Report - saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967

Report Overview

Submitted URL
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967
IP
122.201.67.1
ASN
#38719 Dreamscape Networks Limited
Submitted
2023-03-21 14:26:16
Access
public
Website Title
Final URL
Tags
bank_of_america financial phishing
urlquery detections
Phishing - Bank of America

Detections

urlquery
41
Network Intrusion Detection
2
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
smallenvelop.com	405085	2014-10-25T12:56:31Z	2023-03-25T17:10:16Z	414 B	18 kB	194.1.147.82
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-26T05:11:12Z	413 B	5.9 kB	34.160.144.191
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-26T05:11:59Z	333 B	391 B	34.117.237.239
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-26T05:10:41Z	686 B	1.4 kB	142.250.74.163
ajax.googleapis.com	12905	2013-08-16T11:51:31Z	2023-03-26T06:17:09Z	389 B	31 kB	142.250.74.170
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-26T05:10:29Z	606 B	127 B	35.83.202.51
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-26T05:09:08Z	3.2 kB	56 kB	34.120.237.76
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-25T18:12:03Z	3.7 kB	9.8 kB	23.33.119.27
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-25T18:14:26Z	782 B	2.4 kB	35.241.9.150
saltbox.com.au	unknown	2015-11-21T07:21:38Z	2023-03-24T09:33:41Z	9.4 kB	1.3 MB	122.201.67.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-03-21 14:26:08	high	Client IP	122.201.67.1	ET PHISHING Generic Phishkit Activity (GET)
2023-03-21 14:26:17	medium	122.201.67.1	Client IP	ET PHISHING Suspicious HTML Decimal Obfuscated Title - Possible Phishing Landing Apr 19 2017

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967	96 B	2023-03-07	2023-08-23
Pretty URL saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967 IP 122.201.67.1 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2023-08-23 00:42:32 Times Seen974 Hash 413a00885bbfc45acf8ed919c6592147 1bbf290a9d153e6c713d61d6b2795dea2d79fce1 4593a076a63fefab53aa34590f2e751618766ed8ffd6d0022d85265111bf37fb Loading...

	ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js	86 kB	2023-03-07	2024-04-25
Pretty URL ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js IP 142.250.74.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-25 15:28:43 Times Seen383864 Hash 2f6b11a7e914718e0290410e85366fe9 69bb69e25ca7d5ef0935317584e6153f3fd9a88c 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Loading...

	saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967	64 B	2023-03-07	2023-11-03
Pretty URL saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967 IP 122.201.67.1 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2023-11-03 01:49:34 Times Seen989 Hash 6a9f46a3ed1778e19fcd613072b4530c 90b09342bf88623a80546972f95ece44765fa5ca 55f9434349d57a1d968c00614f5e3ff676b42cb1bfec9cf344b2e2c71ceac3d0 Loading...

HTTP Transactions (47)

URL IP Response Size

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
28774b36cf8bb6b054329393a33f6239
728313ddff6d5ceb6db3eb8445f039779616a140
08378fe6a897ab5a9c8d3bc2748c9670659d0d0d164317fdfac88d23fee78fa0

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "08378FE6A897AB5A9C8D3BC2748C9670659D0D0D164317FDFAC88D23FEE78FA0"
Last-Modified: Sun, 19 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12335
Expires: Tue, 21 Mar 2023 17:51:40 GMT
Date: Tue, 21 Mar 2023 14:26:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ec332b81a27117ce9c16b67a5a8e4fac
b6d2afa2c859d000ad830d3d8d73f57bac6ffce2
1dc32c78e4e850303813338fd4e9616a41c8c05d1063748a1e76a92c397a5e8f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1DC32C78E4E850303813338FD4E9616A41C8C05D1063748A1E76A92C397A5E8F"
Last-Modified: Mon, 20 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2255
Expires: Tue, 21 Mar 2023 15:03:40 GMT
Date: Tue, 21 Mar 2023 14:26:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
4e6141892ec4705c6a0134f3157b969d
4169fdea42b0fa9cb565e14b8e8fdb293575c78e
905537ef3e3a4a9030391b44bd6ac6bb5d7c9ec752b1821d683dfbf483096163

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "905537EF3E3A4A9030391B44BD6AC6BB5D7C9EC752B1821D683DFBF483096163"
Last-Modified: Sun, 19 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2843
Expires: Tue, 21 Mar 2023 15:13:28 GMT
Date: Tue, 21 Mar 2023 14:26:05 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
bc86ef2a0cee04915bc360f5821adc8f
3658f9028cce204d38f7f48fcfaa2a8e4f54383a
aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Backoff, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 21 Mar 2023 13:27:25 GMT
content-type: application/json
age: 3520
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: ecX9fAv3e+cpasRWmrAyElTFdJuFaJ0PpeSA6h8a2U3AknSz/s9PYMF8k/2gLU+xlflnkXjPQ+8=
x-amz-request-id: 3F4H4HF2WDAN95B7
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 21 Mar 2023 13:53:12 GMT
age: 1973
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:05 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967

122.201.67.1

200 OK

2.3 kB

URL HTTP/1.1
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- assembler source, ASCII text, with very long lines (380), with CRLF line terminators
Size
2.3 kB (2301 bytes)
Hash
afa71a5b048a24f07b99edb3d56c3611
f925b2d9961a2e8f80721fb32a3fb07629c07039
396a4495eed81c7bd32c485fb2035997be7d82c21b11d0d9f005810b3c6b0751

Detections

NIDS	Severity	Alert
suricata	high	ET PHISHING Generic Phishkit Activity (GET)
suricata	medium	ET PHISHING Suspicious HTML Decimal Obfuscated Title - Possible Phishing Landing Apr 19 2017

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/login.php?cmd=login_submit&id=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967&session=7df71438ed6943f08f1bdf3247c089677df71438ed6943f08f1bdf3247c08967 HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 21 Mar 2023 14:26:05 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 2301
X-Powered-By: PHP/8.1.9
Upgrade: h2,h2c
Vary: Accept-Encoding
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
3ac4671deeca3302950bd5fce7f4ce3f
62b5d0c548949ee8d932231fcd01196cefc896aa
e4adf52f426f89cbc5a61507b21d33c817e5b8cee1e2709fe3ffecc1ec0c8731

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 21 Mar 2023 14:26:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

142.250.74.170

200 OK

30 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
IP
142.250.74.170:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (32065)
Size
30 kB (30028 bytes)
Hash
6d973c8b7e2439d958e09c0a1ab9fe50
05ae0830200c20b9a2dfd5a825adc400481a60fb
f3c122dc227e829ed96b2a754296809201bd78abbad7ba50ef5079654e1cc894

HTTP Headers

GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://saltbox.com.au/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30028
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 Mar 2023 04:02:11 GMT
expires: Fri, 15 Mar 2024 04:02:11 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 469435
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
3ac4671deeca3302950bd5fce7f4ce3f
62b5d0c548949ee8d932231fcd01196cefc896aa
e4adf52f426f89cbc5a61507b21d33c817e5b8cee1e2709fe3ffecc1ec0c8731

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 21 Mar 2023 14:26:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Last-Modified, Content-Length, Pragma, Expires, ETag, Backoff, Alert, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 21 Mar 2023 14:14:33 GMT
age: 693
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ed35456c8e26a1d434c6b47501ee653e
231d79387835b2be73944409af134ec2c93a1f29
b272d657be04d6ec74e1a500b71d43794281cf7d057659f5395cfe102a2f8b6d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B272D657BE04D6EC74E1A500B71D43794281CF7D057659F5395CFE102A2F8B6D"
Last-Modified: Mon, 20 Mar 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21461
Expires: Tue, 21 Mar 2023 20:23:47 GMT
Date: Tue, 21 Mar 2023 14:26:06 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
4c195a3fc0c2abb831630cef1dcfa770
eda338de3063640556177b9db364c33193d7f6dc
c22eb0537cd79666b82fe61dd77fe9b0b3c059a4c65d405412acfc2c6800b444

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C22EB0537CD79666B82FE61DD77FE9B0B3C059A4C65D405412ACFC2C6800B444"
Last-Modified: Sun, 19 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14248
Expires: Tue, 21 Mar 2023 18:23:34 GMT
Date: Tue, 21 Mar 2023 14:26:06 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c6977d230347b2a50284e248806c4c86
175354448640faa5a78ed89e37921d36576610d4
1632771c0cdcb7d1d17ebc9f5512a85f5cc43502c7ddffbbe8d57c09730e9f76

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1632771C0CDCB7D1D17EBC9F5512A85F5CC43502C7DDFFBBE8D57C09730E9F76"
Last-Modified: Mon, 20 Mar 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=742
Expires: Tue, 21 Mar 2023 14:38:28 GMT
Date: Tue, 21 Mar 2023 14:26:06 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
48e79838da7c6a5bf3b3fc958b6bb50a
6216751f477920edd185ecd4cad86a21fe07cced
31b3d6544f88fda91e58fb9b8f200ab745710e6fa5b82f673095619c0b8c2a7c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "31B3D6544F88FDA91E58FB9B8F200AB745710E6FA5B82F673095619C0B8C2A7C"
Last-Modified: Mon, 20 Mar 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Tue, 21 Mar 2023 20:26:06 GMT
Date: Tue, 21 Mar 2023 14:26:06 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c6977d230347b2a50284e248806c4c86
175354448640faa5a78ed89e37921d36576610d4
1632771c0cdcb7d1d17ebc9f5512a85f5cc43502c7ddffbbe8d57c09730e9f76

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1632771C0CDCB7D1D17EBC9F5512A85F5CC43502C7DDFFBBE8D57C09730E9F76"
Last-Modified: Mon, 20 Mar 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Tue, 21 Mar 2023 20:26:06 GMT
Date: Tue, 21 Mar 2023 14:26:06 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c6977d230347b2a50284e248806c4c86
175354448640faa5a78ed89e37921d36576610d4
1632771c0cdcb7d1d17ebc9f5512a85f5cc43502c7ddffbbe8d57c09730e9f76

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1632771C0CDCB7D1D17EBC9F5512A85F5CC43502C7DDFFBBE8D57C09730E9F76"
Last-Modified: Mon, 20 Mar 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Tue, 21 Mar 2023 20:26:06 GMT
Date: Tue, 21 Mar 2023 14:26:06 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c6977d230347b2a50284e248806c4c86
175354448640faa5a78ed89e37921d36576610d4
1632771c0cdcb7d1d17ebc9f5512a85f5cc43502c7ddffbbe8d57c09730e9f76

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1632771C0CDCB7D1D17EBC9F5512A85F5CC43502C7DDFFBBE8D57C09730E9F76"
Last-Modified: Mon, 20 Mar 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21562
Expires: Tue, 21 Mar 2023 20:25:28 GMT
Date: Tue, 21 Mar 2023 14:26:06 GMT
Connection: keep-alive

push.services.mozilla.com/

35.83.202.51

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.83.202.51:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 7Y/9Svl0c2DsPvEafzjNfg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: tULpbzznN1JcWN3zBCLZ2teklcA=

smallenvelop.com/wp-content/uploads/2014/08/Preloader_11.gif

194.1.147.82

404 Not Found

17 kB

URL HTTP/2
smallenvelop.com/wp-content/uploads/2014/08/Preloader_11.gif
IP
194.1.147.82:0
ASN
#210250 K Media Tech Ltd.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (9698), with CRLF, LF line terminators
Size
17 kB (16893 bytes)
Hash
75a1e2f306234e0117bce526dee7cbd6
06c4503e4c22fdb7be4dda3d8e6402f8ebb96fed
82ab12dd48403969f26c0476365c8e7de109ee6d7e5f5143bc00d36a74129e5f

HTTP Headers

GET /wp-content/uploads/2014/08/Preloader_11.gif HTTP/1.1
Host: smallenvelop.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://saltbox.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 404 Not Found
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: text/html; charset=UTF-8
content-length: 16893
x-powered-by: PHP/7.4.33
set-cookie: PHPSESSID=aao7j82esa7spbptf0f832ipog; path=/; secure; HttpOnly
pragma: no-cache
cache-control: public,max-age=3600
x-ua-compatible: IE=edge
link: <https://smallenvelop.com/wp-json/>; rel="https://api.w.org/"
content-encoding: br
vary: Accept-Encoding,Origin
wpx: 1
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
x-turbo-charged-by: LiteSpeed
x-edge-location: WPX CLOUD/NOR01
server: WPX CLOUD/NOR01
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq7.png

122.201.67.1

200 OK

11 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq7.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 877 x 79, 8-bit/color RGBA, non-interlaced\012- data
Size
11 kB (11323 bytes)
Hash
ca343261254216105f2e164dde122aad
a439caa78f0054ef7f1a59a74650ad9edb1443e4
25073f4f2b08a3cce3e4463804e75b694ebbac835e731869c0b55b2cc9f7eba0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq7.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 11323
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq8.png

122.201.67.1

200 OK

8.7 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq8.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1238 x 41, 8-bit/color RGBA, non-interlaced\012- data
Size
8.7 kB (8697 bytes)
Hash
cfe79b101c15c9d90f43c8b686c7b8b4
f01cadb53c51a78afdcf761fa9fa02bbd9dd24a8
2ab545bc4ed5ba7ba4260983046430bfc4f5b3261a2c8682cbc4552e4bd28471

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq8.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 8697
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq9.png

122.201.67.1

200 OK

61 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq9.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1299 x 363, 8-bit/color RGBA, non-interlaced\012- data
Size
61 kB (61304 bytes)
Hash
0ff7a151363008bf059f8af27068161c
6736749f888336184decbde457c93804433e5e28
29a678c76e364091912911bed222cb32fbfb2ce0c592f790b6e888e9e367ce8b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq9.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 61304
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
de95776582936b8e129e876cf6d80fa8
0233251e1cf0123f1260d980d7c8ef92718723f9
49c07da2ab4ebd66bd166bf0e20dd084b38973cd40c79f85eb283d15a1ccac36

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "49C07DA2AB4EBD66BD166BF0E20DD084B38973CD40C79F85EB283D15A1CCAC36"
Last-Modified: Sun, 19 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21293
Expires: Tue, 21 Mar 2023 20:21:00 GMT
Date: Tue, 21 Mar 2023 14:26:07 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0e5e49ed-9ec4-4b75-b7ba-3c4c213d5d27.jpeg

34.120.237.76

200 OK

4.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0e5e49ed-9ec4-4b75-b7ba-3c4c213d5d27.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.7 kB (4712 bytes)
Hash
d0e5cb0b321323913460ba1efd6b7b63
701eb0eb86c6673bbb6e85cf933bea53187b6048
150d0e93b808b222fcb4b58f0f4a78a403517b84461cb3029fc71c30930bb11b

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0e5e49ed-9ec4-4b75-b7ba-3c4c213d5d27.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4712
x-amzn-requestid: 3c0b3a28-a1a9-4ba0-94ad-29156c2d83c4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B9yGEE8SIAMF-LQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641563c0-1937b8bc1e42142720eddd7b;Sampled=0
x-amzn-remapped-date: Sat, 18 Mar 2023 07:09:52 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: a-jsgTjZQKzBK_IFEYlrxbjpk6zou_7vbQe4ptwA1IOtUdlqDG2uWA==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 5c35539543902c678280929df206948c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 22:24:07 GMT
age: 57720
etag: "701eb0eb86c6673bbb6e85cf933bea53187b6048"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb2ad5022-7f23-468e-8e1f-6388d8cc9db8.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.5 kB (6511 bytes)
Hash
4e5f234aedfabd736b50fef3017380f9
71672a6c3523d9999522e005091863d07ea0e94a
3314df7a93e317d509aeffc1cde69ec450ddad116a27dc197db1abce966da344

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb2ad5022-7f23-468e-8e1f-6388d8cc9db8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6511
x-amzn-requestid: 82d12180-bdcb-4ce0-8588-4239ee27f236
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CGWI_E_eoAMF3sA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418d09f-2f5df7cd5f6cee4762703d29;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 21:31:11 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: yQgmYjA3RIk8IVzzOoHdYl60H1BO_IeCF_7d7AmTqjuIOxQIS2dyDw==
via: 1.1 0a2ce08fa1ec3c33302a7547d3305978.cloudfront.net (CloudFront), 1.1 1d0860167e2100a6d1cd9c0213c2b8e8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 22:08:29 GMT
etag: "71672a6c3523d9999522e005091863d07ea0e94a"
content-type: image/jpeg
age: 58658
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3db1704b-1ecd-4198-a98e-0353d4671a5c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.2 kB (8195 bytes)
Hash
2a940b362660fdee25faaa51e08c439b
85fa91b5c4e6ddc1f3cf45eb6a4a3facfc6ad68c
18b99e3e890fdc959421c895ce343b8b3ed88819c83fa0009823e8ded23458f1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3db1704b-1ecd-4198-a98e-0353d4671a5c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8195
x-amzn-requestid: c6844a50-a6b2-4ef4-ad28-f1a0fbcec14f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CDFESEDGoAMFQ8A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6417821b-22fa560d4b7811c233fe07fa;Sampled=0
x-amzn-remapped-date: Sun, 19 Mar 2023 21:43:55 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: WZ5MqPZ-MEjDt3N53EIx1XrerDmUkyvK-5FUXAmI29GXlGe6AaPqEg==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 219e8f088c8c2a564bdacafe44be620a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 22:23:21 GMT
age: 57766
etag: "85fa91b5c4e6ddc1f3cf45eb6a4a3facfc6ad68c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7963a1ee-914e-454a-a5e7-9466ab707e33.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.7 kB (7695 bytes)
Hash
302595cc68fe8cf12121d0f652b3194d
e5532a3fed552246e8a63ea2ba75e174273a7b9f
6ca3599a9af06f51d4dc205d4ebd8f7f8b38c54864b6b478eac8c0d1adbc97c6

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7963a1ee-914e-454a-a5e7-9466ab707e33.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7695
x-amzn-requestid: 1009077b-14aa-42e5-86f1-de94b8b2aba0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CDETIHf8oAMFxEA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641780e0-07bbb0376f1c1941731e00ba;Sampled=0
x-amzn-remapped-date: Sun, 19 Mar 2023 21:38:40 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: 02HknfEEVW-DU3f3sOQgfs_eL48pvEgV4ft__uRLXOFlDO5qX5tDsQ==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 a06140ffee86972bad90c57fc682df36.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 21:55:31 GMT
age: 59436
etag: "e5532a3fed552246e8a63ea2ba75e174273a7b9f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6943b819-ab3e-4698-a81d-266be026b4b8.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10855 bytes)
Hash
f73dbc0fc3d196647ddc1e30450989d4
75d0a1414a5d350ba426dc37333a6ea131f66753
2a6954b3ccf01567c0c0c2911dd8b02c1cd264fc78178cef2eef6a6796c16c3f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6943b819-ab3e-4698-a81d-266be026b4b8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10855
x-amzn-requestid: bb845712-834d-49b1-97f0-f3750f132741
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CEZD0GCHIAMFq6A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418087e-4361bbd40ec5f0d10dabdf85;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 07:17:18 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: gnFLBOJmRcgsHzy_KXjzE6LwwN4CSqz99pIhYMBx8xrHa8UO6O0kJA==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 0906d4887f6625f4a4467d8d4fd268d2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 21 Mar 2023 07:30:21 GMT
age: 24946
etag: "75d0a1414a5d350ba426dc37333a6ea131f66753"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68a4b574-14c9-4d65-81df-d700ef3fa2f4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11336 bytes)
Hash
e538277f72ecedd22d24c1012250fa9e
4bd955ea3790a6926486e3d56f51c712c56997d7
5f4d374598cfb1a78e7016ec3a0b563e61e7481be202c34b10c9fdfbfc7b638e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68a4b574-14c9-4d65-81df-d700ef3fa2f4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11336
x-amzn-requestid: 3aaca817-ebbc-449f-806c-d5a2a7559335
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CGWjFEmFIAMFqhg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418d146-435381723c24efc66eed6b4b;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 21:33:58 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: ucKJdzsuQMhDuZHuaBcW8q8tDkm1tepcMkqRtTRUuzF-7CIuhAR2MQ==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 5c7981a979abd51ba7e5ca7d464fd048.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 22:27:44 GMT
age: 57503
etag: "4bd955ea3790a6926486e3d56f51c712c56997d7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq4.png

122.201.67.1

200 OK

515 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq4.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 323, 8-bit/color RGBA, non-interlaced\012- data
Size
515 kB (514941 bytes)
Hash
18e7e1cda5c5e03dd622b65bab5b42c7
3f12ad8abfa9dceb145a8a1aea1d446abb87e335
e616de9cf92372fb1de5853891c30a72901377575d3bc277baf3920c7a983002

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq4.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 514941
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq10.png

122.201.67.1

200 OK

5.6 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq10.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 517 x 46, 8-bit/color RGBA, non-interlaced\012- data
Size
5.6 kB (5584 bytes)
Hash
2563fbaaeaeefcc34047cb28194aa744
eb13fbd7881b142fa5f2a035855349c467837ebc
52c7799e55c66bb30a316bf54a4e0e62e9e0b2f16edf22fc783a6fae29ae2801

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq10.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 5584
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq11.png

122.201.67.1

200 OK

46 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq11.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 260, 8-bit/color RGBA, non-interlaced\012- data
Size
46 kB (45770 bytes)
Hash
667d47cdd6968f4f07acaa27e74a562f
8726fd097f771c1cd227b91ef89fddd28e85018c
a9f7a0968d213c127d365dec662b8de8b6b5a6050fb452031e7e18091d4bd73e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq11.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 45770
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq12.png

122.201.67.1

200 OK

51 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq12.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 286, 8-bit/color RGBA, non-interlaced\012- data
Size
51 kB (50594 bytes)
Hash
5e0def8e63a99e936787e98666b95d9d
0f538ca8920e7efcaa6cbefc8ffbad935f1b6de6
4c278d67df0bbcc0faae4216cfed92923b5abbdf60f0f38133ac8c61fbd898d8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq12.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 50594
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/abtn1.png

122.201.67.1

200 OK

779 B

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/abtn1.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 276 x 42, 8-bit/color RGBA, non-interlaced\012- data
Size
779 B (779 bytes)
Hash
ec8d858a5fa5b43345f300cd734e3d47
38ac399e522d4782d182716a0ba882594f21afc5
93be14c5cf1853bc01af2cd61e9ad612098b7657597cfcd6fc84abb8bc49a805

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/abtn1.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:06 GMT
content-type: image/png
content-length: 779
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq5.png

122.201.67.1

200 OK

32 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq5.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 268, 8-bit/color RGBA, non-interlaced\012- data
Size
32 kB (31972 bytes)
Hash
dce032aee5a94cb9d35e006f256334e1
b78e554303591c9bdf7dc21eec8d89dd01c6686d
17b9b2914770b4f4e757183e11da9773e98688170992b7e8be5b7b2fab09e43f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq5.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 31972
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq13.png

122.201.67.1

200 OK

28 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq13.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 323, 8-bit/color RGBA, non-interlaced\012- data
Size
28 kB (27839 bytes)
Hash
646c68c87aed55a496c40b5c48768d6c
a00d9c4d60acc5c3563b32ab6437d5d06ed88e26
d8939bffd427c15a06a2229ec62f9ccd945d05c8114ede2f1bf633f83b4779fb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq13.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 27839
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq16.png

122.201.67.1

200 OK

43 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq16.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 388, 8-bit/color RGBA, non-interlaced\012- data
Size
43 kB (42770 bytes)
Hash
e961dc51909f23f31e7edeea21035a12
74c111eef8a44cdda26d94f9910a639f64a768b7
a57d24063f7f5e45d41ddc407cdcd0cdffd509527e278ecdc3171deefbd4c052

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq16.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 42770
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq14.png

122.201.67.1

200 OK

2.6 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq14.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 399 x 55, 8-bit/color RGBA, non-interlaced\012- data
Size
2.6 kB (2622 bytes)
Hash
e3b7fe92d63f7143cb26c1bf4de03676
e09df45e879c772c3d50c3aaebe69c7b726491fb
ecaeea471f7f018646d9be3ce2282b7089250a0c81c36882b6e2aef3bdd8df05

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq14.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 2622
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq6.png

122.201.67.1

200 OK

11 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq6.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 216, 8-bit/color RGBA, non-interlaced\012- data
Size
11 kB (11091 bytes)
Hash
a00d48506f6937b5aee470a4827bf824
b931aee648c08bcdc11b780888701dc278326192
d5d55effc79ff5e174f4bf5addb72b9369c585660158a214542909aa1a6f78da

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq6.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 11091
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/flr.png

122.201.67.1

200 OK

475 B

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/flr.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 32 x 64, 8-bit/color RGBA, non-interlaced\012- data
Size
475 B (475 bytes)
Hash
7504068cd268f504a72b36cfdf65c650
b5d118d98ff32476dd44b27d09f2ecf90d5729b7
dd60e0f69576a5259dbf2a6d074f6bdcec7d7cb9b25571d1a22bb2f872dd90d3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/flr.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 475
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/ap1.png

122.201.67.1

200 OK

2.6 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/ap1.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 231 x 76, 8-bit/color RGBA, non-interlaced\012- data
Size
2.6 kB (2577 bytes)
Hash
609a5a68c4a467663ae3670a88bf13c4
8106e122ccc46f04c148a08ed390344e07dd4213
83b9da91605d1c9a99e510a9ab52a05aeea01b44ff8474884e509b0da5738f0e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/ap1.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 2577
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq15.png

122.201.67.1

200 OK

25 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq15.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 279, 8-bit/color RGBA, non-interlaced\012- data
Size
25 kB (25248 bytes)
Hash
10a4deefbb546537e08f06b45a5150d4
f734787aba36b5b8c348153857b8fcf15fa629e5
cc508448525581d7c36aa2a0fb0aeb127fe0563cbbb2666b10e78edfe8b374a2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq15.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 25248
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/ap2.png

122.201.67.1

200 OK

3.2 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/ap2.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 248 x 85, 8-bit/color RGBA, non-interlaced\012- data
Size
3.2 kB (3238 bytes)
Hash
0accdd8fd09235d96b8bb91a9aa68383
5d7d74b177a7c492db62f94d39f4eced4e67867e
23041228fd16d305256c27c4c7f2bd9123d1e39ab6b31f0090819794ed2f2e80

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/ap2.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 3238
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/q1.png

122.201.67.1

200 OK

431 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/q1.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1349 x 629, 8-bit/color RGBA, non-interlaced\012- data
Size
431 kB (430729 bytes)
Hash
efdcf99e8f72705f113cc359751e677a
304cc765d94a43b4c845e375141343ec519c628e
bd606237f244d4eac026f8683eeb6c4f83057c729b99ccf85b3b8c2c03099ada

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/q1.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 430729
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq17.png

122.201.67.1

200 OK

9.6 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/aq17.png
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 1033 x 90, 8-bit/color RGBA, non-interlaced\012- data
Size
9.6 kB (9646 bytes)
Hash
b090998bdc20316f4b5e04f246c35690
44849f60dda61476dee120df48d5c3b5069b5daf
9c1d5e5ee851d60c8f55acc3b033b65fcbba73fa4d300f270eeb5b3be2fbaee3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/aq17.png HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:07 GMT
content-type: image/png
content-length: 9646
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/favicon.ico

122.201.67.1

200 OK

7.2 kB

URL HTTP/2
saltbox.com.au/auseternal/blog/decklist/css/js/BOfA/Validation/images/favicon.ico
IP
122.201.67.1:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced\012- data
Size
7.2 kB (7169 bytes)
Hash
e9c41bf8d839804f010ed1a115319efb
60b956b0e31cdef1f96e8e728e6200e76ad3bad4
03b86050fe0dcdabd20b285d908a8788e2fcaf5a9a2dcbc115c64eb29dd741e8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Bank of America
urlquery	phishing	Phishing - Bank of America

HTTP Headers

GET /auseternal/blog/decklist/css/js/BOfA/Validation/images/favicon.ico HTTP/1.1
Host: saltbox.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://saltbox.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 14:26:08 GMT
content-type: image/x-icon
content-length: 7169
last-modified: Thu, 08 Aug 2019 03:27:16 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (47)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type