Report Overview

  1. Submitted URL

    ad.doubleclick.net/clk;265186560;90846275;t;pc=[TPAS_ID]?///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh

  2. IP

    142.250.74.102

    ASN

    #15169 GOOGLE

  3. Submitted

    2024-05-10 01:00:40

    Access

    public

  4. Website Title

    Webmail Portal Login

  5. Final URL

    cloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/wwtnet.html#ashams@fransicapital.com.sa

  6. urlquery detections

    Phishing - Generic phishing

Detections

  1. urlquery

    2

  2. Network Intrusion Detection

    4

  3. Threat Detection Systems

    10

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
www.google.com71997-09-152015-05-102024-03-23
stackpath.bootstrapcdn.com24672012-05-252018-06-152024-05-09
ajax.googleapis.com129052005-01-252013-08-162024-05-09
kit.fontawesome.com18682012-10-182019-12-162024-05-09
ka-f.fontawesome.com35982012-10-182019-12-172024-05-09
t2.gstatic.comunknown2008-02-112013-05-072024-05-09
ocsp.entrust.net12081997-07-282014-01-102024-05-09
www.fransicapital.com.saunknownunknown2015-05-062016-01-20
ad.doubleclick.net1861996-01-162012-05-242024-05-09
wtf.clunknown2008-09-092017-10-042024-04-17
cloudflare-ipfs.com751472018-05-302021-01-202024-03-15
fonts.googleapis.com88772005-01-252013-06-102024-05-10
www.googletagmanager.com752011-11-112013-05-222024-05-09

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

SeveritySource IPDestination IPAlert
lowClient IP 104.17.64.14
lowClient IP 104.17.64.14
medium 193.22.249.204Client IP
medium 193.22.249.204Client IP

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish
SeverityIndicatorAlert
mediumcloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/wwtnet.htmlGeneric/Spear Phishing

PhishTank
SeverityIndicatorAlert
mediumcloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/bootstrap.min.css?1422585379Other
mediumcloudflare-ipfs.com/favicon.icoOther
mediumcloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/jquery-1.jsOther
mediumcloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/wwtnet.htmlOther

mnemonic secure dns

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


JavaScript (22)

HTTP Transactions (31)

URLIPResponseSize
ad.doubleclick.net/clk;265186560;90846275;t;pc=[TPAS_ID]?///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh
142.250.74.102 0 B
wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh///wtf.cl/Rabbbin/rab/em18rt/YXNoYW1zQGZyYW5zaWNhcGl0YWwuY29tLnNh
200.63.97.130 0 B
cloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/bootstrap.min.css?1422585379
104.17.64.14404 Not Found589 B
ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
142.250.74.106200 OK30 kB
fonts.googleapis.com/css?family=Yellowtail%26display=swap
142.250.74.42400 Bad Request1.3 kB
cloudflare-ipfs.com/favicon.ico
104.17.64.14404 Not Found14 B
ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
172.67.139.119200 OK78 kB
www.google.com/s2/favicons?domain=fransicapital.com.sa
142.250.74.132301 Moved Permanently340 B
cloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/jquery-1.js
104.17.64.14404 Not Found586 B
stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js
104.18.11.207200 OK17 kB
t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://fransicapital.com.sa&size=16
142.250.74.132 726 B
ocsp.entrust.net/
23.38.202.187 1.6 kB
www.fransicapital.com.sa/
193.22.249.204 0 B
www.fransicapital.com.sa/sfcua/
193.22.249.204200 OK12 kB
www.fransicapital.com.sa/sfcua/VAADIN/build/webcomponentsjs/webcomponents-loader.js
193.22.249.204200 OK6.3 kB
www.googletagmanager.com/gtag/js?id=G-RCYWWR8DM9
142.250.74.168200 OK102 kB
www.fransicapital.com.sa/sfcua/VAADIN/static/push/vaadinPush-min.js?v=2.3.5
193.22.249.204200 OK13 kB
www.fransicapital.com.sa/sfcua/VAADIN/static/client/client-C001A087E3ACCAA1E16BBD9F71FBD6EA.cache.js
193.22.249.204200 OK48 kB
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
104.18.11.207200 OK675 kB
www.fransicapital.com.sa/sfcua/?v-r=uidl&v-uiId=0
193.22.249.204200 OK311 B
www.fransicapital.com.sa/sfcua/?v-r=push&v-uiId=0&v-pushId=17242b31-c428-4a08-8a3e-03025f5579c4&X-Atmosphere-tracking-id=0&X-Atmosphere-Framework=2.3.2.vaadin1-javascript&X-Atmosphere-Transport=long-polling&X-Atmosphere-TrackMessageSize=true&Content-Type=application%2Fjson%3B%20charset%3DUTF-8&X-atmo-protocol=true&_=1715302819556
193.22.249.204200 OK2.1 kB
www.fransicapital.com.sa/sfcua/?v-r=push&v-uiId=0&v-pushId=17242b31-c428-4a08-8a3e-03025f5579c4&X-Atmosphere-tracking-id=5fe5a88c-9b04-4e7e-9b29-914b151a52a9&X-Atmosphere-Framework=2.3.2.vaadin1-javascript&X-Atmosphere-Transport=long-polling&X-Atmosphere-TrackMessageSize=true&Content-Type=application%2Fjson%3B%20charset%3DUTF-8&X-atmo-protocol=true&_=1715302819691
193.22.249.204200 OK2.1 kB
www.fransicapital.com.sa/sfcua/fonts/Codec-Pro-Regular.ttf
193.22.249.204200 OK282 kB
www.fransicapital.com.sa/sfcua/?v-r=push&v-uiId=0&v-pushId=17242b31-c428-4a08-8a3e-03025f5579c4&X-Atmosphere-Transport=close&X-Atmosphere-tracking-id=5fe5a88c-9b04-4e7e-9b29-914b151a52a9&_=1715302819824
193.22.249.204200 OK0 B
t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://fransicapital.com.sa&size=16
142.250.74.132404 Not Found726 B
www.fransicapital.com.sa/sfcua/VAADIN/build/vaadin-bundle.cache.js
193.22.249.204200 OK1.9 MB
ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
172.67.139.119200 OK60 kB
kit.fontawesome.com/585b051251.js
104.18.40.68200 OK12 kB
cloudflare-ipfs.com/ipfs/bafybeifd3iyuyvebfe54sjc55xyoxyxifvlidryaqnyt6ux2oqashr6es4/wwtnet.html
104.17.64.14200 OK12 kB
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css
104.18.11.207200 OK160 kB
ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
172.67.139.119200 OK27 kB