Report - indloguass.pages.dev/

Report Overview

Submitted URL
indloguass.pages.dev/
IP
172.66.47.70
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-20 05:29:54
Access
public
Website Title
Ѕіցո Οո tο Υοսr Сіtі Αссοսոt - Ꮯіtіbаոk
Final URL
indloguass.pages.dev/
Tags
citi financial phishing
urlquery detections
Phishing - Citi

Detections

urlquery
12
Network Intrusion Detection
0
Threat Detection Systems
84

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
indloguass.pages.dev	unknown	2020-09-02	2024-04-08	2024-04-18	10 kB	3.4 MB	172.66.47.70
www.citi.com	26692	1998-12-29	2012-06-25	2024-04-11	1.7 kB	229 kB	104.110.24.232

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.
2024-04-19	medium	indloguass.pages.dev/	Citigroup Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed
2024-04-20	medium	indloguass.pages.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (24)

URL IP Response Size

indloguass.pages.dev/images/citilogoredesign.png

172.66.47.70

200 OK

1.8 kB

URL GET HTTP/3
indloguass.pages.dev/images/citilogoredesign.png
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
PNG image data, 89 x 89, 8-bit/color RGBA, non-interlaced
Size
1.8 kB (1799 bytes)
Hash
b8c9db53b866a0120618cd396e1513f1
5cfe9732c78e4eb7365681834cdd682b977a0232
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/citilogoredesign.png HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/png
content-length: 1799
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "103c4ab7cc885ff97432791c46c64109"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yGQOGPdjL2Sx8jPBE10hiV%2BauB6Uyul5k8cr9aG8k%2Bg4aekkyZ8M4DJY1XKe4jT9f8FXuIaUZHlTwlQEP7iumZiNEZBpR6rR7nRJDAh96v%2FfcuLNqyS6TTnT2gul3AlUlNpsnKtlmw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca55bbc569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/css/styles.7083615ebe6cea4aa24b.css

172.66.47.70

200 OK

44 B

URL GET HTTP/3
indloguass.pages.dev/css/styles.7083615ebe6cea4aa24b.css
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
HTML document, ASCII text, with no line terminators
Size
44 B (44 bytes)
Hash
bbf7496b50a6f6ddaa9a8c733cb6f07d
aaa63fee59ff8e69ba5948ef78d11ded29e8fc83
b1727c1b9c1b66ed8410c007ddc73f7c169118d56af71ea1200b357706fbcbc7

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/styles.7083615ebe6cea4aa24b.css HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/css; charset=utf-8
content-length: 44
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "86254074c7cacf67f564f81e4519a31d"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hu2mjjrAFBRJTE6lS%2FMzLSWIsLThYw63r1Zib1tGQYCbkG6izIB0vsqs3SV0lV5nb2DaGrAQZoEH71pRxEhQKBLTYUilEL9bcy%2BhUBOxjYJeN9e5IR7ASUkg3cDZbqMr0vWsrgvPBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca54bb6569f-OSL
alt-svc: h3=":443"; ma=86400

www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff

104.110.24.232

200 OK

79 kB

URL GET HTTP/2
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff
IP
104.110.24.232:443
ASN
#16625 AKAMAI-AS

Requested by
https://indloguass.pages.dev/
Certificate
IssuerDigiCert Inc
Subjectwww.citi.com
Fingerprint7B:97:41:ED:8C:0E:70:DA:7E:FF:FC:93:66:2A:DF:E0:12:35:0A:00
ValidityTue, 07 Nov 2023 00:00:00 GMT - Thu, 05 Dec 2024 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 78762, version 1.197
Size
79 kB (78762 bytes)
Hash
b1f3eca7de0c2cb35740f32dd0b83823
dffc474081c23fc151265b637a4468e82004ecc8
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

HTTP Headers

GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff HTTP/1.1
Host: www.citi.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
Origin: https://indloguass.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: font/woff
content-length: 78762
accept-ranges: bytes
access-control-max-age: 2147483647
dclocation: GT1DMS
etag: W/"133aa-18edb4cb448"
last-modified: Sun, 14 Apr 2024 06:30:21 GMT
nonce: 1728229139968968
referrer-policy: no-referrer
scope: VISITOR
sid: 593074fd-e5f3-454f-bce5-b5a8ecbe1f92
uuid: 89b5701d-fe9d-4eaa-af25-1da21ad2bbd6
x-content-type-options: nosniff
x-vcap-request-id: 0ed2a129-a668-495b-5fa4-be7f6dd37c17
x-xss-protection: 1 ; mode=block
x-akamai-citisite: GTDC
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, no-transform, max-age=21600
expires: Sat, 20 Apr 2024 11:29:29 GMT
date: Sat, 20 Apr 2024 05:29:29 GMT
set-cookie: AKMTLTSID=51EC4DCC804E4B5E4302837A04D7C642; path=/; domain=citi.com; secure
access-control-allow-credentials: true
access-control-allow-origin: https://citimobile.citibankonline.com
X-Firefox-Spdy: h2

www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff

104.110.24.232

200 OK

76 kB

URL GET HTTP/2
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
IP
104.110.24.232:443
ASN
#16625 AKAMAI-AS

Requested by
https://indloguass.pages.dev/
Certificate
IssuerDigiCert Inc
Subjectwww.citi.com
Fingerprint7B:97:41:ED:8C:0E:70:DA:7E:FF:FC:93:66:2A:DF:E0:12:35:0A:00
ValidityTue, 07 Nov 2023 00:00:00 GMT - Thu, 05 Dec 2024 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 75538, version 1.197
Size
76 kB (75538 bytes)
Hash
3d1d3153b04b6ce8a33a20f60df9d723
60e91c7766bdc415134c1111a283ffed3749dbae
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

HTTP Headers

GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff HTTP/1.1
Host: www.citi.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
Origin: https://indloguass.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: font/woff
content-length: 75538
accept-ranges: bytes
access-control-max-age: 2147483647
dclocation: GT1DMS
etag: W/"12712-18edb4cb448"
last-modified: Sun, 14 Apr 2024 06:30:21 GMT
nonce: 9526234751594647
referrer-policy: no-referrer
scope: VISITOR
sid: 56480792-9eb7-44c7-a01a-dfa6d70776f3
uuid: e9b63be3-f7a0-41ad-b2d2-05990958d720
x-content-type-options: nosniff
x-vcap-request-id: 5479f767-1a6a-453c-5b2e-995c1f752a44
x-xss-protection: 1 ; mode=block
x-akamai-citisite: GTDC
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, no-transform, max-age=21600
expires: Sat, 20 Apr 2024 11:29:29 GMT
date: Sat, 20 Apr 2024 05:29:29 GMT
set-cookie: AKMTLTSID=3C4312B1CFBD7750B48B8AA7128D0C5F; path=/; domain=citi.com; secure
access-control-allow-credentials: true
access-control-allow-origin: https://citimobile.citibankonline.com
X-Firefox-Spdy: h2

www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff

104.110.24.232

200 OK

72 kB

URL GET HTTP/2
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
IP
104.110.24.232:443
ASN
#16625 AKAMAI-AS

Requested by
https://indloguass.pages.dev/
Certificate
IssuerDigiCert Inc
Subjectwww.citi.com
Fingerprint7B:97:41:ED:8C:0E:70:DA:7E:FF:FC:93:66:2A:DF:E0:12:35:0A:00
ValidityTue, 07 Nov 2023 00:00:00 GMT - Thu, 05 Dec 2024 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 71874, version 1.197
Size
72 kB (71874 bytes)
Hash
9fd45584370dd1c58e1ed9050efb925f
7b41085678166c62e23e8cf3c8c9ab13e13c356d
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

HTTP Headers

GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff HTTP/1.1
Host: www.citi.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
Origin: https://indloguass.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: font/woff
content-length: 71874
accept-ranges: bytes
access-control-max-age: 2147483647
dclocation: GT1DMS
etag: W/"118c2-18edb4cb448"
last-modified: Sun, 14 Apr 2024 06:30:21 GMT
nonce: 8076603523699309
referrer-policy: no-referrer
scope: VISITOR
sid: 5954d4b3-f5de-474c-a04d-ec8079e2fea9
uuid: 72bcbe9f-c54a-4125-a8bd-778bf4b37fcc
x-content-type-options: nosniff
x-vcap-request-id: 709e31da-fa15-477d-4e21-466fbff50e67
x-xss-protection: 1 ; mode=block
x-akamai-citisite: GTDC
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, no-transform, max-age=21600
expires: Sat, 20 Apr 2024 11:29:29 GMT
date: Sat, 20 Apr 2024 05:29:29 GMT
set-cookie: AKMTLTSID=51EC4DCC804E4B5E4302837A04D7C642; path=/; domain=citi.com; secure
access-control-allow-credentials: true
access-control-allow-origin: https://citimobile.citibankonline.com
X-Firefox-Spdy: h2

indloguass.pages.dev/images/LSO_4959.jpg

172.66.47.70

200 OK

175 kB

URL GET HTTP/3
indloguass.pages.dev/images/LSO_4959.jpg
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2160x600, components 3
Size
175 kB (174933 bytes)
Hash
4c50aaf00ec3fd89b59019568e3ce376
e67b56776d6f8bcfbc25c6d31cfea22dc234f58e
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/LSO_4959.jpg HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/jpeg
content-length: 174933
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "e09e73384a2525a34bbcf3ac26e2bbfa"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5p1GJaNPdlugt08VLk7%2Ba6pe0b6GZxgCOtgU%2FAcSEnNf6%2B6I5sfvsa5oLUZlp%2FoSu6wECkE8rV7O%2FC9I%2BAZUYkdgx3ilrbJqDv4fc9jRBDQESrdj9Q%2BQQ6FcX1XdwKACxg6n9s1psw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca89d95569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff

172.66.47.70

200 OK

263 kB

URL GET HTTP/3
indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (57035)
Size
263 kB (262947 bytes)
Hash
a1e383d1905a304be577f70328439b66
e4452d5e3e955cb45cc21cd82f9646d9b6b28de1
e957134d2a178beb618c849e5ed3b27eabc4681de53c72d9cb46b25f44ad90f1

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/html; charset=utf-8
content-length: 262947
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "002e058f63983d06b82cb1fa8ce814a3"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tn7Nb5UkS74Aqayac0Vxuaz8R%2FpqhmPf3A7%2BzEAmFcluVY2MuVkB4cTdgEzWjZa8GbnJv9fjg5S%2B3IYHq6K3io4CuNFT7UIfEHH6orXUdAIJBPQdOn0aYWffmpsn5%2FHQvz%2BvVZ0wGw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca89d96569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/images/Citi-Branding-Sprite.png

172.66.47.70

200 OK

5.0 kB

URL GET HTTP/3
indloguass.pages.dev/images/Citi-Branding-Sprite.png
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
PNG image data, 140 x 349, 8-bit colormap, non-interlaced
Size
5.0 kB (4952 bytes)
Hash
eec8cbc4608427f66f2c1e5a74911748
8cd18d8ece8c75fa4821cdbf1edcb8d15d785ad1
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/Citi-Branding-Sprite.png HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/png
content-length: 4952
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "75bacf103b80c0472b779ae5a58deb8e"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fgqM0M9%2FaKwSEQeH9P%2BBadfPM1hI94jVxOW4xf%2FOdE9Ajmdqy3q5j%2Fz5a58ICuFRSAe%2BW5U0Hqk%2FtPigJjQgotjBfU6Bp55im%2FCf3LTaBpApCOxWviHnB5%2F%2FRjbnvktytqXtXnI0cg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca8ada4569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/images/Appstore-Googleplay-JDPower-Sprite.png

172.66.47.70

200 OK

45 kB

URL GET HTTP/3
indloguass.pages.dev/images/Appstore-Googleplay-JDPower-Sprite.png
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
PNG image data, 120 x 203, 8-bit/color RGBA, interlaced
Size
45 kB (44996 bytes)
Hash
7be7c9b6b21cee4ae9dffb234765a60e
ec853bb38a24a01498cff42a8ef53d8707b39cb0
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/Appstore-Googleplay-JDPower-Sprite.png HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/png
content-length: 44996
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "168b670c2045a8d9f247cac5de47dba1"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AtGN8EG13DvmYcBLCi1HZDjhrbOJ5XvhqIY5w6p8JC79FtGH3OKQ5%2F5u9H1j4T5xtiOF6ZpD0uDQVNUr8WWmiTXgzTKCAsAwqsKDOfgrOqN6m6hCidfpjLCwIjB5Xi%2BLnsVOKIEwLw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca8ada7569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/images/social-media_facebook%403x.png

172.66.47.70

200 OK

445 B

URL GET HTTP/3
indloguass.pages.dev/images/social-media_facebook%403x.png
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
PNG image data, 27 x 48, 8-bit/color RGBA, non-interlaced
Size
445 B (445 bytes)
Hash
1f627e41e84a3b87f57c9de2e3a722d0
a7d350d9d267149f60b46a454f021920f89df877
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/social-media_facebook%403x.png HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/png
content-length: 445
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "806ee369567dcae299cb46f0fbbe9db0"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q9mu36ANr182lOe9NcNycVlV1TXVb9XWYTgCmCBQaHm00S%2Fu4uRihq2QIZvTyBgs6TXQJOsi4%2FxkK%2BSzWYA0MlJ7Lhfb3LjPGqjMZTr3iqSPPRPuKSk7qSfRBfljNA%2BP%2FGbdDlcHKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca8ada8569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/images/social-media_twitter%403x.png

172.66.47.70

200 OK

1.3 kB

URL GET HTTP/3
indloguass.pages.dev/images/social-media_twitter%403x.png
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
PNG image data, 66 x 48, 8-bit/color RGBA, non-interlaced
Size
1.3 kB (1277 bytes)
Hash
60b0fec951727b4762fabc2570a1317f
56f9ed9699233f4cef1317a9a2c83179070b5e8a
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/social-media_twitter%403x.png HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/png
content-length: 1277
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "b4d35665d6de0909e6dd6e9efa62d8df"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JA75jXhJRs8AY8%2F9ayiuWr2i5BjKm9HAfYILqoL%2BgNNH5Lb8tC6HyE4D82IKr67ha9NQXQYX0GWSxd%2FWnd3VMKzMyza4mAZ2YXdbbt4ynPjxUcIbF9eU6BlCJHyMhMlfuigTaGbI%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca8ada9569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/images/social-media_youtube%403x.png

172.66.47.70

200 OK

1.2 kB

URL GET HTTP/3
indloguass.pages.dev/images/social-media_youtube%403x.png
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
PNG image data, 72 x 48, 8-bit/color RGBA, non-interlaced
Size
1.2 kB (1175 bytes)
Hash
3541c5442b1b90b4efe20ab4b2802323
ad778d35efc7b9950d2158d800b61966204b75d8
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/social-media_youtube%403x.png HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/png
content-length: 1175
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "9322ea3f9821759d0bcb9db0d56011ce"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sCql1HeNwdSQ00Or2CReKXfFD%2B1AshYjuYufpFAv4DBctPqWfBP0sGK%2B0ji%2BeL7TeqHSapy2BC%2FNGfeH3t5C%2FyI%2FrEyamBukWYy5aBV%2BVBYT0lG%2BTjbf%2FYVBL4ZN8W3kVWA9BsEuZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca8bdac569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff

172.66.47.70

200 OK

263 kB

URL GET HTTP/3
indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (57035)
Size
263 kB (262947 bytes)
Hash
a1e383d1905a304be577f70328439b66
e4452d5e3e955cb45cc21cd82f9646d9b6b28de1
e957134d2a178beb618c849e5ed3b27eabc4681de53c72d9cb46b25f44ad90f1

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/html; charset=utf-8
content-length: 262947
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "002e058f63983d06b82cb1fa8ce814a3"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qpVawi1ReNjsLmll%2BuChapkMgdiPOF1uZS6UUKStTk9fdmzkzosVQLpR0jN6cCgEax94FiwfEYWO8fNmbp9Gbhe6Bfgxn%2BjBu80PF%2FKG4SbBELdAitcKNyXqCfZOWCBNjs7lGN8HKA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca8cdbb569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf

172.66.47.70

200 OK

108 kB

URL GET HTTP/3
indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (57035)
Size
108 kB (108418 bytes)
Hash
a1e383d1905a304be577f70328439b66
e4452d5e3e955cb45cc21cd82f9646d9b6b28de1
e957134d2a178beb618c849e5ed3b27eabc4681de53c72d9cb46b25f44ad90f1

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"002e058f63983d06b82cb1fa8ce814a3"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M27OsX4G78JNbj7V61TS8p4We4I6aXr2oezoF4UUaBBjVfHbpxuCjQwa9LDebb5w82PCbP7vyp7MYlN1uNZFLOE%2BbKaR73R7JZFceOfg2cb72xl0jsbbUTTO3uRIe3pHBCEiAz%2FH2g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca97e29569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/fonts/Interstate-Bold.woff

172.66.47.70

200 OK

72 kB

URL GET HTTP/3
indloguass.pages.dev/fonts/Interstate-Bold.woff
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
Web Open Font Format, TrueType, length 71874, version 1.197
Size
72 kB (71874 bytes)
Hash
9fd45584370dd1c58e1ed9050efb925f
7b41085678166c62e23e8cf3c8c9ab13e13c356d
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fonts/Interstate-Bold.woff HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://indloguass.pages.dev/css/stylee.css
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: application/font-woff
content-length: 71874
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "6fa4501001e9c0428609f1db6db22820"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x4yX2aBfj50EVFWCy1WRV86aG6%2BRy%2FMpxZC6Wy7QcAmYsWRP4bKcgUAOaMpyJ8bPKI8BzFP6GU2%2BTp%2F%2BG%2FSTIO40DzOC38%2F9QX4oGpSsfryFO1RcjTdfeQluDLzkE2fUG00BoDaf8w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bcaa0e68569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/favicon.ico

172.66.47.70

200 OK

20 kB

URL GET HTTP/3
indloguass.pages.dev/favicon.ico
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
PNG image data, 367 x 367, 8-bit/color RGBA, non-interlaced
Size
20 kB (19751 bytes)
Hash
5c529d13403aaef133f480514b0d7b3f
73b6a54f396770a92bd13f0af7b0530e7a68b546
2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:30 GMT
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"2653d65e253b72dee64bd843b77ce8c4"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v5nuuGex6aY1XMN2SIdDwIxMRxnGGw3XG8lCcMMA%2FcGTsiIDgoasaSOC%2BXRHDFl%2FXJ3%2B7bwMGm2hqZaWwpnZkpRyuTTDD2QZC2wyKwYN5RZRU5ryK0GP8fEGz4GCUzxSOTChKvs3pQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bcaabed2569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/css/stylee.css

172.66.47.70

200 OK

1.2 MB

URL GET HTTP/3
indloguass.pages.dev/css/stylee.css
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type

Size
1.2 MB (1237551 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/stylee.css HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"45f43aeca08fecaefad4220a0611008c"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2Fn7DpaQsxLb8u705fnItItikfD6Na2JueCs8GRz7dL0HoyzRaEq3f612gEzhaUrwbO76w5gBFqdK260WQZqkBILE86jIMtAWZDV9QRN4cAdLjNw5M7GSoQDR7lL3MYu9BBebqBbcg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca54bb4569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf

172.66.47.70

200 OK

263 kB

URL GET HTTP/3
indloguass.pages.dev/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type

Size
263 kB (262947 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"002e058f63983d06b82cb1fa8ce814a3"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9E9Xi1KjTPDXSwC6T7d3YnYXPknVv1ad%2FXn%2FZngrI%2FBHkKmoLYvEOkdMhU2UKWVvyaXH1uR52%2FX4x0XYB8Xrgid3oJ6%2F%2FlkYsX9xRrnmjHrwKVrYz4dmU6R2gjGJEl64gMZKwbr17A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca99e43569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/assets/signin.css

172.66.47.70

200 OK

0 B

URL GET HTTP/3
indloguass.pages.dev/assets/signin.css
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/signin.css HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"002e058f63983d06b82cb1fa8ce814a3"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3CacRVCu2sOiMl6YBjomWvd2HlMGmRtnZXwUgL7YJj%2FQmPWexq4nWlodkpiYc%2FeXwW%2BQs8tksF8JkFbtm5VPfY7fQEC4N1CX4SZ8fDcX8BkAX1yh1L94wi49cxFrHx7gReiQW8Ndbg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca54bb3569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/css/origination.css

172.66.47.70

200 OK

573 kB

URL GET HTTP/3
indloguass.pages.dev/css/origination.css
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
573 kB (573382 bytes)
Hash
12a07fe7685bf0433964b0235e5f3543
10b87d2b7b618bc378da1fa91be05ede56031332
78a7019b985cc187d3677d7ad21a629fe5a38e91f4bd0bcb29839afafe986919

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/origination.css HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"72590497e4f7bb91bb40f38bb91d2881"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=laMpYBS5QW7ju352zKNDNzautETtcBi44vUX6X99DoKYfW5YbHgUzSKq1wZf7iik5RvMJhyCy7d%2BBUL2UjwVcqWUYs8AJF5H7ed%2BvuHPr0o9ogoKGthv45oNZdAG%2BGpl0kYV5CNdkA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca54bb5569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/fonts/Interstate-Light.woff

172.66.47.70

200 OK

76 kB

URL GET HTTP/3
indloguass.pages.dev/fonts/Interstate-Light.woff
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
Web Open Font Format, TrueType, length 75538, version 1.197
Size
76 kB (75538 bytes)
Hash
3d1d3153b04b6ce8a33a20f60df9d723
60e91c7766bdc415134c1111a283ffed3749dbae
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fonts/Interstate-Light.woff HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://indloguass.pages.dev/css/stylee.css
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: application/font-woff
content-length: 75538
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "f3ad8e3733565f3ea20c0827d23ee539"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jT6ZuKQrFyLv68fjTCz5KFpW%2BksHc3RzLfXfy%2Bxsm8y1WGI4TCYgpCDuzKntvLOmZ8BVrfj0CY5pSl5PJAPrGJV6z2XkonvZLSv%2FmnHDNt6zk%2BEGoVNXDlLTl8J800CUWV2YDN5tmA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca9fe65569f-OSL
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/images/050-location%402x.svg

172.66.47.70

200 OK

1.8 kB

URL GET HTTP/3
indloguass.pages.dev/images/050-location%402x.svg
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
SVG Scalable Vector Graphics image
Size
1.8 kB (1752 bytes)
Hash
ae63a50f6936b1dd1eb285ce1aaa49b6
868912dfa53ec9ddf3076cc9f3145458eeab4118
7dc35fcbd00ea5aec17b73c626dd5b87f85111a73405d49674d3291b2ffc36dd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Citi
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/050-location%402x.svg HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"30c8627087146681f5d9ccc8f54347a0"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=82E0Skm7fEt0PWmG%2FmeSJqSaMp8v14dpQLXXiVV%2FbRJICpjkn8lB82dVK74jrc0IewW83DVFC%2BiDlZMincHiTtfhMq0AnhHSnLBAGE5S6tq8btr7TBg9oMirUaOc2VpQEg0Zr1pPoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca55bbd569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/images/icon_globe_med-grey%402x.svg

172.66.47.70

200 OK

3.5 kB

URL GET HTTP/3
indloguass.pages.dev/images/icon_globe_med-grey%402x.svg
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Requested by
https://indloguass.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type
SVG Scalable Vector Graphics image
Size
3.5 kB (3523 bytes)
Hash
d4776dd9f103e21a58f85a11909ac4a5
4ebaef62262e458f73bbe5330f185d73802cb67d
810220a605f17c9dba35c68a2724e4f5342b8748cf24a90ca8e713962090681f

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/icon_globe_med-grey%402x.svg HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://indloguass.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 20 Apr 2024 05:29:29 GMT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"5d8412c1fd989086a891e57d674196fd"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Ew8Ubi68f%2FJRVM6O83yPWpRMWruBSz0jB68%2FMp956DUIkryvUQ1c%2BeOeZobWrXFSsWXqGUTF2aCtgS72Zr5gLiZ4NauaIX7zoXdx4yptFJ9RwGJaoTZGCV7NfSseeMbuBAzMOZK7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca55bbe569f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

indloguass.pages.dev/

172.66.47.70

200 OK

263 kB

URL User Request GET HTTP/2
indloguass.pages.dev/
IP
172.66.47.70:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectindloguass.pages.dev
Fingerprint01:B9:59:CC:43:38:13:BB:DA:81:FB:23:6C:DF:3E:71:EB:AA:5A:D1
ValidityTue, 02 Apr 2024 09:27:49 GMT - Mon, 01 Jul 2024 09:27:48 GMT

File type

Size
263 kB (262947 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Citigroup Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: indloguass.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Apr 2024 05:29:28 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"002e058f63983d06b82cb1fa8ce814a3"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=InwCQaylyeWjyugkmZVnbVnXjnCnBO4SGtCmKv9Guqlj%2BzQkd%2FbBEHJLlzQFX4N6PqpmDcpaTk4eAUi3BOFcF7D%2BrJIIbcvHpxYo3VMXdS%2B3OZRyISYqi0RBNINv82qgcPa2f1g2xw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8772bca1f8b4712d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (24)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type