| GET colorado.gov-mnlc.vip/pay/assets/BfGm9j6d.css |  43.159.143.77 | 200 | 94 kB |
URL GET colorado.gov-mnlc.vip/pay/assets/BfGm9j6d.css IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typeassembler source, Unicode text, UTF-8 text, with very long lines (11562), with CRLF, LF line terminators Hash1c4c68e6960abb70c4f78c344a514cf9 d6baf57af5acdf0f75f487585aed83bb8c1e2df0 d7c67c17af7867b3d475cf6f858ce5baffe23de27a0226effca11d2d6f234cd8
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/assets/BfGm9j6d.css HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/pay/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:30 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|
| GET use.typekit.net/af/a28b50/00000000000000000000e803/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3 |  23.36.77.75 | 200 OK | 17 kB |
URL GET use.typekit.net/af/a28b50/00000000000000000000e803/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3 IP23.36.77.75:443 ASN#20940 Akamai International B.V.
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerDigiCert Inc Subjectuse.typekit.net FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89 ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 16808, version 1.0 Hashe0ba364087ced101e98cb22c66a3de71 8a6fc598bf108239d94fabea4eb0fe686618a55a 09244974d9decf20f9cd3402621e4844a454f3ae43cdf509538f43c0456ba6c4
GET /af/a28b50/00000000000000000000e803/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://colorado.gov-mnlc.vip
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 16808
etag: "a6c1fa20004e862da7c922781204c8a0ef8794a4"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Wed, 11 Jun 2025 17:24:31 GMT
akamai-grn: 0.4d4d2417.1749662671.6e7d3de
X-Firefox-Spdy: h2
|
|
| GET dmv.colorado.gov/themes/custom/ci_xy/images/icons/arrow-up-right-from-square-solid.svg | 54.240.174.8 | 200 OK | 660 B |
URL GET dmv.colorado.gov/themes/custom/ci_xy/images/icons/arrow-up-right-from-square-solid.svg IP54.240.174.8:443
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerAmazon Subject*.colorado.gov Fingerprint58:01:EB:29:8D:98:90:48:39:31:4D:75:B6:A7:70:0F:D5:E1:B8:52 ValidityWed, 07 Aug 2024 00:00:00 GMT - Fri, 05 Sep 2025 23:59:59 GMT
File typeSVG Scalable Vector Graphics image Hash74a2b764b49a75f66f2732c41e875b72 29093f6f8f0098aadf4cef3ce4583dc90f5431b4 a47d90439bbe92ea745391d093dc84bc91dccb575889288ca62a572cabacac74
GET /themes/custom/ci_xy/images/icons/arrow-up-right-from-square-solid.svg HTTP/1.1
Host: dmv.colorado.gov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://colorado.gov-mnlc.vip
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 660
server: nginx
date: Wed, 11 Jun 2025 17:23:55 GMT
last-modified: Wed, 07 May 2025 04:35:19 GMT
cache-control: max-age=31536000
expires: Fri, 05 Jun 2026 06:03:32 GMT
x-request-id: v-cf796488-41d2-11f0-be70-1b064d53aa29
x-ah-environment: prod
via: varnish, 1.1 5bcfe2deda0bdbc6bade0af9b61602ca.cloudfront.net (CloudFront)
x-cache-hits: 91275
accept-ranges: bytes
x-cache: Hit from cloudfront
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: qGwi8B8qHJNC-XSt3J2dJ8F_j7ufw3cdqVu6n6lRfy9rS4hYusufWQ==
age: 559258
X-Firefox-Spdy: h2
|
|
| GET use.typekit.net/af/e3ca36/00000000000000000000e805/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 | 23.36.77.75 | 200 OK | 17 kB |
URL GET use.typekit.net/af/e3ca36/00000000000000000000e805/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 IP23.36.77.75:443 ASN#20940 Akamai International B.V.
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerDigiCert Inc Subjectuse.typekit.net FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89 ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 17116, version 1.0 Hash34d56709ccec98b48945ca2e3c085473 47e244eeb006e577549cf550a59cb6499e603a01 97f752f1bdffe4e12de8fe349f77012495c8926f74f64874a3e740960b365977
GET /af/e3ca36/00000000000000000000e805/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://colorado.gov-mnlc.vip
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 17116
etag: "4577a8003f294766a3a783ec5fba19dc646ecf7c"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Wed, 11 Jun 2025 17:24:31 GMT
akamai-grn: 0.4d4d2417.1749662671.6e7d3db
X-Firefox-Spdy: h2
|
|
| GET fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg | 142.250.178.99 | 200 OK | 6.2 kB |
URL GET fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg IP142.250.178.99:443
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerGoogle Trust Services Subject*.gstatic.com Fingerprint41:FF:72:9C:74:6F:D4:D1:3B:A8:03:EB:55:D2:D2:09:7E:7A:44:DC ValidityMon, 12 May 2025 08:44:01 GMT - Mon, 04 Aug 2025 08:44:00 GMT
File typeSVG Scalable Vector Graphics image Hash2bd5c073a88b83ed74db88282a56ddfb d0ebfc376f8c6a44a8d4cd216817dcd7d0c33650 ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
GET /s/i/productlogos/translate/v14/24px.svg HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-length: 3340
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 07 Jun 2025 20:19:01 GMT
expires: Sun, 07 Jun 2026 20:19:01 GMT
cache-control: public, max-age=31536000
age: 335131
last-modified: Wed, 20 Apr 2022 14:24:23 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| GET colorado.gov-mnlc.vip/pay/assets/BML5x76n.ico | 43.159.143.77 | 200 | 20 kB |
URL GET colorado.gov-mnlc.vip/pay/assets/BML5x76n.ico IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typeMS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel Hash096e21a1cf368116ee8852839843420c 314f5e6914831ae171a05d66fbc7d5cba9d1d049 c2efda14c14a1c23862ff0785d4db8f1db217b7d1fbd408e87bb5eab2a17213c
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/assets/BML5x76n.ico HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:32 GMT
Content-Type: image/vnd.microsoft.icon
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|
| GET colorado.gov-mnlc.vip/pay/assets/fliceXIj.js | 43.159.143.77 | 200 | 37 kB |
URL GET colorado.gov-mnlc.vip/pay/assets/fliceXIj.js IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (36628), with no line terminators Hash4e31b89a07bd7be81019cdbf6fa66e6d 3880afe3c2e216d2e0fcbf484f25177e931f8604 5edba7293c6678f523edb43d17617cdefbc293d83515c426bda2e45d5ddc81e0
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/assets/fliceXIj.js HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/pay/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:30 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|
| GET colorado.gov-mnlc.vip/pay/assets/DLheONWn.js | 43.159.143.77 | 200 | 979 kB |
URL GET colorado.gov-mnlc.vip/pay/assets/DLheONWn.js IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typeJavaScript source, ASCII text, with very long lines (30958) Size979 kB (979125 bytes) Hasha5ee7989e672bb72355dc1f5a443ac96 a442afa675cf8ff8b4e0065323544448442acc5e 9046cc81aad982bb827ffdeeeeb5eb00f6ea1398e3a0e30fb576dfb27ecfb312
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic phishing | | urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/assets/DLheONWn.js HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/pay/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:30 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|
| GET colorado.gov-mnlc.vip/pay/assets/BHcjXi3x.gif | 43.159.143.77 | 200 | 60 kB |
URL GET colorado.gov-mnlc.vip/pay/assets/BHcjXi3x.gif IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typeGIF image data, version 89a, 256 x 256 Hashfadd89694f57f3d6143989b62b09b288 1c6d340af3c4b392538a96c9313136fb23087aa0 7515437df23c4af47700948c1650f0f9460da07e86a9447d33cfda1f36c91052
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/assets/BHcjXi3x.gif HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:30 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|
| GET use.typekit.net/af/c225e2/000000000000000000011aff/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 | 23.36.77.75 | 200 OK | 19 kB |
URL GET use.typekit.net/af/c225e2/000000000000000000011aff/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 IP23.36.77.75:443 ASN#20940 Akamai International B.V.
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerDigiCert Inc Subjectuse.typekit.net FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89 ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 19028, version 1.0 Hash9e62001fb5268425e5ec47afb19a4328 a2832dacc8f95c022db518fba7cceec7b5d1598b be08b553524afe2516979423c8147de88c9ad54ae7fb1ccdcb14bfcd6f862c7d
GET /af/c225e2/000000000000000000011aff/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://colorado.gov-mnlc.vip
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 19028
etag: "aac07d12e2650fd1a93de82aff4c98527ab9f303"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Wed, 11 Jun 2025 17:24:31 GMT
akamai-grn: 0.4d4d2417.1749662671.6e7d362
X-Firefox-Spdy: h2
|
|
| GET colorado.gov-mnlc.vip/pay/assets/D_FexwS0.png | 43.159.143.77 | 200 | 62 kB |
URL GET colorado.gov-mnlc.vip/pay/assets/D_FexwS0.png IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typePNG image data, 225 x 224, 8-bit/color RGBA, non-interlaced Hash697ffbd930ffcaf17ecf30b42ff8e111 5982c6c5c6425b1c5ee15567572233b592bf7f45 50ee3d628ce51d93001f72589021d97863c66832459e73fe27dbda8f8b2d6537
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/assets/D_FexwS0.png HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:31 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|
| GET www.gstatic.com/images/branding/product/2x/translate_24dp.png | 142.250.178.99 | 200 OK | 1.8 kB |
URL GET www.gstatic.com/images/branding/product/2x/translate_24dp.png IP142.250.178.99:443
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerGoogle Trust Services Subject*.gstatic.com Fingerprint41:FF:72:9C:74:6F:D4:D1:3B:A8:03:EB:55:D2:D2:09:7E:7A:44:DC ValidityMon, 12 May 2025 08:44:01 GMT - Mon, 04 Aug 2025 08:44:00 GMT
File typePNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced Hashc69c796362406f9e11c7f4bf5bb628da e489ce95ab56208090868882113d7416abf46775 4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
GET /images/branding/product/2x/translate_24dp.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1842
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 04 Jun 2025 21:30:14 GMT
expires: Thu, 04 Jun 2026 21:30:14 GMT
cache-control: public, max-age=31536000
age: 590058
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| GET wss://colorado.gov-mnlc.vip/front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MTI2NTE0fQ.yHfDAOdbhaxU8rqY6N2PNzHKxAn2mgnwbw2BWMB2aeA | 43.159.143.77 | 101 | 0 B |
URL GET wss://colorado.gov-mnlc.vip/front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MTI2NTE0fQ.yHfDAOdbhaxU8rqY6N2PNzHKxAn2mgnwbw2BWMB2aeA IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /front/im/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MTI2NTE0fQ.yHfDAOdbhaxU8rqY6N2PNzHKxAn2mgnwbw2BWMB2aeA HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://colorado.gov-mnlc.vip
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: dCy9vZKXO9NQPkO//xm+gQ==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:32 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: vqSCEo6rca/D+CspkgLN7DVHUQQ=
Sec-WebSocket-Extensions: permessage-deflate
Strict-Transport-Security: max-age=31536000; includeSubDomains
|
|
| GET colorado.gov-mnlc.vip/pay/ | 43.159.143.77 | 200 | 3.3 kB |
URL User Request GET colorado.gov-mnlc.vip/pay/ IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (433) Hashfe86b17d17e9d4878d38a262c9258875 b46bb744da29f8a3cddaee501f41b044cbac590e 0c2ff9d079050e61a44648b29fff9b7175408fa60ce8577811387458d31c0c6f
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | OpenPhish | phishing | Generic/Spear Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/ HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|
| GET colorado.gov-mnlc.vip/front/checkIp?token=123 | 43.159.143.77 | 200 | 228 B |
URL GET colorado.gov-mnlc.vip/front/checkIp?token=123 IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
Hash10286b83e54c0a2f3e3aeba1ea514b0b 75e233fc47d6c8080213415fbb0b55215876a3a0 5e37dfe67aa35e2a45aff8c162eeff1c37fb0de0bddb075d7a226e8666443b60
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /front/checkIp?token=123 HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://colorado.gov-mnlc.vip/pay/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:31 GMT
Content-Type: text/plain;charset=UTF-8
Content-Length: 228
Connection: keep-alive
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Strict-Transport-Security: max-age=31536000; includeSubDomains
|
|
| GET colorado.gov-mnlc.vip/pay/assets/fmTkokkn.jpg | 43.159.143.77 | 200 | 46 kB |
URL GET colorado.gov-mnlc.vip/pay/assets/fmTkokkn.jpg IP43.159.143.77:443 ASN#132203 Tencent Building, Kejizhongyi Avenue
Requested byhttps://colorado.gov-mnlc.vip/pay/ CertificateIssuerLet's Encrypt Subjectcolorado.gov-mnlc.vip Fingerprint78:D5:F4:87:0B:53:93:25:5C:58:CA:8A:D4:C4:59:49:F0:B3:3C:58 ValidityThu, 05 Jun 2025 13:24:14 GMT - Wed, 03 Sep 2025 13:24:13 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 200x200, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=16, height=4024, bps=206, PhotometricInterpretation=RGB, manufacturer=NIKON CORPORATION, model=NIKON Z 6_2, orientation=upper-left, width=6048], baseline, precision 8, 250x250, components 3 Hash49d66b0637a1343284fe44412e67f134 65c362db48745abab305f082239bd978411312f3 05cf9187bd3929955037319153970c87521d7094891dbdcb46b23850dfb09bac
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Generic Phishing | | Quad9 DNS | malicious | Sinkholed |
GET /pay/assets/fmTkokkn.jpg HTTP/1.1
Host: colorado.gov-mnlc.vip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://colorado.gov-mnlc.vip/pay/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.27.4
Date: Wed, 11 Jun 2025 17:24:31 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
|
|