Report - www.silverleaf-tech.com/css/mygov/app/addcc.php

Report Overview

URL

www.silverleaf-tech.com/css/mygov/app/addcc.php
IP

195.224.99.188

ASN

#5413 Daisy Corporate Services Trading Ltd
Submitted

2023-01-16T21:19:32Z

Access
Tags

australia government phishing
urlquery detections

Phishing - Australian Government

Detections

urlquery

27
Network Intrusion Detection

0
Threat Detection Systems

1

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
fonts.gstatic.com (3)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1472	50371	216.58.207.227
www.pngitem.com (1)	40709	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	450	22159	173.208.209.195
ocsp.entrust.net (2)	1208	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	680	3914	104.110.10.32
r3.o.lencr.org (9)	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3042	7979	23.36.76.226
content-signature-2.cdn.mozilla.net (1)	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413	5844	34.160.144.191
ocsp.pki.goog (4)	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1372	2796	142.250.74.131
ocsp.digicert.com (1)	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	341	737	93.184.220.29
push.services.mozilla.com (1)	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606	127	44.228.207.167
login.my.gov.au (1)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	421	1203	161.146.235.204
img-getpocket.cdn.mozilla.net (6)	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3246	56636	34.120.237.76
firefox.settings.services.mozilla.com (1)	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	337	1431	35.241.9.150
www.silverleaf-tech.com (13)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	6817	702592	195.224.99.188
contile.services.mozilla.com (1)	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333	391	34.117.237.239

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-01-15	medium	www.silverleaf-tech.com/css/mygov/app/addcc.php	Australian Government

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

HTTP Transactions (44)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

0643dc6b6fed33b3537160b6bb77bcbf

aa43bd1fbb30d2219f3285c1ee4991ffb33562c5

f137438e30e0d69cba77ca2eb736687873e4a9c06cf88d23c6d55ea930fde09f

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F137438E30E0D69CBA77CA2EB736687873E4A9C06CF88D23C6D55EA930FDE09F"
Last-Modified: Sat, 14 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2285
Expires: Mon, 16 Jan 2023 21:57:26 GMT
Date: Mon, 16 Jan 2023 21:19:21 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

2258cd6b877a3aca8f4c84074e65ac4b

4e46c70941f8e497e8afc8d078644e7f81761a1c

faac4e0d123f2112b58953c104ea746cd53047fc1ada0ef5d669feecf78ddfff

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FAAC4E0D123F2112B58953C104EA746CD53047FC1ADA0EF5D669FEECF78DDFFF"
Last-Modified: Sat, 14 Jan 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7870
Expires: Mon, 16 Jan 2023 23:30:31 GMT
Date: Mon, 16 Jan 2023 21:19:21 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

14cd9a0afb6ba9a763651d5112760d1e

75d7b104ab9ab11fbb73c3f348b43b0119b5adfa

4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Content-Type, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 16 Jan 2023 20:49:11 GMT
content-type: application/json
age: 1810
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

f7bd85a261739c122eefb74ffddaec99

e2e059b0740592e8591d432249aafe5fcb8af23c

71bdd130b8d143f228542f678e91c98ab4e5844fb9f47b036e15372660be25fd

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "71BDD130B8D143F228542F678E91C98AB4E5844FB9F47B036E15372660BE25FD"
Last-Modified: Sat, 14 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3700
Expires: Mon, 16 Jan 2023 22:21:01 GMT
Date: Mon, 16 Jan 2023 21:19:21 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

7b922915ebf1fa3639b333f994c74f24

144a3f80b98fd0652d4614f24cf6cbbee40f8938

adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: 2WJta41UrWK8YR2YFiW1bcDp9L1JQ5fbjcroJZEhb4iG6DenPlrbru0DSPaxG3ex+LJiAz64c3c=
x-amz-request-id: MAE54ZW26THR6NQR
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 16 Jan 2023 20:55:58 GMT
age: 1403
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

www.silverleaf-tech.com/css/mygov/app/addcc.php

United Kingdom Daisy Corporate Services Trading Ltd

195.224.99.188

200 OK

9701

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/addcc.php
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1004), with CRLF line terminators

Size

9701
Hash

3f6a42ba5bb38cbe32cbe2aca99bd965

42cf73dceeb8a1d0dcce15db707594140f0d7d91

ebc306a24f3d2b7e6a13d9e2d323f5fe903513d1afa8b2c75bf11e3a7c1f5ae8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government
openphish	Australian Government

HTTP Headers

                                        GET /css/mygov/app/addcc.php HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:21 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph; path=/
X-Powered-By: PHP/7.3.33, PleskLin
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Mon, 16 Jan 2023 21:19:21 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

www.silverleaf-tech.com/css/mygov/app/login_files/css

195.224.99.188

200 OK

16018

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/css
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

ASCII text

Size

16018
Hash

4fbcef1c5886d331a7b70aedfc9f6eb9

30ae86d838e734cdbd3ac38821c54364e2a242b3

00b399de3012a5f809a1fb531286f8cdb5e7671e865f0423a0ba0dfffcc8d9c5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/css HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "3e92-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 16018
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain

www.silverleaf-tech.com/css/mygov/app/login_files/login.js.download

195.224.99.188

200 OK

1560

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/login.js.download
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

ASCII text, with very long lines (1560), with no line terminators

Size

1560
Hash

b370795fcbbe14ef5fe323bdb5501fce

f68bc3a5786e9c04d71686ed0876b6e29f670e85

3398bdeeb65157116e93bdeef72d320cb5d90700b149a62f60ff1dcb2ac8f9a5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/login.js.download HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "618-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 1560
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

www.silverleaf-tech.com/css/mygov/app/login_files/blugov.css

195.224.99.188

200 OK

70261

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/blugov.css
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

ASCII text, with very long lines (65536), with no line terminators

Size

70261
Hash

ff098034b744b4eb9d01ac2fd6c6e87d

981587e0b6aba900202f45ec0ae6c1e0274aab64

5ad45c3c8b9efc9e5427d60339eb9b65ffa97a501fe111fe373b100393acc405

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/blugov.css HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "11275-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 70261
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

www.silverleaf-tech.com/css/mygov/app/login_files/ruxitagentjs_ICA2Vfghjqrux_10243220606153550.js.download

195.224.99.188

200 OK

244865

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/ruxitagentjs_ICA2Vfghjqrux_10243220606153550.js.download
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

ASCII text, with very long lines (1629)

Size

244865
Hash

7216f7be2f8ca34e027acb1fb5934958

7c9bdd64c89cb8bdc301c8f182a387c7a279ba09

551d6fdc92d330f73f7b1b18554fd619d72aa8e883f8192a05f6466049ae58b9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/ruxitagentjs_ICA2Vfghjqrux_10243220606153550.js.download HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "3bc81-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 244865
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

www.silverleaf-tech.com/css/mygov/app/login_files/mgv2-application.js.download

195.224.99.188

200 OK

75795

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/mgv2-application.js.download
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

ASCII text, with very long lines (65536), with no line terminators

Size

75795
Hash

36d05e84bc9762e8caca2ac41617d6ec

05954311fc189a24a0362f8ab2d4e19e63144462

2c237ee02f34af672a7b889a44a32183f8558274bd727ff6d453062240c6d090

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/mgv2-application.js.download HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "12813-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 75795
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

www.silverleaf-tech.com/css/mygov/app/login_files/mgv2-vendor.js.download

195.224.99.188

200 OK

152015

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/mgv2-vendor.js.download
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

ASCII text, with very long lines (32058)

Size

152015
Hash

977ee72ff0891a72f5766a357cc78336

3cb5504b13591ce0471b29dec114b94df7420ddb

2bedda083bdbe6820e493159f1e3e27146b96ef6840094bd74447925e8c66e26

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/mgv2-vendor.js.download HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "251cf-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 152015
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

www.silverleaf-tech.com/css/mygov/app/login_files/myGov-cobranded-logo-black.svg

195.224.99.188

200 OK

64143

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/myGov-cobranded-logo-black.svg
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (64143), with no line terminators

Size

64143
Hash

b53f20300babca4ebb422e59b888be1f

699c5898c6dd9d2b8b949db2e13c8f0b0d29e26b

954aa858b3bffb8511bc41bc88b07d2b24597c37faf522550e26c9aa3b0d220d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/myGov-cobranded-logo-black.svg HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "fa8f-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 64143
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml

www.silverleaf-tech.com/css/mygov/app/login_files/myGov-cobranded-logo-white.svg

195.224.99.188

200 OK

64140

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/myGov-cobranded-logo-white.svg
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (64140), with no line terminators

Size

64140
Hash

de646b2f77f5fa27d55a01bbb9cf584e

33316eb871adf6e08af7c780eb15872549d08dc3

10b11a7c97b90bcf7ad520ac94c5769d08540ce1ee3b84d487c587bf128e3388

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/myGov-cobranded-logo-white.svg HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "fa8c-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 64140
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

91cea807ac588843e976cd5803475fde

57cd349a6e743ceb886ddc05e853ea1aff163839

bd233ed8e3f9a3ad67de5d2bfec946db4228f0193754cb32a2f5e57903d3eea5

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD233ED8E3F9A3AD67DE5D2BFEC946DB4228F0193754CB32A2F5E57903D3EEA5"
Last-Modified: Sun, 15 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2998
Expires: Mon, 16 Jan 2023 22:09:20 GMT
Date: Mon, 16 Jan 2023 21:19:22 GMT
Connection: keep-alive

www.silverleaf-tech.com/css/mygov/app/login_files/mgv2-application.css

195.224.99.188

200 OK

329

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/login_files/mgv2-application.css
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/login_files/mgv2-application.css HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
Last-Modified: Mon, 03 Oct 2022 22:04:42 GMT
ETag: "1e9fc-5ea2887d49280"
Accept-Ranges: bytes
Content-Length: 125436
X-Powered-By: PleskLin
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

8b4c80fca9a7bc1b84369cdb60024668

91427b4fd16fa613fb83f053b271f00396b36e90

07bb6c4b267a5f46a15cca9ad9644ca38af67daa1448ad67f583f58e3c8dfcc1

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 16 Jan 2023 21:19:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

8b4c80fca9a7bc1b84369cdb60024668

91427b4fd16fa613fb83f053b271f00396b36e90

07bb6c4b267a5f46a15cca9ad9644ca38af67daa1448ad67f583f58e3c8dfcc1

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 16 Jan 2023 21:19:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

8b4c80fca9a7bc1b84369cdb60024668

91427b4fd16fa613fb83f053b271f00396b36e90

07bb6c4b267a5f46a15cca9ad9644ca38af67daa1448ad67f583f58e3c8dfcc1

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 16 Jan 2023 21:19:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

216.58.207.227

200 OK

15860

URL HTTP/2

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP

216.58.207.227:0
ASN

#15169 GOOGLE

Magic

Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data

Size

15860
Hash

e9f5aaf547f165386cd313b995dddd8e

acdef5603c2387b0e5bffd744b679a24a8bc1968

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

HTTP Headers

                                        GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://www.silverleaf-tech.com
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 13 Jan 2023 13:33:13 GMT
expires: Sat, 13 Jan 2024 13:33:13 GMT
cache-control: public, max-age=31536000
age: 287169
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

216.58.207.227

200 OK

15744

URL HTTP/2

fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP

216.58.207.227:0
ASN

#15169 GOOGLE

Magic

Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data

Size

15744
Hash

15d9f621c3bd1599f0169dcf0bd5e63e

7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

HTTP Headers

                                        GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://www.silverleaf-tech.com
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 11 Jan 2023 19:33:54 GMT
expires: Thu, 11 Jan 2024 19:33:54 GMT
cache-control: public, max-age=31536000
age: 438328
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

216.58.207.227

200 OK

15920

URL HTTP/2

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP

216.58.207.227:0
ASN

#15169 GOOGLE

Magic

Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data

Size

15920
Hash

3a44e06eb954b96aa043227f3534189d

23cef6993ddb2b2979e8e7647fc3763694e2ba7d

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

HTTP Headers

                                        GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://www.silverleaf-tech.com
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 11 Jan 2023 07:51:59 GMT
expires: Thu, 11 Jan 2024 07:51:59 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
age: 480443
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

8b4c80fca9a7bc1b84369cdb60024668

91427b4fd16fa613fb83f053b271f00396b36e90

07bb6c4b267a5f46a15cca9ad9644ca38af67daa1448ad67f583f58e3c8dfcc1

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 16 Jan 2023 21:19:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.pngitem.com/pimgs/m/1-18686_transparent-visa-mastercard-png-white-visa-logo-png.png

173.208.209.195

200 OK

21888

URL HTTP/1.1

www.pngitem.com/pimgs/m/1-18686_transparent-visa-mastercard-png-white-visa-logo-png.png
IP

173.208.209.195:0
ASN

#32097 WII

Magic

PNG image data, 860 x 274, 8-bit/color RGBA, non-interlaced\012- data

Size

21888
Hash

bbbddcf6f7a5289e26ec835a60ad81ca

ffe8ab8f5d41eac9ed82df8201eb75fb3b0881ff

ea47175cbbc28518094852307af7f30bf75816869cf0cb702b213ed62f3a65f5

HTTP Headers

                                        GET /pimgs/m/1-18686_transparent-visa-mastercard-png-white-visa-logo-png.png HTTP/1.1
Host: www.pngitem.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Server: nginx/1.14.0
Date: Mon, 16 Jan 2023 21:19:22 GMT
Content-Type: image/png
Last-Modified: Fri, 09 Dec 2022 08:03:42 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6392ebde-596d"
Content-Encoding: gzip

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

d03545e1fc5a8876441094039811aac5

99fcc840f3516298625c528e9b408132f7fcbb9c

166fa7c7bb716b2cd02a47884ee00df31030dfb4b2a6fdae7b59b19f87739123

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3294
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 16 Jan 2023 21:19:22 GMT
Last-Modified: Mon, 16 Jan 2023 20:24:28 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471

www.silverleaf-tech.com/css/mygov/app/blugov/M-myGov-Coloured%20Line.svg

195.224.99.188

200 OK

URL HTTP/1.1

www.silverleaf-tech.com/css/mygov/app/blugov/M-myGov-Coloured%20Line.svg
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        GET /css/mygov/app/blugov/M-myGov-Coloured%20Line.svg HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph; dtCookie=v_4_srv_-2D83_sn_3DUT3PUDV7SAUIC9C2DVDMRPQQ1VVJ78; rxVisitor=1673903962311D4JO5JJMB85BDCHVTCC8DD9SD7RTC2RT; dtPC=-83$503962303_918h1vJHCUQKPTHTAMCKFLEOVALRAGEILADVBD-0e0; rxvt=1673905762323|1673903962315; dtLatC=35; dtSa=-

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:22 GMT
Server: Apache
X-Powered-By: PHP/7.3.33, PleskLin
Content-Length: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

push.services.mozilla.com/

44.228.207.167

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

44.228.207.167:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: o/U/9fOd6MvmTJ2GfLmM3A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: slLkYmB+HFyaXmh8hhDA0/SOTGI=

ocsp.entrust.net/

104.110.10.32

200 OK

1588

URL HTTP/1.1

ocsp.entrust.net/
IP

104.110.10.32:0
ASN

#16625 AKAMAI-AS

Magic

data

Size

1588
Hash

1364120371558413f15183e95af7a2a3

6ad7da20c1b8b2ed6a712ad83f292923fad2e62b

a95c927e54af846f8fc9db5ca6f3fb2fb22e9e3be004fd8faff3fe0820801a01

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.entrust.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
ETag: "A95C927E54AF846F8FC9DB5CA6F3FB2FB22E9E3BE004FD8FAFF3FE0820801A01"
Last-Modified: Mon, 16 Jan 2023 11:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=2818
Expires: Mon, 16 Jan 2023 22:06:21 GMT
Date: Mon, 16 Jan 2023 21:19:23 GMT
Connection: keep-alive

ocsp.entrust.net/

104.110.10.32

200 OK

1588

URL HTTP/1.1

ocsp.entrust.net/
IP

104.110.10.32:0
ASN

#16625 AKAMAI-AS

Magic

data

Size

1588
Hash

7929807bfebd3076f83e7f4085e7fa84

8983b218a9c84e471729037d6aa51496e64dfc5e

dd3a8c3999770043cf3c649ab3bd08d3e766e8ff3cc97a00b4dc334164c63cb2

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.entrust.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
ETag: "DD3A8C3999770043CF3C649AB3BD08D3E766E8FF3CC97A00B4DC334164C63CB2"
Last-Modified: Mon, 16 Jan 2023 10:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=3357
Expires: Mon, 16 Jan 2023 22:15:20 GMT
Date: Mon, 16 Jan 2023 21:19:23 GMT
Connection: keep-alive

161.146.235.204

200 OK

238

URL HTTP/1.1

login.my.gov.au/mygov/content/mgv2/icons/favicon-16x16.png
IP

161.146.235.204:0
ASN

#18055 Department of Human Services

Magic

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data

Size

238
Hash

734603b796e313e6b30c5314cfff7a0d

9ef8bcab45a447a173ba98d4e8af6114c30a1aca

5e70f30259d620e25efa88586a8871d5c94113f0b0d7d6f3e817f585891bf154

HTTP Headers

                                        GET /mygov/content/mgv2/icons/favicon-16x16.png HTTP/1.1
Host: login.my.gov.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
accept-ranges: bytes
content-length: 238
content-type: image/png
date: Mon, 16 Jan 2023 21:19:23 GMT
last-modified: Fri, 02 Dec 2022 16:01:42 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
vary: Accept-Encoding
x-frame-options: DENY
x-content-type-options: nosniff
cache-control: max-age=3600,public,must-revalidate
inst: 1a
expires: Mon, 16 Jan 2023 22:19:23 GMT
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000; includeSubDomains
server-timing: dtRpid;desc="-86549150"
Set-Cookie: BIGipServerHBZK2i12N308Oa3l35yEhg=!sTCCh6E3I7bqhNKU6TFomdAxad1I6terJAM5g45wC/nrzyC2Tbv7gXLZ9kqlapUD9zD2kBjZhWZOAFo=; expires=Mon, 16-Jan-2023 21:49:23 GMT; path=/; Httponly; Secure;SameSite=none
dtCookie=v_4_srv_48_sn_71E4685B529BC39EDDB63269CBC2F713_perc_100000_ol_0_mul_1; Domain=.my.gov.au.; Path=/; SameSite=None; Secure; HttpOnly
PD_STATEFUL_aaa1d6bc-31d2-11e6-b102-0050568e537f=mygov; Path=/; Secure; HttpOnly;SameSite=none

www.silverleaf-tech.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D83_sn_3DUT3PUDV7SAUIC9C2DVDMRPQQ1VVJ78&svrid=-83&flavor=post&vi=JHCUQKPTHTAMCKFLEOVALRAGEILADVBD-0&modifiedSince=1664408259780&rf=http%3A%2F%2Fwww.silverleaf-tech.com%2Fcss%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=390209061&en=gpalpirq&end=1

195.224.99.188

200 OK

URL HTTP/1.1

www.silverleaf-tech.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D83_sn_3DUT3PUDV7SAUIC9C2DVDMRPQQ1VVJ78&svrid=-83&flavor=post&vi=JHCUQKPTHTAMCKFLEOVALRAGEILADVBD-0&modifiedSince=1664408259780&rf=http%3A%2F%2Fwww.silverleaf-tech.com%2Fcss%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=390209061&en=gpalpirq&end=1
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        POST /LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D83_sn_3DUT3PUDV7SAUIC9C2DVDMRPQQ1VVJ78&svrid=-83&flavor=post&vi=JHCUQKPTHTAMCKFLEOVALRAGEILADVBD-0&modifiedSince=1664408259780&rf=http%3A%2F%2Fwww.silverleaf-tech.com%2Fcss%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=390209061&en=gpalpirq&end=1 HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain;charset=UTF-8
Content-Length: 1246
Origin: http://www.silverleaf-tech.com
Connection: keep-alive
Referer: http://www.silverleaf-tech.com/css/mygov/app/addcc.php
Cookie: PHPSESSID=agru0i0tta03bon0vjp018noph; dtCookie=v_4_srv_-2D83_sn_3DUT3PUDV7SAUIC9C2DVDMRPQQ1VVJ78; rxVisitor=1673903962311D4JO5JJMB85BDCHVTCC8DD9SD7RTC2RT; dtPC=-83$503962303_918h-vJHCUQKPTHTAMCKFLEOVALRAGEILADVBD-0e0; rxvt=1673905762763|1673903962315; dtLatC=35; dtSa=-

                                        HTTP/1.1 200 OK
Date: Mon, 16 Jan 2023 21:19:23 GMT
Server: Apache
X-Powered-By: PHP/7.3.33, PleskLin
Content-Length: 0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

6b6a65d2536cc8f99e68793ae265b595

f65e75f8419bd83e26f49def7fa2604db5f77b4d

94b31f7663e4917e8e97079202ef9fa340766f1ebfc2601360618d947f7dabc9

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94B31F7663E4917E8E97079202EF9FA340766F1EBFC2601360618D947F7DABC9"
Last-Modified: Sun, 15 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14960
Expires: Tue, 17 Jan 2023 01:28:44 GMT
Date: Mon, 16 Jan 2023 21:19:24 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

6b6a65d2536cc8f99e68793ae265b595

f65e75f8419bd83e26f49def7fa2604db5f77b4d

94b31f7663e4917e8e97079202ef9fa340766f1ebfc2601360618d947f7dabc9

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94B31F7663E4917E8E97079202EF9FA340766F1EBFC2601360618D947F7DABC9"
Last-Modified: Sun, 15 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14960
Expires: Tue, 17 Jan 2023 01:28:44 GMT
Date: Mon, 16 Jan 2023 21:19:24 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

6b6a65d2536cc8f99e68793ae265b595

f65e75f8419bd83e26f49def7fa2604db5f77b4d

94b31f7663e4917e8e97079202ef9fa340766f1ebfc2601360618d947f7dabc9

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94B31F7663E4917E8E97079202EF9FA340766F1EBFC2601360618D947F7DABC9"
Last-Modified: Sun, 15 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14960
Expires: Tue, 17 Jan 2023 01:28:44 GMT
Date: Mon, 16 Jan 2023 21:19:24 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

6b6a65d2536cc8f99e68793ae265b595

f65e75f8419bd83e26f49def7fa2604db5f77b4d

94b31f7663e4917e8e97079202ef9fa340766f1ebfc2601360618d947f7dabc9

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94B31F7663E4917E8E97079202EF9FA340766F1EBFC2601360618D947F7DABC9"
Last-Modified: Sun, 15 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14960
Expires: Tue, 17 Jan 2023 01:28:44 GMT
Date: Mon, 16 Jan 2023 21:19:24 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

6b6a65d2536cc8f99e68793ae265b595

f65e75f8419bd83e26f49def7fa2604db5f77b4d

94b31f7663e4917e8e97079202ef9fa340766f1ebfc2601360618d947f7dabc9

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94B31F7663E4917E8E97079202EF9FA340766F1EBFC2601360618D947F7DABC9"
Last-Modified: Sun, 15 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14960
Expires: Tue, 17 Jan 2023 01:28:44 GMT
Date: Mon, 16 Jan 2023 21:19:24 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa81e129b-3fb3-4b30-a6fc-04ac1926b5c8.jpeg

34.120.237.76

200 OK

7986

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa81e129b-3fb3-4b30-a6fc-04ac1926b5c8.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

7986
Hash

0c1d929710bbf5d3a500cff064fa28e5

f76fade4eba5e5740d1261a2bce7776719ee477f

bb0b45ede28406534c236881abe011a1b8162a1bcb4cbe61320c613fec5d0010

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa81e129b-3fb3-4b30-a6fc-04ac1926b5c8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 7986
x-amzn-requestid: 366be46e-97f4-4bdc-8341-5bf87438ad86
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ezbPvEezoAMF6ng=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c47264-7eef208b3ec703b82d792537;Sampled=0
x-amzn-remapped-date: Sun, 15 Jan 2023 21:38:44 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: qfBDjRpkhNx6ijJvTvPJFwvyjzTPnsPFHYFBK6wYwrUk1dwyCo2UCw==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 15 Jan 2023 22:03:31 GMT
age: 83753
etag: "f76fade4eba5e5740d1261a2bce7776719ee477f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9801

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3456fd70-5207-41e6-abed-adbc381fd7a4.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

9801
Hash

74ac30be02dee9dcfeee79a7dc54edff

1368d81de22ea2e4054a3e1a8f01ef337c63e35b

8abc2f276906dfb9ce75c2526d2c2cfa6aea6dbe13f4046de1040cd611cbbc1f

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3456fd70-5207-41e6-abed-adbc381fd7a4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 9801
x-amzn-requestid: 39d84a20-55f7-4b7c-abc4-9ac1ff100da9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eqSkoGCZoAMF1zA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c0caea-4f7a1cf676335cc83018dc51;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 03:07:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: rUFicgD94yxyZhMtQm-aYS-QpZXn07rLRBhnBLMTIQh6qHKOX_LRFg==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 16 Jan 2023 04:24:02 GMT
age: 60922
etag: "1368d81de22ea2e4054a3e1a8f01ef337c63e35b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9176

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcdba5086-6c46-4cc7-9087-e85f89cbe947.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

9176
Hash

ad1a79b09348c4959a8ac05513efcb78

10c0a66add63c868ff332022f588e65f4ac1ec15

8a123746389e6b480669b8d6882f7edce290f1c226cd6744e23bac94b8de6d32

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcdba5086-6c46-4cc7-9087-e85f89cbe947.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 9176
x-amzn-requestid: 1d5746ff-7de6-4a54-87d2-d15330d1bb58
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: etlL8HiPoAMFrIg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c21be5-044d012445cf23c01cb07a89;Sampled=0
x-amzn-remapped-date: Sat, 14 Jan 2023 03:05:09 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: rlWcTZTEG0kynoJM9bd9eba8kiPvodkF7ewyDV7JaR9qPjiNMApa1g==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 16 Jan 2023 00:20:11 GMT
age: 75553
etag: "10c0a66add63c868ff332022f588e65f4ac1ec15"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5766

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa2fb3ba8-a85e-42ba-b607-87ced36844b2.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

5766
Hash

542f87ebb35e170451b610e4b700bcb1

2259cdebacc4c9f07aad838eec494863d4273ad1

85001f2cf33f3fc98d4cdcc7aef38611e34aea3a791d8acb0a5946c4619398eb

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa2fb3ba8-a85e-42ba-b607-87ced36844b2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 5766
x-amzn-requestid: b6a8d7ee-ff35-4720-8d2e-ba2b8db6edfc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ezbP4GDQIAMFTSQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c47265-6022a62f69d8f938458d18a0;Sampled=0
x-amzn-remapped-date: Sun, 15 Jan 2023 21:38:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YcIDYSEtEIIfGauNxD9V1tuSCAPDq9OaaAATRTOC3Sjlb-72IA0ScQ==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 15 Jan 2023 22:02:24 GMT
age: 83820
etag: "2259cdebacc4c9f07aad838eec494863d4273ad1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11285

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d821e79-af3a-4b67-a79e-90cdf9701001.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

11285
Hash

91a664271b9042ab5a34c1259df6ab93

7ce177939ceed31dbe137996cace3f71eaab3cf4

08b872b4c8dc8d4b5e26d7c5e7985c144dcf45623737e6daf7813b2add8ab013

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d821e79-af3a-4b67-a79e-90cdf9701001.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 11285
x-amzn-requestid: 46c0b124-5916-4067-99af-2fa9812dfb2d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ev-1zHc4oAMFV6Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c311be-3ffbee9348f4351459ed0099;Sampled=0
x-amzn-remapped-date: Sat, 14 Jan 2023 20:34:06 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: xvBnmF39Og8Zbf9xZ0IjC0Kd5cIYRc4ONYqolYdxxmzS8i-K2REYSA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 16 Jan 2023 04:56:54 GMT
age: 58950
etag: "7ce177939ceed31dbe137996cace3f71eaab3cf4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6273

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd986c41-5e27-40cc-8622-aeddbd283d0c.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

6273
Hash

a7917592de9f2ddbe7d3a7fa7f3d4d62

866b04ce93a30369d7cb0a6d2155a8b10292507f

da58e1798bf0fcbfe771420a66bbf671cc84e0ca429e076fdc70bb8d73cddb18

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd986c41-5e27-40cc-8622-aeddbd283d0c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 6273
x-amzn-requestid: f5d21802-91ea-44cc-aeb2-8ec9af07e1a2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ezbOyFwNIAMFZsA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c4725e-3028350e72b2ee7b6ae44f2c;Sampled=0
x-amzn-remapped-date: Sun, 15 Jan 2023 21:38:38 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 8ggqVFvybykQ-MJzU9H_L6JS9YqmLGsuaMJ34Qy7o6yoMOJOmvYsMA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Sun, 15 Jan 2023 21:53:09 GMT
age: 84375
etag: "866b04ce93a30369d7cb0a6d2155a8b10292507f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

195.224.99.188

200 OK

URL HTTP/1.1

www.silverleaf-tech.com/LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D83_sn_3DUT3PUDV7SAUIC9C2DVDMRPQQ1VVJ78&svrid=-83&flavor=post&vi=JHCUQKPTHTAMCKFLEOVALRAGEILADVBD-0&modifiedSince=1664408259780&rf=http%3A%2F%2Fwww.silverleaf-tech.com%2Fcss%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=2457034719&en=gpalpirq&end=1
IP

195.224.99.188:0
ASN

#5413 Daisy Corporate Services Trading Ltd

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Australian Government
urlquery	phishing	Phishing - Australian Government

HTTP Headers

                                        POST /LoginServices/main/rb_6de8e2e9-6719-45b3-86be-7effcb9f6525?type=js3&sn=v_4_srv_-2D83_sn_3DUT3PUDV7SAUIC9C2DVDMRPQQ1VVJ78&svrid=-83&flavor=post&vi=JHCUQKPTHTAMCKFLEOVALRAGEILADVBD-0&modifiedSince=1664408259780&rf=http%3A%2F%2Fwww.silverleaf-tech.com%2Fcss%2Fmygov%2Fapp%2Faddcc.php&bp=3&app=5f15dc81410a75c1&crc=2457034719&en=gpalpirq&end=1 HTTP/1.1
Host: www.silverleaf-tech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain;charset=UTF-8
Content-Length: 2459
Origin: http://www.silverleaf-tech.com
Connection: keep-alive
Referer: http://www.silverleaf-te

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

#1 JS:Script (size: 75795)

#2 JS:Script (size: 152015)

#3 JS:Script (size: 1560)

#4 JS:Script (size: 363)

#5 JS:Script (size: 685)

HTTP Transactions (44)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers