Report - www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=

Report Overview

URL

www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
IP

217.160.0.197

ASN

#8560 IONOS SE
Submitted

2023-05-06T21:44:03Z

Access

public
Tags

capitalone financial phishing
urlquery detections

Phishing - Capital One

Detections

urlquery

11
Network Intrusion Detection

0
Threat Detection Systems

19

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
cdnjs.cloudflare.com (1)	235	2015-04-17 22:46:33	2023-05-06 05:09:17	432	11945	104.17.25.14
www.tagwerk.info (21)	unknown	2015-11-25 03:19:54	2022-08-16 13:43:34	12388	1186729	217.160.0.197
ecm.capitalone.com (3)	13649	2017-02-01 18:32:51	2023-05-05 08:34:52	1566	86752	104.110.12.190

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/nr-spa-1169.min.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/widget-loader.min.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/c344d59e90
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/6a11fdd2d5fa6a863700c83f4f717479.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/aee4cee5b8f3059e54cc2fda347def51.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/557936930f28b2d366ab8c42a0f9f373.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/dc6af6edb24bc0a97d6c4571fc66a77c.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/6.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/cc.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/js/script.js
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/browserFingerPrintv1.min.js.download
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/capital-one-logo.svg
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/fdic.svg
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/equal_housing_lender.svg
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/serverComponent.php
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/saved_resource.html
2023-05-06	medium	www.tagwerk.info/rmat/verification/pii/src/247px.js.download

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

HTTP Transactions (25)

URL IP Response Size

cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js

104.17.25.14

200 OK

10899

URL GET HTTP/2

cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js
IP

104.17.25.14:443
ASN

#13335 CLOUDFLARENET

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerCloudflare, Inc.

Subjectsni.cloudflaressl.com

FingerprintA9:11:71:07:07:92:48:7E:A9:3C:E8:32:25:3F:EB:AC:7D:51:7E:8F

ValidityWed, 03 Aug 2022 00:00:00 GMT - Wed, 02 Aug 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (45552)

Size

10899
Hash

6dd93e13c5bb3b67dadd0de250ffea2f

961bf5bb7cc4aa32bcd66b9ac34461f7e02d96d3

1238c95de9a6c90c1992853fd140b31d2ec8854a09deaa0d4a2d3136281af5e9

HTTP Headers

                                        GET /ajax/libs/imask/3.4.0/imask.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Sat, 06 May 2023 21:43:46 GMT
content-type: application/javascript; charset=utf-8
content-length: 10899
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e9f-b217"
last-modified: Mon, 04 May 2020 16:11:11 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2079784
expires: Thu, 25 Apr 2024 21:43:46 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gf53eNOgjZScef2L1jvBLaApi5dDoNVJ%2Frb39JvB1n8G78hN4aS9gECvp8hD2n%2BmDjd%2BZzwPgCU6XE2KPiIbxxnWkExW%2Beh4lyc3%2BjV6SRfFk%2Fr5EkviL8QUaIECVw4ObBGNIhKn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7c346694d9e41c16-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/nr-spa-1169.min.js.download

217.160.0.197

200 OK

37554

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/nr-spa-1169.min.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (32021)

Size

37554
Hash

5e3590bffa49fddc4bc389e63736da42

c7f8bdf8337f4f84b1359cb2bd64a2587aeb74af

37072a42526245f257b725698d7e70dfab281bfd00d38f1112dafd36a6e04176

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/nr-spa-1169.min.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 37554
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "92b2-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/widget-loader.min.js.download

217.160.0.197

200 OK

251471

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/widget-loader.min.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (65465)

Size

251471
Hash

48df4b60ad0dceb092a9d7aab32cb88e

125962d247ec4b5b9ebe05ae8eed4e6d46450444

9d8852f3d0cf2ab3391265179beff783fe5dbbf43666ebc13a7a316868987642

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/widget-loader.min.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 251471
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:26 GMT
etag: "3d64f-5faef74b99380"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/c344d59e90

217.160.0.197

200 OK

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/c344d59e90
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with no line terminators

Size

49
Hash

ada33e5b8877e743ff658bf4bfa1867c

5a78662243dac43c0ee48bcb7e05a536b84c2e38

dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/c344d59e90 HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-length: 49
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "31-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/6a11fdd2d5fa6a863700c83f4f717479.js.download

217.160.0.197

200 OK

142582

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/6a11fdd2d5fa6a863700c83f4f717479.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (1780)

Size

142582
Hash

cce013065bfcfed98fe7372d0d188758

93c89a82faa6d61ea2f1d42ffcf33a63ca6ad5bc

a97acb0c0b54cdecf0ba0170816c8ad546387a0104c144613a1c953709932a88

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/6a11fdd2d5fa6a863700c83f4f717479.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 142582
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "22cf6-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/aee4cee5b8f3059e54cc2fda347def51.js.download

217.160.0.197

200 OK

11374

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/aee4cee5b8f3059e54cc2fda347def51.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (600)

Size

11374
Hash

9be245faac1a23e1a227e553d265d0aa

29484cf6f6a2ce76e52f4cbeb105e83bdabb81c4

51e6ac1e31c3fab5e6705eb47edbf23c4a184f14d582a405896a6fa8c4441429

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/aee4cee5b8f3059e54cc2fda347def51.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 11374
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "2c6e-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/557936930f28b2d366ab8c42a0f9f373.js.download

217.160.0.197

200 OK

285

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/557936930f28b2d366ab8c42a0f9f373.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with no line terminators

Size

285
Hash

ae6c49ec9c8e28a8ea01401770e71cc0

0f251b8a33f7d92495b98c1f5bb231a104e2da6d

7edc1eebffd512b3688a508c6754c98cb44ada1ed7a8f56862096de6d28cb0fa

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/557936930f28b2d366ab8c42a0f9f373.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 285
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "11d-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/dc6af6edb24bc0a97d6c4571fc66a77c.js.download

217.160.0.197

200 OK

101648

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/dc6af6edb24bc0a97d6c4571fc66a77c.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (564)

Size

101648
Hash

4254e419a8ef6fd2049824f42f15b2e4

af9e87a63dea77a05c660094c2cb1060d2a910b7

31b4584d6af36a1dbfc4f957747fdd6ec0e947c1a345c3e1859134aed8c83322

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/dc6af6edb24bc0a97d6c4571fc66a77c.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 101648
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "18d10-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/6.js.download

217.160.0.197

200 OK

1056

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/6.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (1056), with no line terminators

Size

1056
Hash

ad999adb9d5b723fa7826ade641c4264

4b627d57788b8c6125eb8ec14204df485a534f9a

eeb97d820965c4b0f2f0d55c81cd4e8f54ec9faa8ddca76111ee8e9d406429c1

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/6.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 1056
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "420-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/css/style.css

217.160.0.197

200 OK

3776

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/css/style.css
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text

Size

3776
Hash

2d337c2a121cc03a85631a5a824ecb8b

0d207fad87ce5114c1aa5692eda7e949aacb88bf

ff5dfb322569b484616a25c622fd03e10b19ee018eb8daaf39d59effd3d5d79f

HTTP Headers

                                        GET /rmat/verification/pii/css/style.css HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/css
content-length: 3776
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:56:18 GMT
etag: "ec0-5faf0237c5880"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/styles.46f55e805a3865891048.css

217.160.0.197

200 OK

117825

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/styles.46f55e805a3865891048.css
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (65536), with no line terminators

Size

117825
Hash

18b22df77380c1455755c1789a1aa4c8

07043c4af449e9170f5826347030ab5c943b8d0f

05bb73d87c9000a0397443c3dfe64ea892c676173e8d7cd01895426dba399d96

HTTP Headers

                                        GET /rmat/verification/pii/src/styles.46f55e805a3865891048.css HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/css
content-length: 117825
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:30 GMT
etag: "1cc41-5faef74f69c80"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/cc.js.download

217.160.0.197

200 OK

38768

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/cc.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (4821)

Size

38768
Hash

7905ddf5b571034696bdb323dd4556b0

d067758cf1159345c0d2c7fdee50c76e822eb31b

fbb84de8c5c59a2bb5fafacf80660757b499e38c251858e22ea0713b97e31436

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/cc.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 38768
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:30 GMT
etag: "9770-5faef74f69c80"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/js/script.js

217.160.0.197

200 OK

99372

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/js/script.js
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (18129)

Size

99372
Hash

1501b528220baca92f7d189b7f00136b

60b48644dc907af63a10411190e9e085857a7078

9b11ce0ce39ad24aa3c869cbde323c1605bbafdfd45ab8f013aa48731d5a4969

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/js/script.js HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 99372
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Mon, 28 Dec 2020 15:00:36 GMT
etag: "1842c-5b7878953ed00"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/browserFingerPrintv1.min.js.download

217.160.0.197

200 OK

28442

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/browserFingerPrintv1.min.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (28442), with no line terminators

Size

28442
Hash

0f537e63c621f88c0c4bf4257394b2c2

7f28eaf9bbf93c3a2d4e012aaca4f34c3cbc3c97

559d96c9ff8af5055471707c21b22ac1a7bca706d199dc9f5659a65c02d7e944

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/browserFingerPrintv1.min.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 28442
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:30 GMT
etag: "6f1a-5faef74f69c80"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/capital-one-logo.svg

217.160.0.197

200 OK

3971

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/capital-one-logo.svg
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

ASCII text, with very long lines (3967), with CRLF line terminators

Size

3971
Hash

f0b7ad81821effc52540e39cafda48f9

33d64bc7001f414f12bd92e740a45e5ced239add

57dfca5b95599a613da940f4a49ab6378fcf0586366a47cae679796930bf0eed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/capital-one-logo.svg HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: image/svg+xml
content-length: 3971
date: Sat, 06 May 2023 21:43:47 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:32 GMT
etag: "f83-5faef75152100"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/fdic.svg

217.160.0.197

200 OK

2063

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/fdic.svg
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (2063), with no line terminators

Size

2063
Hash

508681d436b6b42ca2fe4f037d575129

78a4d0e58d49cfce4ed992dcd7265548c1fa7814

628de643d113e225cf4347ed2571ee813cb0919a3895d1902ee18e6f63d539f1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/fdic.svg HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: image/svg+xml
content-length: 2063
date: Sat, 06 May 2023 21:43:47 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:32 GMT
etag: "80f-5faef75152100"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/equal_housing_lender.svg

217.160.0.197

200 OK

3739

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/equal_housing_lender.svg
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3739), with no line terminators

Size

3739
Hash

0a9caf42835ab4b61876bddec69ce0de

d30fd829250e6439b36ddd5e1b2354a52f309a4e

6043dfa194d29e8e22dc4aeed56d87b6a9a7623b97c3334592031570f4281d89

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/equal_housing_lender.svg HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: image/svg+xml
content-length: 3739
date: Sat, 06 May 2023 21:43:47 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:32 GMT
etag: "e9b-5faef75152100"
accept-ranges: bytes
X-Firefox-Spdy: h2

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Lt.woff2

104.110.12.190

200 OK

27852

URL GET HTTP/2

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Lt.woff2
IP

104.110.12.190:443
ASN

#16625 AKAMAI-AS

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subjectecm.capitalone.com

Fingerprint90:19:90:06:2C:C9:A4:8F:1D:A2:69:D1:6C:87:09:C4:94:E7:83:C5

ValidityTue, 12 Jul 2022 00:00:00 GMT - Wed, 12 Jul 2023 23:59:59 GMT

Magic

Web Open Font Format (Version 2), TrueType, length 27852, version 1.0\012- data

Size

27852
Hash

cb37fa55f3dfdd26d61901032a53644f

1115e8d43a08c1f74ec1f6a886d1cb530bb9da97

902c5a9d8ad932630fb2021fe1a1a7f4f06513b19e8d073866178ee65ff33fe9

HTTP Headers

                                        GET /CI_Common/assets/fonts/Optimist_W_Lt.woff2 HTTP/1.1
Host: ecm.capitalone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.tagwerk.info
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 27852
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "cb37fa55f3dfdd26d61901032a53644f"
x-amz-server-side-encryption: AES256
x-amz-version-id: Q75rYxmglrbgkwTTGgaHL71RQB9n5YCD
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: WZLHu-KyMHr9Oi38M7o8z4XXwUqHnVG-f6Rg-E6l9knxWl69APaosA==
x-datastream-cache-status: 1
cache-control: max-age=1373146
expires: Mon, 22 May 2023 19:09:33 GMT
date: Sat, 06 May 2023 21:43:47 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/serverComponent.php

217.160.0.197

200 OK

28699

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/serverComponent.php
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

data

Size

28699
Hash

3ae8a64dc5c7188fd2ba4c50d5202c13

b06af9ef40c3fa9bb8729f489dff982676d24ef4

340af876f4ddad09e6b83b38d652e431dab55f9601b343f9eb6663f98ce2a014

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/serverComponent.php HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: text/html
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
content-encoding: gzip
X-Firefox-Spdy: h2

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_SBd.woff2

104.110.12.190

200 OK

28188

URL GET HTTP/2

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_SBd.woff2
IP

104.110.12.190:443
ASN

#16625 AKAMAI-AS

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subjectecm.capitalone.com

Fingerprint90:19:90:06:2C:C9:A4:8F:1D:A2:69:D1:6C:87:09:C4:94:E7:83:C5

ValidityTue, 12 Jul 2022 00:00:00 GMT - Wed, 12 Jul 2023 23:59:59 GMT

Magic

Web Open Font Format (Version 2), TrueType, length 28188, version 1.0\012- data

Size

28188
Hash

d647937062406e5cc182de0cc77947d8

9d4c283a4fca43ae95019091bbd0a9e1b77b97bc

48b4ed4ba8ee0eaeddfba861e6772c61f818931816102636a888ec0b49bce056

HTTP Headers

                                        GET /CI_Common/assets/fonts/Optimist_W_SBd.woff2 HTTP/1.1
Host: ecm.capitalone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.tagwerk.info
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 28188
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "d647937062406e5cc182de0cc77947d8"
x-amz-server-side-encryption: AES256
x-amz-version-id: QmX7yv6RJT4hT4UTSJmqyU0reaonF3KP
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: SxgW2j2Ku0ctcy9uifxoUSuEGDe6rOxpREUwMoFk23y-XvIAp5y9VA==
x-datastream-cache-status: 1
cache-control: max-age=1197591
expires: Sat, 20 May 2023 18:23:38 GMT
date: Sat, 06 May 2023 21:43:47 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/img/favicon.ico

217.160.0.197

200 OK

15086

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/img/favicon.ico
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data

Size

15086
Hash

d27e1739c7477b10ec6917546ae61f1d

bb36ab8bce726ce72a2d74a8529526bca0fa515d

5f2123af80970c0478de7f373c9d861d886e070592ebcd55fa372d8dfc9752ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One

HTTP Headers

                                        GET /rmat/verification/pii/img/favicon.ico HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
content-length: 15086
date: Sat, 06 May 2023 21:43:47 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:12:42 GMT
etag: "3aee-5faef878f5a80"
accept-ranges: bytes
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=

217.160.0.197

200 OK

139782

URL User Request GET HTTP/2

www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

Size

139782
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
openphish	Capital One Financial Corporation
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D= HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
content-type: text/html
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
content-location: Payment_Oath.php
vary: negotiate
tcn: choice
content-encoding: gzip
X-Firefox-Spdy: h2

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Rg.woff2

104.110.12.190

200 OK

28388

URL GET HTTP/2

ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Rg.woff2
IP

104.110.12.190:443
ASN

#16625 AKAMAI-AS

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subjectecm.capitalone.com

Fingerprint90:19:90:06:2C:C9:A4:8F:1D:A2:69:D1:6C:87:09:C4:94:E7:83:C5

ValidityTue, 12 Jul 2022 00:00:00 GMT - Wed, 12 Jul 2023 23:59:59 GMT

Magic

Web Open Font Format (Version 2), TrueType, length 28388, version 1.0\012- data

Size

28388
Hash

f4e1fbca28c954a486a90828b2ee7543

7750f00fe0337120e16632ea7fff2a78b11c874a

9b98e19f831844b3dae8e1fd65b6802bc778446fbdacac8203e34bbc02eacbcd

HTTP Headers

                                        GET /CI_Common/assets/fonts/Optimist_W_Rg.woff2 HTTP/1.1
Host: ecm.capitalone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.tagwerk.info
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 28388
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "f4e1fbca28c954a486a90828b2ee7543"
x-amz-server-side-encryption: AES256
x-amz-version-id: 1GgM.ruzxSoQhqV._aklwOsuyVwoqFBE
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: BGWuX4caZ0kfZbeEU9EBXkYNIfAXAQn7qhOobVDMcBZpZGYT9HOYpw==
x-datastream-cache-status: 1
cache-control: max-age=1024543
expires: Thu, 18 May 2023 18:19:30 GMT
date: Sat, 06 May 2023 21:43:47 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/saved_resource.html

217.160.0.197

200 OK

168

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/saved_resource.html
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators

Size

168
Hash

a7df68343bf875bcc6ea39ba68ebf93f

fe5ac2888749272172287aa64647263e4246bd5b

1f7af2ecf83e96b2d9fa7e552021709594f9272bcf55b54bdccce8cc4daeb192

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/saved_resource.html HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
content-type: text/html
date: Sat, 06 May 2023 21:43:47 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:34 GMT
etag: W/"a8-5faef7533a580"
content-encoding: gzip
X-Firefox-Spdy: h2

www.tagwerk.info/rmat/verification/pii/src/247px.js.download

217.160.0.197

200 OK

154227

URL GET HTTP/2

www.tagwerk.info/rmat/verification/pii/src/247px.js.download
IP

217.160.0.197:443
ASN

#8560 IONOS SE

Requested by

https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Certificate

IssuerDigiCert Inc

Subject*.tagwerk.info

Fingerprint52:0E:52:BE:CC:6A:0D:DE:83:88:B2:93:C1:8A:5F:0D:DD:B5:70:33

ValiditySun, 05 Jun 2022 00:00:00 GMT - Tue, 20 Jun 2023 23:59:59 GMT

Magic

Size

154227
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Capital One
fortinet	Phishing

HTTP Headers

                                        GET /rmat/verification/pii/src/247px.js.download HTTP/1.1
Host: www.tagwerk.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.tagwerk.info/rmat/verification/pii/Payment_Oath?74D101DB17B39BEB856D26F2DB17B39BD22D32D22D3204021EB856D26F2DB17B39BD22D3204021EB0BF7D=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
content-type: text/javascript
content-length: 154227
date: Sat, 06 May 2023 21:43:46 GMT
server: Apache
last-modified: Fri, 05 May 2023 10:07:28 GMT
etag: "25a73-5faef74d81800"
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (16)

#1 JS:Script (size: 142582)

#2 JS:Script (size: 602)

#3 JS:Script (size: 28442)

#4 JS:Script (size: 11374)

#5 JS:Script (size: 285)

#6 JS:Script (size: 251471)

#7 JS:Script (size: 99372)

#8 JS:Script (size: 16)

#9 JS:Script (size: 49)

#10 JS:Script (size: 154227)

#11 JS:Script (size: 45591)

#12 JS:Script (size: 38768)

#13 JS:Script (size: 37554)

#14 JS:Script (size: 1056)

#15 JS:Script (size: 101648)

#1 JS:Eval (size: 5760)

HTTP Transactions (25)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers