Report - www.direct.amzserv.customerfinders.com/gncu/card.php

Report Overview

Submitted URL
www.direct.amzserv.customerfinders.com/gncu/card.php
IP
199.204.248.138
ASN
#11989 WEBINT
Submitted
2022-11-25 21:23:54
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
36

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
www.direct.amzserv.customerfinders.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	10 kB	2.7 MB	199.204.248.138
content-cdn.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	886 B	506 B	3.91.119.191
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	51 kB	34.120.237.76
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.1 kB	2.1 kB	142.250.74.3
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.76.226
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	3.3 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	34.212.166.60
cdn1.onlineaccess1.com	19210	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.1 kB	316 kB	192.0.54.4
app.pendo.io	1783	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	952 B	34.107.204.85

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/card.php	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/phishlabs.js.download	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-pendo.js.download	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-tecton-elements.esm.js.download	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf	Phishing
2022-11-25	medium	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/p-c89cafe1.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	www.direct.amzserv.customerfinders.com/gncu/card.php	32 B	2023-03-08	2024-04-06
Pretty URL www.direct.amzserv.customerfinders.com/gncu/card.php IP 199.204.248.138 ASN #11989 WEBINT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 09:46:27 Last Seen2024-04-06 02:05:39 Times Seen46 Hash 6129eb80d9d816a6f0e6e0fa985573cf a935a325ebdfb351dae4a154fda63cf2c714402d b8ca0c973bd1d0b007ecdcfee48597ae42c78affa3853831c8ac9f6948f56cd5 Loading...

	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/phishlabs.js.download	993 B	2023-03-08	2023-03-13
Pretty URL www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/phishlabs.js.download IP 199.204.248.138 ASN #11989 WEBINT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 09:46:27 Last Seen2023-03-13 01:03:20 Times Seen1 Hash 92958335d82061f4db4301685429bc24 31de4c7b0280f76cb34822a534b5a8afc8ba6ba4 0d1dc09c3287a3326bff3f7d8e68b1ec16079099385b2c06a73dceea800736f5 Loading...

	www.direct.amzserv.customerfinders.com/gncu/card.php	193 B	2023-03-11	2023-03-11
Pretty URL www.direct.amzserv.customerfinders.com/gncu/card.php IP 199.204.248.138 ASN #11989 WEBINT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 20:15:48 Last Seen2023-03-11 20:39:08 Times Seen1 Hash ce7e158f264ffa33ad5ff2cabfc43ee9 df2949f4f3bde6ed163908f1fa593eb217278596 94608e52c607f7ca1612e2aecdcc39da9ee52173e32dbca79602b46e41d8f7c1 Loading...

	cdn1.onlineaccess1.com/cdn/static/q2-pendo/pendo-2.134.1.js	469 kB	2023-03-08	2023-08-13
Pretty URL cdn1.onlineaccess1.com/cdn/static/q2-pendo/pendo-2.134.1.js IP 192.0.54.4 ASN #62659 Q2HOLDINGS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 09:46:27 Last Seen2023-08-13 21:54:12 Times Seen31 Hash 76b89e2a310f4e126e76f82039987a0f f49da6c53a3b9dc4dda366a3dffbcdb1d6ff09c6 4d62203e6a77437d57940e7a5755c1e13f9af1fc059a03b6d5b838d912317d91 Loading...

	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-pendo.js.download	7.8 kB	2023-03-08	2023-03-13
Pretty URL www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-pendo.js.download IP 199.204.248.138 ASN #11989 WEBINT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 09:46:27 Last Seen2023-03-13 01:03:19 Times Seen1 Hash 59385ff1c93501d549451cf1df7b12d0 c0b6c84e3fb16069b47d0b8dc0ad3e36df63ef11 0db6d8f67a5ee144634429adf6eafe41c2ccc47bc4a5bebb33de3b9e811db81a Loading...

	www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-tecton-elements.esm.js.download	5.5 kB	2023-03-08	2023-03-13
Pretty URL www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-tecton-elements.esm.js.download IP 199.204.248.138 ASN #11989 WEBINT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 09:46:27 Last Seen2023-03-13 01:03:19 Times Seen1 Hash 4ce4536bd5d2688c6e9fd5a0e305a5b4 682378f1b37e2f49725db2981e999abb95bb04c9 027fb2e9297fff2f166fe62ff5fc9de51d3db9faa1265a4ded882cc4e5206009 Loading...

	www.direct.amzserv.customerfinders.com/gncu/card.php	157 B	2023-03-08	2023-03-13
Pretty URL www.direct.amzserv.customerfinders.com/gncu/card.php IP 199.204.248.138 ASN #11989 WEBINT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 09:46:27 Last Seen2023-03-13 01:03:20 Times Seen1 Hash 12075065f9c901525d1a039890939fd3 e4e825042ddd1ffd6c9e45ef94d5dd7abf50ea75 d34286b761869664e4ac5835ce208fafcf4c1eb78576221c35a36b3dad12719b Loading...

HTTP Transactions (55)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7c60904d097cde276e4e5632cef1b9f1
4f805026462589345d85e8df2d18eafba6237504
12af026999398f4976749e320667d43da3f99b7a2e8254aca7a410a964a106aa

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "12AF026999398F4976749E320667D43DA3F99B7A2E8254ACA7A410A964A106AA"
Last-Modified: Thu, 24 Nov 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11690
Expires: Sat, 26 Nov 2022 00:38:33 GMT
Date: Fri, 25 Nov 2022 21:23:43 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
10730f388c028d64e19b8a48d414768f
e43b104e57e5ea7ff8568835776858cf2ede6f00
f3c30c6d139288f1bfe13fce85c6ddc1514e1639fcf4d31a6012a3309ed1d50d

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5637
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:43 GMT
Last-Modified: Fri, 25 Nov 2022 19:49:46 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
260e9998c20d831b66f1029c8f47aac9
716d630f647c54dc69a7f9c63a6cac294b3df7f7
c9951a909f354174f0075a01c01c3c3aa6960983040e328bfbbbea81aeb405c2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C9951A909F354174F0075A01C01C3C3AA6960983040E328BFBBBEA81AEB405C2"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6900
Expires: Fri, 25 Nov 2022 23:18:43 GMT
Date: Fri, 25 Nov 2022 21:23:43 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
4d7e4eed097b9c4e5d509419f1cfc85a
290bb3d428a7c6330e2e3d73a952b16f820896c8
0dc9ca0f57af15adcd416035e92794711434e3d53a1feff21d8481d6d500986c

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Length, Alert, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 25 Nov 2022 21:17:29 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 374
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: W0VEVNcc9Xvxe5Wt8/tVRHICFcEfKBouxevrP+OeX1XAkMaMuKlso844/AuiRTORjsxyK/r9QPk=
x-amz-request-id: 52WE7X47VTYQ372A
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 25 Nov 2022 20:40:56 GMT
age: 2567
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 25 Nov 2022 21:23:43 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

www.direct.amzserv.customerfinders.com/gncu/card.php

199.204.248.138

200 OK

196 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/card.php
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (1596), with CRLF line terminators
Size
196 kB (195761 bytes)
Hash
1095bd7aa971cf3688478245256280f9
660604ad04e526ddb9fbbb7f80599cb9ee17f2a2
fdf50d66f21a5748271eb112f057f3e5cfca1485ef8def415f2310e915332a0a

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/card.php HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/tecton-590048df214033d1c1591d552a32c9af.css

199.204.248.138

200 OK

8.0 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/tecton-590048df214033d1c1591d552a32c9af.css
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
Unicode text, UTF-8 text, with very long lines (8014), with no line terminators
Size
8.0 kB (8022 bytes)
Hash
590048df214033d1c1591d552a32c9af
6e93aed836cbb1b6976248df6d2cb4c8b17c23b4
fbb5d60b0e8fbf3ce2eeb2479ad9ef6744585303f9ee0bf27c62b35a0a2dc30a

HTTP Headers

GET /gncu/static/css/gncu_files/tecton-590048df214033d1c1591d552a32c9af.css HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:28 GMT
ETag: "2a606af-1f56-5ea2a1eb11100"
Accept-Ranges: bytes
Content-Length: 8022
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/css

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/phishlabs.js.download

199.204.248.138

200 OK

993 B

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/phishlabs.js.download
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
ASCII text
Size
993 B (993 bytes)
Hash
92958335d82061f4db4301685429bc24
31de4c7b0280f76cb34822a534b5a8afc8ba6ba4
0d1dc09c3287a3326bff3f7d8e68b1ec16079099385b2c06a73dceea800736f5

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/phishlabs.js.download HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:28 GMT
ETag: "2a606a9-3e1-5ea2a1eb11100"
Accept-Ranges: bytes
Content-Length: 993
Keep-Alive: timeout=30, max=99
Connection: Keep-Alive
Content-Type: application/javascript

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/app.css

199.204.248.138

200 OK

96 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/app.css
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
Unicode text, UTF-8 text, with very long lines (55862)
Size
96 kB (95568 bytes)
Hash
a6d9a7427cb7e001863e3672c40c629e
42d101cfa747c4a540255a4a9d6f459d4e15c242
83a18bf19e5e2e0fae7ac33e1c099c335c708966970b7fe7b5915bb6442ff9fd

HTTP Headers

GET /gncu/static/css/gncu_files/app.css HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/card.php

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:18 GMT
ETag: "2a606a2-17550-5ea2a1e187a80"
Accept-Ranges: bytes
Content-Length: 95568
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/css

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-pendo.js.download

199.204.248.138

200 OK

7.8 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-pendo.js.download
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
ASCII text
Size
7.8 kB (7816 bytes)
Hash
59385ff1c93501d549451cf1df7b12d0
c0b6c84e3fb16069b47d0b8dc0ad3e36df63ef11
0db6d8f67a5ee144634429adf6eafe41c2ccc47bc4a5bebb33de3b9e811db81a

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/q2-pendo.js.download HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:30 GMT
ETag: "2a606ab-1e88-5ea2a1ecf9580"
Accept-Ranges: bytes
Content-Length: 7816
Keep-Alive: timeout=30, max=99
Connection: Keep-Alive
Content-Type: application/javascript

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-tecton-elements.esm.js.download

199.204.248.138

200 OK

5.5 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/q2-tecton-elements.esm.js.download
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
ASCII text, with very long lines (5494), with no line terminators
Size
5.5 kB (5494 bytes)
Hash
4ce4536bd5d2688c6e9fd5a0e305a5b4
682378f1b37e2f49725db2981e999abb95bb04c9
027fb2e9297fff2f166fe62ff5fc9de51d3db9faa1265a4ded882cc4e5206009

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/q2-tecton-elements.esm.js.download HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:30 GMT
ETag: "2a606ac-1576-5ea2a1ecf9580"
Accept-Ranges: bytes
Content-Length: 5494
Keep-Alive: timeout=30, max=98
Connection: Keep-Alive
Content-Type: application/javascript

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/

199.204.248.138

403 Forbidden

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35121 bytes)
Hash
419b91b56483c938828edd3ddfbec7ca
01204f8eea044b49d436a206b7f2be986a449bdd
04cdee406e37e6600f8b4a7ba2dc8d27040b8b608ce76a9292c0025f21729924

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/ HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/card.php

HTTP/1.1 403 Forbidden
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 25 Nov 2022 21:11:11 GMT
cache-control: public,max-age=3600
age: 753
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
df06e70fc8a35facf1d8db463d18e231
fa8a2975566cc792898f870e48ae7518d3657326
4cef7e704f4d575ce6733f6f2d803d241b597be51ff3fb03f72e5c33a893b504

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5716
Cache-Control: max-age=134303
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:44 GMT
Etag: "638085ab-1d7"
Expires: Sun, 27 Nov 2022 10:42:07 GMT
Last-Modified: Fri, 25 Nov 2022 09:06:51 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

34.212.166.60

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.212.166.60:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Js9yqd/KO1zO/qDtCkxbzA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Lb+vITYBA4PFTwoiwYiaxmGSVHY=

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/highcontrast-187bc6d9db7409a39a77a6fc6d8ec2dc.css

199.204.248.138

200 OK

983 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/highcontrast-187bc6d9db7409a39a77a6fc6d8ec2dc.css
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
983 kB (983166 bytes)
Hash
187bc6d9db7409a39a77a6fc6d8ec2dc
9620b26e7d102e73219b6ad4a7d7d1498da6c854
6ee46b2d1e31d25ab2b4138c70dc6c73dfae73bba328c57f07a49054a8088e6d

HTTP Headers

GET /gncu/static/css/gncu_files/highcontrast-187bc6d9db7409a39a77a6fc6d8ec2dc.css HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/card.php

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:18 GMT
ETag: "2a606a5-f007e-5ea2a1e187a80"
Accept-Ranges: bytes
Content-Length: 983166
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/css

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/theme-q2-672a467fd0e274363dd92c86a83ab3d5.css

199.204.248.138

200 OK

950 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/theme-q2-672a467fd0e274363dd92c86a83ab3d5.css
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
950 kB (950327 bytes)
Hash
672a467fd0e274363dd92c86a83ab3d5
03d8a458c8681bfc508a9bdddd6abd1e2b06e448
aa25b1a06f5d4552725cc7b4d76514bc8375468762f6f5c7d081a434042f6b83

HTTP Headers

GET /gncu/static/css/gncu_files/theme-q2-672a467fd0e274363dd92c86a83ab3d5.css HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/card.php

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:50 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:20 GMT
ETag: "2a606b0-e8037-5ea2a1e36ff00"
Accept-Ranges: bytes
Content-Length: 950327
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/css

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/ncua_logo_small-b690f247c19ea4970c9d08b2b479f16a.png

199.204.248.138

200 OK

3.9 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/ncua_logo_small-b690f247c19ea4970c9d08b2b479f16a.png
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
PNG image data, 128 x 60, 8-bit colormap, non-interlaced\012- data
Size
3.9 kB (3924 bytes)
Hash
b690f247c19ea4970c9d08b2b479f16a
9bc7e6d23666778c15e4e1bc4f6275947ecc91bc
e0553d5e1f49291bd1730745a95e155e6951aebb077378914eb2816b059a6448

HTTP Headers

GET /gncu/static/css/gncu_files/ncua_logo_small-b690f247c19ea4970c9d08b2b479f16a.png HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:51 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 23:58:30 GMT
ETag: "2a606a6-f54-5ea2a1ecf9580"
Accept-Ranges: bytes
Content-Length: 3924
Keep-Alive: timeout=30, max=99
Connection: Keep-Alive
Content-Type: image/png

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
e68ee61c6ceee995f5e7c0be3561ee02
43cbaecd176693a746ebfcc55d8b07a7cb274b47
a200ce57cf68e0194f4af884f2deb0238c68e2030bb29df90649645be3f62729

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5232
Cache-Control: max-age=151103
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:44 GMT
Etag: "6380c92f-117"
Expires: Sun, 27 Nov 2022 15:22:07 GMT
Last-Modified: Fri, 25 Nov 2022 13:54:55 GMT
Server: ECS (amb/6B96)
X-Cache: HIT
Content-Length: 279

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
e68ee61c6ceee995f5e7c0be3561ee02
43cbaecd176693a746ebfcc55d8b07a7cb274b47
a200ce57cf68e0194f4af884f2deb0238c68e2030bb29df90649645be3f62729

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5232
Cache-Control: max-age=151103
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:44 GMT
Etag: "6380c92f-117"
Expires: Sun, 27 Nov 2022 15:22:07 GMT
Last-Modified: Fri, 25 Nov 2022 13:54:55 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 279

cdn1.onlineaccess1.com/cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/desktop-background-845d58016ae32cd9a48be56e7e3b8d51.jpg

192.0.54.4

200 OK

154 kB

URL HTTP/2
cdn1.onlineaccess1.com/cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/desktop-background-845d58016ae32cd9a48be56e7e3b8d51.jpg
IP
192.0.54.4:0
ASN
#62659 Q2HOLDINGS

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, progressive, precision 8, 1936x1315, components 3\012- data
Size
154 kB (154025 bytes)
Hash
845d58016ae32cd9a48be56e7e3b8d51
da403b017c9e54cb56d1a4d78972a5816993ba20
ead11efc18df94ffb452c4bd4f2ea66f6aaf391d0c0e3596c10292f8a68d13d3

HTTP Headers

GET /cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/desktop-background-845d58016ae32cd9a48be56e7e3b8d51.jpg HTTP/1.1
Host: cdn1.onlineaccess1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Fri, 25 Nov 2022 21:23:44 GMT
content-type: image/jpeg
content-length: 154025
last-modified: Fri, 14 Oct 2022 18:50:59 GMT
etag: "6349af93-259a9"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
timing-allow-origin: *
access-control-allow-headers: *
access-control-allow-origin: *
cf-cache-status: HIT
age: 432028
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
set-cookie: __cfruid=b4eaf16de6dc9ae7ad36777228f3165abf45e110-1669411424; path=/; domain=.onlineaccess1.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 76fd727d7eb3b503-OSL
X-Firefox-Spdy: h2

content-cdn.com/1008/dWdnYzovL2pqai5xdmVycGcubnptZnJlaS5waGZnYnpyZXN2YXFyZWYucGJ6L3RhcGgvcG5lcS5jdWM=.gif

3.91.119.191

301 Moved Permanently

0 B

URL HTTP/1.1
content-cdn.com/1008/dWdnYzovL2pqai5xdmVycGcubnptZnJlaS5waGZnYnpyZXN2YXFyZWYucGJ6L3RhcGgvcG5lcS5jdWM=.gif
IP
3.91.119.191:0
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /1008/dWdnYzovL2pqai5xdmVycGcubnptZnJlaS5waGZnYnpyZXN2YXFyZWYucGJ6L3RhcGgvcG5lcS5jdWM=.gif HTTP/1.1
Host: content-cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive

HTTP/1.1 301 Moved Permanently
location: https://content-cdn.com/1008/dWdnYzovL2pqai5xdmVycGcubnptZnJlaS5waGZnYnpyZXN2YXFyZWYucGJ6L3RhcGgvcG5lcS5jdWM=.gif
vary: Accept-Encoding
date: Fri, 25 Nov 2022 21:23:44 GMT
server: envoy
content-length: 0

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
e68ee61c6ceee995f5e7c0be3561ee02
43cbaecd176693a746ebfcc55d8b07a7cb274b47
a200ce57cf68e0194f4af884f2deb0238c68e2030bb29df90649645be3f62729

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=145871
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:44 GMT
Etag: "6380c92f-117"
Expires: Sun, 27 Nov 2022 13:54:55 GMT
Last-Modified: Fri, 25 Nov 2022 13:54:55 GMT
Server: nginx
Content-Length: 279

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7bc8ec57c77e70e15c146de32435b001
82e3b4519b11bfe510c08e773c3a8b04b60fc482
b9d410a082c3e5ce9e915a121cce0fbe89eb5a9738cab4121c29ac9e0c75342e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B9D410A082C3E5CE9E915A121CCE0FBE89EB5A9738CAB4121C29AC9E0C75342E"
Last-Modified: Thu, 24 Nov 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11424
Expires: Sat, 26 Nov 2022 00:34:09 GMT
Date: Fri, 25 Nov 2022 21:23:45 GMT
Connection: keep-alive

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/tecton-590048df214033d1c1591d552a32c9af.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:51 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

content-cdn.com/1008/dWdnYzovL2pqai5xdmVycGcubnptZnJlaS5waGZnYnpyZXN2YXFyZWYucGJ6L3RhcGgvcG5lcS5jdWM=.gif

3.91.119.191

200 OK

43 B

URL HTTP/2
content-cdn.com/1008/dWdnYzovL2pqai5xdmVycGcubnptZnJlaS5waGZnYnpyZXN2YXFyZWYucGJ6L3RhcGgvcG5lcS5jdWM=.gif
IP
3.91.119.191:0
ASN
#14618 AMAZON-AES

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /1008/dWdnYzovL2pqai5xdmVycGcubnptZnJlaS5waGZnYnpyZXN2YXFyZWYucGJ6L3RhcGgvcG5lcS5jdWM=.gif HTTP/1.1
Host: content-cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: envoy
date: Fri, 25 Nov 2022 21:23:45 GMT
content-type: image/gif
content-length: 43
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
x-envoy-upstream-service-time: 1
X-Firefox-Spdy: h2

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/tecton-590048df214033d1c1591d552a32c9af.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:51 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

cdn1.onlineaccess1.com/cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/logos/logo_large-f97b4c722f38e8bccdf614f5298ea1a7.png

192.0.54.4

200 OK

12 kB

URL HTTP/2
cdn1.onlineaccess1.com/cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/logos/logo_large-f97b4c722f38e8bccdf614f5298ea1a7.png
IP
192.0.54.4:0
ASN
#62659 Q2HOLDINGS

File type
data
Size
12 kB (11941 bytes)
Hash
162dbefbd7fb7e3046ad3e052ae84434
6120ad5b10a8b91cf968b9ef72419632a2a2b9c0
29307fbdf25ed4926055ca2b5a744f8716d4e5fc22c15a772461fabc1c1f12ad

HTTP Headers

GET /cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/logos/logo_large-f97b4c722f38e8bccdf614f5298ea1a7.png HTTP/1.1
Host: cdn1.onlineaccess1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Fri, 25 Nov 2022 21:23:45 GMT
content-type: image/png
last-modified: Fri, 21 Oct 2022 08:09:31 GMT
vary: Accept-Encoding
etag: W/"635253bb-31d0"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
access-control-allow-origin: *
content-encoding: gzip
timing-allow-origin: *
access-control-allow-headers: *
cf-cache-status: HIT
age: 432029
strict-transport-security: max-age=15552000; includeSubDomains; preload
set-cookie: __cfruid=e15ed404b399987b50ea3c7b61cedae72da86a84-1669411425; path=/; domain=.onlineaccess1.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 76fd727eb9e6b503-OSL
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15558
Expires: Sat, 26 Nov 2022 01:43:03 GMT
Date: Fri, 25 Nov 2022 21:23:45 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15558
Expires: Sat, 26 Nov 2022 01:43:03 GMT
Date: Fri, 25 Nov 2022 21:23:45 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15558
Expires: Sat, 26 Nov 2022 01:43:03 GMT
Date: Fri, 25 Nov 2022 21:23:45 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00e89fb5-5cb3-4f68-936b-5ee31d6061bc.jpeg

34.120.237.76

200 OK

8.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00e89fb5-5cb3-4f68-936b-5ee31d6061bc.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.0 kB (8006 bytes)
Hash
8b6ee13d43732f7c764a49500d092865
5d15fd672e968d59b541e4d5d0d01cd5e69f4075
fc3623d527147e1c6aab399251ed8d527e6eefdee6ad7183f00df2613498bfe4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00e89fb5-5cb3-4f68-936b-5ee31d6061bc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8006
x-amzn-requestid: 78aab013-df11-464b-a1c7-ee41b7e77b40
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cIB-AHSrIAMFvKw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe38c-4d795f410a57fc2c21d7075d;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:35:08 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: q53jN1uOtSdeThbk2_0UF6Rl3g4_-_TW7uK1_6Z5oDwSTSRk8XRjyQ==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:35:08 GMT
etag: "5d15fd672e968d59b541e4d5d0d01cd5e69f4075"
content-type: image/jpeg
age: 85717
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.3 kB (4309 bytes)
Hash
841a4b110022a99ddea6f7bf66df0fa1
126771b86638108050cf57c0d12faa27f80f0edb
240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4309
x-amzn-requestid: a22b4d7e-e208-4bda-81c2-d13e6463380e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: blE0hGNioAMF_Tg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371e81c-1b13846866f56a0e47675e56;Sampled=0
x-amzn-remapped-date: Mon, 14 Nov 2022 07:02:52 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 0sYKpJWi2Tv9Atz3PYXm5j7kmncAOxjcLcK4hgAkJ5b4pNMDmjdB6g==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 04:38:44 GMT
age: 60301
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

cdn1.onlineaccess1.com/cdn/static/q2-pendo/pendo-2.134.1.js

192.0.54.4

200 OK

147 kB

URL HTTP/2
cdn1.onlineaccess1.com/cdn/static/q2-pendo/pendo-2.134.1.js
IP
192.0.54.4:0
ASN
#62659 Q2HOLDINGS

File type
data
Size
147 kB (147419 bytes)
Hash
4d8986436a709969b4098a70c39e4e78
2a2c5a9e840b8c890b327c3d71f87b08de0f2a63
c7b6bcdc883de70a847d2f45bd073eb41f4431c7a19de8fc4b776db5cbfe4d56

HTTP Headers

GET /cdn/static/q2-pendo/pendo-2.134.1.js HTTP/1.1
Host: cdn1.onlineaccess1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Fri, 25 Nov 2022 21:23:44 GMT
content-type: application/javascript
last-modified: Wed, 27 Apr 2022 17:47:30 GMT
vary: Accept-Encoding
etag: W/"626981b2-7288e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
content-encoding: gzip
timing-allow-origin: *
access-control-allow-headers: *
access-control-allow-origin: *
cf-cache-status: HIT
age: 14857527
strict-transport-security: max-age=15552000; includeSubDomains; preload
set-cookie: __cfruid=b4eaf16de6dc9ae7ad36777228f3165abf45e110-1669411424; path=/; domain=.onlineaccess1.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 76fd727d8ec2b503-OSL
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80e95b58-6cf9-4974-a4ce-f8515ca995ee.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11743 bytes)
Hash
8784bb7a8b88736a6016f712e3183bf3
b0ddc1555d2506177adcdcea77864d75f1245d07
8e331713b0ad0b5670dd33dfdadde665e076a40ddb80905d4df89876d49803d8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80e95b58-6cf9-4974-a4ce-f8515ca995ee.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11743
x-amzn-requestid: 9ab0aba7-5cd1-4f6c-8984-dc221e1cbf8e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cICD-F7joAMFqmA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637fe3b2-152ba5f1495a44447356cdab;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 21:35:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oWSNdsrz59sJC2znLnFqa_Zm3T14_d6j-rjzDQe4yV22Dy2Qc4Swaw==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:54:45 GMT
age: 84540
etag: "b0ddc1555d2506177adcdcea77864d75f1245d07"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

14 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81517ad5-7c1b-49aa-9ba9-dbfa36fbb071.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
14 kB (13882 bytes)
Hash
64d79191f005c9876b952c5f948aa0f7
1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a
00fb36c3d322e8302c5ce202d6d4119d637510cd6f3b63e1347781ec3bb9d7fc

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81517ad5-7c1b-49aa-9ba9-dbfa36fbb071.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 13882
x-amzn-requestid: 9022b0b3-31d5-4149-a969-02514f11b95a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvzNHjMoAMFWMg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9347-0e8354a02bef623644714e31;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:40:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ve4q5FDkwMGhPK6ZVVVCZtoBTaGaz43r_PwINzwS5Nx5tcZeQkVIfw==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:49:48 GMT
age: 84837
etag: "1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca5cb469-21a0-420a-875c-a81635b33f53.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.0 kB (7993 bytes)
Hash
92c78302bcce1568eb6a5563100b932c
43d1dec7fc06879988c9c3cadd800cc8145df988
0dda9914306c8e3a7ea75eade8e762652d93907dd6c5a8cc81707d6d8098b60a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca5cb469-21a0-420a-875c-a81635b33f53.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7993
x-amzn-requestid: 9f0ff853-4819-47cd-959d-658401ea5748
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvCsG5mIAMFqAQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9211-1c48b9223684f2942f8dd42d;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:35:13 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 7YSXUV-LZpsI7vciFhuqt1EVr6YRkhxcOgMg8z8bxLcOE01_baf6Gg==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 21:47:08 GMT
age: 84997
etag: "43d1dec7fc06879988c9c3cadd800cc8145df988"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/tecton-590048df214033d1c1591d552a32c9af.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:52 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/tecton-590048df214033d1c1591d552a32c9af.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:52 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/theme-q2-672a467fd0e274363dd92c86a83ab3d5.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:52 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/theme-q2-672a467fd0e274363dd92c86a83ab3d5.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:52 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/theme-q2-672a467fd0e274363dd92c86a83ab3d5.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:53 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.woff HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/highcontrast-187bc6d9db7409a39a77a6fc6d8ec2dc.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:53 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/theme-q2-672a467fd0e274363dd92c86a83ab3d5.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:53 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Regular.ttf HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/highcontrast-187bc6d9db7409a39a77a6fc6d8ec2dc.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:53 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.woff HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/highcontrast-187bc6d9db7409a39a77a6fc6d8ec2dc.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:54 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf

199.204.248.138

200 OK

35 kB

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (32016), with CRLF line terminators
Size
35 kB (35180 bytes)
Hash
f7fa0d8eff9a721a27fd206dc00b58ed
260613156fe4b7cf17a153ef09732e4ef8f2315d
3c06f9983709562f20b45caa5d7121eba35682d65b76e3e6871b085cde4936bc

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/fonts/OpenSans/OpenSans-Semibold.ttf HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/highcontrast-187bc6d9db7409a39a77a6fc6d8ec2dc.css

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:54 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=93
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

ocsp.pki.goog/s/gts1d4/S_oXU3H4Jpc

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1d4/S_oXU3H4Jpc
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
264ff76de1d47d591e2d8cdd92d4a0e1
b8a4bae41d4eda5e38ca3e686b9424cca7eb6341
2a6c5b71d0371dce169c4bc59bab9fd4aae239a5ea69bd20fa9e6a9bb9879bf8

HTTP Headers

POST /s/gts1d4/S_oXU3H4Jpc HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:47 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/s/gts1d4/S_oXU3H4Jpc

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1d4/S_oXU3H4Jpc
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
264ff76de1d47d591e2d8cdd92d4a0e1
b8a4bae41d4eda5e38ca3e686b9424cca7eb6341
2a6c5b71d0371dce169c4bc59bab9fd4aae239a5ea69bd20fa9e6a9bb9879bf8

HTTP Headers

POST /s/gts1d4/S_oXU3H4Jpc HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:47 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

app.pendo.io/data/ptm.gif/4cfc5253-789b-470f-45eb-e4d59dd0bf11?v=2.134.1_prod&ct=1669411427213&jzb=eJzNkt9r6jAUx_-XPJe0qbVa34TJnSA6UNnYGCVtoxbaJCYnrU783z119xb2cPdyGVzy0vMj3-8np-ftQuCsBZmQWgAnHsmMaq0wKZQ1ZlkcJxFjUThiSeSRprQlKJOWBV5In2bLh1W6ScenbC7dYJGsjyjA81w5Cfce6arKI85U2H4A0BPfb9uWFqUROVBef6BTQ3NnQdXC7EpZCGNprmp_L3Pn59wUVB80qmqjtCWTyx-E7vM7iorLveP77mFCpts1ufZk_VVsa9CvVBKDgN4P5v4dF700N0LCtHfEVMGhwwmHPmN-GIThF_-QskFEWYoPLbBgRbV7VBYEgoJxopfc8GzeTxY-A5K8nOLpcs10q1_Hv7YOBXaG1-JeXKwadRzNMrF5jk-WRd1PPoPAaQ6D4Or1C1Ap3jn_fQGS_2IBOszfcFESjX5kMGE8vr7fAIVxBgk

34.107.204.85

200 OK

42 B

URL HTTP/2
app.pendo.io/data/ptm.gif/4cfc5253-789b-470f-45eb-e4d59dd0bf11?v=2.134.1_prod&ct=1669411427213&jzb=eJzNkt9r6jAUx_-XPJe0qbVa34TJnSA6UNnYGCVtoxbaJCYnrU783z119xb2cPdyGVzy0vMj3-8np-ftQuCsBZmQWgAnHsmMaq0wKZQ1ZlkcJxFjUThiSeSRprQlKJOWBV5In2bLh1W6ScenbC7dYJGsjyjA81w5Cfce6arKI85U2H4A0BPfb9uWFqUROVBef6BTQ3NnQdXC7EpZCGNprmp_L3Pn59wUVB80qmqjtCWTyx-E7vM7iorLveP77mFCpts1ufZk_VVsa9CvVBKDgN4P5v4dF700N0LCtHfEVMGhwwmHPmN-GIThF_-QskFEWYoPLbBgRbV7VBYEgoJxopfc8GzeTxY-A5K8nOLpcs10q1_Hv7YOBXaG1-JeXKwadRzNMrF5jk-WRd1PPoPAaQ6D4Or1C1Ap3jn_fQGS_2IBOszfcFESjX5kMGE8vr7fAIVxBgk
IP
34.107.204.85:0
ASN
#15169 GOOGLE

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

HTTP Headers

GET /data/ptm.gif/4cfc5253-789b-470f-45eb-e4d59dd0bf11?v=2.134.1_prod&ct=1669411427213&jzb=eJzNkt9r6jAUx_-XPJe0qbVa34TJnSA6UNnYGCVtoxbaJCYnrU783z119xb2cPdyGVzy0vMj3-8np-ftQuCsBZmQWgAnHsmMaq0wKZQ1ZlkcJxFjUThiSeSRprQlKJOWBV5In2bLh1W6ScenbC7dYJGsjyjA81w5Cfce6arKI85U2H4A0BPfb9uWFqUROVBef6BTQ3NnQdXC7EpZCGNprmp_L3Pn59wUVB80qmqjtCWTyx-E7vM7iorLveP77mFCpts1ufZk_VVsa9CvVBKDgN4P5v4dF700N0LCtHfEVMGhwwmHPmN-GIThF_-QskFEWYoPLbBgRbV7VBYEgoJxopfc8GzeTxY-A5K8nOLpcs10q1_Hv7YOBXaG1-JeXKwadRzNMrF5jk-WRd1PPoPAaQ6D4Or1C1Ap3jn_fQGS_2IBOszfcFESjX5kMGE8vr7fAIVxBgk HTTP/1.1
Host: app.pendo.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Fri, 25 Nov 2022 21:23:48 GMT
content-type: image/gif
content-length: 42
access-control-allow-credentials: false
access-control-allow-headers: Origin,Accept,Content-Type,Authorization
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-max-age: 600
x-content-type-options: nosniff
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/s/gts1d4/S_oXU3H4Jpc

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1d4/S_oXU3H4Jpc
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
264ff76de1d47d591e2d8cdd92d4a0e1
b8a4bae41d4eda5e38ca3e686b9424cca7eb6341
2a6c5b71d0371dce169c4bc59bab9fd4aae239a5ea69bd20fa9e6a9bb9879bf8

HTTP Headers

POST /s/gts1d4/S_oXU3H4Jpc HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 25 Nov 2022 21:23:48 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

cdn1.onlineaccess1.com/cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/logos/favicon-60ece86de211be04d011746e7e7f9a4f.ico

192.0.54.4

200 OK

0 B

URL HTTP/2
cdn1.onlineaccess1.com/cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/logos/favicon-60ece86de211be04d011746e7e7f9a4f.ico
IP
192.0.54.4:0
ASN
#62659 Q2HOLDINGS

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /cdn/depot/4102_01/1776/82586256c6fee52a84f789e773a20aa6/assets/images/logos/favicon-60ece86de211be04d011746e7e7f9a4f.ico HTTP/1.1
Host: cdn1.onlineaccess1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive
Cookie: __cfruid=e15ed404b399987b50ea3c7b61cedae72da86a84-1669411425
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Fri, 25 Nov 2022 21:23:45 GMT
content-type: image/x-icon
last-modified: Fri, 21 Oct 2022 08:09:31 GMT
etag: W/"635253bb-1536"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
timing-allow-origin: *
access-control-allow-headers: *
access-control-allow-origin: *
cf-cache-status: HIT
age: 288034
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
cf-ray: 76fd7281a87ab503-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

app.pendo.io/data/guide.json/4cfc5253-789b-470f-45eb-e4d59dd0bf11?jzb=eJylj8FKxDAQht8l5yXZdhW0N0HBBVFh13OIyWw3kCZxMmlF6bvv1EPBixfJJfnzZf4v32L0xVPCvROd0K8Pz_cv-qhvPt_3se6ebg8fYiOMtalGWpBYQ9iIioHpM1HulJqmSTqPYEma4asAjtLWQmkAPPnoAIu0aVB9tFVZg07mc-ahA5BxhozoVodl6__wCCb21fTABET9dhDz6rY-ZWzkSp8iH7byZ3H2f2PuygYh0t3ayBH_YNFpr1XTqHbbtr_6W9nsrmSjMybHFwXC6TEVAhYlrDDPF49AgEU&v=2.134.1_prod&ct=1669411427220

34.107.204.85

200 OK

0 B

URL HTTP/2
app.pendo.io/data/guide.json/4cfc5253-789b-470f-45eb-e4d59dd0bf11?jzb=eJylj8FKxDAQht8l5yXZdhW0N0HBBVFh13OIyWw3kCZxMmlF6bvv1EPBixfJJfnzZf4v32L0xVPCvROd0K8Pz_cv-qhvPt_3se6ebg8fYiOMtalGWpBYQ9iIioHpM1HulJqmSTqPYEma4asAjtLWQmkAPPnoAIu0aVB9tFVZg07mc-ahA5BxhozoVodl6__wCCb21fTABET9dhDz6rY-ZWzkSp8iH7byZ3H2f2PuygYh0t3ayBH_YNFpr1XTqHbbtr_6W9nsrmSjMybHFwXC6TEVAhYlrDDPF49AgEU&v=2.134.1_prod&ct=1669411427220
IP
34.107.204.85:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /data/guide.json/4cfc5253-789b-470f-45eb-e4d59dd0bf11?jzb=eJylj8FKxDAQht8l5yXZdhW0N0HBBVFh13OIyWw3kCZxMmlF6bvv1EPBixfJJfnzZf4v32L0xVPCvROd0K8Pz_cv-qhvPt_3se6ebg8fYiOMtalGWpBYQ9iIioHpM1HulJqmSTqPYEma4asAjtLWQmkAPPnoAIu0aVB9tFVZg07mc-ahA5BxhozoVodl6__wCCb21fTABET9dhDz6rY-ZWzkSp8iH7byZ3H2f2PuygYh0t3ayBH_YNFpr1XTqHbbtr_6W9nsrmSjMybHFwXC6TEVAhYlrDDPF49AgEU&v=2.134.1_prod&ct=1669411427220 HTTP/1.1
Host: app.pendo.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www.direct.amzserv.customerfinders.com/
Origin: http://www.direct.amzserv.customerfinders.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Fri, 25 Nov 2022 21:23:48 GMT
content-type: application/json
vary: Accept-Encoding
access-control-allow-credentials: false
access-control-allow-headers: Origin,Accept,Content-Type,Authorization
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-max-age: 600
x-content-type-options: nosniff
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/p-c89cafe1.js

199.204.248.138

200 OK

0 B

URL HTTP/1.1
www.direct.amzserv.customerfinders.com/gncu/static/css/gncu_files/p-c89cafe1.js
IP
199.204.248.138:0
ASN
#11989 WEBINT

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gncu/static/css/gncu_files/p-c89cafe1.js HTTP/1.1
Host: www.direct.amzserv.customerfinders.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.direct.amzserv.customerfinders.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Fri, 25 Nov 2022 21:23:51 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Keep-Alive: timeout=30, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (55)

URL HTTP/1.1

IP

ASN

File type

Size