Report - fortisgarments.com/index.html

Report Overview

Submitted URL
fortisgarments.com/index.html
IP
202.4.96.3
ASN
#23956 AmberIT Limited
Submitted
2023-02-19 14:12:21
Access
Website Title
Final URL
Tags
bancolombia financial phishing suspicious
urlquery detections
Phishing - Bancolombia
Suspicious - Suspicious JS code

Detections

urlquery
40
Network Intrusion Detection
1
Threat Detection Systems
26

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
ajax.googleapis.com	12905	2013-08-16T11:51:31Z	2023-03-13T08:37:09Z	393 B	32 kB	142.250.74.138
fortisgarments.com	unknown	2017-05-19T07:01:54Z	2023-03-10T19:42:40Z	6.7 kB	1.2 MB	202.4.96.3
ipinfo.io	8136	2013-12-16T08:25:53Z	2023-03-13T05:42:51Z	421 B	514 B	34.117.59.81
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3.0 kB	8.0 kB	23.36.76.226
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.9 kB	34.160.144.191
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	686 B	1.4 kB	142.250.74.131
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	54.202.200.61
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	54 kB	34.120.237.76
ocsp.sectigo.com	487	2019-11-29T12:50:24Z	2023-03-13T08:22:43Z	340 B	963 B	104.18.32.68
api.ipify.org	3267	2014-10-06T14:38:43Z	2023-03-13T05:15:58Z	437 B	215 B	104.237.62.211

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-19 14:12:13	medium	Client IP	34.117.59.81	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-19	medium	fortisgarments.com/index.html	Malware
2023-02-19	medium	fortisgarments.com/js/sax.js	Malware
2023-02-19	medium	fortisgarments.com/js/jquery.validate-1.11.1.js.descarga	Malware
2023-02-19	medium	fortisgarments.com/js/bluebird.min.js.descarga	Malware
2023-02-19	medium	fortisgarments.com/js/jquery.jclockNew.js.descarga	Malware
2023-02-19	medium	fortisgarments.com/js/jquery-1.10.1.js.descarga	Malware
2023-02-19	medium	fortisgarments.com/js/jquery-ui.js.descarga	Malware
2023-02-19	medium	fortisgarments.com/js/bootstrap.js.descarga	Malware
2023-02-19	medium	fortisgarments.com/login_SVP_BC_zonaA.html	Malware
2023-02-19	medium	fortisgarments.com/img/logo.svg	Malware
2023-02-19	medium	fortisgarments.com/css/icon_font_bc.ttf?61jkgi	Malware
2023-02-19	medium	fortisgarments.com/css/CIBFontSans-Light.ttf	Malware
2023-02-19	medium	fortisgarments.com/css/OpenSans-Regular.ttf	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (15)

	URL	Size	First Seen	Last Seen
	fortisgarments.com/js/jquery-1.10.1.js.descarga	146 kB	2023-03-07	2024-04-06
Pretty URL fortisgarments.com/js/jquery-1.10.1.js.descarga IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-04-06 19:24:22 Times Seen212 Hash 43ab7751f1e8455471908c97a5977a6a 84ac89e3f5529b2a8f45032bd421d192b6b466ed 751bcbcd434089a9b12e9339a1891607ee99659ae3a674a6709e9a74dab21cd1 Loading...

	fortisgarments.com/js/jquery-ui.js.descarga	228 kB	2023-03-07	2024-04-16
Pretty URL fortisgarments.com/js/jquery-ui.js.descarga IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-04-16 03:25:30 Times Seen524 Hash 12a65fcb49c314e8dbbcf8d090d26b8a 679dc5cc110ee2c7b083cf52541544c01efea018 8072615124c5bc2634fdecc09485c8b645c78ea27c212c3d61b80c26112bdcb8 Loading...

	fortisgarments.com/index.html	188 B	2023-03-07	2024-04-06
Pretty URL fortisgarments.com/index.html IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-04-06 06:09:16 Times Seen150 Hash b3b503622ed5a0a9948eca48101c20ae f34387ef59eaebe05d0770f5be3d82d9c3a194d2 9866c44d7e9f93ab6a8bfcfdb571b8eec5bc61b625def02978d0dca4828f7e75 Loading...

	fortisgarments.com/index.html	256 B	2023-03-07	2024-02-28
Pretty URL fortisgarments.com/index.html IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-02-28 12:26:58 Times Seen14 Hash 92586154561c2477bb6c71d52d9a2574 d5b199e10dfc8052c8c7c98e15bdf80dc2d8bbdb 1d184864b519d4a32e00c054237527c2be2d3967033842c2207a06b42dcad1a1 Loading...

	fortisgarments.com/js/sax.js	1.1 kB	2023-03-14	2023-03-14
Pretty URL fortisgarments.com/js/sax.js IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-14 04:19:25 Last Seen2023-03-14 04:19:27 Times Seen1 Hash f7b4681efa1128d28fc555829406e1be 0e6722a142e7a9190895482ade870d58f35b890c 3e91b51ffae2c369ea1e676e7953c8707005151444e38d187e8980acbe4404bd Loading...

	fortisgarments.com/js/jquery.jclockNew.js.descarga	7.8 kB	2023-03-07	2024-04-06
Pretty URL fortisgarments.com/js/jquery.jclockNew.js.descarga IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-04-06 19:24:22 Times Seen325 Hash d5bd855b1a1ae610dab2f426107bc101 f3172d1d3ce6a90da44554d3c0d7bbc9910134a0 c6abf874d8228e1e37ece02cbd25c86ac1d64200331f7b91b085885eaa5e3074 Loading...

	fortisgarments.com/index.html	237 B	2023-03-07	2024-03-23
Pretty URL fortisgarments.com/index.html IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-03-23 05:05:31 Times Seen201 Hash 7785316f6352a0e08b0f360c47cc9517 3b1fd03d12263e5efe8e6cf660078eb525ca6d34 73533299d781797b91492e539cbf2b708fd88ea62d42d53b8538474aa5644bec Loading...

	fortisgarments.com/js/bootstrap.js.descarga	36 kB	2023-03-07	2024-04-06
Pretty URL fortisgarments.com/js/bootstrap.js.descarga IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-04-06 19:24:22 Times Seen245 Hash ac685232d37fd9ea8e5adec8ea2964e0 4a60cb8af1fc731ef2f578773ae67aaaac959a7f a678fbd5d6c7dbad7ec89b486ad1baf3323296c8dde801141955969fe5026a73 Loading...

	fortisgarments.com/index.html	355 B	2023-03-07	2023-06-27
Pretty URL fortisgarments.com/index.html IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2023-06-27 19:10:28 Times Seen10 Hash 3dca4fef79d87161ef8bddfd29650263 eef9331bcfeede07ac06a9693050b9a0e81d45b7 abdc7b22b4adfd1ed3f9a62a4e2106e8ec2a7dca6445e802602ebdcde11149cd Loading...

	fortisgarments.com/index.html	188 B	2023-03-07	2024-03-23
Pretty URL fortisgarments.com/index.html IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-03-23 05:05:31 Times Seen28 Hash 6f67e294309a4b771a3d55a8e3139352 bf9cbc0eb63fb189357c8f66dbd86f6fabfbd168 2fadce1cf2c7cd52f1ca3f8d1b2ce0ab7666a1df9b28e507eeedaaac0f93937d Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js	90 kB	2023-03-07	2024-04-25
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js IP 142.250.74.138 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-25 14:34:39 Times Seen139123 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	fortisgarments.com/js/jquery.validate-1.11.1.js.descarga	26 kB	2023-03-07	2024-04-06
Pretty URL fortisgarments.com/js/jquery.validate-1.11.1.js.descarga IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-04-06 19:24:22 Times Seen302 Hash ea15990a79091cfec6b371194c3d26dc a5790e56d3ea1fb17ccc4d069dbba0781b35f055 23df149b107329b3e406b0f70b5e1bdf2455f7f4ee4e90b00e0dbfcf773e98a1 Loading...

	fortisgarments.com/js/bluebird.min.js.descarga	80 kB	2023-03-07	2024-04-06
Pretty URL fortisgarments.com/js/bluebird.min.js.descarga IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-04-06 19:24:22 Times Seen352 Hash 5f381fc63d93a438adaca9c43041efb6 3d186ac6d244691754303d3153839bf42b57f7d1 fe5edd66777d896e48c3d3f6427ff48210727850ca9c870f7780d3a6d0da2b6d Loading...

	fortisgarments.com/index.html	172 B	2023-03-07	2024-03-23
Pretty URL fortisgarments.com/index.html IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-03-23 05:05:31 Times Seen15 Hash b02b158cdcc32c207676f9ec19edbdaf c7365a220afd3680fe577e4a9dbc667647e8e6d2 ab42fa3797709caaaab25a48bcae5714c7a9b7988d8516108c9afc51dd4b1149 Loading...

	fortisgarments.com/index.html	536 B	2023-03-07	2024-03-23
Pretty URL fortisgarments.com/index.html IP 202.4.96.3 ASN #23956 AmberIT Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:48 Last Seen2024-03-23 05:05:31 Times Seen15 Hash 28698056dc76c3cee5c4459aefbe36ab d78b00964739a00cec14db506876f5b5c4fee21f 408bdef6d8cf08023adadf987e517f52c2fc713383db4e1a527f14c235bb8f46 Loading...

HTTP Transactions (46)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ff01d28c7e4c50fb1a146b10670170a2
645b169d11cd047eec9bee5e63719104e3776540
715f77554399136f5c4da17a22be9112ca0ee75ceb8b0c5910a005f70e255e94

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "715F77554399136F5C4DA17A22BE9112CA0EE75CEB8B0C5910A005F70E255E94"
Last-Modified: Fri, 17 Feb 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5403
Expires: Sun, 19 Feb 2023 15:42:13 GMT
Date: Sun, 19 Feb 2023 14:12:10 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
4229cfe19d214d22153fe5833a7b557a
2439958496306a257d266050b4313b9bac51c871
ddfa83afe45b77b508119ac50488a73c3c49a78fa7a64ad983bd4958e0c7a4f9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DDFA83AFE45B77B508119AC50488A73C3C49A78FA7A64AD983BD4958E0C7A4F9"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4270
Expires: Sun, 19 Feb 2023 15:23:20 GMT
Date: Sun, 19 Feb 2023 14:12:10 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Content-Length, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 19 Feb 2023 13:53:30 GMT
content-type: application/json
age: 1120
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5539e12eac82ed8486057f67e18231d3
866778ccdac94dbeff9bc217d4a057079ee71b2a
d82a876ba46480f2caa20e2112941bfb461bdb03e882949b347abb9e8006705f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D82A876BA46480F2CAA20E2112941BFB461BDB03E882949B347ABB9E8006705F"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5289
Expires: Sun, 19 Feb 2023 15:40:19 GMT
Date: Sun, 19 Feb 2023 14:12:10 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: lrDlXQqcaW1/rzJCOymv/yCFyh2hYZM5E6AYqc1AmzlxuOc61X0d4eLoSQQ/y5uGPwH3FmF+M44=
x-amz-request-id: FGAHP0Y5MV3Y9EJZ
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
via: 1.1 google
date: Sun, 19 Feb 2023 13:51:21 GMT
age: 1249
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
content-length: 5348
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sun, 19 Feb 2023 14:12:10 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
b53bc403e0ab0570909b47c9976c4bc3
ac75251663f22d11671b8089f0b1d8d868844764
bd84b9ecba7b9a74d49c6d7a56df5e8a5d813bbd8dac93714d5b68f2de2181af

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 19 Feb 2023 14:12:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

142.250.74.138

200 OK

31 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
142.250.74.138:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (65451)
Size
31 kB (31021 bytes)
Hash
903bc7a7e510f87aa5d0201eb59a0832
ac9aa4dd94cde1bcba9037e94087138b127e41fc
41a7ac8150cc9f38421451d5143c1ffec7a1f1fafbf7a7fc0f51b98ad699cf8f

HTTP Headers

GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://fortisgarments.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 17 Feb 2023 14:18:52 GMT
expires: Sat, 17 Feb 2024 14:18:52 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 172398
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fortisgarments.com/index.html

202.4.96.3

200 OK

15 kB

URL HTTP/1.1
fortisgarments.com/index.html
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ISO-8859 text, with very long lines (411)
Size
15 kB (15187 bytes)
Hash
d267ea2c9f9a3a7eab0acac2cc63e18b
3753368090105800b4adbaa741fb02aafc42d687
133858aeb5e02c3a582f68833aa7a9d358423055ef10c0c2c229e7feb4ee2a9d

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /index.html HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:08 GMT
Server: Apache
Last-Modified: Tue, 09 Aug 2022 18:50:10 GMT
Accept-Ranges: bytes
Content-Length: 15187
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
b53bc403e0ab0570909b47c9976c4bc3
ac75251663f22d11671b8089f0b1d8d868844764
bd84b9ecba7b9a74d49c6d7a56df5e8a5d813bbd8dac93714d5b68f2de2181af

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 19 Feb 2023 14:12:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Content-Type, Alert, Content-Length, Backoff, ETag, Cache-Control, Retry-After, Last-Modified, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 19 Feb 2023 13:20:33 GMT
age: 3097
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

fortisgarments.com/js/sax.js

202.4.96.3

200 OK

1.1 kB

URL HTTP/1.1
fortisgarments.com/js/sax.js
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with CRLF line terminators
Size
1.1 kB (1056 bytes)
Hash
f7b4681efa1128d28fc555829406e1be
0e6722a142e7a9190895482ade870d58f35b890c
3e91b51ffae2c369ea1e676e7953c8707005151444e38d187e8980acbe4404bd

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious JS code
fortinet	Malware

HTTP Headers

GET /js/sax.js HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:08 GMT
Server: Apache
Last-Modified: Fri, 17 Feb 2023 03:26:06 GMT
Accept-Ranges: bytes
Content-Length: 1056
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ffe8651a83ebc937a53bf14c980c348e
8fe2f9219fbe52ee890533f94dd617da679050a4
96149e604ad1e11ab2b100b60e4605b7213f215b0a788506185def01954cb70f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "96149E604AD1E11AB2B100B60E4605B7213F215B0A788506185DEF01954CB70F"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5075
Expires: Sun, 19 Feb 2023 15:36:46 GMT
Date: Sun, 19 Feb 2023 14:12:11 GMT
Connection: keep-alive

fortisgarments.com/css/ui.css

202.4.96.3

200 OK

14 kB

URL HTTP/1.1
fortisgarments.com/css/ui.css
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text
Size
14 kB (13483 bytes)
Hash
fc4114c8fc5f70052eb79403116ba4c1
803d15f0eeb878417048c8fc28db4c53bec0f2ed
0265a31c7bea01a32328e09245aad8cf38ba3316a13e93080697b35e338f35b4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia

HTTP Headers

GET /css/ui.css HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:08 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:40 GMT
Accept-Ranges: bytes
Content-Length: 13483
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css

fortisgarments.com/js/jquery.validate-1.11.1.js.descarga

202.4.96.3

200 OK

26 kB

URL HTTP/1.1
fortisgarments.com/js/jquery.validate-1.11.1.js.descarga
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with very long lines (2795)
Size
26 kB (26459 bytes)
Hash
ea15990a79091cfec6b371194c3d26dc
a5790e56d3ea1fb17ccc4d069dbba0781b35f055
23df149b107329b3e406b0f70b5e1bdf2455f7f4ee4e90b00e0dbfcf773e98a1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /js/jquery.validate-1.11.1.js.descarga HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:08 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:40 GMT
Accept-Ranges: bytes
Content-Length: 26459
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

push.services.mozilla.com/

54.202.200.61

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.202.200.61:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: dX255+L5jjcDKN60slVAtg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: koiKfBBg6I3SGnG7ze7VL9ySj5k=

fortisgarments.com/css/styles.css

202.4.96.3

200 OK

107 kB

URL HTTP/1.1
fortisgarments.com/css/styles.css
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with very long lines (360)
Size
107 kB (107183 bytes)
Hash
6294f17112e15fd32e7de5b41c38d820
395091333aa8b811e38558065dffe38c8ae89455
e7d6f96db1d2dc802487291efac1742134517cdf56a7121ab0dd38dbe3a2195d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia

HTTP Headers

GET /css/styles.css HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:08 GMT
Server: Apache
Last-Modified: Sun, 07 Aug 2022 11:22:02 GMT
Accept-Ranges: bytes
Content-Length: 107183
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

fortisgarments.com/js/bluebird.min.js.descarga

202.4.96.3

200 OK

80 kB

URL HTTP/1.1
fortisgarments.com/js/bluebird.min.js.descarga
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with very long lines (32137), with escape sequences
Size
80 kB (79546 bytes)
Hash
5f381fc63d93a438adaca9c43041efb6
3d186ac6d244691754303d3153839bf42b57f7d1
fe5edd66777d896e48c3d3f6427ff48210727850ca9c870f7780d3a6d0da2b6d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /js/bluebird.min.js.descarga HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:08 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:40 GMT
Accept-Ranges: bytes
Content-Length: 79546
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

fortisgarments.com/css/jquery-ui.css

202.4.96.3

200 OK

32 kB

URL HTTP/1.1
fortisgarments.com/css/jquery-ui.css
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with very long lines (1363)
Size
32 kB (31880 bytes)
Hash
2b936d08a6d742e862a089716f02d90d
6afd4058ec593fbca3c56a423c24a3c47eb87171
c9eeb55f7cf16683b871600ce998b61b1031629097be96069d5741f33adaf6d1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia

HTTP Headers

GET /css/jquery-ui.css HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:09 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:40 GMT
Accept-Ranges: bytes
Content-Length: 31880
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

fortisgarments.com/js/jquery.jclockNew.js.descarga

202.4.96.3

200 OK

7.8 kB

URL HTTP/1.1
fortisgarments.com/js/jquery.jclockNew.js.descarga
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text
Size
7.8 kB (7794 bytes)
Hash
d5bd855b1a1ae610dab2f426107bc101
f3172d1d3ce6a90da44554d3c0d7bbc9910134a0
c6abf874d8228e1e37ece02cbd25c86ac1d64200331f7b91b085885eaa5e3074

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /js/jquery.jclockNew.js.descarga HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:09 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:42 GMT
Accept-Ranges: bytes
Content-Length: 7794
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript

fortisgarments.com/css/bootstrap.css

202.4.96.3

200 OK

121 kB

URL HTTP/1.1
fortisgarments.com/css/bootstrap.css
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
assembler source, ASCII text, with very long lines (540)
Size
121 kB (121294 bytes)
Hash
7fd1c4d3b601350f212dfa209134f45c
06a81c158674832ff7b0a377f83d48360a6c3dcf
40bbcf961798bbca588379db5479b0f1ca48f252e37c7b1c255736849859eb9a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia

HTTP Headers

GET /css/bootstrap.css HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:09 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2022 08:44:24 GMT
Accept-Ranges: bytes
Content-Length: 121294
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

fortisgarments.com/js/jquery-1.10.1.js.descarga

202.4.96.3

200 OK

146 kB

URL HTTP/1.1
fortisgarments.com/js/jquery-1.10.1.js.descarga
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with very long lines (1618)
Size
146 kB (145858 bytes)
Hash
43ab7751f1e8455471908c97a5977a6a
84ac89e3f5529b2a8f45032bd421d192b6b466ed
751bcbcd434089a9b12e9339a1891607ee99659ae3a674a6709e9a74dab21cd1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /js/jquery-1.10.1.js.descarga HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:09 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:40 GMT
Accept-Ranges: bytes
Content-Length: 145858
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

fortisgarments.com/js/jquery-ui.js.descarga

202.4.96.3

200 OK

228 kB

URL HTTP/1.1
fortisgarments.com/js/jquery-ui.js.descarga
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with very long lines (32555)
Size
228 kB (228478 bytes)
Hash
12a65fcb49c314e8dbbcf8d090d26b8a
679dc5cc110ee2c7b083cf52541544c01efea018
8072615124c5bc2634fdecc09485c8b645c78ea27c212c3d61b80c26112bdcb8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /js/jquery-ui.js.descarga HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:08 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:40 GMT
Accept-Ranges: bytes
Content-Length: 228478
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5b1775b8f4f9ebbac7a1572afa4e4f92
7c7c748730a9422b0f5f9bcdde36a91c9639c595
a1685273829a7672a3fa089525b959f1f95f11c0a5c0d09fbbf1f4667b3f7946

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A1685273829A7672A3FA089525B959F1F95F11C0A5C0D09FBBF1F4667B3F7946"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8017
Expires: Sun, 19 Feb 2023 16:25:49 GMT
Date: Sun, 19 Feb 2023 14:12:12 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5b1775b8f4f9ebbac7a1572afa4e4f92
7c7c748730a9422b0f5f9bcdde36a91c9639c595
a1685273829a7672a3fa089525b959f1f95f11c0a5c0d09fbbf1f4667b3f7946

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A1685273829A7672A3FA089525B959F1F95F11C0A5C0D09FBBF1F4667B3F7946"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8017
Expires: Sun, 19 Feb 2023 16:25:49 GMT
Date: Sun, 19 Feb 2023 14:12:12 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5b1775b8f4f9ebbac7a1572afa4e4f92
7c7c748730a9422b0f5f9bcdde36a91c9639c595
a1685273829a7672a3fa089525b959f1f95f11c0a5c0d09fbbf1f4667b3f7946

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A1685273829A7672A3FA089525B959F1F95F11C0A5C0D09FBBF1F4667B3F7946"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8017
Expires: Sun, 19 Feb 2023 16:25:49 GMT
Date: Sun, 19 Feb 2023 14:12:12 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc871eb2d-7988-403d-be39-e2b0932eaede.jpeg

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc871eb2d-7988-403d-be39-e2b0932eaede.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11384 bytes)
Hash
725d5875c48c8b014d7f55324a6e894f
ebac057ff8a8ad7c097369f0aa2f8cacd8cae06b
103f91934102ac9deb0448de1b2044acba3fc3c1599e460c0f54920958e66f0a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc871eb2d-7988-403d-be39-e2b0932eaede.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11384
x-amzn-requestid: a8e08458-da0d-47f6-a521-358b36fe922b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AjfUjEt6IAMFsIQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63f145b6-49a56fa82e5aadfa03b6e022;Sampled=0
x-amzn-remapped-date: Sat, 18 Feb 2023 21:40:06 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: OTuRrRbRrMyR4VZhRxS27f914iOjYOEwaw2CyEC7Aw3_a1qFkMM7xA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Sat, 18 Feb 2023 21:53:52 GMT
etag: "ebac057ff8a8ad7c097369f0aa2f8cacd8cae06b"
content-type: image/jpeg
age: 58700
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881c24a9-07ee-4126-b2c3-501b0461ee5e.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.9 kB (6879 bytes)
Hash
9c5a0bab7d34e51ee6476be179b356ba
87917d3cf520d73b7b1029f44505e7700413d51d
136e727a99409218318247b645558fad485ed84bcd90bd43a5895492cb317d89

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881c24a9-07ee-4126-b2c3-501b0461ee5e.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6879
x-amzn-requestid: 18c46562-f8d9-4f7f-8ea0-1bb46e206f80
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ANnahEWgIAMFwYg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e885dc-50a7cfe4693b4efb038ce1a7;Sampled=0
x-amzn-remapped-date: Sun, 12 Feb 2023 06:23:24 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: K3teFfj79RPIRVaLUr5b2XMz3Jb5g8AeZCce6ZAAZmjOSJWr1QIsNw==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 18 Feb 2023 15:50:17 GMT
age: 80515
etag: "87917d3cf520d73b7b1029f44505e7700413d51d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f46c7b5-bf76-45bb-8341-3eb14d69822e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.1 kB (8094 bytes)
Hash
35b6416a1ce02ea0952e67b87a2e744d
0d21f4f4f51aa9dfa898c56cf7f38bcd7839cf5a
7b2a6446465642266d346d63ad0f6e4219463ec26b2cc12e4e9843b7420d7e95

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f46c7b5-bf76-45bb-8341-3eb14d69822e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8094
x-amzn-requestid: ce94ceab-e8b5-465c-a2a8-b003594c6e39
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AeMxQEHSoAMFe4A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ef2807-293e85e973e8cf512a7ccacb;Sampled=0
x-amzn-remapped-date: Fri, 17 Feb 2023 07:08:55 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 4XxdiGXIDIGaVFC8Ek_gEWGhDHHiKyV6ayZSqdR_wUGcPSgAMDh9TA==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Sun, 19 Feb 2023 07:30:59 GMT
age: 24073
etag: "0d21f4f4f51aa9dfa898c56cf7f38bcd7839cf5a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1d1f60f1-fa69-4ceb-abb9-bdff2dd82a50.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.9 kB (9860 bytes)
Hash
5bf00b47fcc57f6864df6b47d78dee9b
7e66d461e9e66896f682e88c6fdb14a61e49c38d
85c33b8534790bd6f99f96a7286f590f5a33c7a9098f1c6c5970f651aece02cb

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1d1f60f1-fa69-4ceb-abb9-bdff2dd82a50.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9860
x-amzn-requestid: 1c6f1879-14cf-4557-96a9-1c17c7e6c1aa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ANttcHNZIAMFUTA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e88fef-2b334315137348a90e1c0e54;Sampled=0
x-amzn-remapped-date: Sun, 12 Feb 2023 07:06:23 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: MriWSn4CutphTF2nc3LxrQvbHak2BaY4KZBL8ykATXQN4er7MjOb0w==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Sat, 18 Feb 2023 16:36:15 GMT
age: 77757
etag: "7e66d461e9e66896f682e88c6fdb14a61e49c38d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F58cf2ecf-2995-41f9-b2f6-6c7a81ec46a6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.1 kB (3096 bytes)
Hash
674832720ab6807aebe8d120eab3aa8b
480e09afd965891eb163ac812c22e7124ed1bb0f
1dcad65a0189abe50368ecc1056762d1957250d5e1dded8f1f10bf07322ba9ca

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F58cf2ecf-2995-41f9-b2f6-6c7a81ec46a6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3096
x-amzn-requestid: 7c0b5600-ee03-4dba-b18e-e323968d6094
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AXl72GLgoAMFXMQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ec837e-75f7d8196bdbbd3e52eb0003;Sampled=0
x-amzn-remapped-date: Wed, 15 Feb 2023 07:02:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: xIL7sMUQ8nk70ci2ilgCt3CqJatBSdtNS0-GEabZL9MZGFwTaOTP7Q==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 18 Feb 2023 22:59:17 GMT
age: 54775
etag: "480e09afd965891eb163ac812c22e7124ed1bb0f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f08137c-036d-495e-8806-ea2813f0c6b9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8351 bytes)
Hash
5b1573a58278ff85689704e2322606fa
b9850e9ff1801069645f59d6cc8612ea4069186e
c9791366dc55e24124c696544f8fe4fcdee17e0c5a0971c9dbf8c248a7d10ab6

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f08137c-036d-495e-8806-ea2813f0c6b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8351
x-amzn-requestid: f95f5bf3-07a3-4bcb-a51e-ab563b69092d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AdoboEhtoAMFYsQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63eeede3-386836391408d1117d0f7a43;Sampled=0
x-amzn-remapped-date: Fri, 17 Feb 2023 03:00:51 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tmkCikaQTQI258qNQZfp0OWNnUkyd7bxGfYUmPfX0AQuUCKRwbez2g==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Sun, 19 Feb 2023 03:21:35 GMT
age: 39037
etag: "b9850e9ff1801069645f59d6cc8612ea4069186e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

fortisgarments.com/js/bootstrap.js.descarga

202.4.96.3

200 OK

36 kB

URL HTTP/1.1
fortisgarments.com/js/bootstrap.js.descarga
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
ASCII text, with very long lines (415)
Size
36 kB (36250 bytes)
Hash
ac685232d37fd9ea8e5adec8ea2964e0
4a60cb8af1fc731ef2f578773ae67aaaac959a7f
a678fbd5d6c7dbad7ec89b486ad1baf3323296c8dde801141955969fe5026a73

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /js/bootstrap.js.descarga HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:09 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:40 GMT
Accept-Ranges: bytes
Content-Length: 36250
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

fortisgarments.com/img/icon-user.png

202.4.96.3

200 OK

447 B

URL HTTP/1.1
fortisgarments.com/img/icon-user.png
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced\012- data
Size
447 B (447 bytes)
Hash
0e3457ed5ea858d1e9287ef66dcbbfe4
006c99b62e141ebbc69f6e06cab757995d3f7417
75d5b455151a3b1a0a5b100041fee37de2daa0b41d1d177deaa863177c5b5b83

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia

HTTP Headers

GET /img/icon-user.png HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/css/styles.css

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:10 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2022 08:33:24 GMT
Accept-Ranges: bytes
Content-Length: 447
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

fortisgarments.com/login_SVP_BC_zonaA.html

202.4.96.3

200 OK

249 B

URL HTTP/1.1
fortisgarments.com/login_SVP_BC_zonaA.html
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
249 B (249 bytes)
Hash
d0a1f34c3f8293fad9b7e17979426429
a5103466544c36f3afea8c76d10a332f54c9d217
9e9d9a915dbcbc56387a8cccd4e33a8b52ab110d1d3c5e91b194aadaff9b88e8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /login_SVP_BC_zonaA.html HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:10 GMT
Server: Apache
Last-Modified: Sun, 07 Aug 2022 11:12:10 GMT
Accept-Ranges: bytes
Content-Length: 249
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

fortisgarments.com/img/logo.svg

202.4.96.3

200 OK

7.0 kB

URL HTTP/1.1
fortisgarments.com/img/logo.svg
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (667)
Size
7.0 kB (7020 bytes)
Hash
c049dccd21049cb237daabdb645ec648
e29af3f65a8312efd3ea4c3b66d4bd86657dde1b
2c7a6ea74a49a6adc3fad622078895e9b2589448214913d8c035764148aca7d0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /img/logo.svg HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/css/styles.css

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:10 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2022 08:33:16 GMT
Accept-Ranges: bytes
Content-Length: 7020
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

fortisgarments.com/css/icon_font_bc.ttf?61jkgi

202.4.96.3

200 OK

32 kB

URL HTTP/1.1
fortisgarments.com/css/icon_font_bc.ttf?61jkgi
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
TrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, icon_font_bc\012- data
Size
32 kB (31976 bytes)
Hash
8c9559a3d94688605d1d5e1cf68d5ae0
5c2b8fb865aefcc42f119542faa12bcaeaefbb3a
ad0f43b7fd52d2f1574ba930c85ce401f95d69e21ad997ffe8e7ad98fec2ffda

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /css/icon_font_bc.ttf?61jkgi HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/css/styles.css

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:10 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2022 08:32:56 GMT
Accept-Ranges: bytes
Content-Length: 31976
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: font/ttf

fortisgarments.com/css/CIBFontSans-Light.ttf

202.4.96.3

200 OK

111 kB

URL HTTP/1.1
fortisgarments.com/css/CIBFontSans-Light.ttf
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
TrueType Font data, digitally signed, 18 tables, 1st "DSIG", 33 names, Macintosh, Copyright (c) 2019 by Vasava Studio. All rights reserved.\011CIBFont SansLight1.300;UKWN;CIBFont\012- data
Size
111 kB (110612 bytes)
Hash
69096387df83ff65381f8ee25006b0aa
89689ed7f7547a3815d9fa2d0a2c11513480086e
decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /css/CIBFontSans-Light.ttf HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/css/styles.css

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:10 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2022 08:33:04 GMT
Accept-Ranges: bytes
Content-Length: 110612
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/ttf

fortisgarments.com/img/imgPublicidad.png

202.4.96.3

200 OK

48 kB

URL HTTP/1.1
fortisgarments.com/img/imgPublicidad.png
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
PNG image data, 627 x 327, 8-bit colormap, non-interlaced\012- data
Size
48 kB (48266 bytes)
Hash
855d465dd78b97b629cb716e2249b0af
32839205ed2ec2901b5a0ebcc6560774ad10114d
d02b76ee6198664bc9217a1bd9e08541a05ff4ce35509c1b15130c84bd391edd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia

HTTP Headers

GET /img/imgPublicidad.png HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/login_SVP_BC_zonaA.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:10 GMT
Server: Apache
Last-Modified: Mon, 01 Aug 2022 13:34:42 GMT
Accept-Ranges: bytes
Content-Length: 48266
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e914953e4da6e16b08aef37bfb19d6b7
55574c983a0a94982698eafe842febeb7162595c
31e58039939d9d224a1c3158384e4611e810e5c090aa06c4bc5c81f967aba191

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "31E58039939D9D224A1C3158384E4611E810E5C090AA06C4BC5C81F967ABA191"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8249
Expires: Sun, 19 Feb 2023 16:29:42 GMT
Date: Sun, 19 Feb 2023 14:12:13 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e914953e4da6e16b08aef37bfb19d6b7
55574c983a0a94982698eafe842febeb7162595c
31e58039939d9d224a1c3158384e4611e810e5c090aa06c4bc5c81f967aba191

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "31E58039939D9D224A1C3158384E4611E810E5C090AA06C4BC5C81F967ABA191"
Last-Modified: Fri, 17 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8249
Expires: Sun, 19 Feb 2023 16:29:42 GMT
Date: Sun, 19 Feb 2023 14:12:13 GMT
Connection: keep-alive

fortisgarments.com/css/OpenSans-Regular.ttf

202.4.96.3

200 OK

217 kB

URL HTTP/1.1
fortisgarments.com/css/OpenSans-Regular.ttf
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansRegular1.10;1ASC;OpenSans-R\012- data
Size
217 kB (217276 bytes)
Hash
d7d5d4588a9f50c99264bc12e4892a7c
513966e260bb7610d47b2329dba194143831893e
13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia
fortinet	Malware

HTTP Headers

GET /css/OpenSans-Regular.ttf HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/css/styles.css

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:10 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2022 08:33:08 GMT
Accept-Ranges: bytes
Content-Length: 217276
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/ttf

fortisgarments.com/img/favicon.ico

202.4.96.3

200 OK

4.3 kB

URL HTTP/1.1
fortisgarments.com/img/favicon.ico
IP
202.4.96.3:0
ASN
#23956 AmberIT Limited

File type
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel\012- data
Size
4.3 kB (4286 bytes)
Hash
ffa4717e6a1e77411c637682fafb79d2
05bdd644d747fedee3bf37fe38facd6a66263468
a7e42a9339ffbd5cad9f2d63bbd050fc3c518219117b7852153c165e246eb406

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bancolombia
urlquery	phishing	Phishing - Bancolombia

HTTP Headers

GET /img/favicon.ico HTTP/1.1
Host: fortisgarments.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fortisgarments.com/index.html

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:11 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2022 08:36:40 GMT
Accept-Ranges: bytes
Content-Length: 4286
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/x-icon

ocsp.sectigo.com/

104.18.32.68

200 OK

471 B

URL HTTP/1.1
ocsp.sectigo.com/
IP
104.18.32.68:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
471 B (471 bytes)
Hash
771f08ed72a3b2115a94c4db8a26b194
696637d0a82597271be9d3bc3ead57626cb5d829
0151739a23cad257ef19c6091929f1a4e6d7da9380e8004b83c3003dddbffd15

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 19 Feb 2023 14:12:13 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sat, 18 Feb 2023 23:45:28 GMT
Expires: Sat, 25 Feb 2023 23:45:27 GMT
Etag: "696637d0a82597271be9d3bc3ead57626cb5d829"
Cache-Control: max-age=552193,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 79bf98a249a2b505-OSL

api.ipify.org/?format=json

104.237.62.211

200 OK

21 B

URL HTTP/2
api.ipify.org/?format=json
IP
104.237.62.211:0
ASN
#18450 WEBNX

File type
JSON data\012- , ASCII text, with no line terminators
Size
21 B (21 bytes)
Hash
7d69c71af0f191e9a72db6153f8018d1
f67c5f2887bc05654b47f76e9621e53a4091aed1
5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65

HTTP Headers

GET /?format=json HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://fortisgarments.com
Connection: keep-alive
Referer: http://fortisgarments.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: http://fortisgarments.com
content-type: application/json
date: Sun, 19 Feb 2023 14:12:13 GMT
vary: Origin
content-length: 21
X-Firefox-Spdy: h2

ipinfo.io/

34.117.59.81

200 OK

0 B

URL HTTP/2
ipinfo.io/
IP
34.117.59.81:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET / HTTP/1.1
Host: ipinfo.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://fortisgarments.com
Connection: keep-alive
Referer: http://fortisgarments.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-type: application/json; charset=utf-8
date: Sun, 19 Feb 2023 14:12:13 GMT
x-envoy-upstream-service-time: 1
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (15)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML