Report - www.commonwealth-verify.line.pm/

Report Overview

Submitted URL
www.commonwealth-verify.line.pm/
IP
203.28.49.161
ASN
#38719 Dreamscape Networks Limited
Submitted
2023-04-01 01:06:15
Access
public
Website Title
Final URL
Tags
commonwealth_bank financial phishing dyndns
urlquery detections
Phishing - Commonwealth Bank
Suspicious - DynDNS domain

Detections

urlquery
22
Network Intrusion Detection
5
Threat Detection Systems
38

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
commonwealth-verify.line.pm	unknown	2023-02-10T07:50:12Z	2023-04-01T00:32:35Z	5.4 kB	40 kB	203.28.49.161
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-31T07:51:33Z	3.2 kB	51 kB	34.120.237.76
static.my.commbank.com.au	unknown	2017-01-29T14:59:55Z	2023-03-28T15:25:16Z	1.4 kB	36 kB	23.38.202.24
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-31T18:12:04Z	2.7 kB	7.1 kB	23.36.77.32
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-31T18:14:44Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-31T18:18:04Z	413 B	5.9 kB	34.160.144.191
ocsp.entrust.net	1208	2014-01-10T03:18:45Z	2023-03-31T18:12:04Z	1.0 kB	5.9 kB	104.110.10.32
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-31T18:12:09Z	333 B	391 B	34.117.237.239
www.commonwealth-verify.line.pm	unknown	2023-02-10T07:50:12Z	2023-04-01T00:32:35Z	363 B	413 B	203.28.49.161
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-31T18:13:52Z	606 B	127 B	52.43.157.124

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-04-01 01:06:03	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.line .pm Domain
2023-04-01 01:06:03	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.line .pm Domain
2023-04-01 01:06:03	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.line .pm Domain
2023-04-01 01:06:04	medium	Client IP	203.28.49.161	ET INFO DYNAMIC_DNS HTTP Request to a *.line .pm Domain
2023-04-01 01:06:04	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.line .pm Domain

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-02-26	medium	commonwealth-verify.line.pm/pages	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia
2023-02-26	medium	commonwealth-verify.line.pm/	Commonwealth Bank of Australia

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-04-01	medium	www.commonwealth-verify.line.pm/	Phishing
2023-04-01	medium	commonwealth-verify.line.pm/pages	Phishing
2023-04-01	medium	commonwealth-verify.line.pm/js/cntdjs/cntd.js	Phishing
2023-04-01	medium	commonwealth-verify.line.pm/js/cntdjs/jquery.mask.js	Phishing
2023-04-01	medium	commonwealth-verify.line.pm/js/shared/loading.js	Phishing
2023-04-01	medium	commonwealth-verify.line.pm/js/shared/online_status.js	Phishing
2023-04-01	medium	commonwealth-verify.line.pm/front_end/front_end_files/jquery.js	Phishing
2023-04-01	medium	commonwealth-verify.line.pm/js/cntdjs/jquery.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	commonwealth-verify.line.pm/js/cntdjs/jquery.mask.js	23 kB	2023-03-07	2024-04-25
Pretty URL commonwealth-verify.line.pm/js/cntdjs/jquery.mask.js IP 203.28.49.161 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:19:34 Last Seen2024-04-25 19:22:21 Times Seen2676 Hash 24992f1ed62baf9393609f3c6c2ad20e 34716cf70f7f7a9cd072e7796c34ce987f85d18c a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8 Loading...

	commonwealth-verify.line.pm/js/cntdjs/jquery.js	90 kB	2023-03-07	2024-04-26
Pretty URL commonwealth-verify.line.pm/js/cntdjs/jquery.js IP 203.28.49.161 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-04-26 20:07:54 Times Seen261777 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	commonwealth-verify.line.pm/pages	104 B	2023-04-01	2023-04-01
Pretty URL commonwealth-verify.line.pm/pages IP 203.28.49.161 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-01 11:14:16 Last Seen2023-04-01 11:14:16 Times Seen1 Hash 0d534c4ddb42a9f934a8ac7b91aa26c5 c5852c29a375323528446ed4beb5491ce17db182 1ff9d613b4b025a22367e7ee43350c534f7ba8b5a7386dc24a7fa3b2d2de700f Loading...

	commonwealth-verify.line.pm/js/cntdjs/cntd.js	2.8 kB	2023-03-07	2024-04-19
Pretty URL commonwealth-verify.line.pm/js/cntdjs/cntd.js IP 203.28.49.161 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24:54 Last Seen2024-04-19 19:17:06 Times Seen707 Hash 0eee17a675c9c575c21ca0ee6571ca2a b7c192e04cc5dd6199c7fa7f9e4f38928571e055 5b056148977cddad1d04190e8588f71549f5fbce2c8504fd0a52699a451896ca Loading...

	commonwealth-verify.line.pm/js/shared/loading.js	2.0 kB	2023-03-07	2024-04-19
Pretty URL commonwealth-verify.line.pm/js/shared/loading.js IP 203.28.49.161 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:19:34 Last Seen2024-04-19 19:17:06 Times Seen731 Hash f887f681e4eb3254fc34a0f2ba1f56b7 822eaf7d5d740537cdc7e5fff2bc506ade43cc7e 4bdc871a71df801aa86926434d6fbed9744ec4757af4e9d6d40978724ea59134 Loading...

	commonwealth-verify.line.pm/js/shared/online_status.js	998 B	2023-03-07	2024-04-19
Pretty URL commonwealth-verify.line.pm/js/shared/online_status.js IP 203.28.49.161 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:19:34 Last Seen2024-04-19 19:17:06 Times Seen815 Hash ea63f1dec81ad7dd70e88f5e8d68ce2a 4caf64741cf659af90b0324d51d97a8958820afa e64e9d464beb9fe2717cd8bd8d093bb04d570f08a15c65f14533733904e12be7 Loading...

	commonwealth-verify.line.pm/pages	267 B	2023-03-14	2023-04-01
Pretty URL commonwealth-verify.line.pm/pages IP 203.28.49.161 ASN #38719 Dreamscape Networks Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-14 12:27:09 Last Seen2023-04-01 11:14:16 Times Seen2 Hash c079e5e30fdd7bf643a217ca11c3d88e 5aaaf9c4bc4a434213c2d1373e1fa869f4772d53 c1f2abc9cd4e96708044cf5cacc9488b20cb7e2be002bf2aff7c350324b64773 Loading...

HTTP Transactions (37)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
034b06325b334948200ef1d79d4ddeb7
b9a3c93cff37cbaaf20cca79b965b1a21c525ce8
417ce2093027b05cc34199c75e6b29f155c4dd3150651b6b3dbe8564098c4143

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "417CE2093027B05CC34199C75E6B29F155C4DD3150651B6B3DBE8564098C4143"
Last-Modified: Fri, 31 Mar 2023 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14161
Expires: Sat, 01 Apr 2023 05:02:06 GMT
Date: Sat, 01 Apr 2023 01:06:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7af19a5145a4ee99bdf18831bad04bfd
7bdd2a4785b999ef54a2644211d2b2b7190fb8e1
3237bf0111ecdec3615c4d2d49a602f48f800335d0194f52b600bdaefbd63ed0

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3237BF0111ECDEC3615C4D2D49A602F48F800335D0194F52B600BDAEFBD63ED0"
Last-Modified: Thu, 30 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12211
Expires: Sat, 01 Apr 2023 04:29:36 GMT
Date: Sat, 01 Apr 2023 01:06:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
374c9e295a804e605c402f48ae7e2446
967394b36ecdff2dd32842f878887f061024c6b3
7652dfcb9e2d620ce1d033be8ecc53166d2881154c15decd60899415e5ac2706

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7652DFCB9E2D620CE1D033BE8ECC53166D2881154C15DECD60899415E5AC2706"
Last-Modified: Thu, 30 Mar 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6730
Expires: Sat, 01 Apr 2023 02:58:15 GMT
Date: Sat, 01 Apr 2023 01:06:05 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
29fdbcd53b5646cfcdd46510063734c4
85e3ceda5ef130219f4fe8a31e52e2690c8f7d8e
24c27586332c016685e6231fec5836e921048d8aaefbcd4cd6f88969f9d91e18

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 01 Apr 2023 00:28:26 GMT
content-type: application/json
age: 2259
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: qpsA3WHCfmP9Orw2Rdqxx2ra8gGtmv0jeNrw3hSzKsGI9BfK/BYoW++AK6elA2K/ORzw0ez7feA=
x-amz-request-id: FNYR8XZD37KTKZ5F
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 01 Apr 2023 01:03:33 GMT
age: 152
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:05 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Backoff, Last-Modified, Alert, Content-Length, Pragma, Cache-Control, Retry-After, ETag, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 01 Apr 2023 00:14:40 GMT
age: 3085
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b3df8c73360b4239af64e11f9d2388be
dc5463ff26615b40e4eab388052790d6c30ea5e6
877b23d16abf2e0e9f649f53747e82af0b75e8595abd71728254e612847cfdb6

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "877B23D16ABF2E0E9F649F53747E82AF0B75E8595ABD71728254E612847CFDB6"
Last-Modified: Wed, 29 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5569
Expires: Sat, 01 Apr 2023 02:38:54 GMT
Date: Sat, 01 Apr 2023 01:06:05 GMT
Connection: keep-alive

www.commonwealth-verify.line.pm/

203.28.49.161

302 Moved Temporarily

0 B

URL HTTP/1.1
www.commonwealth-verify.line.pm/
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	suspicious	Suspicious - DynDNS domain
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.line .pm Domain

HTTP Headers

GET / HTTP/1.1
Host: www.commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Sat, 01 Apr 2023 01:06:05 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
X-Powered-By: PHP/7.1.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=e9bf454b452cba247f1dd3c6f5461140; path=/
Upgrade: h2,h2c
Location: https://commonwealth-verify.line.pm/pages

push.services.mozilla.com/

52.43.157.124

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.43.157.124:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: v6Y/Mi6n0nKwKFG26GYftQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: SJ4RIcXRRiR6xZ/NjIF2PvUReA8=

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a0546cc84e78f66eb310f728b0ae0e25
05444bca6144397526f60922b9fe4c08ace4a62c
7b5dbd1468bf8469e1009f16d89229bcc9c12d72973128e5618ad01e4537cfc1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7B5DBD1468BF8469E1009F16D89229BCC9C12D72973128E5618AD01E4537CFC1"
Last-Modified: Fri, 31 Mar 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Sat, 01 Apr 2023 07:06:06 GMT
Date: Sat, 01 Apr 2023 01:06:06 GMT
Connection: keep-alive

commonwealth-verify.line.pm/pages

203.28.49.161

200 OK

4.3 kB

URL HTTP/2
commonwealth-verify.line.pm/pages
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (305), with CRLF line terminators
Size
4.3 kB (4251 bytes)
Hash
b8350425cd015d22b7d9bcc633508743
e3478538077b379b0f85472004ec06d1a8468a1d
a9ebf6f9449237f2d5769c345ed9c3436e802041fad16b84023b8e935ebcc8d1

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia
fortinet	Phishing

HTTP Headers

GET /pages HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:06 GMT
content-type: text/html; charset=UTF-8
content-length: 4251
x-powered-by: PHP/7.1.33
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a; path=/
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
14539c5e0ca6ce826e62bdadad738bbd
92ce1bbc7f338d3e48e35d637513ab0aba610a98
58e8d186f5d0531c2597d267b0a92bb46909e8fa162b2b5f7fa6e50b2e0af357

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "58E8D186F5D0531C2597D267B0A92BB46909E8FA162B2B5F7FA6E50B2E0AF357"
Last-Modified: Fri, 31 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5762
Expires: Sat, 01 Apr 2023 02:42:09 GMT
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
14539c5e0ca6ce826e62bdadad738bbd
92ce1bbc7f338d3e48e35d637513ab0aba610a98
58e8d186f5d0531c2597d267b0a92bb46909e8fa162b2b5f7fa6e50b2e0af357

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "58E8D186F5D0531C2597D267B0A92BB46909E8FA162B2B5F7FA6E50B2E0AF357"
Last-Modified: Fri, 31 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5762
Expires: Sat, 01 Apr 2023 02:42:09 GMT
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
14539c5e0ca6ce826e62bdadad738bbd
92ce1bbc7f338d3e48e35d637513ab0aba610a98
58e8d186f5d0531c2597d267b0a92bb46909e8fa162b2b5f7fa6e50b2e0af357

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "58E8D186F5D0531C2597D267B0A92BB46909E8FA162B2B5F7FA6E50B2E0AF357"
Last-Modified: Fri, 31 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5762
Expires: Sat, 01 Apr 2023 02:42:09 GMT
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfa5d643-243c-4157-97e2-d929d9b82514.jpeg

34.120.237.76

200 OK

4.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfa5d643-243c-4157-97e2-d929d9b82514.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.7 kB (4697 bytes)
Hash
613b90b49678a72443e992713b7eb711
f4216e9b06d9cb62aadfafce434789a3cc5d1fe2
7cb101a12e824bf26552b2aaeb00df0e3f239c254168b9dee65192b484f1b61e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfa5d643-243c-4157-97e2-d929d9b82514.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4697
x-amzn-requestid: 9bed2cbf-18d6-4cac-8ac0-32e831ff1d9c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ClWGeHbhIAMFn5Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-642536f5-3d548aea13f757a85ca99750;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 07:15:01 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: cWC8mfkQdpMt1CB3QLj4CRjiegMidFxcrzKqAnvyF1RLJ6_0bYCUSA==
via: 1.1 288c777a01e22425da9494dad7a69734.cloudfront.net (CloudFront), 1.1 ef6538ee7be7b17c84d06edb0f4c0a1a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 31 Mar 2023 07:29:07 GMT
age: 63420
etag: "f4216e9b06d9cb62aadfafce434789a3cc5d1fe2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F95196399-f417-4284-9902-cf35b1e83360.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.8 kB (5830 bytes)
Hash
deb930830ac86ec8ace6a232f67810ba
d084bf4331446c35236019010b2bcf82d45dad1c
bb81782bf590d601110ec8fb891f701e0f5084bda46370d30345bd81403a33ab

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F95196399-f417-4284-9902-cf35b1e83360.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5830
x-amzn-requestid: 0897bf26-6156-48d3-ba67-596cc326dddc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CqnHHG0JoAMF87w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6427522d-6f380d901d9d6b737ec19d6d;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Fri, 31 Mar 2023 21:35:41 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: UfN2iRmDUhddBZW6qGy3q2-HCqb6Kx3iDENnirUkIoCJ6BW6zdWVtw==
via: 1.1 8f251d23da31b683c3c9d6fad6ca944c.cloudfront.net (CloudFront), 1.1 b4085435efbe95a420f374958bd145be.cloudfront.net (CloudFront), 1.1 google
date: Fri, 31 Mar 2023 22:44:32 GMT
etag: "d084bf4331446c35236019010b2bcf82d45dad1c"
content-type: image/jpeg
age: 8495
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff1e5dbb1-cba2-4500-9086-8f86460069ae.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.0 kB (5035 bytes)
Hash
cfbc0c97bcd9123d224a861041b4bf8b
3703d612c4cd2eba9bf0d1ff51f18b82b0b56f2e
f20466a2a79c2ca459f0bc81ba3172b4ec299afd9238740f63974230e8d6bba3

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff1e5dbb1-cba2-4500-9086-8f86460069ae.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5035
x-amzn-requestid: 51fdff0b-5db9-4cc2-a09d-83ef5c9ce4dc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Cqm8FHMqoAMFRmg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-642751e6-3ebcdf7878b4481f599fac7f;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Fri, 31 Mar 2023 21:34:30 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: -Z8Nlb1yG4JUPwIzL-d_S113F8l6J9qvNpkF842e6KKuO24RQVyRYw==
via: 1.1 fb2e3e161147dc940086f9545b8e0e4a.cloudfront.net (CloudFront), 1.1 adc2002956acc4d61bfbf3b973fdf246.cloudfront.net (CloudFront), 1.1 google
date: Fri, 31 Mar 2023 22:02:03 GMT
age: 11044
etag: "3703d612c4cd2eba9bf0d1ff51f18b82b0b56f2e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9870299b-1a48-4dd3-be98-dd6c45ebb2b2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8391 bytes)
Hash
fac2211f37cb63e1a302f02a6d60acd0
148a010cae1fd28665d515ed1427112602930a60
633d3a9d31a3070cc51beb49deb4e2f3488a6348d5299d03272783a0015ba00d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9870299b-1a48-4dd3-be98-dd6c45ebb2b2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8391
x-amzn-requestid: b012c658-c924-4d48-a85a-7524f38f43a5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ClU9EHNSoAMFZDA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64253520-177f2aba1c00bc0944ff6416;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 07:07:12 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: YzimQb2fpJtdH3ZTEvD4uqZDESc2Mrm_6GH7BDb6qcv9pVfGKr9azQ==
via: 1.1 50cc3f0b039433daebdf343a3f4489ae.cloudfront.net (CloudFront), 1.1 1f6e68152880a39d72e6bf2996cd6a60.cloudfront.net (CloudFront), 1.1 google
date: Fri, 31 Mar 2023 08:02:14 GMT
age: 61433
etag: "148a010cae1fd28665d515ed1427112602930a60"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb10f21ee-de68-4185-8874-9d35c509a4c5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10268 bytes)
Hash
87a835db131d4290e217756a50efd68d
5e939a14153904d3689c0ff5a63937dd51995f96
645a510200b974481c1c509e1af2e28aac569be0a313bdcd87d516e2c2c7c4a5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb10f21ee-de68-4185-8874-9d35c509a4c5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10268
x-amzn-requestid: fc04a027-6d97-4cee-a8f9-99c81a481d61
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CiBnMEWooAMFvJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6423e2fa-199cff0f3050c49c54e338ef;Sampled=0
x-amzn-remapped-date: Wed, 29 Mar 2023 07:04:26 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: xAqpS-Psaqh7tfPTW0wvLAhoxfXPPTwddz-rfbTK8aUCy19jzZ7uRA==
via: 1.1 ee6ea1e4552345de209d26f9ffb35d4a.cloudfront.net (CloudFront), 1.1 44cd593d82a2d200a94217033c614c6a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 31 Mar 2023 08:15:53 GMT
age: 60614
etag: "5e939a14153904d3689c0ff5a63937dd51995f96"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0797be4-c308-47e3-9657-c929f7be021e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10139 bytes)
Hash
ba8077c110172a232340b8c843c21704
110ce19838f6050e0df60240211e66bb95659018
ed614253863b689b947ee48c384b0d96360730d25c6a573a8f1776c0f31b4c4c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0797be4-c308-47e3-9657-c929f7be021e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10139
x-amzn-requestid: a65e17df-5f88-4840-a573-8820b3734e82
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CqnHJE9AoAMFdwA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6427522d-13577a7f180985f20a340c8e;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Fri, 31 Mar 2023 21:35:41 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: pCHOy35HMhXe7y4p5HZcpSVBS8BEEh0stYUpY7BpLJTD0sHa7xmEgw==
via: 1.1 e92cc925fc8895560cd0628c67f58828.cloudfront.net (CloudFront), 1.1 b23fb37cd7fff033ab21e3284f558a28.cloudfront.net (CloudFront), 1.1 google
date: Fri, 31 Mar 2023 21:59:12 GMT
age: 11215
etag: "110ce19838f6050e0df60240211e66bb95659018"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.entrust.net/

104.110.10.32

200 OK

1.6 kB

URL HTTP/1.1
ocsp.entrust.net/
IP
104.110.10.32:0
ASN
#16625 AKAMAI-AS

File type
data
Size
1.6 kB (1588 bytes)
Hash
a291381782837b25f7f5b0ff27daadcd
bc709a2954a0baecc3c6c0a1b85ad92cf835cd12
f1128ad888906a37dbe9934db2edf49c20f792506c60e45dfe590c52918d11ca

HTTP Headers

POST / HTTP/1.1
Host: ocsp.entrust.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
ETag: "F1128AD888906A37DBE9934DB2EDF49C20F792506C60E45DFE590C52918D11CA"
Last-Modified: Fri, 31 Mar 2023 23:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=667
Expires: Sat, 01 Apr 2023 01:17:14 GMT
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive

ocsp.entrust.net/

104.110.10.32

200 OK

1.6 kB

URL HTTP/1.1
ocsp.entrust.net/
IP
104.110.10.32:0
ASN
#16625 AKAMAI-AS

File type
data
Size
1.6 kB (1588 bytes)
Hash
a291381782837b25f7f5b0ff27daadcd
bc709a2954a0baecc3c6c0a1b85ad92cf835cd12
f1128ad888906a37dbe9934db2edf49c20f792506c60e45dfe590c52918d11ca

HTTP Headers

POST / HTTP/1.1
Host: ocsp.entrust.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
ETag: "F1128AD888906A37DBE9934DB2EDF49C20F792506C60E45DFE590C52918D11CA"
Last-Modified: Fri, 31 Mar 2023 23:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=741
Expires: Sat, 01 Apr 2023 01:18:28 GMT
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive

ocsp.entrust.net/

104.110.10.32

200 OK

1.6 kB

URL HTTP/1.1
ocsp.entrust.net/
IP
104.110.10.32:0
ASN
#16625 AKAMAI-AS

File type
data
Size
1.6 kB (1588 bytes)
Hash
a291381782837b25f7f5b0ff27daadcd
bc709a2954a0baecc3c6c0a1b85ad92cf835cd12
f1128ad888906a37dbe9934db2edf49c20f792506c60e45dfe590c52918d11ca

HTTP Headers

POST / HTTP/1.1
Host: ocsp.entrust.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
ETag: "F1128AD888906A37DBE9934DB2EDF49C20F792506C60E45DFE590C52918D11CA"
Last-Modified: Fri, 31 Mar 2023 23:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=667
Expires: Sat, 01 Apr 2023 01:17:14 GMT
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive

static.my.commbank.com.au/static/cmxAssets/netbank-logon/sustainability_hub_small.jpg

23.38.202.24

200 OK

29 kB

URL HTTP/1.1
static.my.commbank.com.au/static/cmxAssets/netbank-logon/sustainability_hub_small.jpg
IP
23.38.202.24:0
ASN
#16625 AKAMAI-AS

File type
JPEG image data, baseline, precision 8, 201x96, components 3\012- data
Size
29 kB (28794 bytes)
Hash
a71955f7a7786f974ea3d513399aad4e
85de7a6b25e120cc5b1380ad3cf2b3c27dcaed93
92140e5b29ac1ee8a1e43bf8510307f270367676d9c8ba456f00a47831c9f7a5

HTTP Headers

GET /static/cmxAssets/netbank-logon/sustainability_hub_small.jpg HTTP/1.1
Host: static.my.commbank.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: public,max-age=31536000,must-revalidate,proxy-revalidate
Content-Type: image/jpeg
Last-Modified: Tue, 10 Aug 2021 05:48:59 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 28794
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

static.my.commbank.com.au/static/netbank/theme/fo/images/cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif

23.38.202.24

200 OK

4.9 kB

URL HTTP/1.1
static.my.commbank.com.au/static/netbank/theme/fo/images/cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif
IP
23.38.202.24:0
ASN
#16625 AKAMAI-AS

File type
GIF image data, version 89a, 256 x 46\012- data
Size
4.9 kB (4852 bytes)
Hash
ac9de6fb5214be84653367c74ba0b5f0
be61645ad75ab434ce7195268eb453f77314f9ec
4620bea7b8db9ffe1747e9c29910d7ea2ec84a7a3c7416e7a8a70e450073d820

HTTP Headers

GET /static/netbank/theme/fo/images/cba_mainlogo.ac9de6fb5214be84653367c74ba0b5f0.gif HTTP/1.1
Host: static.my.commbank.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: public,max-age=31536000,must-revalidate,proxy-revalidate
Content-Type: image/gif
Last-Modified: Mon, 18 Apr 2022 03:48:54 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 4852
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

static.my.commbank.com.au/static/cmxAssets/netbank-logon/commbankmobile.png

23.38.202.24

200 OK

984 B

URL HTTP/1.1
static.my.commbank.com.au/static/cmxAssets/netbank-logon/commbankmobile.png
IP
23.38.202.24:0
ASN
#16625 AKAMAI-AS

File type
PNG image data, 72 x 72, 8-bit/color RGB, non-interlaced\012- data
Size
984 B (984 bytes)
Hash
e5cbe1d83ee7aef596f6d4094d98e5b9
8f8888405c48aeb61080d0d6d189b8839082a44d
cf17cf84b3f23f4e05641feb4c518f4a26e03ae5564c38ad035a66d7ab41bacd

HTTP Headers

GET /static/cmxAssets/netbank-logon/commbankmobile.png HTTP/1.1
Host: static.my.commbank.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: public,max-age=31536000,must-revalidate,proxy-revalidate
Content-Type: image/png
Last-Modified: Tue, 12 May 2015 01:25:56 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 984
Date: Sat, 01 Apr 2023 01:06:07 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

commonwealth-verify.line.pm/js/cntdjs/cntd.js

203.28.49.161

200 OK

1.0 kB

URL HTTP/2
commonwealth-verify.line.pm/js/cntdjs/cntd.js
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
C++ source, ASCII text
Size
1.0 kB (1016 bytes)
Hash
9b3197fe5a3fad20c33876e558106010
5a27e28ec9fbbd1eb4439f1bfba6fe5e0d3a3809
cafc313613b7ecadf6e54114d2d96484845317a99ea57fada6f5e1fbc97b73d3

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia
fortinet	Phishing

HTTP Headers

GET /js/cntdjs/cntd.js HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:07 GMT
content-type: application/javascript
content-length: 1016
last-modified: Fri, 03 Jun 2022 15:52:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/front_end/front_end_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css

203.28.49.161

200 OK

9.9 kB

URL HTTP/2
commonwealth-verify.line.pm/front_end/front_end_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
ASCII text, with very long lines (314)
Size
9.9 kB (9907 bytes)
Hash
f4a9faae66a4e2836a5ed2a6e6808712
c50e33a23c9b3422c39d5eb4defaa2f5d2c2f990
b3bdc5f7ea67f5d8d3f9dd27a38cb49203170dddf551c4bd7557bb5650afcd92

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia

HTTP Headers

GET /front_end/front_end_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:07 GMT
content-type: text/css
content-length: 9907
last-modified: Fri, 03 Jun 2022 15:55:26 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/js/cntdjs/jquery.mask.js

203.28.49.161

200 OK

6.8 kB

URL HTTP/2
commonwealth-verify.line.pm/js/cntdjs/jquery.mask.js
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
ASCII text
Size
6.8 kB (6846 bytes)
Hash
2471542f3ac4b3d0378c2061a8cef7a2
51689bba5248ef611bce907f6401cc5c7cf1bff7
674c5ca1e4003aba4989832207e4476568e925e50ed40a82e950a2d7a2bae9a4

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia
fortinet	Phishing

HTTP Headers

GET /js/cntdjs/jquery.mask.js HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:07 GMT
content-type: application/javascript
content-length: 6846
last-modified: Fri, 03 Jun 2022 15:52:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/js/shared/loading.js

203.28.49.161

200 OK

740 B

URL HTTP/2
commonwealth-verify.line.pm/js/shared/loading.js
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
C++ source, ASCII text
Size
740 B (740 bytes)
Hash
e439aefe8fc49cd293a8f58de85cf9a8
e4c3dabdc337251225437025fc24f5e3f2e8c969
9ddf304b2a5507ab3e7fa0d4967053762539b595a4562899642b0fb637eb40ce

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia
fortinet	Phishing

HTTP Headers

GET /js/shared/loading.js HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:07 GMT
content-type: application/javascript
content-length: 740
last-modified: Fri, 03 Jun 2022 15:52:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/js/shared/online_status.js

203.28.49.161

200 OK

452 B

URL HTTP/2
commonwealth-verify.line.pm/js/shared/online_status.js
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
C++ source, ASCII text
Size
452 B (452 bytes)
Hash
a60cfceeac6f071c893b300bf51b67e1
6ad994adff012a5b78d6414b071954fe727c3eec
e564ce4307f456d29e449ea4a885a51893d237ee8ccee8027dfd9b1bf59eacc1

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia
fortinet	Phishing

HTTP Headers

GET /js/shared/online_status.js HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:07 GMT
content-type: application/javascript
content-length: 452
last-modified: Fri, 03 Jun 2022 15:52:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/front_end/front_end_files/hbg.0236e4e9a193069c4e8554db8b06354c.png

203.28.49.161

200 OK

254 B

URL HTTP/2
commonwealth-verify.line.pm/front_end/front_end_files/hbg.0236e4e9a193069c4e8554db8b06354c.png
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 4 x 475, 8-bit/color RGB, non-interlaced\012- data
Size
254 B (254 bytes)
Hash
0236e4e9a193069c4e8554db8b06354c
87ebd8fcf29ee4ac820a5f372c84cc7554006fcf
f0755c4aa02ff90cf951d4752166ce52ea98cb85b86186f954dcc5d9d9cd02c0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia

HTTP Headers

GET /front_end/front_end_files/hbg.0236e4e9a193069c4e8554db8b06354c.png HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/front_end/front_end_files/logon-merge.8397238ab0ae7a25ea1af4d375f2c3df.css
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:08 GMT
content-type: image/png
content-length: 254
last-modified: Fri, 03 Jun 2022 15:55:26 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/front_end/front_end_files/logonsprite2.307a0c523f35f709f390895b4720d350.png

203.28.49.161

200 OK

14 kB

URL HTTP/2
commonwealth-verify.line.pm/front_end/front_end_files/logonsprite2.307a0c523f35f709f390895b4720d350.png
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type
PNG image data, 3969 x 75, 8-bit/color RGBA, non-interlaced\012- data
Size
14 kB (14207 bytes)
Hash
307a0c523f35f709f390895b4720d350
94fc38cd1c928167f22a356181fb97bbf067b434
c3787cbabd5c9acf9bfdc72c8e706754d644a14d5bd538e675c1885ccae87341

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia

HTTP Headers

GET /front_end/front_end_files/logonsprite2.307a0c523f35f709f390895b4720d350.png HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:08 GMT
content-type: image/png
content-length: 14207
last-modified: Fri, 03 Jun 2022 15:55:26 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/favicon.ico

203.28.49.161

404 Not Found

0 B

URL HTTP/2
commonwealth-verify.line.pm/favicon.ico
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	phishing	Phishing - Commonwealth Bank
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sat, 01 Apr 2023 01:06:08 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/7.1.33
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/front_end/front_end_files/jquery.js

203.28.49.161

200 OK

0 B

URL HTTP/2
commonwealth-verify.line.pm/front_end/front_end_files/jquery.js
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia
fortinet	Phishing

HTTP Headers

GET /front_end/front_end_files/jquery.js HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:07 GMT
content-type: application/javascript
last-modified: Fri, 03 Jun 2022 15:55:26 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

commonwealth-verify.line.pm/js/cntdjs/jquery.js

203.28.49.161

200 OK

0 B

URL HTTP/2
commonwealth-verify.line.pm/js/cntdjs/jquery.js
IP
203.28.49.161:0
ASN
#38719 Dreamscape Networks Limited

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Commonwealth Bank of Australia
fortinet	Phishing

HTTP Headers

GET /js/cntdjs/jquery.js HTTP/1.1
Host: commonwealth-verify.line.pm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://commonwealth-verify.line.pm/pages
Cookie: PHPSESSID=436230f6d258bb74b2b54413f8cfaf1a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 01 Apr 2023 01:06:07 GMT
content-type: application/javascript
last-modified: Fri, 03 Jun 2022 15:52:42 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (37)

URL HTTP/1.1

IP

ASN

File type