Report - varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

Report Overview

Submitted URL
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php
IP
199.188.207.126
ASN
#22612 NAMECHEAP-NET
Submitted
2023-04-04 09:39:19
Access
public
Website Title
Final URL
Tags
american_express financial phishing
urlquery detections
Phishing - American Express

Detections

urlquery
11
Network Intrusion Detection
0
Threat Detection Systems
50

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-04-04T18:12:09Z	2.4 kB	6.2 kB	23.36.76.226
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-04-04T18:13:55Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-04-04T18:20:05Z	413 B	5.9 kB	34.160.144.191
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-04-04T18:13:50Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-04-04T18:19:16Z	606 B	238 B	34.117.65.55
varrock.click	unknown	2022-04-14T13:30:33Z	2023-04-04T04:41:45Z	10 kB	340 kB	199.188.207.126
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-04-04T13:13:40Z	3.2 kB	43 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php	American Express

PhishTank

Scan Date	Severity	Indicator	Alert
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php	Other

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/script-supplier.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/pilot2.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/rwd.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ensighten-head-domestic	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/VIDServiceDomestic.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/jquery.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/chatButtonBootStrap.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/tag.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/a.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/serverComponent_002.php	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ptc.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmpackage-1.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmcore_002.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/visitorAPI-NonAAM.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/uxa.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-ui-router.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-sanitize.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-translate.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/adobetracking	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-animate.js	Phishing
2023-04-04	medium	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-messages.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/pilot2.js	30 kB	2023-03-07	2023-04-26
Pretty URL varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/pilot2.js IP 199.188.207.126 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:25:41 Last Seen2023-04-26 08:59:51 Times Seen106 Hash 7057bff89250fb4e96a87acf8d67dab7 e5ab48ad04ae6ba872767df20cbfaaa34b9329af e7b45773efb4f4ad5a1fb731b16b76aed0881e80fb6fbb3ab19bb7e047e35420 Loading...

	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ensighten-head-domestic	81 kB	2023-03-08	2023-04-21
Pretty URL varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ensighten-head-domestic IP 199.188.207.126 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 07:17:30 Last Seen2023-04-21 17:50:55 Times Seen99 Hash f5c717e849b8e611cf78368cd4e6fdb2 aa30ae864fe88cb4e170d10c2e874b05baf36475 ac7b75e9cef95d920f3832ba314e5ec3ccec6adb91e96a7ceac8ab71a51890e4 Loading...

	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/serverComponent_002.php	165 B	2023-03-08	2023-04-21
Pretty URL varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/serverComponent_002.php IP 199.188.207.126 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 07:17:30 Last Seen2023-04-21 17:50:55 Times Seen86 Hash 0ba13d7ecfb9284a0c77c975ebe2e195 0446c21e4be49c50fc1c8fe780469898d5127a41 a58aaf020f49841d8cae415490209e949fd73095dd2d7ae026c1056aa579cb5e Loading...

	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ptc.js	47 kB	2023-03-08	2023-04-21
Pretty URL varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ptc.js IP 199.188.207.126 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 07:17:30 Last Seen2023-04-21 17:50:55 Times Seen103 Hash 6e92a69b3d0311078b56c5b28104709a 0f49e56ab39c6361d2f2e7f3ad3294f471c210bf c3facc5f3d547265536fb46f11ea582d5a476f754f12ca55f9c9c917b1f6d9c1 Loading...

	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/script-supplier.js	64 kB	2023-03-08	2023-04-21
Pretty URL varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/script-supplier.js IP 199.188.207.126 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 07:17:30 Last Seen2023-04-21 17:50:55 Times Seen84 Hash fa19ec785f8b8b912e389cb10af226fe 90f0204e49685bb5343fc46ae0e3112b921a11bc 91b9598ce3b4fe3cbcdd5b0f427169c78e8186916fca2c7c1c9d5f6fb4eef616 Loading...

	varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/adobetracking	76 kB	2023-03-08	2023-04-21
Pretty URL varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/adobetracking IP 199.188.207.126 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 07:17:30 Last Seen2023-04-21 17:50:55 Times Seen99 Hash e0cfa0525156be243b3faf4c2080c09a dce1602a67078c45dc5c1bf4a28cf6a5395c2cb9 8c83c596abf7096d4ac19854d8297883a6a6172a665485efcd0d7e52618d3c0b Loading...

HTTP Transactions (44)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1965860f5630f7dda817a236cb72ea24
beec8147d48911a007287014564ce544d296a5fd
00b4aafe530f6ceb3d6d4de42fffdaee0cb4e0a60834c85b1d21e42e5db2ef91

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "00B4AAFE530F6CEB3D6D4DE42FFFDAEE0CB4E0A60834C85B1D21E42E5DB2EF91"
Last-Modified: Mon, 03 Apr 2023 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7161
Expires: Tue, 04 Apr 2023 11:38:29 GMT
Date: Tue, 04 Apr 2023 09:39:08 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e50dac5108a698d61ca49516033d1a20
53d243b89fc00deb9bfae07351bbe36ddb7c1df3
e9e0ad98c485b56fe65ea0a8bc4974fff3f804fcf2d8f6266ada9acd27c7b7cc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E9E0AD98C485B56FE65EA0A8BC4974FFF3F804FCF2D8F6266ADA9ACD27C7B7CC"
Last-Modified: Tue, 04 Apr 2023 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21349
Expires: Tue, 04 Apr 2023 15:34:57 GMT
Date: Tue, 04 Apr 2023 09:39:08 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
903ed2d58f1f33d069b70c4b53f1cb1f
0ef89cd6eb79a2ddd74434f9233cf486fffc1142
d8c984b50f04fcdb1ebc99d982502d85193302c85239ee7497666247edfc0061

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8C984B50F04FCDB1EBC99D982502D85193302C85239EE7497666247EDFC0061"
Last-Modified: Sun, 02 Apr 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10922
Expires: Tue, 04 Apr 2023 12:41:10 GMT
Date: Tue, 04 Apr 2023 09:39:08 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
29fdbcd53b5646cfcdd46510063734c4
85e3ceda5ef130219f4fe8a31e52e2690c8f7d8e
24c27586332c016685e6231fec5836e921048d8aaefbcd4cd6f88969f9d91e18

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 04 Apr 2023 09:28:44 GMT
content-type: application/json
age: 624
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-05-20-17-04-38.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-05-20-17-04-38.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
95f61d351f5fc9533cc78e255ce9bc06
fba284117f347782ac23c51d141d7e3ec15a867e
7fcc5f9e52e389d8d7c6df7f1f2a1291ae0aaae8e554f3022239ab092b2ef3c3

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-05-20-17-04-38.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: WANlCw2Xs09nKYT+eGImGbmWduxaSfa3maD+TR0O7gsjQux0fYLRbSOcppE53npJaz6ZMYQtZNI=
x-amz-request-id: QRPRFNT5GSWPN58Y
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 04 Apr 2023 08:53:09 GMT
age: 2759
last-modified: Fri, 31 Mar 2023 17:04:39 GMT
etag: "95f61d351f5fc9533cc78e255ce9bc06"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 04 Apr 2023 09:39:08 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
27326a64990c6f698a83600491674790
a6bdb4743ace6be80673f6899605bf9177a75b69
e4a8d3c3016130e47580098183bcea5ae369697b7907eafd65ac3450dc2eb265

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E4A8D3C3016130E47580098183BCEA5AE369697B7907EAFD65AC3450DC2EB265"
Last-Modified: Mon, 03 Apr 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11332
Expires: Tue, 04 Apr 2023 12:48:01 GMT
Date: Tue, 04 Apr 2023 09:39:09 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Backoff, Last-Modified, Alert, Content-Length, Pragma, Cache-Control, Retry-After, ETag, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 04 Apr 2023 09:14:45 GMT
age: 1464
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

push.services.mozilla.com/

34.117.65.55

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.117.65.55:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 6aVLbnK8sZ8PRA7EjxhuHQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: JhF+a0Jo9UdWjD9Tx5Cty2PYPxA=
Date: Tue, 04 Apr 2023 09:39:09 GMT
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

199.188.207.126

200 OK

27 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Non-ISO extended-ASCII text, with very long lines (25605), with CRLF line terminators
Size
27 kB (26744 bytes)
Hash
99c3ea3a2fb7e47d88a65b4c4e359bf2
d9ac3e9d901f2a1deff8817719e2f31818242079
d46fe4df3f90db14eeac45081c661a58c2ba1c9acb6a3b06ecd37bd4ed53fabf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
openphish	American Express
phishtank	Other
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify-card.php HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:08 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 26744
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/chatFrame.css

199.188.207.126

200 OK

3.8 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/chatFrame.css
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with CRLF line terminators
Size
3.8 kB (3793 bytes)
Hash
c553b148fd20b80120140a49594d8e0a
63fff126161ea1e99268bfad5a3aa430f5742538
022a3f24eb867fb1e62eb9b74a8107c4327ec310f2026044f7f1bd8ff3be9a9d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/chatFrame.css HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 3793
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/script-supplier.js

199.188.207.126

200 OK

21 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/script-supplier.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
Unicode text, UTF-8 text, with very long lines (64178), with no line terminators
Size
21 kB (20612 bytes)
Hash
e6ee60d7ab4b421f5ee4b06563eb0e69
8b346592f3bb7d1291785b4c35e8700a8e6e8ec6
10cb787490ede0e751cff71bfe19eebb5f85388ceec8a0d78a93b0187f6b7787

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/script-supplier.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 20612
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/pilot2.js

199.188.207.126

200 OK

6.2 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/pilot2.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (22962)
Size
6.2 kB (6230 bytes)
Hash
2168a99b0a230960a5da92a90ab8b035
ce7fd2f9336c1e51a06173cef4fc85a6a8151ff1
4f18f72232db03494ccbbbcb33f1bf3ae67af8222cc501fc9ba663df63a340c7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/pilot2.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 6230
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
869fe4a8dc549ffa1023d3adc184e4f2
37b95d88dd3f6f251bb651b130e09b202850033f
9387d0291fa66cc98248bae7724ec34f884c766302d2a99e734585cc591ad304

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9387D0291FA66CC98248BAE7724EC34F884C766302D2A99E734585CC591AD304"
Last-Modified: Mon, 03 Apr 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17260
Expires: Tue, 04 Apr 2023 14:26:50 GMT
Date: Tue, 04 Apr 2023 09:39:10 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
869fe4a8dc549ffa1023d3adc184e4f2
37b95d88dd3f6f251bb651b130e09b202850033f
9387d0291fa66cc98248bae7724ec34f884c766302d2a99e734585cc591ad304

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9387D0291FA66CC98248BAE7724EC34F884C766302D2A99E734585CC591AD304"
Last-Modified: Mon, 03 Apr 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17260
Expires: Tue, 04 Apr 2023 14:26:50 GMT
Date: Tue, 04 Apr 2023 09:39:10 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
869fe4a8dc549ffa1023d3adc184e4f2
37b95d88dd3f6f251bb651b130e09b202850033f
9387d0291fa66cc98248bae7724ec34f884c766302d2a99e734585cc591ad304

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9387D0291FA66CC98248BAE7724EC34F884C766302D2A99E734585CC591AD304"
Last-Modified: Mon, 03 Apr 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17259
Expires: Tue, 04 Apr 2023 14:26:50 GMT
Date: Tue, 04 Apr 2023 09:39:11 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd5a64c6f-4f76-4a92-92c4-1fa8cb48142e.jpeg

34.120.237.76

200 OK

6.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd5a64c6f-4f76-4a92-92c4-1fa8cb48142e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.8 kB (6803 bytes)
Hash
fde7605b95c3ac6b8de339dbd12e17b1
b44d521b31be7b3fe378a0e070c49379a6eab26e
5496cf7c705ccc67dd13f86a07d9a352424d58591aa67afe1e1361c640f8d510

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd5a64c6f-4f76-4a92-92c4-1fa8cb48142e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6803
x-amzn-requestid: 6c78179f-0d11-4a23-8e86-e4f05d7c7f90
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: C0fq3HrioAMF7ww=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-642b4645-758850e07ef9b1512b684c35;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Mon, 03 Apr 2023 21:33:57 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: TvDTtH9ZqXuvomWMYiB8g8N0JKjRrHIXF1SxfCRJfwZS-7pGLAPrVw==
via: 1.1 ee32c7a76e2727d565413cc6c352ef48.cloudfront.net (CloudFront), 1.1 29a825d8a219984d47bec4350779b558.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Apr 2023 21:33:57 GMT
etag: "b44d521b31be7b3fe378a0e070c49379a6eab26e"
content-type: image/jpeg
age: 43514
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59f4c3da-c33f-44e6-8deb-eb7674fc7bb5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.9 kB (4939 bytes)
Hash
f7ceebf2eccd4d6061fb93eb844efbe8
d99c79d4cad47caa809909a8aff0e0992fb50ec1
214ad3948e19d8723b0ce11b6a892b1badf67ee1eaada0c7c3194a26c61c5971

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59f4c3da-c33f-44e6-8deb-eb7674fc7bb5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4939
x-amzn-requestid: e0563c56-9cb1-43fd-9414-a10105c2500a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CyhOHEF1IAMFVcQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-642a7bf3-4acdd5ed3fac5c8353ff46f2;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Mon, 03 Apr 2023 07:10:43 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: L07bIuQhDzGQ1r-QEZKK0r0tqKtLSQS1nlalT3yIgQQWflzLM8dYQg==
via: 1.1 a87682502db4b394cc6ba84510da9f98.cloudfront.net (CloudFront), 1.1 f268a165a18929fd0a24a3189fbd16b2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 04 Apr 2023 07:15:49 GMT
age: 8602
etag: "d99c79d4cad47caa809909a8aff0e0992fb50ec1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa5f70c40-8b38-48db-b482-a5cc8f1580ef.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.9 kB (6912 bytes)
Hash
9d1360ec3cb182322e0a0c445f57e5b7
9f71e3cd002ca8116d917c3b7fb57291099269d1
e3d216e879d771bf2507928ba1b26465c87a4202a4cdc03483f002c2826a81b2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa5f70c40-8b38-48db-b482-a5cc8f1580ef.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6912
x-amzn-requestid: 53fcdc8a-e064-4e81-b5ac-5d0ae4bcfdb9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: C0fpuEZ-IAMFxaA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-642b463d-3b7b43f30dd66fae5dc9ea6a;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Mon, 03 Apr 2023 21:33:49 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: GZgHaJIuhgJevaSQVWPEZ-U5S-OGbnM_ZSvlcmim_e5Fsi6P_7TISA==
via: 1.1 59456abf79b201034ab5c9cfef7355e2.cloudfront.net (CloudFront), 1.1 29a825d8a219984d47bec4350779b558.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Apr 2023 21:33:50 GMT
etag: "9f71e3cd002ca8116d917c3b7fb57291099269d1"
content-type: image/jpeg
age: 43521
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81b22292-2571-4b3d-aeae-f84b72b36391.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.1 kB (6134 bytes)
Hash
0e87dbffda284dbb0008567a8d4dee30
8edeb9deea0d64ca580af16c44b99d37e918fd58
023247190546b5da51b52c452cf0ce7fe2c4a5b640d5ed682b27e80ee1b3f850

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81b22292-2571-4b3d-aeae-f84b72b36391.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6134
x-amzn-requestid: d72d8ddc-ed19-402a-b1e7-3392eacd9230
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: C0fpsGPIoAMFppA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-642b463d-4099b9bc35b52bd3297c0bbb;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Mon, 03 Apr 2023 21:33:49 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: sGdeT2q8lkX5OCuHS456z_5v7gQ-TUwyLnp3e9bE7TmOjG6SsJjLxg==
via: 1.1 5502255f9557c1e2c098b94110b6151c.cloudfront.net (CloudFront), 1.1 ae06b19943a6bad1c1b12b79f7339498.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Apr 2023 21:33:50 GMT
etag: "8edeb9deea0d64ca580af16c44b99d37e918fd58"
content-type: image/jpeg
age: 43521
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F86274a5c-15b7-49b6-a8ee-01546eb3817c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.7 kB (7652 bytes)
Hash
968835dc12a7fcd43dd43ce155b857f4
a5d938ee5166c39a3cd73a2a85469f06338341e6
369095e1c0c06d202d9b4a199017193aa08d114eebe18dbe4192d28046f0b3ed

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F86274a5c-15b7-49b6-a8ee-01546eb3817c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7652
x-amzn-requestid: d3a5499f-5194-4521-96d0-580f8582fb1e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: C0fpsHO_oAMFjEg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-642b463d-7ad0993b235ba1933683c3ae;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Mon, 03 Apr 2023 21:33:49 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: oSK-hWRWnv3UIko9BAlLkT_C6o6ndytXScYmDv57nXzaaChzUAmCag==
via: 1.1 ba490acb2ea716cd57876286ed686786.cloudfront.net (CloudFront), 1.1 ae06b19943a6bad1c1b12b79f7339498.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Apr 2023 21:33:50 GMT
etag: "a5d938ee5166c39a3cd73a2a85469f06338341e6"
content-type: image/jpeg
age: 43521
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F16318447-1c81-4525-becf-32a77c9030e1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.3 kB (4265 bytes)
Hash
5c226ea23c670c61a42a6d94959e10dc
e4a946d93a63ad9fcf751fbb8e55ab18466197e2
b95c03169121047006cdab960d5564c683c6ef8755ba9ca143e0c87bcca9ed92

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F16318447-1c81-4525-becf-32a77c9030e1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4265
x-amzn-requestid: c4bfc599-63fb-4953-b39b-45c059c99070
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CopBKHO1IAMF10A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6426886d-7adcee9a3a8156542d555ccf;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Fri, 31 Mar 2023 07:14:53 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: Yx9_tqAFKR9hYmdjG7q3Z27fk9-StzSDP9Pjpz6tbDygWUFBHplGiA==
via: 1.1 22ea0ab0881473261b786ecbb5e00f54.cloudfront.net (CloudFront), 1.1 4d8620b80ebe37d366388e117039aa8e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Apr 2023 12:50:38 GMT
age: 74913
etag: "e4a946d93a63ad9fcf751fbb8e55ab18466197e2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/oce-min.css

199.188.207.126

200 OK

46 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/oce-min.css
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (65536), with no line terminators
Size
46 kB (46203 bytes)
Hash
e2a53bf2decc81c6c0a3bd747921fc6d
c6fe90f6e8c6444d020b843205aa853a177de3de
1067fd62d4d4adb182e1e0b5f8c576c5190213cf33f2022c9cc138b1220b6657

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/oce-min.css HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 46203
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/rwd.js

199.188.207.126

200 OK

1.1 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/rwd.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text
Size
1.1 kB (1067 bytes)
Hash
e45725cb00758b3c449a09a4dfb6c141
b150b793dac7f1cd5660080944dd142e406f2144
98359ab616cb61b797e4341880ada7cdaab15ef06e85f0235cef835c157766b5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/rwd.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:11 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1067
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ensighten-head-domestic

199.188.207.126

200 OK

20 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ensighten-head-domestic
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (600)
Size
20 kB (19812 bytes)
Hash
83de09030c5d95ed4aa5e48e08346620
230cc26e3eb62c6e8e548ad640cd5640959a199c
25801b5d706f546d3df14e4e08882cbd1b21aaa0235e5224964a722edb02f245

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/ensighten-head-domestic HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:11 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 19812
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/VIDServiceDomestic.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/VIDServiceDomestic.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/VIDServiceDomestic.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/jquery.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/jquery.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/jquery.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/chatButtonBootStrap.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/chatButtonBootStrap.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/chatButtonBootStrap.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/tag.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/tag.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/tag.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/a.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/a.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/a.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:10 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmcore.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmcore.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/mmcore.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:11 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/serverComponent_002.php

199.188.207.126

200 OK

142 B

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/serverComponent_002.php
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text
Size
142 B (142 bytes)
Hash
2bfd4c40c6961cf95a498eadffc9c3c5
33f866e7c00364ae886d5275aa207fc9918668df
2e8f13863016a571177a90f2167b638ad8450c33fc7963b21b9d956491850c8c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/serverComponent_002.php HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:12 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 142
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ptc.js

199.188.207.126

200 OK

12 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/ptc.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (2457)
Size
12 kB (12308 bytes)
Hash
efbf725e07879ce5f4f18ac74078af4a
a6ec43646e816a7ac79748f1baaaa9d2e098375e
35dd00a3ab6803a5626c9bd68333b0c910d6d35534a15a63d68734b22c9b875a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/ptc.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:14 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 12308
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: application/javascript

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmpackage-1.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmpackage-1.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/mmpackage-1.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:12 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmcore_002.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/mmcore_002.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/mmcore_002.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:12 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/visitorAPI-NonAAM.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/visitorAPI-NonAAM.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/visitorAPI-NonAAM.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:12 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/uxa.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/uxa.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/uxa.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:12 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/angular.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:14 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-ui-router.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-ui-router.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/angular-ui-router.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:14 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-sanitize.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-sanitize.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/angular-sanitize.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:14 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-translate.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-translate.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/angular-translate.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:14 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/adobetracking

199.188.207.126

200 OK

22 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/adobetracking
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (624), with CRLF line terminators
Size
22 kB (21550 bytes)
Hash
43f4b25ba4dc1cc815057542b77f9bfd
88b6894665edfc71a097bd8fdc9e14ac11ffb087
e7f8d4798e8b677cc1d015ab4cdb6bb7745ab8b84bc7b57af84f167242eb4864

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - American Express
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/adobetracking HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 09:39:17 GMT
Server: Apache
Last-Modified: Fri, 30 Dec 2022 11:36:30 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 21550
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-animate.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-animate.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/angular-animate.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:15 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-messages.js

199.188.207.126

404 Not Found

11 kB

URL HTTP/1.1
varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify/angular-messages.js
IP
199.188.207.126:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10165), with CRLF, LF line terminators
Size
11 kB (10756 bytes)
Hash
8444aa82b24d7a9da8ce30cf832c3d62
cf24805396501254a2bd0c44140594dc4cc041b1
aa7af032710a4dbd72a0d5dc46f5400e6008b9915d6bdacd3a8a8190c9e5fe51

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /wp-content/americanexpeess.com.apx/amexnew/verify/angular-messages.js HTTP/1.1
Host: varrock.click
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://varrock.click/wp-content/americanexpeess.com.apx/amexnew/verify-card.php

HTTP/1.1 404 Not Found
Date: Tue, 04 Apr 2023 09:39:15 GMT
Server: Apache
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://varrock.click/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 10756
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (44)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type