WEBSITE ANALYSIS REPORT

http://fiordlandoutdoors.co.nz/

28 Aug 2026 · 18:48:37.000 UTCpublic

Report tags: phishing ghostframe aitm
Submit tags

Request review

Phishing detected

2 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

app.wonderchat.io45 captured requests
arclight.vimeo.com3 captured requests
assets.flodesk.com7 captured requests
f.vimeocdn.com4 captured requests
fiordlandoutdoors.co.nz1 captured requests
form.flodesk.com7 captured requests
i.vimeocdn.com2 captured requests
p.typekit.net1 captured requests
player.vimeo.com1 captured requests
res.cloudinary.com2 captured requests
use.typekit.net3 captured requests
usercontent.flodesk.com4 captured requests
vimeo.com6 captured requests
vod-adaptive-ak.vimeocdn.com12 captured requests
www.fiordlandoutdoors.co.nz32 captured requests
www.google.com1 captured requests
www.googletagmanager.com2 captured requests

Connections

app.wonderchat.io → res.cloudinary.comLoads from2 captured connections
fiordlandoutdoors.co.nz → www.fiordlandoutdoors.co.nzRedirects to1 captured connections
player.vimeo.com → arclight.vimeo.comCalls3 captured connections
player.vimeo.com → f.vimeocdn.comLoads from4 captured connections
player.vimeo.com → i.vimeocdn.comLoads from2 captured connections
player.vimeo.com → vimeo.comCalls6 captured connections
player.vimeo.com → vod-adaptive-ak.vimeocdn.comCalls12 captured connections
www.fiordlandoutdoors.co.nz → app.wonderchat.ioCalls3 captured connections
www.fiordlandoutdoors.co.nz → app.wonderchat.ioEmbeds1 captured connections
www.fiordlandoutdoors.co.nz → app.wonderchat.ioLoads from1 captured connections
www.fiordlandoutdoors.co.nz → assets.flodesk.comLoads from7 captured connections
www.fiordlandoutdoors.co.nz → form.flodesk.comCalls7 captured connections
www.fiordlandoutdoors.co.nz → p.typekit.netLoads from1 captured connections
www.fiordlandoutdoors.co.nz → player.vimeo.comEmbeds1 captured connections
www.fiordlandoutdoors.co.nz → use.typekit.netLoads from3 captured connections
www.fiordlandoutdoors.co.nz → usercontent.flodesk.comLoads from4 captured connections
www.fiordlandoutdoors.co.nz → www.google.comCalls1 captured connections
www.fiordlandoutdoors.co.nz → www.googletagmanager.comLoads from2 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

18:47:49.126 GET 301 document 0 B 1007 ms —

18:47:50.141 GET 200 document 244.0 KB 2073 ms —

18:47:52.336 GET 200 stylesheet 1.9 KB 519 ms —

18:47:52.338 GET 200 stylesheet 132.1 KB 1843 ms —

18:47:52.339 GET 200 script 67.3 KB 143 ms 1 alerts

18:47:52.349 GET 200 img 6.1 KB 936 ms —

18:47:52.352 GET 200 img 6.3 KB 392 ms —

18:47:52.353 GET 200 img 6.0 KB 970 ms —

18:47:52.354 GET 200 img 6.9 KB 957 ms —

18:47:52.355 GET 200 img 5.6 KB 992 ms —

18:47:52.356 GET 200 img 4.6 KB 955 ms —

18:47:52.366 GET 200 script 237.8 KB 2157 ms —

18:47:52.368 GET 200 img 3.5 KB 950 ms —

18:47:52.369 GET 200 img 1.9 KB 943 ms —

18:47:52.370 GET 200 img 1.0 KB 1007 ms —

18:47:52.371 GET 200 img 4.1 KB 954 ms —

18:47:52.372 GET 200 img 4.1 KB 945 ms —

18:47:52.373 GET 200 img 2.9 KB 921 ms —

18:47:52.878 GET 200 stylesheet 5 B 22 ms —

18:47:54.193 GET 200 script 191.9 KB 52 ms —

18:47:54.199 GET 200 script 490.8 KB 146 ms —

18:47:54.264 GET 200 font 17.9 KB 17 ms —

18:47:54.267 GET 200 img 163.7 KB 1223 ms —

18:47:54.268 GET 200 img 48.4 KB 1535 ms —

18:47:54.270 GET 200 img 108.1 KB 1254 ms —

18:47:54.271 GET 200 img 45.9 KB 1621 ms —

18:47:54.272 GET 200 img 54.0 KB 1593 ms —

18:47:54.273 GET 200 img 125.0 KB 1830 ms —

18:47:54.274 GET 200 img 102.5 KB 1879 ms —

18:47:54.275 GET 200 img 69.1 KB 984 ms —

18:47:54.276 GET 200 img 143.4 KB 1857 ms —

18:47:54.277 GET 200 img 64.2 KB 1558 ms —

18:47:54.279 GET 200 img 81.2 KB 1572 ms —

18:47:54.280 GET 200 img 259.3 KB 2076 ms —

18:47:54.319 GET 200 font 51.8 KB 1839 ms —

18:47:54.321 GET 200 font 18.2 KB 2 ms —

18:47:54.323 GET 200 subdocument 20.8 KB 307 ms —

18:47:54.646 GET 200 script 103.5 KB 109 ms —

18:47:54.647 GET 200 script 211.4 KB 113 ms —

18:47:54.650 GET 200 script 8.6 KB 101 ms —

18:47:54.651 GET 200 script 27.7 KB 101 ms —

18:47:54.653 GET 200 xhr 26.2 KB 190 ms —

18:47:54.654 GET 200 xhr 31.6 KB 400 ms —

18:47:54.660 GET 200 fetch 965 B 264 ms 1 alerts

Transaction #37

Request / response

URL

GET HTTPS

https://app.wonderchat.io/api/get-widget-info?chatbotId=cly593gfh02manaqur19pwnac

IP / ASN

104.21.12.162

AS13335 · CLOUDFLARENET

Requested by: https://www.fiordlandoutdoors.co.nz/

Resource information

File type: JSON text data
MIME type: application/json; charset=utf-8
First seen (UTC): 28 Aug 2026 · 18:48:57.842 UTC
Last seen (UTC): 28 Aug 2026 · 18:48:57.842 UTC
Times seen: 1

Size: 965 B (965 bytes)
MD5: 144ecd512a9906ed171f1c50f4c11c68
SHA1: 938cf7a3581386b9a7b487f3a8f86f9887f0c6b9
SHA256: dc3a1a75dc60d73732f49ead95679a3458cfd8ba6ab0c03916eebac484c0a25c

Certificate information

Issuer: Google Trust Services · WE1
Subject: app.wonderchat.io
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 63:77:E4:C3:7A:3B:89:88:66:C9:AC:98:07:44:46:7E:FC:B7:78:ED
Valid from: Tue, 25 Aug 2026 02:07:42 GMT
Valid until: Mon, 23 Nov 2026 03:07:38 GMT

Technology fingerprints

Render (PaaS)
HSTS (Security)
Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - GhostFrame Phishing kit	high	Phishing

HTTP headers

Request headers

GET /api/get-widget-info?chatbotId=cly593gfh02manaqur19pwnac HTTP/1.1
Host: app.wonderchat.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Origin: https://www.fiordlandoutdoors.co.nz
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Priority: u=4
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 
access-control-allow-headers: Content-Type, Authorization
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
content-encoding: br
content-security-policy: frame-ancestors 'none'
content-type: application/json; charset=utf-8
date: Fri, 28 Aug 2026 18:47:54 GMT
etag: "fdjaxbfc6jqr"
referrer-policy: strict-origin-when-cross-origin
rndr-id: ea749fb0-dfd4-42fe
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding, Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-render-origin-server: Render
server-timing: cfExtPri
cf-cache-status: DYNAMIC
priority: u=4,i=?0
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Z4DvQ7uiey4%2Bof4Qh4eRMFkDDltr9erKFV%2B0I0Nlv7rpgz%2FykSkScLPQuasM%2FKeJUP7WyzN78avs23remgjTwUrqmdLj0YOsZCUxmMyMSmMmU1xKgdJ8qvmtWLAw%2FqFJgjgYzA%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: a3257cb6bd710b51-OSL
alt-svc: h3=":443"; ma=86400
content-length: 471

18:47:54.665 GET 302 script 0 B 19 ms —

18:47:54.688 GET 200 script 21.0 KB 33 ms —

18:47:54.714 GET 200 script 907.1 KB 63 ms —

18:47:54.716 GET 200 script 320.0 KB 267 ms —

18:47:54.718 GET 200 stylesheet 232.7 KB 45 ms —

18:47:54.741 GET 200 script 538.3 KB 112 ms —

http://fiordlandoutdoors.co.nz/