Report - fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail

Report Overview

Submitted URL
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail
IP
172.67.208.175
ASN
#13335 CLOUDFLARENET
Submitted
2022-09-23 07:35:39
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
18

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	143.204.55.115
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
ajax.googleapis.com	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	381 B	31 kB	142.250.74.42
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	52.42.74.230
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	57 kB	34.120.237.76
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	662 B	1.4 kB	142.250.74.3
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.77.32
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	143.204.55.49
fti.unmerpas.ac.id	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	4.6 kB	261 kB	172.67.208.175

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

Scan Date	Severity	Indicator	Alert
2022-09-17	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/	Other

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail	Phishing
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/	Phishing
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/config.js	Phishing
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/framework.min.js	Phishing
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/images/icons/icons.svg	Phishing
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/bundle.min.js	Phishing
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Medium.woff2	Phishing
2022-09-23	medium	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Regular.woff2	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js	84 kB	2023-03-07	2024-05-04
Pretty URL ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js IP 142.250.74.42 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-05-04 23:37:16 Times Seen14010 Hash e40ec2161fe7993196f23c8a07346306 afb90752e0a90c24b7f724faca86c5f3d15d1178 874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4 Loading...

	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/config.js	43 B	2023-03-07	2024-03-14
Pretty URL fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/config.js IP 172.67.208.175 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:22:35 Last Seen2024-03-14 06:59:07 Times Seen40 Hash 5fb5664122bd69d952107ac0d19178b5 93c9749d5924b753d6217db83d57717d59d663f9 e530ef443c682ca02cab15d939402ead8c7c060fcf676164efd4078508e510e6 Loading...

	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/framework.min.js	34 kB	2023-03-07	2024-03-13
Pretty URL fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/framework.min.js IP 172.67.208.175 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:22:35 Last Seen2024-03-13 03:02:56 Times Seen34 Hash 0d6793d477095e3ee517dc42da751e40 e9ab9e980bf225c1f97b2032cc3cb848c3951a8a 687c54662b84844c54be2a5a39421290e7ccc05bc8298983d304f28af7e11083 Loading...

	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/	76 B	2023-03-07	2023-03-29
Pretty URL fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/ IP 172.67.208.175 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:22:35 Last Seen2023-03-29 21:45:15 Times Seen4 Hash 72e0fd42591902ec6c60978d33426683 4b244e02328b646fe95a641d4d66d49b062b8299 58e983cb86577a5d1721c3542edfe3bf8a4c901ddbad2ccc7bee10d0ec48812e Loading...

	fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/bundle.min.js	412 kB	2023-03-07	2024-03-13
Pretty URL fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/bundle.min.js IP 172.67.208.175 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:22:35 Last Seen2024-03-13 03:02:56 Times Seen30 Hash b6bff6dd74ea04f80bb0a8ee56fa029b edf7c3f3fd5debe7020202cdbdd90a5e9ed4c3df 43c812e91778bed6e73a73a0fde5fda61b793930ada817126abc015587f53a50 Loading...

HTTP Transactions (33)

URL IP Response Size

firefox.settings.services.mozilla.com/v1/

143.204.55.115

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
143.204.55.115:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
1b3053fa528e28810f8a2cc9284cc921
cca9eb471d941881a6b9a1793aecb6c281908f6a
a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Backoff, Content-Length, Retry-After
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Fri, 23 Sep 2022 07:14:07 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 9dd61138197a68f8d69f12574aab6930.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: VOIdAAk3ZEcN6BIyR2jP3PoT1L3F9R2EnaPp6fFbUuEy_ry6v88cpA==
Age: 1281

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a26d0784548ecab22f417f3d689daf23
8893b79366bbadeb5c8d587b8f023e310694df1c
35baaae7b3ce3110ebb2b075881cfab55ecf3eab57d834283fd18ac691b41fa2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "35BAAAE7B3CE3110EBB2B075881CFAB55ECF3EAB57D834283FD18AC691B41FA2"
Last-Modified: Tue, 20 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2380
Expires: Fri, 23 Sep 2022 08:15:08 GMT
Date: Fri, 23 Sep 2022 07:35:28 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

143.204.55.49

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
143.204.55.49:0
ASN
#16509 AMAZON-02

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Fri, 23 Sep 2022 04:35:15 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: -wqhebpb6tYYaoB3wWebMRRdaQOcm_c5Bdaqz0pngIm8u0gCqUhgvg==
age: 10814
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 07:35:28 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail

172.67.208.175

301 Moved Permanently

277 B

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
277 B (277 bytes)
Hash
a7774ef34f24fcaeff3cefd0dc610215
15a6da2520ff03fd939ff81d257a8c41c5f4ad4a
76d22bbcd051c202f43acc910e5aa11cd016a720aac233c04ce201f0048724ff

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Fri, 23 Sep 2022 07:35:28 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YzRu%2FyEz0nO%2FspMQ0cEV%2BWt1dr5TR5yQMb1%2BEbM0cDbO0AJwpKYYFDjL6W3YQyGq3HMct87QbzzZQ6VvTbhJKmqd7jZfD8Aal7AQusxSmPbebw4pcxNJXErIf9zuEQJX5UM4jzI%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19a917f47b506-OSL
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

143.204.55.115

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
143.204.55.115:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Fri, 23 Sep 2022 07:03:22 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Fri, 23 Sep 2022 07:25:29 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: OJftj_3lpr33_iOqZ9I17ye7ZhFqUQue2VjngjLxGNmVeWpXzt9ovQ==
Age: 1926

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
86624f45fb3b7126dbe002f69c94dd86
30bcf274db5037122f989fb25dbf1e72c9ec417b
2cc9600578cf057dc499835773fb495caa60ac154c4945f0fc1f2b31d43f5502

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5280
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 23 Sep 2022 07:35:29 GMT
Last-Modified: Fri, 23 Sep 2022 06:07:29 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

52.42.74.230

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.42.74.230:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 5Kj5HgtM/5HlnU+IxJDgWQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: gri8eU2MjvpbOYLH7TMiLq0/Oug=

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8ebb267e443b81854ef9a01b3eb6489d
b932e9e5679da5a9160da5429458041765509b52
4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5211
Expires: Fri, 23 Sep 2022 09:02:21 GMT
Date: Fri, 23 Sep 2022 07:35:30 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8ebb267e443b81854ef9a01b3eb6489d
b932e9e5679da5a9160da5429458041765509b52
4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5211
Expires: Fri, 23 Sep 2022 09:02:21 GMT
Date: Fri, 23 Sep 2022 07:35:30 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8ebb267e443b81854ef9a01b3eb6489d
b932e9e5679da5a9160da5429458041765509b52
4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5211
Expires: Fri, 23 Sep 2022 09:02:21 GMT
Date: Fri, 23 Sep 2022 07:35:30 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8ebb267e443b81854ef9a01b3eb6489d
b932e9e5679da5a9160da5429458041765509b52
4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5211
Expires: Fri, 23 Sep 2022 09:02:21 GMT
Date: Fri, 23 Sep 2022 07:35:30 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8ebb267e443b81854ef9a01b3eb6489d
b932e9e5679da5a9160da5429458041765509b52
4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5211
Expires: Fri, 23 Sep 2022 09:02:21 GMT
Date: Fri, 23 Sep 2022 07:35:30 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9444e811-e2d5-4901-a86d-9e9269a6f846.jpeg

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9444e811-e2d5-4901-a86d-9e9269a6f846.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10927 bytes)
Hash
3b6b51846ec2b7d856b7dc12e4d720f4
5a69190a9a778a6979e11fafedd43e1031caf8e2
a497c04d1c9d0be88aa9c288423346e83c6a7b296295387b3b7b855c550492a2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9444e811-e2d5-4901-a86d-9e9269a6f846.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10927
x-amzn-requestid: ae562f19-3dd9-42b1-bb98-ab026140506e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YsqHOHguIAMFS7Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632823c7-6d4bcabf6879463427e68a50;Sampled=0
x-amzn-remapped-date: Mon, 19 Sep 2022 08:09:43 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: u4DgvdhOG7agsl8-aoovMcR029kbfcAk9eoiUiHb-PZuq3RbbFg9Mw==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 21:48:51 GMT
age: 35199
etag: "5a69190a9a778a6979e11fafedd43e1031caf8e2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd24d050-0f4e-43ea-b109-09eb13cf70e5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (6984 bytes)
Hash
d540596f820baceec10c6f88915b4b31
a0446558f4fb73d9f0ef044f19c901f8da94583e
26a61b39202e89bf8a92401ba9c3f04c3891ab96350fb6e9584ae8049824d605

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd24d050-0f4e-43ea-b109-09eb13cf70e5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6984
x-amzn-requestid: ec7457c0-b12b-4d17-b8ed-0c94d0c2ffda
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y1-EWzIAMF7nw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4f2-4403cf134c3da3fc3c5dcc48;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:42 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 1-TYuqDumtvV9U1bfgBkD1RA7w0T0p8w5g_CGb-t_nE3Bq2JtXM2kg==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 22:09:45 GMT
age: 33945
etag: "a0446558f4fb73d9f0ef044f19c901f8da94583e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b936e90-90ba-49d6-946e-b7cd524d23f9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.2 kB (7180 bytes)
Hash
6243782119c18721ebfb39448a079e32
6131afd540498e8ead1b9937bc953fadbdb164f9
9f70c0b851ea5039eee2edf8d37f447946e2d2783d6ce257c0ccbcf9f262d289

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b936e90-90ba-49d6-946e-b7cd524d23f9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7180
x-amzn-requestid: c08a48fa-b734-4ac7-aa76-a1225135b792
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YsS2qHbcIAMFgEQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6327fe90-4a5915de1b0da7a07efddf86;Sampled=0
x-amzn-remapped-date: Mon, 19 Sep 2022 05:30:56 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 6QVS_B0PlpAG7YSjavV2LBnC_hiHBza_hYkyA6MtdaN6iMYmVliMOg==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 07:27:08 GMT
age: 502
etag: "6131afd540498e8ead1b9937bc953fadbdb164f9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ac88c56-4515-47b4-9c1e-7745782bd306.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10127 bytes)
Hash
b877ead4a15221fdd278ef27f281a7ec
48c10714503e8dfdd3e3c3d39b919ef2792f0d15
f4a1d5abcfa4092828e004b6c0605a7a24e4133d275312f613dceff875971daf

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ac88c56-4515-47b4-9c1e-7745782bd306.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10127
x-amzn-requestid: 456e3c6a-e173-433e-8d54-d787cb50b7e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y0sHmCoAMFVSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4ea-7a07b336571396533e48b4cb;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:34 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: gWZNsIn_FEbYwMeR1JArmPEgyuHEGgWsfb-wB6P_NrmoHhNgvGWoPw==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 22:07:28 GMT
age: 34082
etag: "48c10714503e8dfdd3e3c3d39b919ef2792f0d15"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ca56e32-b483-4063-a12c-be8fa8c3d85e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.5 kB (8497 bytes)
Hash
7606ff88f05062b66970d9805f38987a
d47db5fcd83023b4a8de40a47d4510e183de387a
20f89dd859e5715e27c289040fac6a121248e5b6c06da0a7f186984ffb029eb2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ca56e32-b483-4063-a12c-be8fa8c3d85e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8497
x-amzn-requestid: 8543ac70-48ab-4523-856f-5d5fa1191c97
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yin-pEryoAMFTfQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6324205d-660bba3f655f940d143bc437;Sampled=0
x-amzn-remapped-date: Fri, 16 Sep 2022 07:06:05 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: e9KUFhjuFMzjuh37rFiNKaMNVaGZwPGBkLrv0zgfSTT7dCIuWj4G9Q==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 22:11:27 GMT
age: 33843
etag: "d47db5fcd83023b4a8de40a47d4510e183de387a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F155952bd-256a-4103-9017-437efcfb03bf.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (7005 bytes)
Hash
1985a957e6bc0c15d8489fa731e7f14e
4584bff61bf4d5c9b8fd3b97c048a8e6975e4323
9f3e1fd6e18d85d4f6645d077da643a3bc2cca611d5e85f534ba798102dca243

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F155952bd-256a-4103-9017-437efcfb03bf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7005
x-amzn-requestid: c805d882-7a00-4abd-a239-d8313d7df0c4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4aBwEaMIAMF09A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd6d7-6d6a417f10c9628a16d438e1;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:42:47 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 7edV0FJytVSpHH-WkCiYzhW1JP4L6i6bpPCq9MTxPdhwFQTryf06BQ==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 9c675215120a4ade8754c4357ef2f3ea.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 21:53:16 GMT
age: 34934
etag: "4584bff61bf4d5c9b8fd3b97c048a8e6975e4323"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

172.67.208.175

200 OK

2.1 kB

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4514), with CRLF line terminators
Size
2.1 kB (2125 bytes)
Hash
556169fefad598bb9270a571641263a2
d372fa6528cc988c3a82d67e7a5463b44f42f6d6
d2afb81bb7c5c6d7b97a1e5103d8d291e7a2f0135cdfd479fa1749ef8b1baaeb

Detections

Analyzer	Verdict	Alert
phishtank	Other
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/ HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Endurance-Cache-Level: 2
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e2P4BKMGFTPWfj5InfYG0gEqOicRwR%2F%2Bk7wZ7QchSN1yfIISuPQoTitgNNhvWpB%2FBehAqvx%2BXgpZfVanFszFhgZVrc3ME7qszkie6VWm32DMtJTmXbrB3RHCYd1uku%2BiTvYGGZU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19a946acfb506-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
ab9170d59e1c01422d2c55356248b569
0df99ca360de0b69a7e79d8e79b6383fec4a5453
7747cc09f59efbc03c3663c9be6bb63248a43f8f310c1bae1466255e83a72455

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 23 Sep 2022 07:35:35 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js

142.250.74.42

200 OK

30 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
IP
142.250.74.42:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (32061)
Size
30 kB (29671 bytes)
Hash
b90b3d2618cce9d766152cd3092b5c27
496339457cd00caab8118e2e1f30ea18dc05b9f4
b7b155aa8c6b5db28f9a6b41e88c96e9462c196c700add426f8ef32c9ce1ed41

HTTP Headers

GET /ajax/libs/jquery/2.1.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 29671
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 16 Sep 2022 15:43:54 GMT
expires: Sat, 16 Sep 2023 15:43:54 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 575501
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
ab9170d59e1c01422d2c55356248b569
0df99ca360de0b69a7e79d8e79b6383fec4a5453
7747cc09f59efbc03c3663c9be6bb63248a43f8f310c1bae1466255e83a72455

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 23 Sep 2022 07:35:35 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/config.js

172.67.208.175

200 OK

43 B

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/config.js
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text
Size
43 B (43 bytes)
Hash
5fb5664122bd69d952107ac0d19178b5
93c9749d5924b753d6217db83d57717d59d663f9
e530ef443c682ca02cab15d939402ead8c7c060fcf676164efd4078508e510e6

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/js/config.js HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: application/javascript
Content-Length: 43
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
ETag: "630fc04c-2b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0DQ3wbtktm9PkC%2Brrvql5UQEgkIBz%2FTJzroaZRI0LMBAporMqJoZOf11nOXr5goqJIYocN%2BGhXbteehhHSQSXJa6hbmxYhvFY6MVCJd2t0kFdNMvVk4Mlv6SboZascwFsi98%2FeU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 74f19abba880b503-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/api.css

172.67.208.175

200 OK

626 B

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/api.css
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (1915), with no line terminators
Size
626 B (626 bytes)
Hash
68d989b3b039e19b3c3d551c12eacd64
4248325909963f8080d5fadee5ff7eeebd09c490
fadc7c1881693890de476809de13bf32e244d7fc086a7931c7b5c153f4bc4be8

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/css/api.css HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
Vary: Accept-Encoding
ETag: W/"630fc04c-77b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q8LfzOzDcBf6TMWcjQu3T%2BB2v7etJrS7lKrGq%2FUFvHx5pum3XU%2BgWg%2BoA%2BFLaVnhPt3FG4b8yr%2FPkmw1t%2BEZp9Kso%2FcpEwm8dfhsL4qYFepZYtW2ZH7gjLV%2Bka%2Fj8xtC%2BiQqm20%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19abb9db4b506-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/style.css

172.67.208.175

200 OK

8.7 kB

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/style.css
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
Unicode text, UTF-8 text, with very long lines (43311)
Size
8.7 kB (8691 bytes)
Hash
6ab82ab49e75eb963f20cea8e5088ab0
148e8814613995d5d329ae05352bfc1a86af5bb0
63ccb056e1ecbd0e37d32d5a05edf9edc9a20b6afbb9578dd74ef0ac90330d9e

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/css/style.css HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
Vary: Accept-Encoding
ETag: W/"630fc04c-b798"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZiBg4DaeojvsDHnQujtojlRfnR7%2BDwWB4ve%2F7BY6BSq19uqOrvxPd%2Bs%2FoCThujJ2G2eFvjcslUJCQWfXSSpwDAVEjuz%2FYRb7edtjUYkxjUYrGmhVn9aGifKgryG44HL4MO3bQ2I%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19abbab9e1bfe-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/framework.min.js

172.67.208.175

200 OK

9.8 kB

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/framework.min.js
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (31994)
Size
9.8 kB (9810 bytes)
Hash
d4ba2920533969595af1c3e7790eff18
516e1678c2368b7651d07a303f0defee1762e3dc
3a930fd2c778e973dedc6d96cee2d6b6708f11bcdaa0c1bb644142c0d8020e50

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/js/framework.min.js HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
Vary: Accept-Encoding
ETag: W/"630fc04c-8503"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9krfcc8kEWq7CRcBGtSJOEu4RBlK%2FHz12PY2Td5E5gc6%2Bs4j6UIKB%2FXeyqkyDwJYx3Qw5M8V5i1uRCpGLd7BNKpNhz4lmrnHCDozdVPXjNUD8OVnn2SM6JwFOSQHyrV%2FZyHzL4M%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19abbaf99b521-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/pikaday.css

172.67.208.175

200 OK

1.4 kB

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/pikaday.css
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
Unicode text, UTF-8 text, with very long lines (3271)
Size
1.4 kB (1410 bytes)
Hash
e19093e16c4a7b98cf1e5c85dd31d059
03c7d12ef818097a043e036879d9b984f19eb14a
9d899d9ee7b0ce8ec4abe933cd0df61e74188b09ef9c2ba27ba6e2b9d05bb8c4

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/css/pikaday.css HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
Vary: Accept-Encoding
ETag: W/"630fc04c-d37"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4mnYkK6n5s6S%2Fub2DUCsfYtf1U7BZQRlyv2rXY6%2F6lyJoouaxGdCbMypXkIq6lwxTpAQ56eQB%2FX9u%2FUrse9KSPee7ya64GQG1K1DOZiNa2D3agdkcpbpLh5hrfd%2FLUAU51e1EdU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19abbaf820af6-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/images/icons/icons.svg

172.67.208.175

404 Not Found

173 B

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/images/icons/icons.svg
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
173 B (173 bytes)
Hash
3674c9f9d4cb3aeda8a1dabcf83e21ce
e464bbf96e99f833d457531275b5f4e94d5f633d
d0defd1c3d57c0cc21ccf2602e742ba72684282cebaae43539b5b6c6d97ac5b7

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/images/icons/icons.svg HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 404 Not Found
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Er2Tg9V4WlpLTDF5D0rRU%2FsjKIfir9icFdolgjmTNi9HaCTbV88t3s2yaukmXTp7pQZDwrFufy3ClGoRgaph5FzwQbaceepyzKYRqBBdE9o2FLW9YsLmGyaf6yugKq1U9S1vjlM%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 74f19abeaaf5b521-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/bundle.min.js

172.67.208.175

200 OK

101 kB

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/js/bundle.min.js
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (31985)
Size
101 kB (100636 bytes)
Hash
6c553bb46fb8fef4de58723a5892d4c1
e286bc1f94551e8815e08982fa84987d3d822f18
a831f21b4a173bd7eb8dfa3d469ad4f335e744dea9a142c752c47993bda3653a

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/js/bundle.min.js HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
Vary: Accept-Encoding
ETag: W/"630fc04c-648d1"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=44HK%2BE0laVTtQ2XDhe5gLsgk4n3UeLEr7d67Q5vRn3uw6tDA1BDkcM6xAsLYamk7cN4xedfe7s6mW7LMOfTQ4ac0XHzCGT4kdomG78nGNs%2FLVYVQ8lSxZhbSGnlDc24EocwKLjY%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19abbadbab506-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Medium.woff2

172.67.208.175

200 OK

64 kB

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Medium.woff2
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 63800, version 2.0\012- data
Size
64 kB (63800 bytes)
Hash
86cae98350d9aaa601230e829707d83f
5cb23c2ac98be5b4e0fb8a97e28dda99ae76b8c7
2fea2f2aa913b7aa163f45c897a463ba47a00fba670f747ead3d73c44c0d61bd

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Medium.woff2 HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/style.css

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:36 GMT
Content-Type: font/woff2
Content-Length: 63800
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
ETag: "f938-5e78f17fef3dc"
X-Endurance-Cache-Level: 2
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DdjmmVIwOspajAULAb1lVIeTL3Gu3WnH02D8KMC4uGBeYVQ5FLj8hBd%2BN8cgnJVKqEk0PqxbrFkw%2BURv5rrXHtwaIET%2BmQoV%2Bk%2Fj4TeanpsVSx2hBZrmi%2BeY6l2z4br7yGUqNws%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 74f19abeba510af6-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Regular.woff2

172.67.208.175

200 OK

63 kB

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Regular.woff2
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 63156, version 2.0\012- data
Size
63 kB (63156 bytes)
Hash
38812f4ed9937a253927cd4a918c8540
5cdbe0a3b2ecefc9c25ccefa511cf8a781c78799
65de8a3e5c4e0307b538ebe97df4dbcae0303b7a7afc5753aba95c218ae33a8e

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/fonts/Roboto-Regular.woff2 HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/css/style.css

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:36 GMT
Content-Type: font/woff2
Content-Length: 63156
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
ETag: "f6b4-5e78f17fef7c4"
X-Endurance-Cache-Level: 2
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rnc3zT4gaSqZRUoUWyjdAGId9f%2BUzg%2BjNnbRS%2BUyNV55vN7VVrsY5TSdLMQCeMdF4AWFbuWJfwg6kb7axl1AvPNg6KskI1YkwHlI0ipt1MAXwC%2FH53sSrzWpxcbQOIIYQw3emyk%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 74f19abeccafb503-OSL
alt-svc: h2=":443"; ma=60

fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/images/background.jpg

172.67.208.175

200 OK

0 B

URL HTTP/1.1
fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/images/background.jpg
IP
172.67.208.175:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /wp-admin/user/webgenkic/investopia/webmail/images/background.jpg HTTP/1.1
Host: fti.unmerpas.ac.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://fti.unmerpas.ac.id/wp-admin/user/webgenkic/investopia/webmail/

HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 07:35:35 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 31 Aug 2022 20:10:52 GMT
Vary: Accept-Encoding
ETag: W/"630fc04c-fd380"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Cache: HIT from Backend
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Encoding: gzip
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Am7HSBZg4eSMzB4Vv91NQPN5vKHW5rwUH92w3gAbgMNvJYZrOQqSgZnDbfx%2BX96Z1F4ur8WjAMbwiaIYAbvDJuYYHficMzXPMptr7SD%2FSeZPTQ2Wu4lf%2F%2F7K08nRSiQz%2Fd3oZA%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 74f19abeae5e1bfe-OSL
alt-svc: h2=":443"; ma=60

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (33)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size