Report - www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/

Report Overview

Submitted URL
www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/
IP
74.208.236.111
ASN
#8560 IONOS SE
Submitted
2023-01-04 06:17:23
Access
Website Title
Final URL
Tags
capitalone financial phishing
urlquery detections
Phishing - Capital One

Detections

urlquery
11
Network Intrusion Detection
0
Threat Detection Systems
24

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ecm.capitalone.com	13649	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.4 kB	87 kB	104.110.12.190
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.9 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
www.bluekapwa.ca	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	7.9 kB	309 kB	74.208.236.111
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	4.2 kB	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.38.146.2
cdnjs.cloudflare.com	235	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	391 B	12 kB	104.17.24.14
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	52 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.4 kB	6.2 kB	23.36.76.226
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-01-03	medium	www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/	Capital One Financial Corporation
2023-01-03	medium	www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/	Capital One Financial Corporation

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-04	medium	www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/capital-one-logo.svg	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/examine.svg	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/browserFingerPrintv1.min.js.download	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/equal_housing_lender.svg	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/fdic.svg	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/js/script.js	Phishing
2023-01-04	medium	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/js/script.js	99 kB	2023-03-09	2023-05-30
Pretty URL www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/js/script.js IP 74.208.236.111 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 04:28:11 Last Seen2023-05-30 14:04:26 Times Seen83 Hash 1501b528220baca92f7d189b7f00136b 60b48644dc907af63a10411190e9e085857a7078 9b11ce0ce39ad24aa3c869cbde323c1605bbafdfd45ab8f013aa48731d5a4969 Loading...

	cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js	46 kB	2023-03-07	2024-04-06
Pretty URL cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:12 Last Seen2024-04-06 06:20:41 Times Seen13263 Hash 79c82646b886e08184f7b9fff25e64ff 804b4b0f8f3443ff05833e33fb5b76780ffafe25 8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d Loading...

	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/browserFingerPrintv1.min.js.download	28 kB	2023-03-07	2024-04-10
Pretty URL www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/browserFingerPrintv1.min.js.download IP 74.208.236.111 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:39:19 Last Seen2024-04-10 18:29:39 Times Seen54 Hash 0f537e63c621f88c0c4bf4257394b2c2 7f28eaf9bbf93c3a2d4e012aaca4f34c3cbc3c97 559d96c9ff8af5055471707c21b22ac1a7bca706d199dc9f5659a65c02d7e944 Loading...

	www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/	151 kB	2023-03-09	2023-05-05
Pretty URL www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/ IP 74.208.236.111 ASN #8560 IONOS SE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 04:28:11 Last Seen2023-05-05 12:50:33 Times Seen15 Hash 89716296c565960e4dcd886beb30c119 8f0975305bd8da00946366e9b3af1be1a1201974 e6f8e5833e41c4ef624208d26ea92ce1943c699be1e7b813fbe48dff4d96cd87 Loading...

		Size	First Seen	Last Seen
	#1 Eval - 926bee349e653cb07604659df10443f1	5.8 kB	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:39:19 Last Seen2024-04-10 18:29:39 Times Seen28 Hash 926bee349e653cb07604659df10443f1 41398d8facb4a3adf258926f1ff2b791b7cb64e3 c434981231757e151338d82440787196d61aff8e65c9cd890ada8ffcfba2c2e0 Loading...

HTTP Transactions (40)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
16803ffa29e10ee999c43eb4e4acfe92
a5ede865a388fa440f20994b43c417d403e9a493
08de8f6abb622e84d2cb6e88dee8fc7c408147ac43da9c24d4cde510ed36b53a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "08DE8F6ABB622E84D2CB6E88DEE8FC7C408147AC43DA9C24D4CDE510ED36B53A"
Last-Modified: Mon, 02 Jan 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9798
Expires: Wed, 04 Jan 2023 09:00:29 GMT
Date: Wed, 04 Jan 2023 06:17:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b5997a492d3d161c9009d95add566733
9db765ae549ebe4aa859ca27abe365cf7f62dc4d
1ec0de25b0afd3b402c728b9c6b47c4fcf25fb989052427886841a3f52510a0e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1EC0DE25B0AFD3B402C728B9C6B47C4FCF25FB989052427886841A3F52510A0E"
Last-Modified: Wed, 04 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17202
Expires: Wed, 04 Jan 2023 11:03:53 GMT
Date: Wed, 04 Jan 2023 06:17:11 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 04 Jan 2023 05:36:20 GMT
content-type: application/json
age: 2451
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
225d42543c0190cdb3686bf236533f4f
13a0940800fce078487372b6b3ca614dd1ab6c31
766bbe15eb1642ac39e9b71669fbb44252471c8de5adb555cd1a76db44fbe7bc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "766BBE15EB1642AC39E9B71669FBB44252471C8DE5ADB555CD1A76DB44FBE7BC"
Last-Modified: Mon, 02 Jan 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3986
Expires: Wed, 04 Jan 2023 07:23:37 GMT
Date: Wed, 04 Jan 2023 06:17:11 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: 5P0Ja+BVKytUPXAGkkpdp4MupQPGIUOxV16nZeGiXTXCaRykzPdCFPxDKeZlz/F5Ue4jaaV62znGMf+Ftgyp7g==
x-amz-request-id: 2EM634GFBGM380CG
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 04 Jan 2023 05:59:00 GMT
age: 1091
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/

74.208.236.111

302 Found

323 B

URL HTTP/1.1
www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
323 B (323 bytes)
Hash
d43a4f342edbcfa06ca55c28f39ccd6f
61178b5631b3855ee983986e393ac1a175f85a3a
e343deb3d9175a3de5397899747470cbf21d87079f362acb9e27c5d3f661da82

Detections

Analyzer	Verdict	Alert
openphish	Capital One Financial Corporation
fortinet	Phishing

HTTP Headers

GET /cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/ HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Found
Content-Type: text/html; charset=iso-8859-1
Content-Length: 323
Connection: keep-alive
Keep-Alive: timeout=15
Date: Wed, 04 Jan 2023 06:17:11 GMT
Server: Apache
Location: https://www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 04 Jan 2023 06:17:11 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, ETag, Pragma, Last-Modified, Expires, Alert, Content-Type, Retry-After, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 04 Jan 2023 06:08:11 GMT
age: 541
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/

74.208.236.111

301 Moved Permanently

347 B

URL HTTP/2
www.bluekapwa.ca/cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
347 B (347 bytes)
Hash
15b5908c4a80c01312d6a251ec8098e4
829c039f8d630acc83f0bfc3339913e679bbb540
c82c2cdf35157b5ab60cac7deb50b843300d0bd073b2c7014b5340bbbcafd7c7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
openphish	Capital One Financial Corporation
fortinet	Phishing

HTTP Headers

GET /cfg/2db17b39bd22d4d7856d26f2db17856d26f2db17b39bd22d320b39bd22d4d101856d26f2db17b39bd22d3204021eb0bf7d/account/kb/ HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 301 Moved Permanently
content-type: text/html; charset=iso-8859-1
content-length: 347
location: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
date: Wed, 04 Jan 2023 06:17:12 GMT
server: Apache
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
49d6e3cef8f01f0261ff5644001d652b
03eca12234d73b1f3e8489939e4f6551914d29b2
bb680ef4d4989e9e1147da3a7d5ccc518f63108b4ed1f2367a2793db0f740f21

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1397
Cache-Control: max-age=97974
Content-Type: application/ocsp-response
Date: Wed, 04 Jan 2023 06:17:12 GMT
Etag: "63b3f029-1d7"
Expires: Thu, 05 Jan 2023 09:30:06 GMT
Last-Modified: Tue, 03 Jan 2023 09:06:49 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

52.38.146.2

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.38.146.2:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: o+pxv7h+xSQ4h0N9TY5GdQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: o7cwm6wBJP1JBjDVwN6xxCRkYVc=

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
451a5bbd03c487dd9d250cc36d6c64b1
686f54242c66b065264bc0691739260cb91cec57
92911a1f30f4e94dcca7e4e760bdcc227d0bb159805baa3e1819962893bf8239

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5094
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 04 Jan 2023 06:17:13 GMT
Last-Modified: Wed, 04 Jan 2023 04:52:19 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 279

cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js

104.17.24.14

200 OK

11 kB

URL HTTP/2
cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js
IP
104.17.24.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (45552)
Size
11 kB (10899 bytes)
Hash
6dd93e13c5bb3b67dadd0de250ffea2f
961bf5bb7cc4aa32bcd66b9ac34461f7e02d96d3
1238c95de9a6c90c1992853fd140b31d2ec8854a09deaa0d4a2d3136281af5e9

HTTP Headers

GET /ajax/libs/imask/3.4.0/imask.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Wed, 04 Jan 2023 06:17:13 GMT
content-type: application/javascript; charset=utf-8
content-length: 10899
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e9f-b217"
last-modified: Mon, 04 May 2020 16:11:11 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 7812761
expires: Mon, 25 Dec 2023 06:17:13 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hugDZj3FyLV1cLFIRosD0KvHLLe7%2BNfhjySVmcfcC%2FyigmDD6p5iPYvLSZ%2BMuOcQTQ4nztXkQE2iYGc4xAcSBcAO%2BgrEP7cBtQ0JNHLXjPcDGG0MntBLypNOG7qFOV%2BEKAiuBNMz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7841d994e8ffb515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
451a5bbd03c487dd9d250cc36d6c64b1
686f54242c66b065264bc0691739260cb91cec57
92911a1f30f4e94dcca7e4e760bdcc227d0bb159805baa3e1819962893bf8239

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5094
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 04 Jan 2023 06:17:13 GMT
Last-Modified: Wed, 04 Jan 2023 04:52:19 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 279

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/capital-one-logo.svg

74.208.236.111

200 OK

4.0 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/capital-one-logo.svg
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
ASCII text, with very long lines (3967), with CRLF line terminators
Size
4.0 kB (3971 bytes)
Hash
f0b7ad81821effc52540e39cafda48f9
33d64bc7001f414f12bd92e740a45e5ced239add
57dfca5b95599a613da940f4a49ab6378fcf0586366a47cae679796930bf0eed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/capital-one-logo.svg HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: image/svg+xml
content-length: 3971
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "f83-5ef762be36cb4"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 04 Jan 2024 06:17:13 GMT
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/css/style.css

74.208.236.111

200 OK

4.2 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/css/style.css
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
ASCII text
Size
4.2 kB (4248 bytes)
Hash
4572542ac353167e7fcd4b37c42cc452
c3072ef8fddc1f11e80afe2de5c72867628d42a7
724701ba0869c2848b479b01f166f66c868e5e6b4405b3fe9ab147c16a6068e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/css/style.css HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: text/css
content-length: 4248
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "1098-5ef762be2ff53"
accept-ranges: bytes
cache-control: max-age=2592000
expires: Fri, 03 Feb 2023 06:17:13 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/examine.svg

74.208.236.111

200 OK

2.1 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/examine.svg
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2092), with no line terminators
Size
2.1 kB (2092 bytes)
Hash
5791de769b621b54ec564801ab823f10
f9cb957eb9d2ef18c32c71af001e2e7bb0380f5d
a9e240fa54e4bd317fb06ce0920687e1f1a577d70c9593db633891126e8fbd29

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/examine.svg HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: image/svg+xml
content-length: 2092
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "82c-5ef762be38bf4"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 04 Jan 2024 06:17:13 GMT
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c4719f10b16aa492c5dbdb8a1bfc20af
21831c11bfc9679c9f0ebc1f6a39284a5d16be56
c8682ee9e025254ee9cd1d9c663a40707cb170c141a328a7de07ded8de06f787

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8682EE9E025254EE9CD1D9C663A40707CB170C141A328A7DE07DED8DE06F787"
Last-Modified: Sun, 01 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9177
Expires: Wed, 04 Jan 2023 08:50:11 GMT
Date: Wed, 04 Jan 2023 06:17:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c4719f10b16aa492c5dbdb8a1bfc20af
21831c11bfc9679c9f0ebc1f6a39284a5d16be56
c8682ee9e025254ee9cd1d9c663a40707cb170c141a328a7de07ded8de06f787

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8682EE9E025254EE9CD1D9C663A40707CB170C141A328A7DE07DED8DE06F787"
Last-Modified: Sun, 01 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9177
Expires: Wed, 04 Jan 2023 08:50:11 GMT
Date: Wed, 04 Jan 2023 06:17:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c4719f10b16aa492c5dbdb8a1bfc20af
21831c11bfc9679c9f0ebc1f6a39284a5d16be56
c8682ee9e025254ee9cd1d9c663a40707cb170c141a328a7de07ded8de06f787

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8682EE9E025254EE9CD1D9C663A40707CB170C141A328A7DE07DED8DE06F787"
Last-Modified: Sun, 01 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9177
Expires: Wed, 04 Jan 2023 08:50:11 GMT
Date: Wed, 04 Jan 2023 06:17:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c4719f10b16aa492c5dbdb8a1bfc20af
21831c11bfc9679c9f0ebc1f6a39284a5d16be56
c8682ee9e025254ee9cd1d9c663a40707cb170c141a328a7de07ded8de06f787

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8682EE9E025254EE9CD1D9C663A40707CB170C141A328A7DE07DED8DE06F787"
Last-Modified: Sun, 01 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9177
Expires: Wed, 04 Jan 2023 08:50:11 GMT
Date: Wed, 04 Jan 2023 06:17:14 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe1e7ae45-d7bc-45ee-b5cf-e5f349c76c4e.jpeg

34.120.237.76

200 OK

7.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe1e7ae45-d7bc-45ee-b5cf-e5f349c76c4e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.7 kB (7655 bytes)
Hash
1debd0fa88aad972c29c52a1e9957ccd
23d96a350188af576789a17d4c3d8dd49ae013ff
066e3a682b655aa0a181887d74d51b6a46cb9a77a6ca33c7062cb30d4efef3b8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe1e7ae45-d7bc-45ee-b5cf-e5f349c76c4e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7655
x-amzn-requestid: d972df9b-3a43-4352-9a7a-057e6bb7a17b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eL3I4H3_oAMFjBA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b49f05-464fc6182f45c555787f10e7;Sampled=0
x-amzn-remapped-date: Tue, 03 Jan 2023 21:32:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: EWN1t8MkyIQzM29O214hR652QfjSuYQZk16PrQoMQBHSD4sykn4IEw==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Tue, 03 Jan 2023 21:56:12 GMT
age: 30062
etag: "23d96a350188af576789a17d4c3d8dd49ae013ff"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/

74.208.236.111

200 OK

29 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
data
Size
29 kB (29175 bytes)
Hash
f9fd3ceb82257022d1bb60ce4164dd2b
7f96d2f05dffac2f0f06b70850d9a7f1c253bf5b
d338449de9dfa0ad1ccbc1add0573c974670c01452df796f7ee1c0cb17a6d0fa

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/ HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Wed, 04 Jan 2023 06:17:12 GMT
server: Apache
content-encoding: gzip
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47c59aba-5379-4fff-95d5-8540d0c16430.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (12457 bytes)
Hash
3c01df2f086c1d09c62a5807068c3cac
1061a5dc02f6d20370df15fdf9149e4eb584c57d
f9aa18ca218f97cd5202c68d9f308774c61342b508dbe330ea13ccae642a47c9

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47c59aba-5379-4fff-95d5-8540d0c16430.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12457
x-amzn-requestid: a1201e80-94d8-47fa-b658-82b77166189e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eL3qEEO3oAMFjDg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b49fd9-1467b4de3b1a372910bfacc6;Sampled=0
x-amzn-remapped-date: Tue, 03 Jan 2023 21:36:25 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mojjbk4rJDJGzOjNGtw6g6GuasWhHUg9u3UWU_4AswkxiozseoQmCg==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Tue, 03 Jan 2023 21:41:38 GMT
age: 30936
etag: "1061a5dc02f6d20370df15fdf9149e4eb584c57d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7fbc2bda-914f-48de-ba69-0e5ab6ef0311.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.4 kB (7395 bytes)
Hash
d7dc8674d02ff8ad635ad33509ea3d9f
928c4043ae573b01d9faca39f96c49ad7c38da39
14946029a47840da573e272c7b60ec142f89818a3750fe288b6fa34fac501176

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7fbc2bda-914f-48de-ba69-0e5ab6ef0311.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7395
x-amzn-requestid: 158d3961-42cf-418c-a66a-62786216b7a9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eL34wGmHIAMF6xw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b4a037-22558e746f81da5622b33f33;Sampled=0
x-amzn-remapped-date: Tue, 03 Jan 2023 21:37:59 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: KHHaVNPDuI8aGWqqvNq5rLEPl2V9FbO84Mkbb76n4ZE6p3W6dZ2IeA==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Tue, 03 Jan 2023 21:49:52 GMT
age: 30442
etag: "928c4043ae573b01d9faca39f96c49ad7c38da39"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9ff2360c-5204-4d20-b397-821a4c4421e7.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11877 bytes)
Hash
359f30e64bec00d0a01acd69a08b684d
ac965c8642c4d1e47713965060fa2fc8f19088b1
fff1b001462468cc953092a2312650c03f307e95c40e2c6bb7356e2a8b9b0283

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9ff2360c-5204-4d20-b397-821a4c4421e7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11877
x-amzn-requestid: 884b9243-6a8a-4434-9b2a-e5eff84d4e99
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eL33bFnDoAMFpoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b4a02f-3f7043ae29d21e010ddc1ff9;Sampled=0
x-amzn-remapped-date: Tue, 03 Jan 2023 21:37:51 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: WcUVY1LHWCEWWyJZEhS8M5tlXhx5WDnIr9RmxLMvqIilnREfwORJew==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Tue, 03 Jan 2023 22:12:53 GMT
age: 29061
etag: "ac965c8642c4d1e47713965060fa2fc8f19088b1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe9ecc719-60f0-4a52-b964-f7ba1917dff9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.2 kB (7165 bytes)
Hash
48315ea620c3dc9697a816f0f9354052
62d5ba126490fb38ed2a8f6ea0fe43b0b4302fc4
6b37b106c6b1cc612a3704a99223bab98123da3031f8967f92a06f243b05da3a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe9ecc719-60f0-4a52-b964-f7ba1917dff9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7165
x-amzn-requestid: b1b9736b-f624-44e0-81ae-89b67b1888b7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eDR3EFT4IAMFwzg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b1302d-0143e93a6ae1b1636a9d0450;Sampled=0
x-amzn-remapped-date: Sun, 01 Jan 2023 07:03:09 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 92zBbGBQ_ITUCOhk3KT3skYxXN3Y07KbY4TuxE8J_eYlFDr4GlkayA==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Tue, 03 Jan 2023 09:29:44 GMT
age: 74850
etag: "62d5ba126490fb38ed2a8f6ea0fe43b0b4302fc4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/styles.475f87ef7e34e703d941.css

74.208.236.111

200 OK

116 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/styles.475f87ef7e34e703d941.css
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
ASCII text, with very long lines (65536), with no line terminators
Size
116 kB (116197 bytes)
Hash
6268f898e79f113dced13dcebe38b10f
7ecc82d74dda1ef9ad06700d4edcbafbc6de261a
c1470f7e138a7522526d75fdb5b1597f9adafb7bdbec38b11b89c46e931f450c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/styles.475f87ef7e34e703d941.css HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: text/css
content-length: 116197
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "1c5e5-5ef762be42836"
accept-ranges: bytes
cache-control: max-age=2592000
expires: Fri, 03 Feb 2023 06:17:13 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/browserFingerPrintv1.min.js.download

74.208.236.111

200 OK

28 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/browserFingerPrintv1.min.js.download
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
ASCII text, with very long lines (28442), with no line terminators
Size
28 kB (28442 bytes)
Hash
0f537e63c621f88c0c4bf4257394b2c2
7f28eaf9bbf93c3a2d4e012aaca4f34c3cbc3c97
559d96c9ff8af5055471707c21b22ac1a7bca706d199dc9f5659a65c02d7e944

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/browserFingerPrintv1.min.js.download HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: application/javascript
content-length: 28442
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "6f1a-5ef762be36cb4"
accept-ranges: bytes
cache-control: max-age=2592000
expires: Fri, 03 Feb 2023 06:17:13 GMT
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/equal_housing_lender.svg

74.208.236.111

200 OK

3.7 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/equal_housing_lender.svg
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3739), with no line terminators
Size
3.7 kB (3739 bytes)
Hash
0a9caf42835ab4b61876bddec69ce0de
d30fd829250e6439b36ddd5e1b2354a52f309a4e
6043dfa194d29e8e22dc4aeed56d87b6a9a7623b97c3334592031570f4281d89

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/equal_housing_lender.svg HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: image/svg+xml
content-length: 3739
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "e9b-5ef762be38bf4"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 04 Jan 2024 06:17:13 GMT
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/fdic.svg

74.208.236.111

200 OK

2.1 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/fdic.svg
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (2063), with no line terminators
Size
2.1 kB (2063 bytes)
Hash
508681d436b6b42ca2fe4f037d575129
78a4d0e58d49cfce4ed992dcd7265548c1fa7814
628de643d113e225cf4347ed2571ee813cb0919a3895d1902ee18e6f63d539f1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/files/fdic.svg HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: image/svg+xml
content-length: 2063
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "80f-5ef762be39b94"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 04 Jan 2024 06:17:13 GMT
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/js/script.js

74.208.236.111

200 OK

99 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/js/script.js
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
ASCII text, with very long lines (18129)
Size
99 kB (99372 bytes)
Hash
1501b528220baca92f7d189b7f00136b
60b48644dc907af63a10411190e9e085857a7078
9b11ce0ce39ad24aa3c869cbde323c1605bbafdfd45ab8f013aa48731d5a4969

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/js/script.js HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: application/javascript
content-length: 99372
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "1842c-5ef762be725de"
accept-ranges: bytes
cache-control: max-age=2592000
expires: Fri, 03 Feb 2023 06:17:13 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
404dcfeee16bd3d823459fde600e0035
46137c573a79345bfc20b775d5d13041e770a307
cb0051fb8353d91491f721bd1a05506a7086ba6db18f60b36de1b242b2cbe1f2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5641
Cache-Control: max-age=160573
Content-Type: application/ocsp-response
Date: Wed, 04 Jan 2023 06:17:14 GMT
Etag: "63b4d41e-1d7"
Expires: Fri, 06 Jan 2023 02:53:27 GMT
Last-Modified: Wed, 04 Jan 2023 01:19:26 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Lt.woff2

104.110.12.190

200 OK

28 kB

URL HTTP/2
ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Lt.woff2
IP
104.110.12.190:0
ASN
#16625 AKAMAI-AS

File type
Web Open Font Format (Version 2), TrueType, length 27852, version 1.0\012- data
Size
28 kB (27852 bytes)
Hash
cb37fa55f3dfdd26d61901032a53644f
1115e8d43a08c1f74ec1f6a886d1cb530bb9da97
902c5a9d8ad932630fb2021fe1a1a7f4f06513b19e8d073866178ee65ff33fe9

HTTP Headers

GET /CI_Common/assets/fonts/Optimist_W_Lt.woff2 HTTP/1.1
Host: ecm.capitalone.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.bluekapwa.ca
Connection: keep-alive
Referer: https://www.bluekapwa.ca/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 27852
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "cb37fa55f3dfdd26d61901032a53644f"
x-amz-server-side-encryption: AES256
x-amz-version-id: Q75rYxmglrbgkwTTGgaHL71RQB9n5YCD
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: WZLHu-KyMHr9Oi38M7o8z4XXwUqHnVG-f6Rg-E6l9knxWl69APaosA==
x-datastream-cache-status: 1
cache-control: max-age=1477640
expires: Sat, 21 Jan 2023 08:44:34 GMT
date: Wed, 04 Jan 2023 06:17:14 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
404dcfeee16bd3d823459fde600e0035
46137c573a79345bfc20b775d5d13041e770a307
cb0051fb8353d91491f721bd1a05506a7086ba6db18f60b36de1b242b2cbe1f2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5641
Cache-Control: max-age=160573
Content-Type: application/ocsp-response
Date: Wed, 04 Jan 2023 06:17:14 GMT
Etag: "63b4d41e-1d7"
Expires: Fri, 06 Jan 2023 02:53:27 GMT
Last-Modified: Wed, 04 Jan 2023 01:19:26 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
404dcfeee16bd3d823459fde600e0035
46137c573a79345bfc20b775d5d13041e770a307
cb0051fb8353d91491f721bd1a05506a7086ba6db18f60b36de1b242b2cbe1f2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2322
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 04 Jan 2023 06:17:14 GMT
Last-Modified: Wed, 04 Jan 2023 05:38:32 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Rg.woff2

104.110.12.190

200 OK

28 kB

URL HTTP/2
ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Rg.woff2
IP
104.110.12.190:0
ASN
#16625 AKAMAI-AS

File type
Web Open Font Format (Version 2), TrueType, length 28388, version 1.0\012- data
Size
28 kB (28388 bytes)
Hash
f4e1fbca28c954a486a90828b2ee7543
7750f00fe0337120e16632ea7fff2a78b11c874a
9b98e19f831844b3dae8e1fd65b6802bc778446fbdacac8203e34bbc02eacbcd

HTTP Headers

GET /CI_Common/assets/fonts/Optimist_W_Rg.woff2 HTTP/1.1
Host: ecm.capitalone.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.bluekapwa.ca
Connection: keep-alive
Referer: https://www.bluekapwa.ca/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 28388
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "f4e1fbca28c954a486a90828b2ee7543"
x-amz-server-side-encryption: AES256
x-amz-version-id: 1GgM.ruzxSoQhqV._aklwOsuyVwoqFBE
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: BGWuX4caZ0kfZbeEU9EBXkYNIfAXAQn7qhOobVDMcBZpZGYT9HOYpw==
x-datastream-cache-status: 1
cache-control: max-age=278187
expires: Sat, 07 Jan 2023 11:33:41 GMT
date: Wed, 04 Jan 2023 06:17:14 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_SBd.woff2

104.110.12.190

200 OK

28 kB

URL HTTP/2
ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_SBd.woff2
IP
104.110.12.190:0
ASN
#16625 AKAMAI-AS

File type
Web Open Font Format (Version 2), TrueType, length 28188, version 1.0\012- data
Size
28 kB (28188 bytes)
Hash
d647937062406e5cc182de0cc77947d8
9d4c283a4fca43ae95019091bbd0a9e1b77b97bc
48b4ed4ba8ee0eaeddfba861e6772c61f818931816102636a888ec0b49bce056

HTTP Headers

GET /CI_Common/assets/fonts/Optimist_W_SBd.woff2 HTTP/1.1
Host: ecm.capitalone.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.bluekapwa.ca
Connection: keep-alive
Referer: https://www.bluekapwa.ca/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 28188
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "d647937062406e5cc182de0cc77947d8"
x-amz-server-side-encryption: AES256
x-amz-version-id: QmX7yv6RJT4hT4UTSJmqyU0reaonF3KP
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: SxgW2j2Ku0ctcy9uifxoUSuEGDe6rOxpREUwMoFk23y-XvIAp5y9VA==
x-datastream-cache-status: 1
cache-control: max-age=1514256
expires: Sat, 21 Jan 2023 18:54:50 GMT
date: Wed, 04 Jan 2023 06:17:14 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/img/favicon.ico

74.208.236.111

200 OK

15 kB

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/img/favicon.ico
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
15 kB (15086 bytes)
Hash
d27e1739c7477b10ec6917546ae61f1d
bb36ab8bce726ce72a2d74a8529526bca0fa515d
5f2123af80970c0478de7f373c9d861d886e070592ebcd55fa372d8dfc9752ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/img/favicon.ico HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
content-length: 15086
date: Wed, 04 Jan 2023 06:17:14 GMT
server: Apache
last-modified: Sat, 10 Dec 2022 09:48:25 GMT
etag: "3aee-5ef762be6d7bd"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 04 Jan 2024 06:17:14 GMT
X-Firefox-Spdy: h2

www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/

74.208.236.111

200 OK

0 B

URL HTTP/2
www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
IP
74.208.236.111:0
ASN
#8560 IONOS SE

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/ HTTP/1.1
Host: www.bluekapwa.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2DB17856D26F2DB17B39BD22D320B39BD22D4D101856D26F2DB17B39BD22D3204021EB0BF7D/account/kb/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Wed, 04 Jan 2023 06:17:13 GMT
server: Apache
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (40)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN