Report - prem-inquiry-setup-dyn-require-bank.dns04.com/login.php

Report Overview

Submitted URL
prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
IP
164.92.123.193
ASN
#0
Submitted
2022-11-17 18:55:44
Access
Website Title
Final URL
Tags
None
urlquery detections
DynDNS domain detected
Phishing - Chase
Phishing - Chase

Detections

urlquery
28
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-10T05:12:35Z	413 B	5.8 kB	34.160.144.191
prem-inquiry-setup-dyn-require-bank.dns04.com	unknown	2022-11-17T17:50:49Z	2023-02-26T21:30:01Z	5.9 kB	687 kB	164.92.123.193
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-10T05:10:00Z	333 B	229 B	34.117.237.239
ajax.googleapis.com	12905	2013-08-16T11:51:31Z	2023-03-10T15:05:48Z	760 B	66 kB	216.58.207.234
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-10T13:49:44Z	682 B	1.6 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-10T05:10:00Z	782 B	2.4 kB	34.102.187.140
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-10T05:11:10Z	686 B	1.4 kB	142.250.74.35
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-10T05:10:02Z	606 B	127 B	34.213.140.56
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-10T05:10:04Z	3.2 kB	60 kB	34.120.237.76
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-10T05:09:10Z	1.7 kB	4.4 kB	23.36.76.226
cdnjs.cloudflare.com	235	2015-04-17T22:46:33Z	2023-03-10T08:04:05Z	731 B	12 kB	104.17.24.14

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-17	medium	prem-inquiry-setup-dyn-require-bank.dns04.com/login.php	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	prem-inquiry-setup-dyn-require-bank.dns04.com/login.php	411 B	2023-03-07	2024-03-27
Pretty URL prem-inquiry-setup-dyn-require-bank.dns04.com/login.php IP 164.92.123.193 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:17:38 Last Seen2024-03-27 07:18:37 Times Seen40 Hash 895c416f011da2fb28fe5370d6665c38 2f0a8d7d8c4bd3d82d5a71bc3746f47873096593 dd1141f8c7018cbb24fd0271583d487da473fcdca31977adf02a7180501e248e Loading...

	prem-inquiry-setup-dyn-require-bank.dns04.com/login.php	419 B	2023-03-07	2024-03-27
Pretty URL prem-inquiry-setup-dyn-require-bank.dns04.com/login.php IP 164.92.123.193 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:17:38 Last Seen2024-03-27 07:18:37 Times Seen54 Hash e1038ca21267d0f760d0a810ac8d164f 7f6afbb8610200f32c7e77af612be06fe2e4a608 e0336b4b3d01b738e69bb563da46179360bb17280bc497252fafc0124ea9121b Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/toggleDisabled.js	1.5 kB	2023-03-07	2024-03-27
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/toggleDisabled.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:17:38 Last Seen2024-03-27 07:18:37 Times Seen1944 Hash 63b5a507f54e01418d48f37a53d90896 2b80dcd3c5d18e56b35a451d09838fab7a506471 256a06c938ecc394af763d147219fa14033d3528b1ed9da5f1e2f2ddbc8d2b08 Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/jquery.form-validator.min.js	29 kB	2023-03-07	2024-04-18
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/jquery.form-validator.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:15:37 Last Seen2024-04-18 08:11:07 Times Seen4162 Hash 65d26571933bceaf63fb8cc76e7cbee3 ced024e4ee91e3b87f0d068c35008118c7fb60e8 f1264020dbe3f8813dceb1e15a7d5f4a48f2142e413cb310e7a256f4999d949a Loading...

	ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js	93 kB	2023-03-07	2024-04-18
Pretty URL ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js IP 216.58.207.234 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-18 13:22:04 Times Seen16763 Hash e0e0559014b222245deb26b6ae8bd940 e2f3603e23711f6446f278a411d905623d65201e 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js	88 kB	2023-03-07	2024-04-18
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js IP 216.58.207.234 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-18 18:01:52 Times Seen94993 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

HTTP Transactions (37)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
30c30d01178fc74ac5266ee64c3ee85b
c0c2af8a864c00aa85a8775d55f85ab107150a3b
c15644f69fbfeb99074c7e9711dfc9452ee164fa78eb981b6bae4fb7e3585f2a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C15644F69FBFEB99074C7E9711DFC9452EE164FA78EB981B6BAE4FB7E3585F2A"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4811
Expires: Thu, 17 Nov 2022 20:15:43 GMT
Date: Thu, 17 Nov 2022 18:55:32 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
be1be806b5dca7facbb45a6c3db44652
7ae9380a2f3eca959fe6ff6b3832a17cffd12cf4
1f3338058f8e9cae5c9fdd733c74564312726b01c6efdcd628d851d0c99876b0

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4099
Cache-Control: max-age=146650
Content-Type: application/ocsp-response
Date: Thu, 17 Nov 2022 18:55:32 GMT
Etag: "63760d7b-1d7"
Expires: Sat, 19 Nov 2022 11:39:42 GMT
Last-Modified: Thu, 17 Nov 2022 10:31:23 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3a38b6dd8a4cc335c026aebf2ed348b6
8a386e0ccb0ca4dc502746c45b2ebc3aa3f83cf8
8b4040a645cec1841a00a22765eb3a74978559daf15c54bd4b41b6b48aab7f95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8B4040A645CEC1841A00A22765EB3A74978559DAF15C54BD4B41B6B48AAB7F95"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5406
Expires: Thu, 17 Nov 2022 20:25:38 GMT
Date: Thu, 17 Nov 2022 18:55:32 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
d130218d0e2841f39c99610fe1a2ab90
29fbe1e177ee55c7a61ae0a206afff271cf5f945
6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 17 Nov 2022 18:44:56 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 636
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: KffK+NzxOBVND53Ckyfvx/vfcG1AZ7w2bBdzWkXpdRSb3GsNYIEVajY8bsQi+05Fdx3YfaG64O4=
x-amz-request-id: ZJ7EVMARJ3WQ7GYN
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 17 Nov 2022 18:52:35 GMT
age: 177
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

prem-inquiry-setup-dyn-require-bank.dns04.com/login.php

164.92.123.193

200 OK

9.9 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
IP
164.92.123.193:0
ASN
#0

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (702), with CRLF line terminators
Size
9.9 kB (9938 bytes)
Hash
762a92297384c6cab2408e49130f3d6d
5db998d9fe969d71d77ed5acff32a20d208d03ed
96dfffeb1abab47cd960eef643e522a73c69eb40cdb8769b07c4ff2b0a2f7cd5

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
fortinet	Phishing

HTTP Headers

GET /login.php HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:32 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 17 Nov 2022 18:55:32 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/jquery.form-validator.min.js

104.17.24.14

200 OK

9.4 kB

URL HTTP/1.1
cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/jquery.form-validator.min.js
IP
104.17.24.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (29177)
Size
9.4 kB (9423 bytes)
Hash
c77a126f5a1763cba1f40df808bd670b
1aaf935d5c9605b268d982c7b43b4435b6c78b11
09a2aac74dd63101eff013af9178b8d90696a198232a129a41a1e43aa54551d1

HTTP Headers

GET /ajax/libs/jquery-form-validator/2.3.26/jquery.form-validator.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:32 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 9423
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "5eb03ec2-72c7"
Last-Modified: Mon, 04 May 2020 16:11:46 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
CF-Cache-Status: HIT
Age: 1143382
Expires: Tue, 07 Nov 2023 18:55:32 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ybNE7VmS9zU2i0z%2B4Mlbx3y0bz6ZQZPgLWYYTgeq0QBsgevUtEdI4fOtOKuzHIOexOIbQ61qCnZs%2BEgWr%2FQY8LdmqVvU5pStQ7819ZCqQLdfoV%2BhZQ2qPvDx57mM0X5v7F%2Bw8PLH"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76baae64ce56b50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

216.58.207.234

200 OK

33 kB

URL HTTP/1.1
ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
IP
216.58.207.234:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (32072)
Size
33 kB (32954 bytes)
Hash
d38e2944bbc9ae54b8947a2bd0b9a932
782a825679b248d38979c2d7ecae257873344437
65a0917567cb7037612cf420629873f2f3594d2e741aaadf90d893d07d8f5fdd

HTTP Headers

GET /ajax/libs/jquery/1.10.2/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/

HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 32954
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Wed, 16 Nov 2022 13:33:42 GMT
Expires: Thu, 16 Nov 2023 13:33:42 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Content-Type: text/javascript; charset=UTF-8
Age: 105710

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
e0988257645d0359bc09fcf8f36ee806
21ea6f07f4eaa0f49a91b1ea4cb50b89997b8d95
d3c26792aa54f799696df0c32e5f3fec39da752ac732bfdac2a7b36623197bec

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 17 Nov 2022 18:55:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

216.58.207.234

200 OK

31 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP
216.58.207.234:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (65451)
Size
31 kB (30774 bytes)
Hash
81182f4b684635f6bdcbdd907ee66f25
a1f2f151df72ede41397c8131bd47a3ce85575b3
be40946c98d9a78a3c7c9ad097d379ab12549a195bd7a4766919a1d3fd987396

HTTP Headers

GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30774
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Nov 2022 16:16:09 GMT
expires: Fri, 17 Nov 2023 16:16:09 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Mon, 13 May 2019 14:37:17 GMT
content-type: text/javascript; charset=UTF-8
age: 9563
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
e0988257645d0359bc09fcf8f36ee806
21ea6f07f4eaa0f49a91b1ea4cb50b89997b8d95
d3c26792aa54f799696df0c32e5f3fec39da752ac732bfdac2a7b36623197bec

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 17 Nov 2022 18:55:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/blue-ui2.css

164.92.123.193

200 OK

62 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/blue-ui2.css
IP
164.92.123.193:0
ASN
#0

File type
ASCII text, with very long lines (65532), with CRLF line terminators
Size
62 kB (62101 bytes)
Hash
796dcdd3ccc66e8ff69992d578311239
a9ec40637e5be7449fd69e9ff8a023a5134b0b6c
c07e7ef29cc67db74ad5db919c61daff2835a359b9ccccc100ea9eb994ed8851

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/blue-ui2.css HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:32 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/css

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/logon.css

164.92.123.193

200 OK

16 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/logon.css
IP
164.92.123.193:0
ASN
#0

File type
ASCII text, with very long lines (65536), with no line terminators
Size
16 kB (16328 bytes)
Hash
618bd07cb538045b93d022e78eceee72
67653186807880c14406311062f3802cbb5a29cc
83f4fcbebd9c52267f02866021ce0216f585e536fbd89bd747e30f3bf8d052cf

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/logon.css HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:32 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 16328
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/login.css

164.92.123.193

200 OK

1.6 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/login.css
IP
164.92.123.193:0
ASN
#0

File type
ASCII text, with very long lines (1856), with CRLF line terminators
Size
1.6 kB (1576 bytes)
Hash
c289b2efc09e8671b50a9b0d2a68cfdf
57e8425b973a7548bd0582b74b7d3085bb6c1af5
1f5f147bed0fcb8388d01046c9f1a85ec27cf78a04848b9d3568281183283068

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/login.css HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:32 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 1576
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 17 Nov 2022 18:44:49 GMT
cache-control: public,max-age=3600
age: 643
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
c10055ce87434f700ff8b20e3be1f919
477b3c9f1da0c464282bb54572737e76b6e346da
4d78eb296876122e5ff40fcd7667adf1bf8a4b1ee4c8203c88a63ce8d7910a57

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5374
Cache-Control: max-age=142856
Content-Type: application/ocsp-response
Date: Thu, 17 Nov 2022 18:55:33 GMT
Etag: "6375f9af-1d7"
Expires: Sat, 19 Nov 2022 10:36:29 GMT
Last-Modified: Thu, 17 Nov 2022 09:06:55 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/dashboard.css

164.92.123.193

200 OK

214 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/dashboard.css
IP
164.92.123.193:0
ASN
#0

File type
ASCII text, with very long lines (65536), with no line terminators
Size
214 kB (213800 bytes)
Hash
648541c553815b69190deed4b35461ef
2f43d42f827b71bb0792aca1d7a0ffd190da1c6e
cc04d11d14e5c1988c5d5c878bf31f40f27d7be3703883cbb7df3634955ba153

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/dashboard.css HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:32 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/css

push.services.mozilla.com/

34.213.140.56

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.213.140.56:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: kXvsQKc7rphDgMIgvxP8JQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Urho7y6kn4f/oQ9IAp3m0hWhufg=

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/blue-ui.css

164.92.123.193

200 OK

53 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/blue-ui.css
IP
164.92.123.193:0
ASN
#0

File type
ASCII text, with very long lines (65536), with no line terminators
Size
53 kB (52949 bytes)
Hash
f9fdc3a60629e3e17f1dbd12387c3acc
f3568a5a139fd44b103f987a92147621ad24683b
541d313f599632d4529ad0977bc4d2a26508cb1a1964e75a5bf473892ad0121e

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/blue-ui.css HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/dashboard.css
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:33 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 52949
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/toggleDisabled.js

104.17.24.14

200 OK

765 B

URL HTTP/1.1
cdnjs.cloudflare.com/ajax/libs/jquery-form-validator/2.3.26/toggleDisabled.js
IP
104.17.24.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (1294)
Size
765 B (765 bytes)
Hash
ac199842c5e81e3e31d3c7526dd58a83
04a14d7f565adcbb606353c6a169f2b0dcf73754
87b5d0c1b44a285f0f5f3d99f8de4ec6ef72a3fc7136195ff9f5129984a8adfe

HTTP Headers

GET /ajax/libs/jquery-form-validator/2.3.26/toggleDisabled.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:33 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 765
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "5eb03ec2-5dc"
Last-Modified: Mon, 04 May 2020 16:11:46 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
CF-Cache-Status: HIT
Age: 399912
Expires: Tue, 07 Nov 2023 18:55:33 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fjga%2FHThqeMjPZCIb3eCfHRYZBjLxMu7LXUVefGhDWEYJTBT3cB44kqbCMevOz5lgeuogku7E6kjpK4X3Z2TqzungJo05dZ37V1vkv4q%2FzEhHTMurDXotqxSMVwUXHHAN4ER2x6Z"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76baae6bc9a6b50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/wordmark-white.svg

164.92.123.193

200 OK

1.4 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/wordmark-white.svg
IP
164.92.123.193:0
ASN
#0

File type
SVG Scalable Vector Graphics image\012- , ASCII text
Size
1.4 kB (1409 bytes)
Hash
b55b042f907bc7108f5dca2103a8476b
9fcdcc86bfe1f3c7d4f774775670fbd08fe7556c
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/img/wordmark-white.svg HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/logon.css
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:33 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Content-Length: 1409
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/fonts/opensans-semibold.woff

164.92.123.193

200 OK

25 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/fonts/opensans-semibold.woff
IP
164.92.123.193:0
ASN
#0

File type
Web Open Font Format, TrueType, length 25108, version 1.0\012- data
Size
25 kB (25108 bytes)
Hash
33b58dcbc5aa1ae12fa76473c21ffe44
82a3345756101d0f95fe1dab285e9f9c4e79871f
d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/fonts/opensans-semibold.woff HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/login.css
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:33 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Content-Length: 25108
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: font/woff

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/fonts/dcefont.woff

164.92.123.193

200 OK

53 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/fonts/dcefont.woff
IP
164.92.123.193:0
ASN
#0

File type
Web Open Font Format, TrueType, length 52572, version 1.0\012- data
Size
53 kB (52572 bytes)
Hash
246d7cde27d09b7212e3528b6323cef7
45043cf1de108bb0dd2ecaf98d6467f43c25624d
d53f74cb74bb7738f0fa226ead6ddd70a5de9cc9d6ee48034fc2d1f8204aceb4

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/fonts/dcefont.woff HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/blue-ui.css
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:33 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Content-Length: 52572
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/fonts/opensans-regular.woff

164.92.123.193

200 OK

25 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/fonts/opensans-regular.woff
IP
164.92.123.193:0
ASN
#0

File type
Web Open Font Format, TrueType, length 24876, version 1.0\012- data
Size
25 kB (24876 bytes)
Hash
4eeedb4bc24c1cae309e117eea3f102f
ad5a141ef39ad1ada22a464fcd3678fcf72ac22b
b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/css/fonts/opensans-regular.woff HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/login.css
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:33 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Content-Length: 24876
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/background.desktop.night.12.jpeg

164.92.123.193

200 OK

187 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/background.desktop.night.12.jpeg
IP
164.92.123.193:0
ASN
#0

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1920x1080, components 3\012- data
Size
187 kB (187031 bytes)
Hash
ea18a7bc097d50f19da32e98f80a36ac
f89ad5f1b633e545fdd985f2f0c819ed5d9a1bf7
9b92c0a5ed030335751624ba19a830c8182ef2b82a33c408154d5f71d2ec2e69

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/img/background.desktop.night.12.jpeg HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/css/login.css
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:33 GMT
Server: Apache
Last-Modified: Sat, 29 Feb 2020 04:18:48 GMT
Accept-Ranges: bytes
Content-Length: 187031
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/jpeg

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/chase-touch-icon-152x152.png

164.92.123.193

200 OK

3.3 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/chase-touch-icon-152x152.png
IP
164.92.123.193:0
ASN
#0

File type
PNG image data, 152 x 152, 8-bit/color RGB, non-interlaced\012- data
Size
3.3 kB (3306 bytes)
Hash
c914a8a86590b23691476a4178ea3a52
af16ec4fc3b5446cac17ec8f0044286b835d3295
f3446f452fc926c9182a2a43780faa169e533df8446d4f9a5f62ac2fb5b375e6

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/img/chase-touch-icon-152x152.png HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:34 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Content-Length: 3306
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9426341bb128c1b6ba16e64df78152b4
08859a30ed6dee233cde4d77f2a04f058991502b
209a0520d5fb1eeb6dfa7d2f4c334a7109cc885cf4be8605bfe5a8f52232306d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "209A0520D5FB1EEB6DFA7D2F4C334A7109CC885CF4BE8605BFE5A8F52232306D"
Last-Modified: Tue, 15 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3564
Expires: Thu, 17 Nov 2022 19:54:58 GMT
Date: Thu, 17 Nov 2022 18:55:34 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9426341bb128c1b6ba16e64df78152b4
08859a30ed6dee233cde4d77f2a04f058991502b
209a0520d5fb1eeb6dfa7d2f4c334a7109cc885cf4be8605bfe5a8f52232306d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "209A0520D5FB1EEB6DFA7D2F4C334A7109CC885CF4BE8605BFE5A8F52232306D"
Last-Modified: Tue, 15 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3564
Expires: Thu, 17 Nov 2022 19:54:58 GMT
Date: Thu, 17 Nov 2022 18:55:34 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9426341bb128c1b6ba16e64df78152b4
08859a30ed6dee233cde4d77f2a04f058991502b
209a0520d5fb1eeb6dfa7d2f4c334a7109cc885cf4be8605bfe5a8f52232306d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "209A0520D5FB1EEB6DFA7D2F4C334A7109CC885CF4BE8605BFE5A8F52232306D"
Last-Modified: Tue, 15 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3564
Expires: Thu, 17 Nov 2022 19:54:58 GMT
Date: Thu, 17 Nov 2022 18:55:34 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f1b43b0-5ba1-4c6c-9a53-bfae9befdd7d.jpeg

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f1b43b0-5ba1-4c6c-9a53-bfae9befdd7d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6344 bytes)
Hash
a9d32fa3866dd741de610a61a93ad893
4cb2141b1ef1e5bf19a3b355995dcd8fa36f695e
4492338de536cfae6fb42fd37170c60f4fbc281a2a924efe6d2b5af352cd102c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f1b43b0-5ba1-4c6c-9a53-bfae9befdd7d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6344
x-amzn-requestid: cac35b04-be3b-4ae1-bb5e-8cedcd7a7db4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: btqOVFCXIAMFcOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63755728-45c28fa333b748520be29b57;Sampled=0
x-amzn-remapped-date: Wed, 16 Nov 2022 21:33:28 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: mhgNSp1_LsVmn00ULm116flMHpnfE6G6JABrJwXH5i4q-isv_W1-Ig==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 f313d3df80c4dab8f5399614116801cc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 16 Nov 2022 21:34:18 GMT
age: 76876
etag: "4cb2141b1ef1e5bf19a3b355995dcd8fa36f695e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa5e6ba2a-6046-47f6-8da2-f2c9ea6dd2b8.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.4 kB (9362 bytes)
Hash
7e2a2d21ac149d7cf783628b5e815702
ae4692dccf90fa1a30119c95a1539ed8163e574f
5e1ebb536daa764e1c906c60a7a36c0f67aa476e12bf9fe1fda07bf87bc1f299

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa5e6ba2a-6046-47f6-8da2-f2c9ea6dd2b8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9362
x-amzn-requestid: 859ecb2a-831d-48df-a769-4bd9e21941fa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: brWuSF8hoAMFtVA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63746b28-737fcd2d0c4d85eb71bfc452;Sampled=0
x-amzn-remapped-date: Wed, 16 Nov 2022 04:46:32 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: UcWX7UUT0MOlHaUX-wJpnTCTUyngMOWWh10l7O7qIuJ-0lGeYRWSdw==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 2ab6211e66998c8b58132661a7e3cade.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 05:27:03 GMT
age: 48511
etag: "ae4692dccf90fa1a30119c95a1539ed8163e574f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0be1985-4e6e-4cc3-9b6e-2fc0d94bc02b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.7 kB (5749 bytes)
Hash
96b4478c098865b0d19738098db61d64
0e18a8c51596c8a4d84a142a57ffe376294833cc
9c9e433cf8f2167e4cfc3cff247eee85ebb9977e338e6e144acaea830db17c2c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0be1985-4e6e-4cc3-9b6e-2fc0d94bc02b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5749
x-amzn-requestid: ee63924c-be5c-4f48-9fe0-cc2ba3f93ab8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bX5qxHgWoAMFiZA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ca311-32c6916d41247a9b563c952f;Sampled=0
x-amzn-remapped-date: Thu, 10 Nov 2022 07:06:57 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 5hBm4pVThVud5Nr3ReI8uRgqhR3MVsqS4qGEcE5Wrs3pqzyMgH2CRg==
via: 1.1 33d72803ad26b392c1b578a2b1276580.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 06:42:32 GMT
age: 43982
etag: "0e18a8c51596c8a4d84a142a57ffe376294833cc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b2f2035-e536-45fc-90d6-5a76f2b7a8f9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (12337 bytes)
Hash
2bd274d60bc239b0328fe30a442ef2d9
fc4b5a6f389cf683c16e6c229e72b5bfdf9f00ed
f32dab0bb88b93fe3fe49c0b0974cb14e6bdca88d2eaab2d8b9fc42d36ee0dc0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b2f2035-e536-45fc-90d6-5a76f2b7a8f9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12337
x-amzn-requestid: 783b124b-1f0e-445d-b19d-78ed9358c717
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bX6VnGCBoAMFx8Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ca423-6767360524d1bb9a7cf259fb;Sampled=0
x-amzn-remapped-date: Thu, 10 Nov 2022 07:11:31 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: xi0co5JQdy62MidhB6aUpqt8_18pj-ytLday1_6XauQ4v4B1K3qW0w==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Wed, 16 Nov 2022 21:57:12 GMT
age: 75502
etag: "fc4b5a6f389cf683c16e6c229e72b5bfdf9f00ed"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c125d22-7470-46da-85af-7621027dbe03.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.0 kB (8027 bytes)
Hash
785c079072174860502c277b03f7743d
e63af885fa20dbd2a49ee44397d8f8c595b1cbcf
f4d748e2e7b16f41af16e3f2450a4823af56dacaacaa7f1a9537f41186c64148

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c125d22-7470-46da-85af-7621027dbe03.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8027
x-amzn-requestid: 9c8f833a-bc10-4899-aafb-b6068751f15d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bn08wGsOoAMFaSQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637301eb-75b862d5320dfa553466860c;Sampled=0
x-amzn-remapped-date: Tue, 15 Nov 2022 03:05:15 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: fbMtJC2Dfg8rDQl7nw16eZf1C1aMGv-3VtcXARXUaZV80TGvps3aAA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 5954c6394458ffb44c970b3819d7ff2a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 03:51:12 GMT
age: 54262
etag: "e63af885fa20dbd2a49ee44397d8f8c595b1cbcf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92501a28-163f-4c6e-aed7-d31c29354d1e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11667 bytes)
Hash
032386e5c9dffff1ba1ee5e8a322d438
dd4fd6c803a9b333bace9a541c6bd183d0c56bb9
0e9f559a0aa7e114c5810a27ba243c0da7b44dc0bf7aec2b7ab32b8f0e2b536c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92501a28-163f-4c6e-aed7-d31c29354d1e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11667
x-amzn-requestid: ae092a0a-1709-4497-9f07-0348a28d2491
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bqZOIEN7oAMFlaA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637408c0-5ac595df302a8f1d3703ad8d;Sampled=0
x-amzn-remapped-date: Tue, 15 Nov 2022 21:46:40 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: c_SJMaV3uYSUysTSOFV--jQqDUxw-fBp8cXWWUZw9vUjt0d6PsOpxA==
via: 1.1 0bb842bd5868b86440983b936bb0adee.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Thu, 17 Nov 2022 02:49:36 GMT
age: 57958
etag: "dd4fd6c803a9b333bace9a541c6bd183d0c56bb9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/chasefavicon.ico

164.92.123.193

200 OK

32 kB

URL HTTP/1.1
prem-inquiry-setup-dyn-require-bank.dns04.com/Crax/Files/img/chasefavicon.ico
IP
164.92.123.193:0
ASN
#0

File type
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
32 kB (32038 bytes)
Hash
5744986eb3dc6f2da92157a651889902
5a558b58498fab2aeb742acdab51e0c2fbc78385
625816f80596303e9de8e68695973369faa462b416202825b03899c781464fb9

Detections

Analyzer	Verdict	Alert
urlquery		DynDNS domain detected
urlquery		Phishing - Chase

HTTP Headers

GET /Crax/Files/img/chasefavicon.ico HTTP/1.1
Host: prem-inquiry-setup-dyn-require-bank.dns04.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://prem-inquiry-setup-dyn-require-bank.dns04.com/login.php
Cookie: PHPSESSID=0f4f6fdcc8c341482c5c85cb6a291b75

HTTP/1.1 200 OK
Date: Thu, 17 Nov 2022 18:55:34 GMT
Server: Apache
Last-Modified: Sat, 22 Feb 2020 17:41:58 GMT
Accept-Ranges: bytes
Content-Length: 32038
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/x-icon

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (37)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size