secure-hostboa0123.access.ly/BOA/b4decc33ba0136e71c05a18a3f30285b/?cont=QERldmlsbWFzazA5&token=dbf5e0e3f8b60afb065b9aaa506f3a461cb4c2e5343ade7038252e30612b99e7b5c215597f941467700435e44af88ea34da2ccf66479350c4ce1609830321fc4
302 Found 0 B URL User Request GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/b4decc33ba0136e71c05a18a3f30285b/?cont=QERldmlsbWFzazA5&token=dbf5e0e3f8b60afb065b9aaa506f3a461cb4c2e5343ade7038252e30612b99e7b5c215597f941467700435e44af88ea34da2ccf66479350c4ce1609830321fc4
IP
Certificate IssuercPanel, Inc.
Subjectsecure-hostboa0123.access.ly
Fingerprint94:F9:D6:2C:56:DF:6D:99:97:A1:53:31:F4:4F:8C:23:3F:26:25:09
ValidityFri, 19 May 2023 00:00:00 GMT - Thu, 17 Aug 2023 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
GET /BOA/b4decc33ba0136e71c05a18a3f30285b/?cont=QERldmlsbWFzazA5&token=dbf5e0e3f8b60afb065b9aaa506f3a461cb4c2e5343ade7038252e30612b99e7b5c215597f941467700435e44af88ea34da2ccf66479350c4ce1609830321fc4 HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Thu, 25 May 2023 02:40:46 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f; path=/
Location: ../index.php
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
secure-hostboa0123.access.ly/BOA/index.php
302 Found 0 B URL User Request GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/index.php
IP
Certificate IssuercPanel, Inc.
Subjectsecure-hostboa0123.access.ly
Fingerprint94:F9:D6:2C:56:DF:6D:99:97:A1:53:31:F4:4F:8C:23:3F:26:25:09
ValidityFri, 19 May 2023 00:00:00 GMT - Thu, 17 Aug 2023 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
GET /BOA/index.php HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Thu, 25 May 2023 02:40:47 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: ac854fa330efec582004738d75df4683?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
301 Moved Permanently 443 B URL User Request GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
IP
Certificate IssuercPanel, Inc.
Subjectsecure-hostboa0123.access.ly
Fingerprint94:F9:D6:2C:56:DF:6D:99:97:A1:53:31:F4:4F:8C:23:3F:26:25:09
ValidityFri, 19 May 2023 00:00:00 GMT - Thu, 17 Aug 2023 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash da363b9122f070aa6530f760e81d7ea8
6fd07df19a0f98c5acc6417928f4ef3a5ac76832
3839e3fb64a5ac3c917d2026f1fedcadbe770370ef929b3cf9528277f0e09b96
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
GET /BOA/ac854fa330efec582004738d75df4683?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076 HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Thu, 25 May 2023 02:40:48 GMT
Server: Apache
Location: https://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Content-Length: 443
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
secure-hostboa0123.access.ly/
619 B URL secure-hostboa0123.access.ly/
IP
Certificate IssuercPanel, Inc.
Subjectsecure-hostboa0123.access.ly
Fingerprint94:F9:D6:2C:56:DF:6D:99:97:A1:53:31:F4:4F:8C:23:3F:26:25:09
ValidityFri, 19 May 2023 00:00:00 GMT - Thu, 17 Aug 2023 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a2c1022c94ce45ad4a1461f5e953dd0f
6d6b1d4dfe75186d85e31df87665ed952503d635
247213bd41dce9118419d4d6124f991f626be67860eed666d74bb4dbca65bd6a
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET / HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:49 GMT
Server: Apache
Content-Length: 619
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/script/libraries/jquery-migrate-custom.js
200 OK 10 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/script/libraries/jquery-migrate-custom.js
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Hash bedff910fdc85bf57f5b28ac6f9474ac
8752dc091a7c0d60fa1b98dd2d589d89925a2948
507c9d07862848eb2252ea5aa73050168e57663e4b6887159e725017ae629386
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/script/libraries/jquery-migrate-custom.js HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:51 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 10067
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/utilities/ah-continuous-auth-util/1.1/deploy/cau-loginBehBio.js
200 OK 8.2 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/utilities/ah-continuous-auth-util/1.1/deploy/cau-loginBehBio.js
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type ASCII text, with very long lines (625), with CRLF line terminators
Hash 4447e075ba5a336bdc0cd0ac29b1e6eb
755b4c479c2b41e6de2c558d8e4318f01b46155b
d5e30c9cbba6ef6a57a298730391d38757f5ced4446874b1470743f1ba7f7290
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/utilities/ah-continuous-auth-util/1.1/deploy/cau-loginBehBio.js HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:51 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 8151
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
ocsp.sectigo.com/
472 B IP
Hash e9e972d57046ac31025bf327e66fad25
d29d14edf2a5b384462388430e3739391e4e0a48
bb2f6ed0bdb508a4e07c74040027df7759ba6e6def2301338b5d7d4a07805a77
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:51 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 24 May 2023 05:40:03 GMT
Expires: Wed, 31 May 2023 05:40:02 GMT
Etag: "d29d14edf2a5b384462388430e3739391e4e0a48"
Cache-Control: max-age=528686,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7cca6a8419b3b51b-OSL
ocsp.sectigo.com/
472 B IP
Hash e9e972d57046ac31025bf327e66fad25
d29d14edf2a5b384462388430e3739391e4e0a48
bb2f6ed0bdb508a4e07c74040027df7759ba6e6def2301338b5d7d4a07805a77
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:52 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 24 May 2023 05:40:03 GMT
Expires: Wed, 31 May 2023 05:40:02 GMT
Etag: "d29d14edf2a5b384462388430e3739391e4e0a48"
Cache-Control: max-age=528686,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7cca6a840a1db4fa-OSL
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules-app/VIPAA/online-id-vipaa-module/1.0/script/online-id-vipaa-module-enter-skin.js
200 OK 52 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules-app/VIPAA/online-id-vipaa-module/1.0/script/online-id-vipaa-module-enter-skin.js
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type Unicode text, UTF-8 text, with very long lines (380), with CRLF line terminators
Hash a8b5442932ef01872e23f6702e6ec6c4
0df228486aba4f8f2d9ee5c36e4005d52773493f
c1c8c8523e2522ad61aad8ab255908bf8a2509b69ffc79543c3816cccfec4df6
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/modules-app/VIPAA/online-id-vipaa-module/1.0/script/online-id-vipaa-module-enter-skin.js HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:51 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 51909
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/text-decompressed/xengine/VIPAA/9.2.1/script/cm-jawr.js
200 OK 42 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/text-decompressed/xengine/VIPAA/9.2.1/script/cm-jawr.js
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type HTML document, ASCII text, with very long lines (42027), with no line terminators
Hash 48bd15dcb4c7045c72a2051ee85d1636
a6d4ba03db3402a0d1b82f809fbbea9ad4d0f109
e49851a126b4eac23416ee43bc11329b8cf2a857018e030191c4b649a975fb61
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/text-decompressed/xengine/VIPAA/9.2.1/script/cm-jawr.js HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:51 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 42027
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
devilsms.live/cleave.js
200 OK 21 kB IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Certificate IssuerSectigo Limited
Subjectdevilsms.live
Fingerprint72:C0:D3:B1:19:FB:CD:8A:B3:B2:6D:62:78:A9:37:61:9F:B9:AA:6C
ValidityThu, 18 Aug 2022 00:00:00 GMT - Sat, 16 Sep 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (1712)
Hash 3bbc061fb0ad251028998d5a611eff8e
e02e4f2220bd63e95045a79f6cf7ee0f530ec8e5
9d490665d6b1ea2dc13de64536164ce5b8efa60f17d32610cb97b57c823a466d
GET /cleave.js HTTP/1.1
Host: devilsms.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 01 Jun 2023 02:40:51 GMT
content-type: application/javascript
last-modified: Sun, 30 Jan 2022 13:07:42 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 21221
date: Thu, 25 May 2023 02:40:51 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css
200 OK 457 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type ASCII text, with very long lines (65536), with no line terminators
Size 457 kB (457321 bytes)
Hash 40ae5df6c356c7206c0876c3fdeed9b2
f93483d262927057f60a1043fdf834122b59645d
2c8d18952fefaef3418ad318639e26cceab99db0807087cf04935a3c6a9395cf
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:51 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 457321
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
devilsms.live/clve-min.js
200 OK 54 kB URL GET HTTP/2 devilsms.live/clve-min.js
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Certificate IssuerSectigo Limited
Subjectdevilsms.live
Fingerprint72:C0:D3:B1:19:FB:CD:8A:B3:B2:6D:62:78:A9:37:61:9F:B9:AA:6C
ValidityThu, 18 Aug 2022 00:00:00 GMT - Sat, 16 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash 9ceb72888e84ad14c62b1b4949517ccf
6164852302126a4de36f1076b5f6ad4d0acda3f3
5d53f9ca36661d544806a5125ab283ee4fc47007924f5ea26fc8d4c562856faa
GET /clve-min.js HTTP/1.1
Host: devilsms.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 01 Jun 2023 02:40:52 GMT
content-type: application/javascript
last-modified: Mon, 07 Feb 2022 11:17:03 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 53924
date: Thu, 25 May 2023 02:40:52 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/script/vipaa-v4-jawr.js
200 OK 1.6 MB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/script/vipaa-v4-jawr.js
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type ASCII text, with very long lines (65451)
Size 1.6 MB (1555001 bytes)
Hash 6186c25031037bba1d5444131289e736
c43ce63a765739958a73f37604c3c7244bcf6215
3ef44e75e7bcfa9d11302535571258ff594520c15e5a7a38ab8fdbd73a79bb4d
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/script/vipaa-v4-jawr.js HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:51 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 1555001
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules-app/VIPAA/online-id-vipaa-module/1.0/graphic/mobile_llama.png
200 OK 19 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules-app/VIPAA/online-id-vipaa-module/1.0/graphic/mobile_llama.png
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type PNG image data, 298 x 416, 8-bit colormap, non-interlaced\012- data
Hash 178098b4327cb4e5407e4a69c8cd2d18
0be208356ff56bea3794ed175f3682c2b0701415
6bb1d4b1b719488b9812d1fb67b41b03857eec8f4e0a4d46a8066574037d817a
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/modules-app/VIPAA/online-id-vipaa-module/1.0/graphic/mobile_llama.png HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:52 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 19167
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr-print.css
200 OK 10 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr-print.css
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type ASCII text, with very long lines (9953), with no line terminators
Hash a2af793292866b502045f42be5fc997c
088f20867c1ff4931bf7917ab47e6940f7dfe493
2f0ac0559a948fa017a8ecdb5bddf7ac54033e8aa1eb91ff7df93243c690f0d1
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr-print.css HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:52 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 9953
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/content/images/ContextualSiteGraphics/Logos/en_US/BofA_rgb.png
200 OK 39 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/content/images/ContextualSiteGraphics/Logos/en_US/BofA_rgb.png
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type PNG image data, 1520 x 170, 8-bit/color RGBA, non-interlaced\012- data
Hash 49bc9262c4a31f1ee2ca2dd5e1dc8588
5b145ba3666ffa9eded453160010567ccc24e8cc
30652cee5990b3b76f6cbf6f26362be9254dd62b4c6e6003c1127d1484573787
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/content/images/ContextualSiteGraphics/Logos/en_US/BofA_rgb.png HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:52 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 39422
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
target.bankofamerica.com/m2/bankofamerica/mbox/json?mbox=target-global-mbox&mboxSession=fe3e9288d0324f109693b5d507c00ba7&mboxPC=&mboxPage=02c2a8c52deb4813a81ab090df219ea2&mboxRid=db5c723c8ebe40d1b045fb1ade9e0748&mboxVersion=1.8.0&mboxCount=1&mboxTime=1684982452764&mboxHost=secure-hostboa0123.access.ly&mboxURL=http%3A%2F%2Fsecure-hostboa0123.access.ly%2FBOA%2Fac854fa330efec582004738d75df4683%2F%3Fcont%3DQERldmlsbWFzazA5%26token%3D265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076&mboxReferrer=&mboxXDomain=enabled&browserHeight=1024&browserWidth=1280&browserTimeOffset=0&screenHeight=1024&screenWidth=1280&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&at_property=2c28efc5-fc52-2eba-d89f-6f09359d852c&mboxState=No%20State%20Selected
200 OK 142 B URL GET HTTP/1.1 target.bankofamerica.com/m2/bankofamerica/mbox/json?mbox=target-global-mbox&mboxSession=fe3e9288d0324f109693b5d507c00ba7&mboxPC=&mboxPage=02c2a8c52deb4813a81ab090df219ea2&mboxRid=db5c723c8ebe40d1b045fb1ade9e0748&mboxVersion=1.8.0&mboxCount=1&mboxTime=1684982452764&mboxHost=secure-hostboa0123.access.ly&mboxURL=http%3A%2F%2Fsecure-hostboa0123.access.ly%2FBOA%2Fac854fa330efec582004738d75df4683%2F%3Fcont%3DQERldmlsbWFzazA5%26token%3D265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076&mboxReferrer=&mboxXDomain=enabled&browserHeight=1024&browserWidth=1280&browserTimeOffset=0&screenHeight=1024&screenWidth=1280&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&at_property=2c28efc5-fc52-2eba-d89f-6f09359d852c&mboxState=No%20State%20Selected
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type JSON data\012- , ASCII text, with no line terminators
Hash 5a73f127d03a7914bc3d72faa284992e
eed7eaab45696226ebafdbf1fbfd3d999a4de13c
eb5571527bb024fa9d50c4d431a43daf28a7cd643ef68ee8ab5c2413a50bf118
GET /m2/bankofamerica/mbox/json?mbox=target-global-mbox&mboxSession=fe3e9288d0324f109693b5d507c00ba7&mboxPC=&mboxPage=02c2a8c52deb4813a81ab090df219ea2&mboxRid=db5c723c8ebe40d1b045fb1ade9e0748&mboxVersion=1.8.0&mboxCount=1&mboxTime=1684982452764&mboxHost=secure-hostboa0123.access.ly&mboxURL=http%3A%2F%2Fsecure-hostboa0123.access.ly%2FBOA%2Fac854fa330efec582004738d75df4683%2F%3Fcont%3DQERldmlsbWFzazA5%26token%3D265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076&mboxReferrer=&mboxXDomain=enabled&browserHeight=1024&browserWidth=1280&browserTimeOffset=0&screenHeight=1024&screenWidth=1280&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&at_property=2c28efc5-fc52-2eba-d89f-6f09359d852c&mboxState=No%20State%20Selected HTTP/1.1
Host: target.bankofamerica.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://secure-hostboa0123.access.ly
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Thu, 25 May 2023 02:40:53 GMT
content-type: application/json;charset=UTF-8
content-length: 142
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-origin: http://secure-hostboa0123.access.ly
access-control-allow-credentials: true
x-request-id: db5c723c8ebe40d1b045fb1ade9e0748
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
set-cookie: bankofamerica!mboxSession=fe3e9288d0324f109693b5d507c00ba7; Max-Age=1860; Expires=Thu, 25-May-2023 03:11:53 GMT; Domain=target.bankofamerica.com; Path=/; HttpOnly; SameSite=None
bankofamerica!mboxPC=fe3e9288d0324f109693b5d507c00ba7.37_0; Max-Age=63244800; Expires=Mon, 26-May-2025 02:40:53 GMT; Domain=target.bankofamerica.com; Path=/; HttpOnly; SameSite=None
pragma: no-cache
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
server: jag
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/graphic/help-qm-fsd.png
200 OK 3.2 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/graphic/help-qm-fsd.png
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash a1874bec60e4440a4c0d240ef3d0a385
51e42f8b4483cfe0107394675e20c51acb1adb33
e1ac56ae25629e508f729b799d563d71920902a4cb26cf3bb602beb3e368775e
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/graphic/help-qm-fsd.png HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f; check=true; mbox=session#fe3e9288d0324f109693b5d507c00ba7#1684984313
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:53 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 3220
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules/header-module/2.8/graphic/fsd-secure-esp-sprite.png
200 OK 473 B URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules/header-module/2.8/graphic/fsd-secure-esp-sprite.png
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type PNG image data, 12 x 37, 8-bit/color RGBA, non-interlaced\012- data
Hash f6f74792e7ce049e3a26a8a725dba8c8
ca49f42737d7566f1970eba7c437399821a614fb
8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/modules/header-module/2.8/graphic/fsd-secure-esp-sprite.png HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f; check=true; mbox=session#fe3e9288d0324f109693b5d507c00ba7#1684984313
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:53 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 473
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/graphic/sign-in-sprite.png
200 OK 3.1 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/graphic/sign-in-sprite.png
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type PNG image data, 9 x 135, 8-bit/color RGBA, non-interlaced\012- data
Hash cdcb0f012c00908030c706b328c6325e
40b1d7c103b08787c7e76ccf00a7174938c18ceb
2a1b1589e316d02ab75481e7aa88c9975afd2e87f17982fb6d38b6ebe2425a4c
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/global-assets/1.0/graphic/sign-in-sprite.png HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f; check=true; mbox=session#fe3e9288d0324f109693b5d507c00ba7#1684984313
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:53 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 3119
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules/global-footer-module/2.5/graphic/gfootb-static-sprite.png
200 OK 49 kB URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules/global-footer-module/2.5/graphic/gfootb-static-sprite.png
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type PNG image data, 14 x 50, 8-bit/color RGBA, non-interlaced\012- data
Hash fbf368512d6de369ecf24f2778db0aa1
ad621d647f845c66d1780e44e5495e606605c5fa
ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/modules/global-footer-module/2.5/graphic/gfootb-static-sprite.png HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f; check=true; mbox=session#fe3e9288d0324f109693b5d507c00ba7#1684984313; cmTPSet=Y
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:53 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 48667
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules/global-footer-module/2.5/graphic/gfoot-home-icon.png
200 OK 144 B URL GET HTTP/1.1 secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/modules/global-footer-module/2.5/graphic/gfoot-home-icon.png
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
File type PNG image data, 14 x 9, 8-bit/color RGBA, non-interlaced\012- data
Hash 1f1d3a49189d9ff1e1b99d83e8a36be5
713bfd8a0cc4acb57d41ed3b82c6e601936018e7
a8bc6337547a246ef75d1ae66d7ec8a0ed6171c1ba49804a403124e27c8e8452
Analyzer Verdict Alert urlquery phishing Phishing - Bank of America
urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
GET /BOA/ac854fa330efec582004738d75df4683/pa/components/modules/global-footer-module/2.5/graphic/gfoot-home-icon.png HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/pa/components/bundles/gzip-compressed/xengine/VIPAA/9.2.1/style/vipaa-v4-jawr.css
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f; check=true; mbox=session#fe3e9288d0324f109693b5d507c00ba7#1684984313; cmTPSet=Y
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:53 GMT
Server: Apache
Last-Modified: Thu, 25 May 2023 02:40:48 GMT
Accept-Ranges: bytes
Content-Length: 144
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
36 kB URL User Request GET secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
IP
Certificate IssuercPanel, Inc.
Subjectsecure-hostboa0123.access.ly
Fingerprint94:F9:D6:2C:56:DF:6D:99:97:A1:53:31:F4:4F:8C:23:3F:26:25:09
ValidityFri, 19 May 2023 00:00:00 GMT - Thu, 17 Aug 2023 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (880), with CRLF line terminators
Hash 770dc866ad316c12d0619b34f7e7e029
a7f449f622602136f9a279124fc3c1523bce878a
0f7ebb468f1a1ef7b099fab7d485c96df59c2cf7438b4350cafe319aada57b2f
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.access .ly Domain
suricata medium ET PHISHING Bank of America Phishing Landing Aug 19 2015
GET /BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076 HTTP/1.1
Host: secure-hostboa0123.access.ly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=be4ceb19a4ddca459d7cc6acaa605f8f
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 02:40:49 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
ocsp.entrust.net/
1.6 kB IP
Hash 0fd51aa23b9760d501cc00bcf1e4b7c1
4577ade8ed03b38d2caa70a27411492d0b92731b
b45c7971063563b8e941db34816be0479252d5ad0944242983b4761c37c7c4a1
POST / HTTP/1.1
Host: ocsp.entrust.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
ETag: "B45C7971063563B8E941DB34816BE0479252D5AD0944242983B4761C37C7C4A1"
Last-Modified: Wed, 24 May 2023 20:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=2308
Expires: Thu, 25 May 2023 03:19:22 GMT
Date: Thu, 25 May 2023 02:40:54 GMT
Connection: keep-alive
www.bankofamerica.com/pa/global-assets/1.0/graphic/favicon.ico?ts=20151018
429 B URL GET www.bankofamerica.com/pa/global-assets/1.0/graphic/favicon.ico?ts=20151018
IP
Requested by http://secure-hostboa0123.access.ly/BOA/ac854fa330efec582004738d75df4683/?cont=QERldmlsbWFzazA5&token=265bea710b648d7955f8fe513e8a5f0929392f04d75f0793cf6933c6d7bd7c39fd94d9078788af28102835bd5f11107ec9f3ca7e9bf79e402f75e531d97fc076
Certificate IssuerEntrust, Inc.
Subjectwww.bankofamerica.com
FingerprintEF:4A:10:B6:C9:CA:DC:19:72:09:DE:71:9A:CB:07:94:24:3B:5A:2B
ValidityWed, 12 Oct 2022 20:00:25 GMT - Thu, 12 Oct 2023 20:00:25 GMT
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 165d08697e7e0ff31c98209b5195cb2d
ec5a74919d139899a1a74fdcfab9a2087e7fc7ca
1776ec2d36cfe2cab1aeffeb1d8d8eb4ccc53014fb6948c8ab46673df08bd7c0
GET /pa/global-assets/1.0/graphic/favicon.ico?ts=20151018 HTTP/1.1
Host: www.bankofamerica.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://secure-hostboa0123.access.ly/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Last-Modified: Tue, 16 Aug 2022 09:03:59 GMT
ETag: "47e-5e658076a32f3"
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Vary: Accept-Encoding
Content-Encoding: gzip
X-BOA-RequestID: ZGwXx4kow_Iq3rl6hjC_nAAAAP8
Keep-Alive: timeout=40, max=478
Content-Type: image/x-icon
X-Serviced-By: /pa/global-assets/1.0/graphic/favicon.ico--BDNionnBlZCYdOCbIuf1WA==--ISbmvLifT0lU0VLfxrS39w==
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: script-src 'self' *.bac-assets.com cdn.cookielaw.org *.livelook.com *.livelook.net *.tiqcdn.com *.bankofamerica.com *.glance.net *.glancecdn.net *.myglance.net s3.amazonaws.com *.cobrowse.oraclecloud.com *.oraclecloud.com www.google-analytics.com *.convertro.com idsync.rlcdn.com *.coremetrics.com *.brightcove.net *.brightcove.com maps.googleapis.com api.boldchat.com anrdoezrs.com cj.dotomi.com cj.com cj.mplxtms.com emjcd.com mczbf.com sjwoe.com secure-cdn.mplxtms.com cdn.mplxtms.com 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' https: data: blob: *.bac-assets.com *.bankofamerica.com cdn.cookielaw.org *.livelook.com *.livelook.net *.glancecdn.net *.cobrowse.oraclecloud.com *.oraclecloud.com www.google-analytics.com *.convertro.com idsync.rlcdn.com 'unsafe-inline'; worker-src 'self' blob:;
Connection: Keep-Alive
Date: Thu, 25 May 2023 02:40:55 GMT
Expires: Fri, 24 May 2024 02:36:43 GMT
Age: 253
Content-Length: 429
24.199.96.169
104.18.15.101
104.110.10.32