Report - nyt-ep.com/dfcu/pages/login.php

Report Overview

Submitted URL
nyt-ep.com/dfcu/pages/login.php
IP
103.120.66.134
ASN
#137373 PT. SUITEN INOVASI SUKSES
Submitted
2023-01-24 02:41:36
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
38

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
nyt-ep.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	16 kB	549 kB	103.120.66.134
s3.amazonaws.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	422 B	8.1 kB	52.217.235.88
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	54.191.86.97
ocsp.godaddy.com	698	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	680 B	4.6 kB	192.124.249.24
usassets.cobrowse.pega.com	93477	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	819 B	266 kB	54.235.214.226
ocsp.r2m01.amazontrust.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	350 B	944 B	143.204.48.16
dcu.demdex.net	167443	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	476 B	3.5 kB	52.17.115.124
ocsp.sca1b.amazontrust.com	1015	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	350 B	1.0 kB	54.230.245.100
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.4 kB	6.2 kB	95.101.11.115
assets.adobedtm.com	512	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.4 kB	62 kB	2.18.172.233
cm.everesttech.net	996	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	420 B	475 B	18.201.4.185
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.4 kB	5.3 kB	93.184.220.29
mpsnare.iesnare.com	5723	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	23 kB	54.195.39.4
us.cobrowse.pega.com	49768	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	370 B	1.5 kB	54.235.214.226
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	56 kB	34.120.237.76
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
cdn.plaid.com	17458	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	376 B	41 kB	54.230.111.36
digitalfederalcreditunion.sc.omtrdc.net	158858	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.9 kB	965 B	15.236.125.10
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150
dpm.demdex.net	204	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.4 kB	3.0 kB	34.255.210.6

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-01-23	medium	nyt-ep.com/dfcu/pages/login.php	Generic/Spear Phishing

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-24	medium	nyt-ep.com/dfcu/pages/sty	Phishing
2023-01-24	medium	nyt-ep.com/dfcu/pages/iovation/config.js	Phishing
2023-01-24	medium	nyt-ep.com/dfcu/pages/iovation/loader_only.js	Phishing
2023-01-24	medium	nyt-ep.com/js/67.08d37c06.js	Phishing
2023-01-24	medium	nyt-ep.com/js/chunk-common.ee86c272.js	Phishing
2023-01-24	medium	nyt-ep.com/js/2.eae3d549.js	Phishing
2023-01-24	medium	nyt-ep.com/iojs/5.5.0/logo.js	Phishing
2023-01-24	medium	nyt-ep.com/js/vendor.4cab2b63.js	Phishing
2023-01-24	medium	nyt-ep.com/js/app.2123d633.js	Phishing
2023-01-24	medium	nyt-ep.com/js/67.08d37c06.js	Phishing
2023-01-24	medium	nyt-ep.com/dfcu/pages/login.php	Phishing
2023-01-24	medium	nyt-ep.com/js/chunk-common.ee86c272.js	Phishing
2023-01-24	medium	nyt-ep.com/js/2.eae3d549.js	Phishing
2023-01-24	medium	nyt-ep.com/iojs/5.5.0/logo.js	Phishing
2023-01-24	medium	nyt-ep.com/js/vendor.4cab2b63.js	Phishing
2023-01-24	medium	nyt-ep.com/js/app.2123d633.js	Phishing
2023-01-24	medium	nyt-ep.com/dfcu/fonts/fa-solid-900.0a037305.woff2	Phishing
2023-01-24	medium	nyt-ep.com/dfcu/fonts/fa-solid-900.46457309.ttf	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (9)

	URL	Size	First Seen	Last Seen
	assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js	34 kB	2023-03-07	2024-04-26
Pretty URL assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js IP 2.18.172.233 ASN #16625 AKAMAI-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:09 Last Seen2024-04-26 15:38:52 Times Seen2932 Hash d860c16ac938f7d839f0ec158d02d0f0 8710f81ed151233677f7e32b229cb35293dd6840 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c Loading...

	dcu.demdex.net/dest5.html?d_nsid=0#http%3A%2F%2Fnyt-ep.com	6.7 kB	2023-03-07	2024-03-23
Pretty URL dcu.demdex.net/dest5.html?d_nsid=0#http%3A%2F%2Fnyt-ep.com IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:36 Last Seen2024-03-23 05:26:10 Times Seen1169 Hash bea2f42512935b636558e81988e2d51f 2c9772b62f6eb8a3cec9c3a6fb9c0b22c927e59d 0cc5ff21c24654308609656ebcfda2d792d15f6fda17c0a88b551fcf8e456fdb Loading...

	cdn.plaid.com/link/v2/stable/link-initialize.js	128 kB	2023-03-13	2023-03-13
Pretty URL cdn.plaid.com/link/v2/stable/link-initialize.js IP 54.230.111.36 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 06:17:11 Last Seen2023-03-13 06:53:16 Times Seen1 Hash 353f8766665513254498e596ae3de7ac b169287ec92bea26176a12b3d56381c52a39cecb a496db4afdb3891f0d1d0c0393eb5bc583ea2a46f5818a739b708542e40f680d Loading...

	mpsnare.iesnare.com/5.5.0/logo.js	505 B	2023-03-13	2023-03-13
Pretty URL mpsnare.iesnare.com/5.5.0/logo.js IP 54.195.39.4 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 06:30:52 Last Seen2023-03-13 06:30:52 Times Seen1 Hash 4e781388d5ed1930f70e739c45ad870a f95d12657de60e88435209a6a40651221b101a90 b99b7497ab2904c3a011f15581e5917460b36bffe3d33d862af350a52b403879 Loading...

	assets.adobedtm.com/c710ed4af822/4edff89d26dd/launch-1574d0b03693.min.js	149 kB	2023-03-13	2023-03-13
Pretty URL assets.adobedtm.com/c710ed4af822/4edff89d26dd/launch-1574d0b03693.min.js IP 2.18.172.233 ASN #16625 AKAMAI-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 06:17:11 Last Seen2023-03-13 06:30:52 Times Seen1 Hash 00714a64b1758bd55efffc4ba4749518 7b54bddfcb4df91358856c836c342d6a8c0adbf9 c509d642146e5c191c88d86c4e207d46f8e3c325f10fa95e4c46390f0016a961 Loading...

	usassets.cobrowse.pega.com/assets/scripts/final/customer.js?v=8.7.1	1.2 MB	2023-03-07	2023-10-13
Pretty URL usassets.cobrowse.pega.com/assets/scripts/final/customer.js?v=8.7.1 IP 54.235.214.226 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:09:27 Last Seen2023-10-13 04:53:55 Times Seen4 Hash 02f1c3ee76b41a35f41358245aa6154c 92f6f5fab0d66676cf2c7b22a3eb17adba21fe14 882a1478e03664b3e5f2bb5b286689f553197877c4c5dae59c9c2991f5e1bd0a Loading...

	mpsnare.iesnare.com/general5/wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false	42 kB	2023-03-13	2023-03-13
Pretty URL mpsnare.iesnare.com/general5/wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false IP 54.195.39.4 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 06:30:52 Last Seen2023-03-13 06:30:52 Times Seen1 Hash 29953b1f893bd509c4bf30178cb388aa b2ba192a16d5e9db1f5a4e2995f56912652c1ab0 89fcc5cfbe2285e15d01506e4e9a94142ed5da6f7e11fbe751754f24bce63b37 Loading...

	assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js	3.3 kB	2023-03-07	2024-04-26
Pretty URL assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js IP 2.18.172.233 ASN #16625 AKAMAI-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:10 Last Seen2024-04-26 15:38:52 Times Seen2375 Hash 2d1382c349d480b6b41574ac0c1af066 53ddf017aa6b66b4d54ea0818dc5c04789b9e5ae 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575 Loading...

	us.cobrowse.pega.com/cobrowse/loadScripts	508 B	2023-03-07	2023-11-30
Pretty URL us.cobrowse.pega.com/cobrowse/loadScripts IP 54.235.214.226 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:09:27 Last Seen2023-11-30 01:33:20 Times Seen12 Hash 9cdb6851bb88c14e6033ca658ac8aa88 ee1d43de555319019f8b0713a683a463803a9b41 fa05f2814bdcd558f6b652532c66d74a995b0a05f464bda6e9375fcb3c02cf82 Loading...

HTTP Transactions (88)

URL IP Response Size

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
0be6cec5607bb65c06dbadd33456aec1
9d13129e936eb5fc82e403931884cdc8c6e6ab92
cb028034340b709ece65e45e8fc1a26a64dd85926beaa542f308d3f1d5ee2c84

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CB028034340B709ECE65E45E8FC1A26A64DD85926BEAA542F308D3F1D5EE2C84"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8950
Expires: Tue, 24 Jan 2023 05:10:35 GMT
Date: Tue, 24 Jan 2023 02:41:25 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f416977a8d6dfaafb2dbfd0e68b871f8
dfa97bd829b03162de91c80133f2fde69b58a8d2
2c4d0fd1b7a6d398026a4817267adce203429acdd3defa44a879f0d945f392d5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2C4D0FD1B7A6D398026A4817267ADCE203429ACDD3DEFA44A879F0D945F392D5"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6537
Expires: Tue, 24 Jan 2023 04:30:22 GMT
Date: Tue, 24 Jan 2023 02:41:25 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Backoff, Content-Length, Alert, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 24 Jan 2023 02:35:05 GMT
content-type: application/json
age: 380
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6cd4f1da1215c7473500807c185f2449
b14db0c67cf1f5faf85648ed8f94baf2dd03808b
9750518efd869da5ff74ba65a196445bd4340c909157cc1a420f62c1d07224a0

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9750518EFD869DA5FF74BA65A196445BD4340C909157CC1A420F62C1D07224A0"
Last-Modified: Mon, 23 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4718
Expires: Tue, 24 Jan 2023 04:00:03 GMT
Date: Tue, 24 Jan 2023 02:41:25 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: umkbBjtCRmUMp0l2PjMuA++apsNDdSR4Rf0xs1kUnUIrngF4Gwsf1JeMJ3Vz+SAdo7Pu/K8Tvq8=
x-amz-request-id: 393JK0JDAA9PN0V6
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 24 Jan 2023 02:19:06 GMT
age: 1339
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 24 Jan 2023 02:41:25 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js

2.18.172.233

200 OK

12 kB

URL HTTP/2
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
IP
2.18.172.233:0
ASN
#16625 AKAMAI-AS

File type
ASCII text, with very long lines (32768)
Size
12 kB (12163 bytes)
Hash
e616df092766c7ab7904619f971a35cc
a960429c42802a43e3ce728fc4d1e8bdab10e606
082ae7647bfdb639846791e5c0ca39b96544dff3aed0c365973c9589cd5b091e

HTTP Headers

GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 12163
unused62: 8096267
expires: Tue, 24 Jan 2023 03:41:25 GMT
date: Tue, 24 Jan 2023 02:41:25 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2

assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js

2.18.172.233

200 OK

1.6 kB

URL HTTP/2
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
IP
2.18.172.233:0
ASN
#16625 AKAMAI-AS

File type
ASCII text, with very long lines (3155)
Size
1.6 kB (1597 bytes)
Hash
e672de61b277fc72de4299829bfbb31c
157a7409922d58a02dad3ba879d04eb2a3ef8f3d
e1a1c2a6f2ed4ffb63ebfda157eaf12c6ee3973be4da649eb63e0402c0d29215

HTTP Headers

GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
unused62: 8096267
content-length: 1597
expires: Tue, 24 Jan 2023 03:41:25 GMT
date: Tue, 24 Jan 2023 02:41:25 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2

assets.adobedtm.com/c710ed4af822/4edff89d26dd/launch-1574d0b03693.min.js

2.18.172.233

200 OK

46 kB

URL HTTP/2
assets.adobedtm.com/c710ed4af822/4edff89d26dd/launch-1574d0b03693.min.js
IP
2.18.172.233:0
ASN
#16625 AKAMAI-AS

File type
ASCII text, with very long lines (32722)
Size
46 kB (46433 bytes)
Hash
c0adfbdf586b65b00148dfbd8d520f6e
03d388b00456dcae77478055c1af1b6a4eddc4bc
feb8784918a56df368f456affca929ec1d9f8d390638aeab855c30ebcd47c382

HTTP Headers

GET /c710ed4af822/4edff89d26dd/launch-1574d0b03693.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "00714a64b1758bd55efffc4ba4749518:1671553608.984329"
last-modified: Tue, 20 Dec 2022 16:26:48 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 46433
cache-control: max-age=3600
expires: Tue, 24 Jan 2023 03:41:25 GMT
date: Tue, 24 Jan 2023 02:41:25 GMT
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2

nyt-ep.com/dfcu/pages/sty

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/dfcu/pages/sty
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /dfcu/pages/sty HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
7f1b3b7de50609b1b787e2753fb210d2
21151749c9b5353e2373f965e7fad38fa2e89d0d
54dde0ef2e28ab24d0b7ab3e7da4096e4bddedf2a539147c022c367cd3a40256

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4729
Cache-Control: max-age=86209
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 02:41:25 GMT
Etag: "63cde09d-1d7"
Expires: Wed, 25 Jan 2023 02:38:14 GMT
Last-Modified: Mon, 23 Jan 2023 01:19:25 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
f2a3fa146ee2832070831fe6e9964e7a
aa99675abc0300e26a997ef8f1b3d3ab3bff53bd
b101576d7c5e8ba16fe72b88691543ca667807155f670083030cbeedaabad303

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4800
Cache-Control: max-age=131585
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 02:41:25 GMT
Etag: "63ce9196-1d7"
Expires: Wed, 25 Jan 2023 15:14:30 GMT
Last-Modified: Mon, 23 Jan 2023 13:54:30 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
f2a3fa146ee2832070831fe6e9964e7a
aa99675abc0300e26a997ef8f1b3d3ab3bff53bd
b101576d7c5e8ba16fe72b88691543ca667807155f670083030cbeedaabad303

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4800
Cache-Control: max-age=131585
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 02:41:25 GMT
Etag: "63ce9196-1d7"
Expires: Wed, 25 Jan 2023 15:14:30 GMT
Last-Modified: Mon, 23 Jan 2023 13:54:30 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
6b1325787961385dd0a1aa9accae320e
a48bbffa81bff4191b367afbaf463d18eaec7bec
eb159a5a24fdd950cf17c714311fb378c573bde6a0cdec714e03213d983826ad

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1011
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 02:41:25 GMT
Etag: "63ce26c3-1d7"
Last-Modified: Tue, 24 Jan 2023 02:24:34 GMT
Server: ECS (amb/6BA2)
X-Cache: HIT
Content-Length: 471

mpsnare.iesnare.com/5.5.0/logo.js

54.195.39.4

200 OK

418 B

URL HTTP/1.1
mpsnare.iesnare.com/5.5.0/logo.js
IP
54.195.39.4:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (377)
Size
418 B (418 bytes)
Hash
ca0a881fd9dc5c003018cec7eb840692
18c7e2f12f32944ea5e5a9d4bb6e586ee0c2111e
454db1053052af3386be0a7829d06bf0e3d8e34ee03664320f3d534ce0c3504e

HTTP Headers

GET /5.5.0/logo.js HTTP/1.1
Host: mpsnare.iesnare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 24 Jan 2023 02:41:25 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Expires: Wed, 24 Jan 2024 02:41:25 GMT
Cache-Control: private
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip

mpsnare.iesnare.com/general5/wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false

54.195.39.4

200 OK

19 kB

URL HTTP/1.1
mpsnare.iesnare.com/general5/wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false
IP
54.195.39.4:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (1056)
Size
19 kB (18555 bytes)
Hash
533035fa1dca9ae19203cb56abb47933
6be2c91001a32ac170931596f9129650043e69c8
ac3e10e12a75b1ca273eebd1161e68f14ff466a1cea8186fe4eb75b7896a10e2

HTTP Headers

GET /general5/wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1
Host: mpsnare.iesnare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 24 Jan 2023 02:41:25 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=O4mRUuHDJIgdJf+aws66JzHDMlwUCfDX468pulEx6ik=;Path=/;Expires=Wed, 24-Jan-2024 02:41:25 GMT;Max-Age=31536000;Secure;HttpOnly;SameSite=None
Cache-Control: no-cache, private
Pragma: no-cache
Expires: 0
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip

nyt-ep.com/dfcu/pages/iovation/config.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/dfcu/pages/iovation/config.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /dfcu/pages/iovation/config.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/iojs/general5/static_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/iojs/general5/static_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /iojs/general5/static_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/dfcu/pages/iovation/loader_only.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/dfcu/pages/iovation/loader_only.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /dfcu/pages/iovation/loader_only.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/vendor.18ecc1fa.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/vendor.18ecc1fa.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/vendor.18ecc1fa.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/app.12ac5d63.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/app.12ac5d63.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/app.12ac5d63.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Last-Modified, ETag, Content-Length, Expires, Cache-Control, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 24 Jan 2023 01:48:59 GMT
age: 3147
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

nyt-ep.com/css/67.9e8fe349.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/67.9e8fe349.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/67.9e8fe349.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/js/67.08d37c06.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/67.08d37c06.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/67.08d37c06.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/chunk-common.b93dc9af.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/chunk-common.b93dc9af.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/chunk-common.b93dc9af.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/js/chunk-common.ee86c272.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/chunk-common.ee86c272.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/chunk-common.ee86c272.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/2.fa09428f.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/2.fa09428f.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/2.fa09428f.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
bb280016d8f12fa0a6ae86792ba89e67
53188091dab8e35ba20d2e341624777c2fb1536a
c28ed8dc9af97c7096f60030048432a41fb853e81ea91208e91493784d382bb9

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 392
Cache-Control: max-age=109914
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 02:41:26 GMT
Etag: "63ce4e28-1d7"
Expires: Wed, 25 Jan 2023 09:13:20 GMT
Last-Modified: Mon, 23 Jan 2023 09:06:48 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

nyt-ep.com/js/2.eae3d549.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/2.eae3d549.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/2.eae3d549.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/iojs/5.5.0/logo.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/iojs/5.5.0/logo.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /iojs/5.5.0/logo.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/iojs/5.5.0/dyn_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/iojs/5.5.0/dyn_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /iojs/5.5.0/dyn_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/vsc.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/vsc.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/vsc.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/js/vendor.4cab2b63.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/vendor.4cab2b63.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/vendor.4cab2b63.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/js/app.2123d633.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/app.2123d633.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/app.2123d633.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/iojs/general5/static_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/iojs/general5/static_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /iojs/general5/static_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

push.services.mozilla.com/

54.191.86.97

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.191.86.97:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 6Hm0Oh2GWtgLjgmJyKkoIQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: S7WS0pNeV1ZvJXV/sO9q7cwXchM=

mpsnare.iesnare.com/star

54.195.39.4

101 Switching Protocols

0 B

URL HTTP/1.1
mpsnare.iesnare.com/star
IP
54.195.39.4:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /star HTTP/1.1
Host: mpsnare.iesnare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: http://nyt-ep.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: maTMWLuwIW/2wMB1KxfWfQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Server: nginx
Date: Tue, 24 Jan 2023 02:41:26 GMT
Connection: upgrade
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Accept: LcLtL92dZ8Duhdqz1Nukx5R+Jcg=
Upgrade: WebSocket

nyt-ep.com/js/67.08d37c06.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/67.08d37c06.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/67.08d37c06.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/vendor.18ecc1fa.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/vendor.18ecc1fa.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/vendor.18ecc1fa.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/app.12ac5d63.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/app.12ac5d63.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/app.12ac5d63.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/css/67.9e8fe349.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/67.9e8fe349.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/67.9e8fe349.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:24 GMT
Server: Apache
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
29cef1b196c67abfea36b34a8b78d728
3b37bcf6d19af0fbe61db1241a7cef57bd2c6f11
b8e088d0b76c5ffbe283610cffec369d58cb44491ceb9ee39c8ed11428b8a1ec

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1891
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 02:41:26 GMT
Last-Modified: Tue, 24 Jan 2023 02:09:55 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

nyt-ep.com/dfcu/pages/login.php

103.120.66.134

200 OK

542 kB

URL HTTP/1.1
nyt-ep.com/dfcu/pages/login.php
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (29546), with CRLF line terminators
Size
542 kB (541961 bytes)
Hash
fe4e62861fd3546bfb940b5f070f325f
4835486da0f66f0738371f1dd4d65bcec89dfe4b
27975a8b542f7033373ac63fdc9d3cd2e169e721df7e332335598747e69d777d

Detections

Analyzer	Verdict	Alert
openphish	Generic/Spear Phishing
fortinet	Phishing

HTTP Headers

GET /dfcu/pages/login.php HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Tue, 24 Jan 2023 02:41:23 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=46051B125B89FACB0A495DD6%40AdobeOrg&d_nsid=0&ts=1674528085090

34.255.210.6

200 OK

835 B

URL HTTP/1.1
dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=46051B125B89FACB0A495DD6%40AdobeOrg&d_nsid=0&ts=1674528085090
IP
34.255.210.6:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (2304), with no line terminators
Size
835 B (835 bytes)
Hash
7e65662a060508148012c1c1ad205627
dbaef75f64f0d6750b28eea958d67a59f18e0854
2ef51caf352f8705b64cb59055fe82ffb1f2edfb178079507b5698c0d8324c35

HTTP Headers

GET /id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=46051B125B89FACB0A495DD6%40AdobeOrg&d_nsid=0&ts=1674528085090 HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: http://nyt-ep.com
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://nyt-ep.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: application/json;charset=utf-8
DCS: dcs-prod-irl1-1-v045-0f7e0a58c.edge-irl1.demdex.com 2 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=16781957611493296952626328520164154940; Max-Age=15552000; Expires=Sun, 23 Jul 2023 02:41:26 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: K0p53sDKTjo=
Content-Length: 835
Connection: keep-alive

nyt-ep.com/js/chunk-common.ee86c272.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/chunk-common.ee86c272.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/chunk-common.ee86c272.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CvVersion%7C5.4.0

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:25 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

cdn.plaid.com/link/v2/stable/link-initialize.js

54.230.111.36

200 OK

40 kB

URL HTTP/2
cdn.plaid.com/link/v2/stable/link-initialize.js
IP
54.230.111.36:0
ASN
#16509 AMAZON-02

File type
data
Size
40 kB (40318 bytes)
Hash
744eddb0bc88060de54a682b290eb9b6
bc45cfc32053f36df747a4829220c8a8b96647de
d093ba7116e090f89d9aa3b10878046efa07724415e07b4b50335eb61720b5d9

HTTP Headers

GET /link/v2/stable/link-initialize.js HTTP/1.1
Host: cdn.plaid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: application/javascript
x-amz-id-2: UNeLemsQCmAKG/dKmt9N6asqs2l1fiFsfvUFJ5X3xXNEVzZsFJOF8qe3Fi7vNgOdwQ6P5s3AoDA=
x-amz-request-id: V3DSARAEFAXGV0XA
x-amz-replication-status: COMPLETED
last-modified: Fri, 20 Jan 2023 21:48:01 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: Olz7vHS2338JOTgdQDy.quPH4S1stpH6
server: AmazonS3
content-encoding: gzip
date: Mon, 23 Jan 2023 04:14:15 GMT
cache-control: no-cache,must-revalidate,max-age=0
etag: W/"353f8766665513254498e596ae3de7ac"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 b053873243f91b1bb6dc406ce0c67db4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: TAmU42YOSggsRu8FAggz7SkdI_KPj5dPddnHwBr5FAiiWxvGx1e2eQ==
age: 80923
X-Firefox-Spdy: h2

ocsp.godaddy.com/

192.124.249.24

200 OK

1.8 kB

URL HTTP/1.1
ocsp.godaddy.com/
IP
192.124.249.24:0
ASN
#30148 SUCURI-SEC

File type
data
Size
1.8 kB (1778 bytes)
Hash
58284f4e5a8b7e0d8272d35394d5dd19
c8cbdf3ae3a8d523255cde1edc51c9651f3a35af
700051d0eb67ee59ccd7c866efc5019e6ebdbb2eaf3757fd49cae085ff4ec7a2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Tue, 24 Jan 2023 02:41:26 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19024
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Mon, 23 Jan 2023 20:44:10 GMT
Expires: Tue, 24 Jan 2023 20:44:10 GMT
ETag: "c8cbdf3ae3a8d523255cde1edc51c9651f3a35af"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

ocsp.godaddy.com/

192.124.249.24

200 OK

1.8 kB

URL HTTP/1.1
ocsp.godaddy.com/
IP
192.124.249.24:0
ASN
#30148 SUCURI-SEC

File type
data
Size
1.8 kB (1778 bytes)
Hash
58284f4e5a8b7e0d8272d35394d5dd19
c8cbdf3ae3a8d523255cde1edc51c9651f3a35af
700051d0eb67ee59ccd7c866efc5019e6ebdbb2eaf3757fd49cae085ff4ec7a2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Tue, 24 Jan 2023 02:41:26 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19024
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Mon, 23 Jan 2023 20:44:10 GMT
Expires: Tue, 24 Jan 2023 20:44:10 GMT
ETag: "c8cbdf3ae3a8d523255cde1edc51c9651f3a35af"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"

ocsp.digicert.com/

93.184.220.29

200 OK

313 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
313 B (313 bytes)
Hash
c4fda2361860c443da2de3c953e85963
8b5014e9c520fa59b7dbeb39a243e9a467087f1f
8012ae038cda65a635056288af615bbcc7a3f9a936266257ee4014ae151e8adc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3139
Cache-Control: max-age=163785
Content-Type: application/ocsp-response
Date: Tue, 24 Jan 2023 02:41:27 GMT
Etag: "63cf15dd-139"
Expires: Thu, 26 Jan 2023 00:11:12 GMT
Last-Modified: Mon, 23 Jan 2023 23:18:53 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 313

digitalfederalcreditunion.sc.omtrdc.net/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&mid=17089465370507669272634557587177644396&ts=1674528085352

15.236.125.10

200 OK

2 B

URL HTTP/2
digitalfederalcreditunion.sc.omtrdc.net/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&mid=17089465370507669272634557587177644396&ts=1674528085352
IP
15.236.125.10:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with no line terminators
Size
2 B (2 bytes)
Hash
99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

HTTP Headers

GET /id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&mid=17089465370507669272634557587177644396&ts=1674528085352 HTTP/1.1
Host: digitalfederalcreditunion.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: http://nyt-ep.com
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: http://nyt-ep.com
access-control-allow-credentials: true
date: Tue, 24 Jan 2023 02:41:27 GMT
p3p: CP="This is not a P3P policy"
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 2
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2

nyt-ep.com/css/2.fa09428f.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/2.fa09428f.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/2.fa09428f.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:25 GMT
Server: Apache
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/js/2.eae3d549.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/2.eae3d549.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/2.eae3d549.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:25 GMT
Server: Apache
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/iojs/5.5.0/dyn_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/iojs/5.5.0/dyn_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /iojs/5.5.0/dyn_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:25 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js

2.18.172.233

304 Not Modified

0 B

URL HTTP/2
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
IP
2.18.172.233:0
ASN
#16625 AKAMAI-AS

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
If-Modified-Since: Mon, 14 Feb 2022 16:35:31 GMT
If-None-Match: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
TE: trailers

HTTP/2 304 Not Modified
content-type: application/x-javascript
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
expires: Tue, 24 Jan 2023 03:41:27 GMT
date: Tue, 24 Jan 2023 02:41:27 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2

assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js

2.18.172.233

304 Not Modified

0 B

URL HTTP/2
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
IP
2.18.172.233:0
ASN
#16625 AKAMAI-AS

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
If-Modified-Since: Mon, 14 Feb 2022 16:35:31 GMT
If-None-Match: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
TE: trailers

HTTP/2 304 Not Modified
content-type: application/x-javascript
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
expires: Tue, 24 Jan 2023 03:41:27 GMT
date: Tue, 24 Jan 2023 02:41:27 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2

usassets.cobrowse.pega.com/assets/stylesheets/customer/final/default.css?v=8.7.1

54.235.214.226

200 OK

3.5 kB

URL HTTP/2
usassets.cobrowse.pega.com/assets/stylesheets/customer/final/default.css?v=8.7.1
IP
54.235.214.226:0
ASN
#14618 AMAZON-AES

File type
Unicode text, UTF-8 text, with very long lines (14626)
Size
3.5 kB (3489 bytes)
Hash
c9e0ee1acc72fd18e3953cf614f7e879
bacc2349aab9dfac47cd153702e98e1fa48466f4
e13c4a8b7d5d884e11579582e7e99198c7fdfbd2587a37f52add1783e49e5d8e

HTTP Headers

GET /assets/stylesheets/customer/final/default.css?v=8.7.1 HTTP/1.1
Host: usassets.cobrowse.pega.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 24 Jan 2023 02:41:27 GMT
content-type: text/css
content-length: 3489
set-cookie: AWSALB=uv17rqdn+gKe61TU4PD/9EkyQ+V1J6co1bt1ZHEo2nlRmKhcusYZB/Wd4/Y9IvEK6ZL3iBLruMOJjRDaLfKEF90AW2VijnakTZRAwwFJh6a4QzI4ghlWcQe40TNB; Expires=Tue, 31 Jan 2023 02:41:27 GMT; Path=/
AWSALBCORS=uv17rqdn+gKe61TU4PD/9EkyQ+V1J6co1bt1ZHEo2nlRmKhcusYZB/Wd4/Y9IvEK6ZL3iBLruMOJjRDaLfKEF90AW2VijnakTZRAwwFJh6a4QzI4ghlWcQe40TNB; Expires=Tue, 31 Jan 2023 02:41:27 GMT; Path=/; SameSite=None; Secure
server: nginx
last-modified: Wed, 13 Jul 2022 12:04:58 GMT
etag: "62ceb4ea-da1"
access-control-allow-origin: *
content-encoding: gzip
accept-ranges: bytes
X-Firefox-Spdy: h2

us.cobrowse.pega.com/cobrowse/loadScripts

54.235.214.226

200 OK

508 B

URL HTTP/2
us.cobrowse.pega.com/cobrowse/loadScripts
IP
54.235.214.226:0
ASN
#14618 AMAZON-AES

File type
ASCII text
Size
508 B (508 bytes)
Hash
9cdb6851bb88c14e6033ca658ac8aa88
ee1d43de555319019f8b0713a683a463803a9b41
fa05f2814bdcd558f6b652532c66d74a995b0a05f464bda6e9375fcb3c02cf82

HTTP Headers

GET /cobrowse/loadScripts HTTP/1.1
Host: us.cobrowse.pega.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 24 Jan 2023 02:41:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 508
set-cookie: AWSALB=Ax9zZcudiQLdMIxcMIvkha+LdV9J/uibM074WwOHUoVjvhibO0byfNQk02yoKCUIfKku8epBsCa84nDo9ADdANx6DDL1hY3HEDbGvqAXk9qMFqgc31vJFbIZK50B; Expires=Tue, 31 Jan 2023 02:41:27 GMT; Path=/
AWSALBCORS=Ax9zZcudiQLdMIxcMIvkha+LdV9J/uibM074WwOHUoVjvhibO0byfNQk02yoKCUIfKku8epBsCa84nDo9ADdANx6DDL1hY3HEDbGvqAXk9qMFqgc31vJFbIZK50B; Expires=Tue, 31 Jan 2023 02:41:27 GMT; Path=/; SameSite=None; Secure
connect.sid=s%3ALy5o81CH8-kpQVGoAq40CtRYw3MO1lW7.FXRJLQ2bArYkgL1qnye3jTi9sHVcGsWNSbyD%2BbdY9uc; Path=/; Expires=Thu, 26 Jan 2023 02:41:27 GMT; Secure; SameSite=None
server: nginx
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: X-CSRF-Token, X-Requested-With, accept, x-j-token, content-type
etag: W/"1fc-7h1D3lVTGQGfiwcTpoOkY4A6m0E"
X-Firefox-Spdy: h2

ocsp.r2m01.amazontrust.com/

143.204.48.16

200 OK

471 B

URL HTTP/1.1
ocsp.r2m01.amazontrust.com/
IP
143.204.48.16:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
5a4a27a4ee4d21d12fd2bee7ca302f90
2ed2a06cda30526e38418d04dde610e00d7eeb6f
279bdb00a32c4a8d72d11664b1fbedcd9e27657fe515514abc31e795992289ca

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Tue, 24 Jan 2023 02:41:27 GMT
Last-Modified: Tue, 24 Jan 2023 01:38:59 GMT
Server: ECS (nyb/1D20)
X-Cache: Miss from cloudfront
Via: 1.1 f00e3524edcdf61801454f2bb21e71ce.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 2undlncO4y_riYmd7s0RMeXuAljRVVHSNiRx_wfLwOZeVvqGQo19Hw==
Age: 3748

usassets.cobrowse.pega.com/assets/scripts/final/customer.js?v=8.7.1

54.235.214.226

200 OK

261 kB

URL HTTP/2
usassets.cobrowse.pega.com/assets/scripts/final/customer.js?v=8.7.1
IP
54.235.214.226:0
ASN
#14618 AMAZON-AES

File type
ASCII text, with very long lines (65536), with no line terminators
Size
261 kB (261370 bytes)
Hash
eb9524e46cc30efd2673a51baa3a655e
f9860cf1e6dc646899418909a7bf2156df4556a4
c1898417dc51a18a977daaea237101556511c77a676d51982c6c035cbf15f1c1

HTTP Headers

GET /assets/scripts/final/customer.js?v=8.7.1 HTTP/1.1
Host: usassets.cobrowse.pega.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 24 Jan 2023 02:41:27 GMT
content-type: application/javascript
content-length: 261370
set-cookie: AWSALB=5FAKdLVz/E+ushV6+//tDavLjqg4IKBXvh4MHrlTDQUJFUk6l6EWMpvD6Qbgd0kmwLJLHXRlw6ydqehHSkXlme4c7ZYUpCIQh054PjbQASHE4LyCoSIOUJxdqH+a; Expires=Tue, 31 Jan 2023 02:41:27 GMT; Path=/
AWSALBCORS=5FAKdLVz/E+ushV6+//tDavLjqg4IKBXvh4MHrlTDQUJFUk6l6EWMpvD6Qbgd0kmwLJLHXRlw6ydqehHSkXlme4c7ZYUpCIQh054PjbQASHE4LyCoSIOUJxdqH+a; Expires=Tue, 31 Jan 2023 02:41:27 GMT; Path=/; SameSite=None; Secure
server: nginx
last-modified: Mon, 18 Jul 2022 06:30:25 GMT
etag: "62d4fe01-3fcfa"
access-control-allow-origin: *
content-encoding: gzip
accept-ranges: bytes
X-Firefox-Spdy: h2

nyt-ep.com/iojs/5.5.0/logo.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/iojs/5.5.0/logo.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /iojs/5.5.0/logo.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:25 GMT
Server: Apache
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

s3.amazonaws.com/assets.projectfinance.io/siteAssets/DCU/dcuLogoDark.png

52.217.235.88

200 OK

7.7 kB

URL HTTP/1.1
s3.amazonaws.com/assets.projectfinance.io/siteAssets/DCU/dcuLogoDark.png
IP
52.217.235.88:0
ASN
#16509 AMAZON-02

File type
PNG image data, 217 x 78, 8-bit/color RGBA, non-interlaced\012- data
Size
7.7 kB (7743 bytes)
Hash
ae64e87365d6e6696145c8c53ce3632e
09337bd0289c432bffab6f653297fe2534ad0c68
d1093fceb5f8b35c09e5d3329c8dc55509d7f46096efeea840f6e433212ba45e

HTTP Headers

GET /assets.projectfinance.io/siteAssets/DCU/dcuLogoDark.png HTTP/1.1
Host: s3.amazonaws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
x-amz-id-2: hyU93un7L3Jz3SsYpo6PbWzT5i8MZN+KSN0HlKhNJmgzUERtnWkNoO8RXD/O7imb1Ma2igCzAKA=
x-amz-request-id: W38WVMKVY7MAFJNJ
Date: Tue, 24 Jan 2023 02:41:28 GMT
Last-Modified: Tue, 12 May 2020 18:43:36 GMT
ETag: "ae64e87365d6e6696145c8c53ce3632e"
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 7743

dcu.demdex.net/dest5.html?d_nsid=0

52.17.115.124

200 OK

2.8 kB

URL HTTP/1.1
dcu.demdex.net/dest5.html?d_nsid=0
IP
52.17.115.124:0
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (550)
Size
2.8 kB (2791 bytes)
Hash
ccbdcb1e84c241950763ec4cd516cdfc
55dfa8d4b09c5c3a80fcd101152f6ebed3d27a2c
de9ccb9b168945a24f20edc28c39be4135b328129ba8ee378401a7aedc925d12

HTTP Headers

GET /dest5.html?d_nsid=0 HTTP/1.1
Host: dcu.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Tue, 24 Jan 2023 02:41:27 GMT
DCS: dcs-prod-irl1-2-v045-0f45dc272.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Fri, 28 Oct 2022 11:26:52 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: GZgV/eDOTcU=
transfer-encoding: chunked
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4032
Expires: Tue, 24 Jan 2023 03:48:39 GMT
Date: Tue, 24 Jan 2023 02:41:27 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4032
Expires: Tue, 24 Jan 2023 03:48:39 GMT
Date: Tue, 24 Jan 2023 02:41:27 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4032
Expires: Tue, 24 Jan 2023 03:48:39 GMT
Date: Tue, 24 Jan 2023 02:41:27 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d5528af26e629a9bfbf0c421146b921f
1e4f99245d551384bedfe9b59b5f9905127d87bf
989830d93a90c30051b948a26ce403fb4370587ed3407d8d77ad0ad9cc28eb7a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4032
Expires: Tue, 24 Jan 2023 03:48:39 GMT
Date: Tue, 24 Jan 2023 02:41:27 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5a0f24f-7a25-4324-960c-9137142e8f70.jpeg

34.120.237.76

200 OK

7.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5a0f24f-7a25-4324-960c-9137142e8f70.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.8 kB (7757 bytes)
Hash
32dd7620701c91aba60f9602444a044d
326af548de3711b3af0e3271eae6409461520604
56d8f0647de678252f5a3b186e06e7d4668fd03e77e9c38ce3b3b4e476a5f5ca

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5a0f24f-7a25-4324-960c-9137142e8f70.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7757
x-amzn-requestid: e4c0d6ab-0eee-46b7-acde-3d0f9e743379
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLzVbEXvIAMFfcA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ce3288-5f5a78bf26b1d94428b3b092;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 07:08:56 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: X8xrA0X45WbOzyUDTERwixRRpPHFtWR6IGOQ1yyDa5wSdDilcYiERg==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 07:31:23 GMT
age: 69004
etag: "326af548de3711b3af0e3271eae6409461520604"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F409361f2-a546-44d7-82d6-d496f6ee134d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11918 bytes)
Hash
4cb7be12333fa7ea3353901b4b3215af
4b758cc432874384f330568177eef5a328d7e69a
d6f86c0ddbabd5c4fd7cee72ce4da62ccddd9d29139c9ab033bb1ab8425bae22

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F409361f2-a546-44d7-82d6-d496f6ee134d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11918
x-amzn-requestid: df7df0ae-d70e-4b80-9483-2ecd5c8ee4a7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fEqvPEXMoAMF5Aw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cb57fa-04193e0514c1c1e85d9d023b;Sampled=0
x-amzn-remapped-date: Sat, 21 Jan 2023 03:11:55 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: fznabMNG3n9Uo4L1jrrewtL_hJnQv8oR2qggeZtruvOLVzpUpcs7Tw==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 03:21:12 GMT
age: 84015
etag: "4b758cc432874384f330568177eef5a328d7e69a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81d3fe9a-5a47-4b14-b9fa-dbdb9eaa15b5.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.3 kB (9337 bytes)
Hash
463ff6307fdd172cbd2cae55f9b4a502
7e17bac498e8403b40fc7bfeffe8a8ca0161c6b5
1b30579f2387e4d417cc9ae8d33361b95b2778f7d74a29c77ec4731927fed2a0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81d3fe9a-5a47-4b14-b9fa-dbdb9eaa15b5.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9337
x-amzn-requestid: f3e46ddd-18ac-4a5f-b32a-397613b152bf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNzYjFiroAMFl8Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ceff69-05f69341783503ea1daca727;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:43:05 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: U2GuMBFB9_AGaxvsAzuRQAuN8Bu-fYpAWSkkQtc5F0TU9IWVrJHWuQ==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 21:56:47 GMT
etag: "7e17bac498e8403b40fc7bfeffe8a8ca0161c6b5"
content-type: image/jpeg
age: 17080
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F874475eb-9740-41dc-8fad-94561f78702c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.3 kB (8333 bytes)
Hash
d1097271d834ab63d9ac18ae798d5fe6
21a451f3ea7cce0630a0cd3277d98a8751deeb18
3b86a231e6dbef2af349c2039f4da669f207c02ae91300b9cd078daa4981bfb5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F874475eb-9740-41dc-8fad-94561f78702c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8333
x-amzn-requestid: 7198b53d-2bb1-4b4e-a26e-3412f9a07ed0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNzFTHuRoAMFR5A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefeee-13bab7f47f403afb790c48c6;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:41:02 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: TlSKKwkaSHX0V8XqdClwRxX_-U8QVSdmiYQSvHIfmS1G5cC-Ty5tSQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 22:13:28 GMT
age: 16079
etag: "21a451f3ea7cce0630a0cd3277d98a8751deeb18"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b12041d-fdaa-483d-b290-d584ffb6ea13.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.6 kB (7642 bytes)
Hash
deb690b8f5503bf4bcf424e58ddb6b8c
eb96120190e3a5c286ac5ec51ee8b163540377fd
c762b17d3e43d773966490d1186ebc352a78d47781c77a4f048e32fee9732b7d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b12041d-fdaa-483d-b290-d584ffb6ea13.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7642
x-amzn-requestid: 3f4482cf-98a5-420e-abe7-17fd2d214da0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNyxIF3aIAMFWoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefe6d-0c1838dc7b4ab4650d54ee56;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:38:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: OD1DSocM7Q1FhRQ4oMhGjU8GN-sv978YqNpLMiKjeWupfFbK-WDXxQ==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 22:04:05 GMT
age: 16642
etag: "eb96120190e3a5c286ac5ec51ee8b163540377fd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ad2eb2b-9cfe-4f71-89ea-99ac9e3f783f.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.4 kB (4381 bytes)
Hash
462fc1946b8dbae49aa3cf22291fc707
400c6dc7973b36a5d3e43cc3b439da49ab6c76b5
88e13373963e8427baa4cdf19909eb297aafe035ec0376cbed6d4f4fa45dbd32

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ad2eb2b-9cfe-4f71-89ea-99ac9e3f783f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4381
x-amzn-requestid: 528fddee-8bac-466a-8f82-3d5bffab7ca4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNzFpFghoAMFSPg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefef0-63f97c8409b808910ce8f50a;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:41:04 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 0eb65TKWgBaHaPETcwgUpjEHT6yMMT4N0vcRh3C66WYct0PNL-AcpQ==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 21:56:47 GMT
etag: "400c6dc7973b36a5d3e43cc3b439da49ab6c76b5"
content-type: image/jpeg
age: 17080
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

nyt-ep.com/css/vsc.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/css/vsc.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /css/vsc.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:25 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/js/vendor.4cab2b63.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/vendor.4cab2b63.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/vendor.4cab2b63.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:25 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/js/app.2123d633.js

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/js/app.2123d633.js
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/app.2123d633.js HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:26 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/dfcu/pages/src/styles/main.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/dfcu/pages/src/styles/main.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /dfcu/pages/src/styles/main.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:26 GMT
Server: Apache
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

nyt-ep.com/dfcu/pages/src/styles/css/variables.css

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/dfcu/pages/src/styles/css/variables.css
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /dfcu/pages/src/styles/css/variables.css HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:26 GMT
Server: Apache
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

mpsnare.iesnare.com/time.mp3?nocache=0.7423939561312526

54.195.39.4

206 Partial Content

504 B

URL HTTP/1.1
mpsnare.iesnare.com/time.mp3?nocache=0.7423939561312526
IP
54.195.39.4:0
ASN
#16509 AMAZON-02

File type
MPEG ADTS, layer III, v2.5, 32 kbps, 8 kHz, JntStereo\012- data
Size
504 B (504 bytes)
Hash
cfe47da3367b896cf8fe9d23144e6294
5eb28e56c71ce7e851b99b4d90b4091e3090243a
2857eb76b4850703192f5d42bc145b2384147fcb65f63b5447ed74664e241507

HTTP Headers

GET /time.mp3?nocache=0.7423939561312526 HTTP/1.1
Host: mpsnare.iesnare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 206 Partial Content
Server: nginx
Date: Tue, 24 Jan 2023 02:41:28 GMT
Content-Type: audio/mpeg
Content-Length: 504
Connection: keep-alive
Content-Disposition: inline; filename=time.mp3
Content-Range: bytes 0-503/504
Accept-Ranges: bytes
Pragma: public
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains

mpsnare.iesnare.com/time.mp3?nocache=0.237270902410452

54.195.39.4

206 Partial Content

504 B

URL HTTP/1.1
mpsnare.iesnare.com/time.mp3?nocache=0.237270902410452
IP
54.195.39.4:0
ASN
#16509 AMAZON-02

File type
MPEG ADTS, layer III, v2.5, 32 kbps, 8 kHz, JntStereo\012- data
Size
504 B (504 bytes)
Hash
cfe47da3367b896cf8fe9d23144e6294
5eb28e56c71ce7e851b99b4d90b4091e3090243a
2857eb76b4850703192f5d42bc145b2384147fcb65f63b5447ed74664e241507

HTTP Headers

GET /time.mp3?nocache=0.237270902410452 HTTP/1.1
Host: mpsnare.iesnare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 206 Partial Content
Server: nginx
Date: Tue, 24 Jan 2023 02:41:28 GMT
Content-Type: audio/mpeg
Content-Length: 504
Connection: keep-alive
Content-Disposition: inline; filename=time.mp3
Content-Range: bytes 0-503/504
Accept-Ranges: bytes
Pragma: public
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains

mpsnare.iesnare.com/time.mp3?nocache=0.1481889384982229

54.195.39.4

206 Partial Content

504 B

URL HTTP/1.1
mpsnare.iesnare.com/time.mp3?nocache=0.1481889384982229
IP
54.195.39.4:0
ASN
#16509 AMAZON-02

File type
MPEG ADTS, layer III, v2.5, 32 kbps, 8 kHz, JntStereo\012- data
Size
504 B (504 bytes)
Hash
cfe47da3367b896cf8fe9d23144e6294
5eb28e56c71ce7e851b99b4d90b4091e3090243a
2857eb76b4850703192f5d42bc145b2384147fcb65f63b5447ed74664e241507

HTTP Headers

GET /time.mp3?nocache=0.1481889384982229 HTTP/1.1
Host: mpsnare.iesnare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 206 Partial Content
Server: nginx
Date: Tue, 24 Jan 2023 02:41:28 GMT
Content-Type: audio/mpeg
Content-Length: 504
Connection: keep-alive
Content-Disposition: inline; filename=time.mp3
Content-Range: bytes 0-503/504
Accept-Ranges: bytes
Pragma: public
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains

nyt-ep.com/favicon.ico

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/favicon.ico
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:26 GMT
Server: Apache
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

ocsp.sca1b.amazontrust.com/

54.230.245.100

200 OK

471 B

URL HTTP/1.1
ocsp.sca1b.amazontrust.com/
IP
54.230.245.100:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
a456b385ac21f1fc7cc5425834f34ea2
f30a7295147251c855a1be1d392b342e5ec3c2c1
c41823c292afa219b3751539d8d7ec7dd3e9ed8f430d79bd8d69a2c350cff70c

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=129848
Date: Tue, 24 Jan 2023 02:41:28 GMT
Etag: "63ce9321-1d7"
Expires: Wed, 25 Jan 2023 14:45:36 GMT
Last-Modified: Mon, 23 Jan 2023 14:01:05 GMT
Server: ECS (nyb/1D07)
X-Cache: Miss from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: k9bKYA5dlI5df7fTDGX_1NjiDZXoTezpi2XVolHq-64HCLYzqSA7sg==
Age: 2671

cm.everesttech.net/cm/dd?d_uuid=16781957611493296952626328520164154940

18.201.4.185

302

0 B

URL HTTP/1.1
cm.everesttech.net/cm/dd?d_uuid=16781957611493296952626328520164154940
IP
18.201.4.185:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cm/dd?d_uuid=16781957611493296952626328520164154940 HTTP/1.1
Host: cm.everesttech.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 302 
Date: Tue, 24 Jan 2023 02:41:28 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: everest_g_v2=g_surferid~Y89FWAAAAHlzsQMx; Domain=.everesttech.net; Expires=Wed, 24-Jan-2024 02:41:28 GMT; Path=/
everest_session_v2=Y89FWAAAAHlzsgMx; Domain=.everesttech.net; Path=/
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y89FWAAAAHlzsQMx
Server: AMO-cookiemap/1.1

nyt-ep.com/dfcu/fonts/fa-solid-900.0a037305.woff2

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/dfcu/fonts/fa-solid-900.0a037305.woff2
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /dfcu/fonts/fa-solid-900.0a037305.woff2 HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:26 GMT
Server: Apache
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

dpm.demdex.net/ibs:dpid=411&dpuuid=Y89FWAAAAHlzsQMx

34.255.210.6

302 Found

0 B

URL HTTP/1.1
dpm.demdex.net/ibs:dpid=411&dpuuid=Y89FWAAAAHlzsQMx
IP
34.255.210.6:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /ibs:dpid=411&dpuuid=Y89FWAAAAHlzsQMx HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://nyt-ep.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 302 Found
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-1-v045-078a58cff.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y89FWAAAAHlzsQMx
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=36358686032894537491246938393268853137; Max-Age=15552000; Expires=Sun, 23 Jul 2023 02:41:28 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 6NdhkcDvSEA=
Content-Length: 0
Connection: keep-alive

digitalfederalcreditunion.sc.omtrdc.net/b/ss/dfcudigbankingprod,dfcumainglobal/1/JS-2.22.4-LCXS/s86301370878205?AQB=1&ndh=1&pf=1&t=24%2F0%2F2023%202%3A41%3A26%202%200&vid=17089465370507669272634557587177644396&mid=17089465370507669272634557587177644396&aamlh=6&ce=UTF-8&pageName=projectfinance%3Aen%3Adfcu%3Apages%3Alogin.php&g=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Flogin.php&cc=USD&ch=dfcu&server=nyt-ep.com&events=event1&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=dfcu&c2=dfcu%3Apages&v2=dfcu%3Apages&c3=dfcu%3Apages%3Alogin.php&v3=dfcu%3Apages%3Alogin.php&c9=D%3Dv9&v9=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Flogin.php&v10=D%3Dc10&v11=projectfinance%3Aen%3Adfcu%3Apages%3Alogin.php&v12=year%3D2023%20%7C%20month%3DJanuary%20%7C%20date%3D24%20%7C%20day%3DTuesday%20%7C%20time%3D2%3A41%20AM&v13=New&c14=31&v14=D%3Dc14&c15=New%20Visitor&c16=1&c17=first%20hit%20of%20visit&v20=Project%20Finance&v41=17089465370507669272634557587177644396&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&AQE=1

15.236.125.10

200 OK

43 B

URL HTTP/1.1
digitalfederalcreditunion.sc.omtrdc.net/b/ss/dfcudigbankingprod,dfcumainglobal/1/JS-2.22.4-LCXS/s86301370878205?AQB=1&ndh=1&pf=1&t=24%2F0%2F2023%202%3A41%3A26%202%200&vid=17089465370507669272634557587177644396&mid=17089465370507669272634557587177644396&aamlh=6&ce=UTF-8&pageName=projectfinance%3Aen%3Adfcu%3Apages%3Alogin.php&g=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Flogin.php&cc=USD&ch=dfcu&server=nyt-ep.com&events=event1&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=dfcu&c2=dfcu%3Apages&v2=dfcu%3Apages&c3=dfcu%3Apages%3Alogin.php&v3=dfcu%3Apages%3Alogin.php&c9=D%3Dv9&v9=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Flogin.php&v10=D%3Dc10&v11=projectfinance%3Aen%3Adfcu%3Apages%3Alogin.php&v12=year%3D2023%20%7C%20month%3DJanuary%20%7C%20date%3D24%20%7C%20day%3DTuesday%20%7C%20time%3D2%3A41%20AM&v13=New&c14=31&v14=D%3Dc14&c15=New%20Visitor&c16=1&c17=first%20hit%20of%20visit&v20=Project%20Finance&v41=17089465370507669272634557587177644396&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&AQE=1
IP
15.236.125.10:0
ASN
#16509 AMAZON-02

File type
GIF image data, version 89a, 2 x 2\012- data
Size
43 B (43 bytes)
Hash
ad480fd0732d0f6f1a8b06359e3a42bb
a544538683a2dfe574eeb2e358ac8fcc78289d50
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

HTTP Headers

GET /b/ss/dfcudigbankingprod,dfcumainglobal/1/JS-2.22.4-LCXS/s86301370878205?AQB=1&ndh=1&pf=1&t=24%2F0%2F2023%202%3A41%3A26%202%200&vid=17089465370507669272634557587177644396&mid=17089465370507669272634557587177644396&aamlh=6&ce=UTF-8&pageName=projectfinance%3Aen%3Adfcu%3Apages%3Alogin.php&g=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Flogin.php&cc=USD&ch=dfcu&server=nyt-ep.com&events=event1&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=dfcu&c2=dfcu%3Apages&v2=dfcu%3Apages&c3=dfcu%3Apages%3Alogin.php&v3=dfcu%3Apages%3Alogin.php&c9=D%3Dv9&v9=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Flogin.php&v10=D%3Dc10&v11=projectfinance%3Aen%3Adfcu%3Apages%3Alogin.php&v12=year%3D2023%20%7C%20month%3DJanuary%20%7C%20date%3D24%20%7C%20day%3DTuesday%20%7C%20time%3D2%3A41%20AM&v13=New&c14=31&v14=D%3Dc14&c15=New%20Visitor&c16=1&c17=first%20hit%20of%20visit&v20=Project%20Finance&v41=17089465370507669272634557587177644396&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&AQE=1 HTTP/1.1
Host: digitalfederalcreditunion.sc.omtrdc.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/

HTTP/1.1 200 OK
access-control-allow-origin: *
date: Tue, 24 Jan 2023 02:41:28 GMT
expires: Mon, 23 Jan 2023 02:41:28 GMT
last-modified: Wed, 25 Jan 2023 02:41:28 GMT
pragma: no-cache
p3p: CP="This is not a P3P policy"
server: jag
etag: 3596021688363089920-4619377917446945903
vary: *
content-type: image/gif;charset=utf-8
content-length: 43
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff

dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y89FWAAAAHlzsQMx

34.255.210.6

200 OK

59 B

URL HTTP/1.1
dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y89FWAAAAHlzsQMx
IP
34.255.210.6:0
ASN
#16509 AMAZON-02

File type
GIF image data, version 89a, 1 x 1\012- data
Size
59 B (59 bytes)
Hash
1251cd5e5c2def4c046309375f87c1c1
e02d6b0c6a5c495c15985e2832e335eda8528c80
4e7010cc46fa361c88e57e3346d27421cf3b8a8bf5f39b43fc45997c60cb1c13

HTTP Headers

GET /demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y89FWAAAAHlzsQMx HTTP/1.1
Host: dpm.demdex.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://nyt-ep.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: image/gif
DCS: dcs-prod-irl1-2-v045-0f9127447.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: qhiJp3XPTqY=
Content-Length: 59
Connection: keep-alive

nyt-ep.com/dfcu/fonts/fa-solid-900.46457309.ttf

103.120.66.134

404 Not Found

16 B

URL HTTP/1.1
nyt-ep.com/dfcu/fonts/fa-solid-900.46457309.ttf
IP
103.120.66.134:0
ASN
#137373 PT. SUITEN INOVASI SUKSES

File type
ASCII text
Size
16 B (16 bytes)
Hash
4845f01eaa8068384625e302e9a4eb05
fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /dfcu/fonts/fa-solid-900.46457309.ttf HTTP/1.1
Host: nyt-ep.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/login.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19382%7CMCMID%7C17089465370507669272634557587177644396%7CMCAAMLH-1675132885%7C6%7CMCAAMB-1675132885%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674535285s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1; s_tslv=1674528086787; s_vnc365=1706064086787%26vn%3D1; s_ivc=true; s_dur=1674528086788; s_nr30=1674528086805-New; s_ppv=projectfinance%253Aen%253Adfcu%253Apages%253Alogin.php%2C100%2C100%2C939%2C1%2C1; s_ips=939; s_tp=939; s_cc=true

HTTP/1.1 404 Not Found
Date: Tue, 24 Jan 2023 02:41:26 GMT
Server: Apache
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML