Report - www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php

Report Overview

Submitted URL
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
IP
216.172.184.77
ASN
#46606 UNIFIEDLAYER-AS-1
Submitted
2023-01-14 08:39:41
Access
Website Title
Final URL
Tags
navy_federal_credit_union financial phishing
urlquery detections
Phishing - Navy Federal Credit Union

Detections

urlquery
25
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
fonts.gstatic.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	496 B	12 kB	142.250.74.35
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	7.1 kB	23.36.77.32
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	341 B	737 B	93.184.220.29
www.gww-word.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	11 kB	93 kB	216.172.184.77
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.8 kB	64 kB	34.120.237.76
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	686 B	1.4 kB	142.250.74.131
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.88.220.109

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-12-25	medium	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php	Navy Federal Credit Union

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.js	9.3 kB	2023-03-07	2024-02-05
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.js IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:41 Last Seen2024-02-05 14:40:27 Times Seen115 Hash eb0afe588da6ed46920d443d7e390f72 ae3e3edee280d769cede147fd7b34ca2ba0f5e70 648e8bbb6388bce48e2ae62585040075d8f8484ec301ecd576275e186636f5c4 Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery-1.js	72 kB	2023-03-07	2024-04-25
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery-1.js IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:10 Last Seen2024-04-25 07:44:00 Times Seen7162 Hash 10092eee563dec2dca82b77d2cf5a1ae 65cbff4e9d95d47a6f31d96ab4ea361c1f538a7b e23a2a4e2d7c2b41ebcdd8ffc0679df7140eb7f52e1eebabf827a88182643c59 Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php	29 B	2023-03-12	2023-03-12
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 22:58:22 Last Seen2023-03-12 22:58:22 Times Seen1 Hash 030bc344b66d25769c168648fd167779 2830e734c42a3fdb7f5fa9f524a80c83631b6bbe 01f1c7e69b5b419d1a113dc4ed2eb86f19fec5bb080ffb0f294aca6c1c14a6a6 Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery.js	2.0 kB	2023-03-07	2024-02-05
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery.js IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:41 Last Seen2024-02-05 14:40:27 Times Seen115 Hash 375fac5283bc80c286c0d8510245ac30 e01f12f2a5fa6a2d28660a28463ea87660e2cecf 5a7e54fbc97213c7e72c607aaabe9d32b9285e01dc5ec8f9e0fa72b98a18f6cc Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php	55 B	2023-03-07	2024-02-05
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:41 Last Seen2024-02-05 14:40:27 Times Seen92 Hash 8da30844f5ae6760747d74ad88e3debc 3f7d49bae0c06959ecdfd0d99a45b1a93eba8e2b a2df90defaf862b1c32cf1f130910b1d6cae618f61b7548f7d54e94530ee7b1a Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/pm_fp.js	26 kB	2023-03-07	2024-02-05
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/pm_fp.js IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:41 Last Seen2024-02-05 14:40:27 Times Seen123 Hash 4de3dc0bc0cb5abb6491591020021af5 21a5bcefe4323b8ff63bb86c294e2a1f85382081 b06f75fb1bf4d564e06f2ef443165a6366da4525628891004a4dd1f500a2f27b Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php	2.4 kB	2023-03-07	2024-02-05
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:41 Last Seen2024-02-05 14:40:27 Times Seen91 Hash 545dd012cb0f966c10dc3300b42d637c b837383a9c577fcca6ef75cdbb433b6945edfea9 e4582a4629e20ebde2719754d26ab61847164913abf88e407a24043e156d9062 Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php	116 B	2023-03-07	2024-02-05
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:41 Last Seen2024-02-05 14:40:27 Times Seen91 Hash 2dccb0e219ac9d4ac9b600b0d1f077c4 893d903001d733d7c07ad558f4bed695f2d51792 b541b615679e3c8baad3ddf0505625616fbd520856dd5e5bc37737bbbae94f94 Loading...

	www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php	76 B	2023-03-07	2024-02-05
Pretty URL www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php IP 216.172.184.77 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:41 Last Seen2024-02-05 14:40:27 Times Seen91 Hash 5d38d325c93785d159b57e5c34814f03 6481eaa0eb207a55b4a437eaa4dc3e3b5d97e928 15d9136eaef4a0e94aa0e5c60476be0b2b2ced97307bbb14ff95758bc2e3901e Loading...

		Size	First Seen	Last Seen
	#1 Write - 5531a5834816222280f20d1ef9e95f69	4 B	2023-03-12	2024-01-28
Pretty Observations First Seen2023-03-12 12:17:15 Last Seen2024-01-28 13:22:54 Times Seen21116 Hash 5531a5834816222280f20d1ef9e95f69 445cd2fd3273962bdf09425109a2d09f7170e837 d398b29d3dbbb9bf201d4c7e1c19ff9d43c15fd45a0cec46fbe9885ec3f6e97f Loading...

HTTP Transactions (46)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a8b4f1afb0e830b797238d34ab9254aa
e011acef3d05c959a65205d53b651ecd18a889fe
f7ceff5b4fda083c7449b7298c232224cf48a632dcb87233b646790de207d49c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F7CEFF5B4FDA083C7449B7298C232224CF48A632DCB87233B646790DE207D49C"
Last-Modified: Thu, 12 Jan 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5271
Expires: Sat, 14 Jan 2023 10:07:21 GMT
Date: Sat, 14 Jan 2023 08:39:30 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
0643dc6b6fed33b3537160b6bb77bcbf
aa43bd1fbb30d2219f3285c1ee4991ffb33562c5
f137438e30e0d69cba77ca2eb736687873e4a9c06cf88d23c6d55ea930fde09f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F137438E30E0D69CBA77CA2EB736687873E4A9C06CF88D23C6D55EA930FDE09F"
Last-Modified: Sat, 14 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15349
Expires: Sat, 14 Jan 2023 12:55:19 GMT
Date: Sat, 14 Jan 2023 08:39:30 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
0f4ecf4f26be1ba09e61135b1b488bf4
f16b8277e00033bc990a8bcce54b693cb3c87d62
3018c2a228f0a894d217e8e8b0b8dd060527f06879cd2f469bac6c8766acbbf8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3018C2A228F0A894D217E8E8B0B8DD060527F06879CD2F469BAC6C8766ACBBF8"
Last-Modified: Wed, 11 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6921
Expires: Sat, 14 Jan 2023 10:34:51 GMT
Date: Sat, 14 Jan 2023 08:39:30 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 14 Jan 2023 07:48:53 GMT
content-type: application/json
age: 3037
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: 2LAt+7u24mDhG96SmWG3God+Yi+nruKLFYvedle/NNycYYPTQNwxRpYGxlRU7YQpsYeVnEy9UjE=
x-amz-request-id: MMPYBTJ45E3Z36DT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 14 Jan 2023 07:54:52 GMT
age: 2678
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 14 Jan 2023 08:39:30 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Expires, Pragma, Content-Type, Backoff, Last-Modified, Cache-Control, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 14 Jan 2023 08:17:25 GMT
age: 1325
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
b1e3535cab3c1ac295b1412126a9325c
d1bdf1b8663817ae34b6182db29d6b20666779e7
90c4ecd4b0782647fd78110b5bacfb73d2b05aae4de789a90318574407dfb565

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2706
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 08:39:30 GMT
Last-Modified: Sat, 14 Jan 2023 07:54:24 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

52.88.220.109

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.88.220.109:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: uyKsHXIHNcT9rMNJ7w/rag==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: v30BP7+PCAxS0Kh3OiEzIoW4Edg=

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php

216.172.184.77

301 Moved Permanently

286 B

URL HTTP/1.1
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
286 B (286 bytes)
Hash
27187c8d5608da843ed06bf7dae185aa
312658547b80f204247cc8ba5f2f44faf094428c
cb437d036beefbe4bd474f2350415f83618988b9ecc2d9ce761253171bfdc737

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union
openphish	Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Sat, 14 Jan 2023 08:39:30 GMT
Server: Apache
Content-Security-Policy: upgrade-insecure-requests
Location: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Cache-Control: max-age=300
Expires: Sat, 14 Jan 2023 08:44:30 GMT
Content-Length: 286
Keep-Alive: timeout=5, max=75
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19329
Expires: Sat, 14 Jan 2023 14:01:40 GMT
Date: Sat, 14 Jan 2023 08:39:31 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19329
Expires: Sat, 14 Jan 2023 14:01:40 GMT
Date: Sat, 14 Jan 2023 08:39:31 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19329
Expires: Sat, 14 Jan 2023 14:01:40 GMT
Date: Sat, 14 Jan 2023 08:39:31 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19329
Expires: Sat, 14 Jan 2023 14:01:40 GMT
Date: Sat, 14 Jan 2023 08:39:31 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78b0d4bc-9eea-491e-9fed-be68e71088e5.jpeg

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78b0d4bc-9eea-491e-9fed-be68e71088e5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9135 bytes)
Hash
64ba27a2f0a3bc61bd325f1fb317b755
c65c58476b66cbb6269ba1d8412d270a0a003ae3
5f7f03752f8a7c8c08d92512ae93b193ea37f59354503c3129d33fd2910f87e0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78b0d4bc-9eea-491e-9fed-be68e71088e5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9135
x-amzn-requestid: 2c5e9de0-9244-43ac-b7c4-712cbcf7038c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enAnoG6roAMFzgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bf7afd-7fb640b30bab63bc1979a173;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 03:14:05 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: RnAGo4OuBl5UjyOlUOJqu2nlFLHTOe0ETxokWtbI4frbpkNVnIBSew==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 01:41:40 GMT
age: 25071
etag: "c65c58476b66cbb6269ba1d8412d270a0a003ae3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78b55aad-884c-40db-a779-021d0c2305b4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.2 kB (9154 bytes)
Hash
b1378f107c1996ade14a8fe7fd728072
f52d98d9a0d1d343a539689ea14acf99e148cf8c
4be994757ec7ec42929590169de199e927889261334e258903a0929a1055047d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78b55aad-884c-40db-a779-021d0c2305b4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9154
x-amzn-requestid: fbb1140d-7ec2-4f86-8761-5d04601af70e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enAkCEN2IAMFuMQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bf7ae6-4baebf1104f9cf2a0ee8a538;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 03:13:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: jlRcVyQppaQaPPMKaqadtaEHfdOYXXXbnfrr44l_2E2qaOoh_O0Mog==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 04:21:52 GMT
age: 15459
etag: "f52d98d9a0d1d343a539689ea14acf99e148cf8c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F917985a1-aa8d-4c0a-860c-0b16c203387e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.2 kB (8181 bytes)
Hash
d24ea1f095f492934a1f1c63f5d8590c
dade37148c9b9a941f93a8535d8ddc5de3952623
2d8e3f90eb347eb3479a6c5d20a1c2ca6a0560f335a6c6800948db2640e4c878

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F917985a1-aa8d-4c0a-860c-0b16c203387e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8181
x-amzn-requestid: 7ada8fbd-58e6-4433-a532-b4a4ef93ac9c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: es0paH-OIAMFg5A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1ce3c-582529522dbb67ee728484f8;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 21:33:48 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AHjOmYxva5avyA3gt9DvYLas_B2ACimer5QRQOi919HDtSjnKq22lw==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 21:36:45 GMT
age: 39766
etag: "dade37148c9b9a941f93a8535d8ddc5de3952623"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4885191c-7ccc-4801-bef2-6d6bbb61cdb1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.4 kB (5371 bytes)
Hash
d9c918c3f0569cbf09fdcd8998e2fc00
ad06e348d49e8ae0550d922b50bc2a1d4905457a
8f96e49cf0dbbad59d260d0f991d79eb72ea25dcc0caa5ba4480056bd918d07d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4885191c-7ccc-4801-bef2-6d6bbb61cdb1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5371
x-amzn-requestid: fcbafc8b-5b89-49e6-8ebd-157cb3b24a55
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: es0qnERXoAMFsZQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1ce43-3eb3b4d84dbf415a3dec1308;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 21:33:55 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AbaES_6874zaabJY_z0_FOZfJx86Zsv-osNxWqzef8DDNyelo0HRtQ==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 21:49:01 GMT
age: 39030
etag: "ad06e348d49e8ae0550d922b50bc2a1d4905457a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

14 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbd91e555-c9f3-4166-92be-27db2e1919b6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
14 kB (13626 bytes)
Hash
afcc8f4875f4b74ca0640829b689731e
584d0e11665ae89f9a294baf1e9bb4f0e4e9a4df
3e487396389c4330abc99bc99053eecc6aaf56f7afa398d70c30e1f4709577a0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbd91e555-c9f3-4166-92be-27db2e1919b6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 13626
x-amzn-requestid: 4769eaeb-0c78-4054-ad47-eefdd6ab2d03
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eWHMZErbIAMF6sQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b8b8b5-4c7bacfe060899044e361f70;Sampled=0
x-amzn-remapped-date: Sat, 07 Jan 2023 00:11:33 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: JRzc2Mcl4EasyH6_1kFh7sr-57f1HNDu-YN8YptDe_kcTET9x8P9LA==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 14:03:21 GMT
age: 66970
etag: "584d0e11665ae89f9a294baf1e9bb4f0e4e9a4df"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F198805f8-79dd-4ac3-8fb7-22c15cbb9cb9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.9 kB (5918 bytes)
Hash
cb8fb3720ec05dd59482cb49e4bffd5c
99b1ea4060e5332b23fdfdc679f61be5af1a7bf7
c44e3c07c1fb842a741c22862afa738e3fbdda05947e9de59267791357f9f09a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F198805f8-79dd-4ac3-8fb7-22c15cbb9cb9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5918
x-amzn-requestid: f1786e4a-9ab0-45bd-8f45-ce687f9568d9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enAczGTJIAMFaCA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bf7ab8-4d96e5b066d83750238865b8;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 03:12:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: BTkp5sUcYhIw7VTnWpTCwdQ_MERqCzJNulldrmcIZHZHTMhXJn1ZRw==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 03:36:19 GMT
age: 18192
etag: "99b1ea4060e5332b23fdfdc679f61be5af1a7bf7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7151d737157b1f7c2633f49604d4a4a2
7359bb8a55ed8b42926feb72acb63d9c4a3b155a
6de42da184c7640e9bd18e2e1d0bab6d2548ddcca397ad2da2bb5c533010a97f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6DE42DA184C7640E9BD18E2E1D0BAB6D2548DDCCA397AD2DA2BB5C533010A97F"
Last-Modified: Fri, 13 Jan 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21520
Expires: Sat, 14 Jan 2023 14:38:12 GMT
Date: Sat, 14 Jan 2023 08:39:32 GMT
Connection: keep-alive

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php

216.172.184.77

200 OK

5.8 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ISO-8859 text, with very long lines (482), with CRLF line terminators
Size
5.8 kB (5756 bytes)
Hash
81ece1f59e42fae1496d1ec461a08079
aba2c3f5e959b45f712688021f2955485d09cfe2
53aed4508092c37927d6f86cddb8fa526de7dc406a393df7e24c5472a1641ea5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 5756
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/css.css

216.172.184.77

200 OK

279 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/css.css
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
ASCII text
Size
279 B (279 bytes)
Hash
83694301793cdf30385ef7f902875c09
d6697995c9af9a0a68a46ef34377d1a8e5c7315f
4e2f86faf272b12f948bcce12ea795791b1c93d67e6845314762df49d032e513

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/css.css HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
cache-control: max-age=2592000
expires: Mon, 13 Feb 2023 08:39:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 279
content-type: text/css
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery.js

216.172.184.77

200 OK

815 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery.js
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
ASCII text
Size
815 B (815 bytes)
Hash
43328d66e204bcf40e632346eb66bac6
bef2ea278295a4a00d4a560601d19f276a828c1e
bda0c2de2f0dabf0a4bfa052d6fba90901fd68db90fc89a909b4dd2ebb493c17

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery.js HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
cache-control: max-age=21600
expires: Sat, 14 Jan 2023 14:39:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 815
content-type: application/javascript
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.css

216.172.184.77

200 OK

793 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.css
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
ASCII text, with very long lines (310)
Size
793 B (793 bytes)
Hash
24ed8dcb3d563097b40989d9d98e8fa9
a1642d4395f19995300a3a45cad32f5473d1579a
7c04868e41e4831eee5e704b81aa248e49d35a1a0c4a1bf841fd7f60edd48ca0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.css HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
cache-control: max-age=2592000
expires: Mon, 13 Feb 2023 08:39:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 793
content-type: text/css
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.js

216.172.184.77

200 OK

3.2 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.js
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text
Size
3.2 kB (3221 bytes)
Hash
8266edb36105dea46bc62fe8164e6e89
34ce47dd6d4b429602fc1628c9ff1ebaecf7a405
eb9de6f8e93a5528a3f3a8d49e7ec79117efab078c34b58acdccbd15755e6650

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/facebox.js HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
cache-control: max-age=21600
expires: Sat, 14 Jan 2023 14:39:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 3221
content-type: application/javascript
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css

216.172.184.77

200 OK

16 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
ASCII text
Size
16 kB (16499 bytes)
Hash
c0f1aa3d1022d44568b97273174c3e94
6ec30c9549a023099b01d92e15bcbca3527620ea
c4c43def635101b89edf8676ee1016ae5387406f54af3c2f81eb454895909669

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
cache-control: max-age=2592000
expires: Mon, 13 Feb 2023 08:39:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 16499
content-type: text/css
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/footer_navy_fed_logo.png

216.172.184.77

200 OK

3.0 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/footer_navy_fed_logo.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
PNG image data, 73 x 43, 8-bit/color RGBA, non-interlaced\012- data
Size
3.0 kB (3014 bytes)
Hash
910b5a8703d923763de890e8be7a437e
dcfab8799e5f2c81522aeea9037b1b4e521545cd
26aa1e5d382461643776161453f29771a528577f5a831f0bb2036e4357513c1e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/footer_navy_fed_logo.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
content-length: 3014
cache-control: max-age=31536000
expires: Sun, 14 Jan 2024 08:39:32 GMT
x-endurance-cache-level: 2
content-type: image/png
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/navy_fed_logo.png

216.172.184.77

200 OK

8.2 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/navy_fed_logo.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
PNG image data, 262 x 72, 8-bit/color RGBA, non-interlaced\012- data
Size
8.2 kB (8167 bytes)
Hash
5bb6117010267d83596835c656dde37b
e84fc9bb92b2d4b50d7e7cf5a14b162a5063666d
0f88c98aba4ab56ee718ff00281d971cd4762b800c558408638d83b611253505

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/navy_fed_logo.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
content-length: 8167
cache-control: max-age=31536000
expires: Sun, 14 Jan 2024 08:39:32 GMT
x-endurance-cache-level: 2
content-type: image/png
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/pm_fp.js

216.172.184.77

200 OK

8.6 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/pm_fp.js
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
ASCII text, with very long lines (333)
Size
8.6 kB (8620 bytes)
Hash
95ddd4f3eb0efc2e68840e6741668b10
7803550a6733cfdfdbcca42137e91a61a16b3d78
64fd8639cd59e524d8130181f3831760ad592cf9fe580b48d4505c033269fbd6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/pm_fp.js HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
cache-control: max-age=21600
expires: Sat, 14 Jan 2023 14:39:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 8620
content-type: application/javascript
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/footer_equal_housing_logo.png

216.172.184.77

200 OK

1.3 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/footer_equal_housing_logo.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
PNG image data, 22 x 16, 8-bit/color RGBA, non-interlaced\012- data
Size
1.3 kB (1306 bytes)
Hash
ba37ed2bfc2714cc23901467f3729083
ad1afbbe6b1e4db24d82c97d0f11270364dc5d8f
f610a1c5a2648dd9405f74c42b87763940044fde590877666aa7cd5ddcad9d76

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/footer_equal_housing_logo.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
content-length: 1306
cache-control: max-age=31536000
expires: Sun, 14 Jan 2024 08:39:32 GMT
x-endurance-cache-level: 2
content-type: image/png
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/modal-close.png

216.172.184.77

200 OK

2.1 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/modal-close.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced\012- data
Size
2.1 kB (2067 bytes)
Hash
8155217a78f213a95981403fcee963fe
84b89a2be574b185e3ea7edd11ef7c179690c4ef
cc82339d0a44acfba5899aed36a2bb76e0eb46bd6948143d56d0d035f5b4d802

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
urlquery	phishing	Phishing - Navy Federal Credit Union

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/modal-close.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
content-length: 2067
cache-control: max-age=31536000
expires: Sun, 14 Jan 2024 08:39:32 GMT
x-endurance-cache-level: 2
content-type: image/png
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
df489559868985b8815baa1cfaaff191
cb804ae84a7d8c2b6580c97caa484cfb515c1435
ecfca9383aa4ff0bc88dc975918610d1406ac9198e68d26a731a589b073b3ead

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 08:39:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.gstatic.com/s/gudea/v4/6M2RKly85u67vSsXH0-zqvesZW2xOQ-xsNqO47m55DA.woff

142.250.74.35

200 OK

11 kB

URL HTTP/2
fonts.gstatic.com/s/gudea/v4/6M2RKly85u67vSsXH0-zqvesZW2xOQ-xsNqO47m55DA.woff
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
Web Open Font Format, TrueType, length 10680, version 1.1\012- data
Size
11 kB (10680 bytes)
Hash
c123a16ad761fa66090d2ced22133855
67d9668af24a5ebb35a73759c50b533c41ac0dc7
afdd3513410ee9407424d26662d6c7f2688845ab5fcef8882eb20ef40bbdb83e

HTTP Headers

GET /s/gudea/v4/6M2RKly85u67vSsXH0-zqvesZW2xOQ-xsNqO47m55DA.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.gww-word.com
Connection: keep-alive
Referer: https://www.gww-word.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 10680
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 09 Jan 2023 07:06:40 GMT
expires: Tue, 09 Jan 2024 07:06:40 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 27 Aug 2014 14:55:21 GMT
content-type: font/woff
age: 437572
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/bg_gradient.png

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/bg_gradient.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/bg_gradient.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/globe_bg.png

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/globe_bg.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/globe_bg.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/navy_fed_logo.png

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/navy_fed_logo.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/navy_fed_logo.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery-1.js

216.172.184.77

200 OK

31 kB

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery-1.js
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
ASCII text, with very long lines (820)
Size
31 kB (31110 bytes)
Hash
909c79c2b9cb4b5e643df2c482cb8a54
dcb0ee55763922849ee358f6b80967e505ec462e
b0d92353b2c8e2a6ed30047ee0cbf6056e1feaa5e4c01f7435c3c1e351452378

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/jquery-1.js HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
last-modified: Wed, 16 Nov 2022 22:47:55 GMT
accept-ranges: bytes
cache-control: max-age=21600
expires: Sat, 14 Jan 2023 14:39:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-type: application/javascript
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/footer_bg.jpg

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/footer_bg.jpg
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/footer_bg.jpg HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/info_question_mark_icon.png

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/info_question_mark_icon.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/info_question_mark_icon.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/img/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
df489559868985b8815baa1cfaaff191
cb804ae84a7d8c2b6580c97caa484cfb515c1435
ecfca9383aa4ff0bc88dc975918610d1406ac9198e68d26a731a589b073b3ead

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 08:39:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/close.png

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/close.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/close.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/modal-close.png

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/modal-close.png
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/modal-close.png HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/loader_large.gif

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/loader_large.gif
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/nfcu_images/modal_images/loader_large.gif HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:32 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
content-length: 339
content-type: text/html; charset=UTF-8
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
X-Firefox-Spdy: h2

www.gww-word.com/favicon.ico

216.172.184.77

200 OK

339 B

URL HTTP/2
www.gww-word.com/favicon.ico
IP
216.172.184.77:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (720), with no line terminators
Size
339 B (339 bytes)
Hash
1f45cb3e492c14dc1b5430b3dadbbca4
d58cb1aece0dc9004759219dc597e359cc5f6247
7627ef7aa81b7044b500e873b61e51523c538adabbf09ee04e70f63c09161ec9

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.gww-word.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.gww-word.com/wp-admin/usr/7169fbdfe6676ff6d744a6cd3cf87947/que.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Sat, 14 Jan 2023 08:39:32 GMT
server: Apache
content-type: text/html; charset=UTF-8
content-length: 339
content-security-policy: upgrade-insecure-requests
cache-control: max-age=300
expires: Sat, 14 Jan 2023 08:44:34 GMT
vary: Accept-Encoding
content-encoding: gzip
x-endurance-cache-level: 2
x-server-cache: true
x-proxy-cache: MISS
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4eac26ee-70ec-4eca-8e10-c7a79b5575b3.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.9 kB (4936 bytes)
Hash
f4f04f55a9d261ddda8128b0bb721446
5e8df480a1650606937ee493660177bf09c49c14
3a357fbbd9f41d384a06e151a0daff50b345520d4816e70cc1b2c694949ce79f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4eac26ee-70ec-4eca-8e10-c7a79b5575b3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
content-length: 4936
x-amzn-requestid: f1808de3-5712-4a65-8394-c1624668cdb9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: es0pZFbIIAMFnvA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1ce3b-48c4b0cd36319a2634c0c5f0;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 21:33:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: rudCuuUXfxE8aRq8-FFIwHE4tqeSWxYrd8uilWI-8DZSY9A-8EiLQQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 21:49:06 GMT
age: 39032
etag: "5e8df480a1650606937ee493660177bf09c49c14"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML