Report - virginia.gov-evkm.win/pay/

Report Overview

Visited public
2025-06-03 00:41:26
Tags
phishing
URL
virginia.gov-evkm.win/pay/
Finishing URL
virginia.gov-evkm.win/pay/
IP / ASN
43.162.120.31
#132203 Tencent Building, Kejizhongyi Avenue
Title
Traffic Tickets
Phishing - Generic phishing
Phishing - Generic Phishing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
virginia.gov-evkm.win	unknown	2025-06-02	2025-06-03	2025-06-03	3.9 kB	1.5 MB	43.162.120.31
fonts.gstatic.com	unknown	2008-02-11	2014-04-02	2025-05-28	1.7 kB	134 kB	142.250.74.35

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	virginia.gov-evkm.win/pay/assets/fliceXIj.js	ScriptElement	37 kB	2025-05-30	2025-06-07
Pretty URL virginia.gov-evkm.win/pay/assets/fliceXIj.js IP 43.162.120.31 ASN #132203 Tencent Building, Kejizhongyi Avenue Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-30 20:07 Last Seen2025-06-07 04:09 Times Seen11 Hash 967a7587f7b0dfc2e6b04cc341817a21 25df4ad1d00bd1fb1fa878b3f333c4e73490f0c4 9b42c0451dba1f16a48832c455ede1090c51dc7f9359d45aff00c8729ce431c4 Loading...

	virginia.gov-evkm.win/pay/	ScriptElement	314 B	2023-03-11	2025-06-18
Pretty URL virginia.gov-evkm.win/pay/ IP 43.162.120.31 ASN #132203 Tencent Building, Kejizhongyi Avenue Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-11 11:23 Last Seen2025-06-18 05:06 Times Seen6131 Hash cd7a34e714de94d5c29b8ac5acdde24b b722bccb435490630d97ef88cafeb02d92f70fd0 312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71 Loading...

	virginia.gov-evkm.win/pay/	ScriptElement	84 B	2023-04-07	2025-06-18
Pretty URL virginia.gov-evkm.win/pay/ IP 43.162.120.31 ASN #132203 Tencent Building, Kejizhongyi Avenue Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 06:55 Last Seen2025-06-18 05:06 Times Seen14702 Hash 528dd01eb509d1fc3c68b48e165c9d77 8d702f33d869eb8c53cf75c17014f96385322395 b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a Loading...

	virginia.gov-evkm.win/pay/assets/D-0VqdtB.js	ScriptElement	1.2 MB	2025-05-30	2025-06-07
Pretty URL virginia.gov-evkm.win/pay/assets/D-0VqdtB.js IP 43.162.120.31 ASN #132203 Tencent Building, Kejizhongyi Avenue Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-30 20:07 Last Seen2025-06-07 04:09 Times Seen11 Hash baf588627c0e07f2f6b6bc29562ccf06 81783a750199fe317f91de948bcfb5d2731cecf0 883720703351c643d61404e65726f8e4e2a580b1977f17d757f37fae2ca0290d Loading...

HTTP Transactions (11)

URL IP Response Size

virginia.gov-evkm.win/pay/

43.162.120.31

200

3.3 kB

URL User Request GET
virginia.gov-evkm.win/pay/
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (433)
Size
3.3 kB (3309 bytes)
Hash
280376d27c72951fc09c613e59063b70
4b9436045a05a4cff56ca920fb290f53896b4885
e16fce23d9dfbdd42844a6dc11b7dd5a0cb77ad6b27e9c3b4c19b09c7b7c2306

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /pay/ HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip

fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2

142.250.74.35

200 OK

40 kB

URL GET
fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint41:FF:72:9C:74:6F:D4:D1:3B:A8:03:EB:55:D2:D2:09:7E:7A:44:DC
ValidityMon, 12 May 2025 08:44:01 GMT - Mon, 04 Aug 2025 08:44:00 GMT

File type
Web Open Font Format (Version 2), TrueType, length 40128, version 1.0
Size
40 kB (40128 bytes)
Hash
9a01b69183a9604ab3a439e388b30501
8ed1d59003d0dbe6360481017b44665153665fbe
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2

HTTP Headers

GET /s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://virginia.gov-evkm.win
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 40128
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 29 May 2025 10:03:46 GMT
expires: Fri, 29 May 2026 10:03:46 GMT
cache-control: public, max-age=31536000
age: 398240
last-modified: Wed, 08 Jan 2025 18:23:10 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

virginia.gov-evkm.win/pay/favicon.ico

43.162.120.31

200

15 kB

URL GET
virginia.gov-evkm.win/pay/favicon.ico
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
15 kB (15406 bytes)
Hash
3326a24b429a9244015a0ee42fcefd37
d79a3a3e63ff77c44f38017267900e1554b7466e
ae422efb68b96e8019f21fa646da5e2954122791347bacad89d1afe8e0f15a3c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /pay/favicon.ico HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:06 GMT
Content-Type: image/vnd.microsoft.icon
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip

wss://virginia.gov-evkm.win/front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6NzIyNzF9.c9yWkL-EaP7bFVkYvYs_X59K-ehksE-uKsr2XZz53VM

43.162.120.31

101

0 B

URL GET
wss://virginia.gov-evkm.win/front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6NzIyNzF9.c9yWkL-EaP7bFVkYvYs_X59K-ehksE-uKsr2XZz53VM
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6NzIyNzF9.c9yWkL-EaP7bFVkYvYs_X59K-ehksE-uKsr2XZz53VM HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://virginia.gov-evkm.win
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: CJRWDSUwL2sMRpMazPfqlw==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:06 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 7AcTmje000oI6JM+aVVaV4KGy/Y=
Sec-WebSocket-Extensions: permessage-deflate
Strict-Transport-Security: max-age=31536000; includeSubDomains

virginia.gov-evkm.win/pay/assets/fliceXIj.js

43.162.120.31

200

37 kB

URL GET
virginia.gov-evkm.win/pay/assets/fliceXIj.js
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (36605), with no line terminators
Size
37 kB (36606 bytes)
Hash
967a7587f7b0dfc2e6b04cc341817a21
25df4ad1d00bd1fb1fa878b3f333c4e73490f0c4
9b42c0451dba1f16a48832c455ede1090c51dc7f9359d45aff00c8729ce431c4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /pay/assets/fliceXIj.js HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/pay/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:04 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip

virginia.gov-evkm.win/pay/assets/D-0VqdtB.js

43.162.120.31

200

1.2 MB

URL GET
virginia.gov-evkm.win/pay/assets/D-0VqdtB.js
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type
JavaScript source, ASCII text, with very long lines (30996)
Size
1.2 MB (1190042 bytes)
Hash
baf588627c0e07f2f6b6bc29562ccf06
81783a750199fe317f91de948bcfb5d2731cecf0
883720703351c643d61404e65726f8e4e2a580b1977f17d757f37fae2ca0290d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic phishing
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /pay/assets/D-0VqdtB.js HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/pay/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:04 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip

virginia.gov-evkm.win/pay/assets/BHcjXi3x.gif

43.162.120.31

200

60 kB

URL GET
virginia.gov-evkm.win/pay/assets/BHcjXi3x.gif
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type
GIF image data, version 89a, 256 x 256
Size
60 kB (59994 bytes)
Hash
fadd89694f57f3d6143989b62b09b288
1c6d340af3c4b392538a96c9313136fb23087aa0
7515437df23c4af47700948c1650f0f9460da07e86a9447d33cfda1f36c91052

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /pay/assets/BHcjXi3x.gif HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:05 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip

virginia.gov-evkm.win/pay/assets/C7D1UDrT.css

43.162.120.31

200

153 kB

URL GET
virginia.gov-evkm.win/pay/assets/C7D1UDrT.css
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type
Unicode text, UTF-8 text, with very long lines (4834), with CRLF, LF line terminators
Size
153 kB (153378 bytes)
Hash
e83deca7ac41d1486308dc50cbadf4c7
b92e218ade955c9f2c6b0b728be678b7decb0f4f
7d4dd6d4532afc3f5f89e9f5e3d033c6c460206536f334f25984d78b04cb8ea7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /pay/assets/C7D1UDrT.css HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/pay/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:04 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip

virginia.gov-evkm.win/front/checkIp?token=123

43.162.120.31

200

226 B

URL GET
virginia.gov-evkm.win/front/checkIp?token=123
IP
43.162.120.31:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerLet's Encrypt
Subjectvirginia.gov-evkm.win
Fingerprint66:AE:A0:D3:94:DD:54:5B:ED:EB:28:48:2F:8F:B0:C2:5D:B8:37:2A
ValidityMon, 02 Jun 2025 10:21:45 GMT - Sun, 31 Aug 2025 10:21:44 GMT

File type
JSON text data
Size
226 B (226 bytes)
Hash
d776206532f04f6aeda627dc89704bd0
d68c647f77cf5b76fdfc7f8a0c5f7af3da898db9
fef6095fc8edcf784b24acfd3c46aedcea2fd8c7917a7f77c013a8c09dae69ef

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Phishing

HTTP Headers

GET /front/checkIp?token=123 HTTP/1.1
Host: virginia.gov-evkm.win
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://virginia.gov-evkm.win/pay/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Server: nginx/1.27.4
Date: Tue, 03 Jun 2025 00:41:05 GMT
Content-Type: text/plain;charset=UTF-8
Content-Length: 226
Connection: keep-alive
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Strict-Transport-Security: max-age=31536000; includeSubDomains

fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2

142.250.74.35

200 OK

40 kB

URL GET
fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint41:FF:72:9C:74:6F:D4:D1:3B:A8:03:EB:55:D2:D2:09:7E:7A:44:DC
ValidityMon, 12 May 2025 08:44:01 GMT - Mon, 04 Aug 2025 08:44:00 GMT

File type
Web Open Font Format (Version 2), TrueType, length 40128, version 1.0
Size
40 kB (40128 bytes)
Hash
9a01b69183a9604ab3a439e388b30501
8ed1d59003d0dbe6360481017b44665153665fbe
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2

HTTP Headers

GET /s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://virginia.gov-evkm.win
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 40128
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 29 May 2025 10:03:46 GMT
expires: Fri, 29 May 2026 10:03:46 GMT
cache-control: public, max-age=31536000
age: 398240
last-modified: Wed, 08 Jan 2025 18:23:10 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/robotocondensed/v30/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2

142.250.74.35

200 OK

51 kB

URL GET
fonts.gstatic.com/s/robotocondensed/v30/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://virginia.gov-evkm.win/pay/
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint41:FF:72:9C:74:6F:D4:D1:3B:A8:03:EB:55:D2:D2:09:7E:7A:44:DC
ValidityMon, 12 May 2025 08:44:01 GMT - Mon, 04 Aug 2025 08:44:00 GMT

File type
Web Open Font Format (Version 2), TrueType, length 51412, version 1.0
Size
51 kB (51412 bytes)
Hash
9e5e97447fcc00eca79e97de3b337831
efafc4ef0f1ac7fefb6e22be4ea9c681a53d415a
8d230115e58faa2ed303bee567b91d1a792e0c958a0118998b53648b2ab7c057

HTTP Headers

GET /s/robotocondensed/v30/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://virginia.gov-evkm.win
DNT: 1
Connection: keep-alive
Referer: https://virginia.gov-evkm.win/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 51412
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 29 May 2025 16:03:33 GMT
expires: Fri, 29 May 2026 16:03:33 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 28 May 2025 16:58:12 GMT
content-type: font/woff2
age: 376653
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET