b38c1187eda564639527e2428e
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550

HTTP Headers

GET /releases/v5.1.0/css/all.css HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://benefitsforfamilies.com
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 12:51:47 GMT
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
etag: W/"826c57385f3d35cfed5478ba7b1f5c03"
last-modified: Fri, 22 Sep 2023 01:44:25 GMT
vary: Origin, Accept-Encoding
cf-cache-status: HIT
age: 927711
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qx3vWtb4p0R7amouK96cf6d92RVRAJ5TMh%2BHW4HOGcmFKqLYFz6aeWJ%2FJ7NNrC3fCG9s6OUIHQ33WK%2FCm%2B11gYqIfzL2ndfhYeoa0uhMVrjLv8siMTznwMMhOrYrCw2EUZHqCvzs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a6b4d01ae71c0a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

benefitsforfamilies.com/favicon.ico

172.67.170.34

404 Not Found

6.9 kB

URL GET HTTP/3
benefitsforfamilies.com/favicon.ico
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
6.9 kB (6887 bytes)
Hash
998368d7c95ea4293237f2320546e440
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XDRHWhrS6erIoAYsKRO1huAdlL299Qn9Mo1laarWGCzw5HCuoqnOgYqsGZv5qc%2BX2ai17hW3IF12Xal733ZRB9bYzLRsu8zm%2Bu2frezCUN%2Fu%2FwPdUgTUgidEeaeEVpUiE5ds9rz8Oo6BhA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a6b4d3dd730b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ronikklab.com/

146.190.156.148

9.1 kB

URL
ronikklab.com/
IP
146.190.156.148:0
ASN
#14061 DIGITALOCEAN-ASN

File type
data
Size
9.1 kB (9132 bytes)
Hash
ba81ead091112e3071755d2addbe3d9f
64f64f0d77dcdb35fc249e167ce200495baccdc0
b8bdd7275f847aeb099fb1146c31ff48257744c65738d7953db04c8855adf31f

HTTP Headers

GET / HTTP/1.1
Host: ronikklab.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.0 200 Internal Server Error
cache-control: cache
content-type: text/html

benefitsforfamilies.com/assets/img/family-blue.jpg

172.67.170.34

200 OK

282 kB

URL GET HTTP/3
benefitsforfamilies.com/assets/img/family-blue.jpg
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
JPEG image data, baseline, precision 8, 900x600, components 3
Size
282 kB (282110 bytes)
Hash
450f134dc837274c88c5f7662bb4743d
6714f059daa1ebed0cd14455e627d571222012cb
05e8dea3a2f8976174a2c749dc44308db93a0e946e35645d877145cc717f64b2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/img/family-blue.jpg HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/assets/css/custom.css
Cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: image/jpeg
content-length: 282110
last-modified: Tue, 28 Mar 2023 17:28:43 GMT
etag: "642323cb-44dfe"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7E4le9ZOcQDFyPWsM7AyXnkXYZScUZUSH6hC%2BP6eb4TckRqJfnn8W7upfVQb6JEwhivICWehjIDuGkfms7WDky4gbSXgDUF9H0mAw4lP0zrXONzrJJAuaIJx2%2F7A4nTAUnCGHLg9GEAjdw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a6b4d2cc7a0b49-OSL
alt-svc: h3=":443"; ma=86400

use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2

172.67.142.245

200 OK

60 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2
IP
172.67.142.245:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 59572, version 1.0
Size
60 kB (59572 bytes)
Hash
18d2347ab2a9f40ca2247cdb03303d84
8aba5b59c5aa7f548a1fa663f02f3cdd3757bb52
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9

HTTP Headers

GET /releases/v5.1.0/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://benefitsforfamilies.com
DNT: 1
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: font/woff2
content-length: 59572
access-control-allow-origin: *
cache-control: max-age=31556926
etag: "18d2347ab2a9f40ca2247cdb03303d84"
last-modified: Fri, 22 Sep 2023 01:44:25 GMT
vary: Origin, Accept-Encoding
cf-cache-status: HIT
age: 927712
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZCPcS%2BDH4QX4sR82kJ08QWu3A%2FypqhHgZvw5UB%2Bnw5MvBtC0RhU4ydu1JXM3FWUlI2%2B0KW6hC8SyTCAOUnbzuAxDz5IexzT8tkarfKZTkBMu5NZvfoX9XJ3sUbz2zS84nq5R33MK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a6b4d2eda91c0a-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

benefitsforfamilies.com/assets/css/custom.css

172.67.170.34

200 OK

6.7 kB

URL GET HTTP/3
benefitsforfamilies.com/assets/css/custom.css
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
ASCII text, with very long lines (7373), with no line terminators
Size
6.7 kB (6731 bytes)
Hash
1ec722cec12a4fb35ef81eba654e0886
f009287533025d909b6ab183717f38af47520121
be156fa53235b4808255e820cca1561f90b34f46972e59f92f236140f31d8a64

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/css/custom.css HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: text/css
last-modified: Tue, 28 Mar 2023 17:28:43 GMT
etag: W/"642323cb-1a4b"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qu7rl6MeAbEX0UyCByfVwU%2BB4jzXWawcKmJyKRGK07E54DM%2BP2Uh4HmQhXm6Heu453nQIwCUuOQbFgB96T4AybLOzje6IPGUdVYDkbOW%2FJYZhNhwSeJomhwHMQAAyIId3SZ3a2og5iVi6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a6b4cfe97b0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

benefitsforfamilies.com/assets/js/jquery.mask.min.js

172.67.170.34

200 OK

8.3 kB

URL GET HTTP/3
benefitsforfamilies.com/assets/js/jquery.mask.min.js
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
JavaScript source, ASCII text, with very long lines (8550), with no line terminators
Size
8.3 kB (8327 bytes)
Hash
330ced9fb9619c9b605e47730355869a
842f7329266618618689052402242fc3ffb50378
2950fccfc1560fd10d219e1ac89bb2da789794eba5b5288311c1b3b4a6aab945

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/js/jquery.mask.min.js HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: application/javascript
last-modified: Tue, 28 Mar 2023 17:28:43 GMT
etag: W/"642323cb-2087"
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mElffYL50h3Qs14ld%2Fg%2FF6euUZS1V4TB5pMD3dc3G2OYkUEWtM%2BnD%2Bm1ftizerjTeZNi7f9Sw04d5AiiAPNXc1MPJql6dbKh4IK%2BBrtced3qm22xYalpGlsqfgDnCIgbyIi4FNR4qApuZA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a6b4cfe97e0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

104.17.25.14

200 OK

19 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (19015)
Size
19 kB (19188 bytes)
Hash
70d3fda195602fe8b75e0097eed74dde
c3b977aa4b8dfb69d651e07015031d385ded964b
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

HTTP Headers

GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 12:51:47 GMT
content-type: application/javascript; charset=utf-8
content-length: 6157
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-4af4"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 143460
expires: Wed, 16 Apr 2025 12:51:47 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PvLKFRkJ0%2FOTAsNKWvTJnBGzX1gKqnSFSjU5D8sY1GKHQSu2sv1ICklZVvz%2B9bmBrs65bKdLVAyNU9oeb1tPGie%2BLwkM%2FbnnnxFsB8LAjdL23JwBGBnX8My7dsbDHF0LoMTXgVwc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a6b4d0192eb523-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

benefitsforfamilies.com/assets/js/validate.js

172.67.170.34

200 OK

10 kB

URL GET HTTP/3
benefitsforfamilies.com/assets/js/validate.js
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
JavaScript source, ASCII text, with very long lines (10894), with no line terminators
Size
10 kB (9979 bytes)
Hash
74a5a8abd1ee8fcc0bfd780aa2ecc621
925fac16b688dbc54f2cd573fd79690fc81e952f
e96bcc584adf1294da7ef30b9d4662d6144ee00fe792238864540deb42fb642d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/js/validate.js HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 17:34:31 GMT
etag: W/"65e757a7-26fb"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F71Ac77fCkQFi4Sns4T%2FpsAxE4cpcFONis0zZbJxJRZ4BXLt8LfTTAwJRQbTzFC9UJtncfF5I444%2FzIhgIH4hwSiJxY6wxH4FHrvwOsuci%2FO8w0ChoNq0YrIGfgdTnCXdwj76HWxTF08ig%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a6b4cff9880b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

104.18.11.207

200 OK

49 kB

URL GET HTTP/2
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
IP
104.18.11.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63
ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT

File type
JavaScript source, ASCII text, with very long lines (48664)
Size
49 kB (48944 bytes)
Hash
14d449eb8876fa55e1ef3c2cc52b0c17
a9545831803b1359cfeed47e3b4d6bae68e40e99
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

HTTP Headers

GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 12:51:47 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: US
cdn-edgestorageid: 617, 617, 617
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 2021-06-08 14:29:21
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: 395e10f82368220a7b7579d8f1c28956
cdn-cache: HIT
cf-cache-status: HIT
age: 13510240
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 87a6b4d019fa5695-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

benefitsforfamilies.com/assets/js/regular.js

172.67.170.34

200 OK

4.3 kB

URL GET HTTP/3
benefitsforfamilies.com/assets/js/regular.js
IP
172.67.170.34:443
ASN
#13335 CLOUDFLARENET

Requested by
https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Certificate
IssuerGoogle Trust Services LLC
Subjectbenefitsforfamilies.com
Fingerprint48:09:AF:85:81:5F:F3:95:69:0D:EC:3E:65:79:A0:2A:D3:A9:24:42
ValidityWed, 24 Apr 2024 17:41:12 GMT - Tue, 23 Jul 2024 17:41:11 GMT

File type
JavaScript source, ASCII text, with very long lines (4651), with no line terminators
Size
4.3 kB (4264 bytes)
Hash
94e8e36d1260502df21d6b9af5c061cc
58c2bcf65c314ff6fc6ad7f56a24cea2b2436700
51c76d46ba73f3f2ee98f3c9b01e460b68e00226a3712550a7e4f7b82b8fb479

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/js/regular.js HTTP/1.1
Host: benefitsforfamilies.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://benefitsforfamilies.com/?a=103&s1=mixdes4322
Cookie: PHPSESSID=852cre9c8cc5apj9ha21dae4uv
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 12:51:48 GMT
content-type: application/javascript
last-modified: Tue, 28 Mar 2023 17:28:43 GMT
etag: W/"642323cb-10a8"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d6Zrn3Xj6pYMfo6ofVSWc1zjhZiRIH5W9Z%2Fb1bzcwgBFnj80IAc8cH09oTpm8JQkvnZzUxTUOP5URm8wn%2BFWRVnYMxeH4633yORKAJYu88UCCfHTgj4jN4B6idiW7Jz3b%2FE%2BSi7uW1tkoA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a6b4cff9890b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (8)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML