Report - greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/

Report Overview

Visited public
2023-11-11 11:24:55
Tags
URL
greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
Finishing URL
greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
IP / ASN
178.159.36.195
#213058 Private Internet Hosting LTD
Title
First Financial Bank - Recover

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
s3-us-west-2.amazonaws.com	unknown	2005-08-18	2017-01-29 12:21:01	2023-11-11 05:53:51	449 B	177 kB	52.92.197.80
greenlovedeliveries.com	unknown	2022-09-25	2022-10-02 12:44:32	2023-11-10 09:15:21	1.5 kB	6.7 kB	178.159.36.195
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17 22:46:33	2023-11-11 05:09:14	441 B	28 kB	104.17.24.14

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-11-11	medium	greenlovedeliveries.com	Sinkholed
2023-11-11	medium	greenlovedeliveries.com	Sinkholed
2023-11-11	medium	greenlovedeliveries.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	From	Size	First Seen	Last Seen
	greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/	ScriptElement	0 B	0001-01-01	2025-05-11
Pretty URL greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/ IP 178.159.36.195 ASN #213058 Private Internet Hosting LTD Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-05-11 14:09 Times Seen4654917 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js	ScriptElement	87 kB	2023-03-07	2025-05-11
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 13:23 Times Seen112282 Hash e071abda8fe61194711cfc2ab99fe104 f647a6d37dc4ca055ced3cf64bbc1f490070acba 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Loading...

	s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js	ScriptElement	176 kB	2023-03-07	2025-05-10
Pretty URL s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js IP 52.92.197.80 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07 Last Seen2025-05-10 17:58 Times Seen299 Hash f0b02d9f2d3c6679556e63935ac23320 384bb74cdb2840da6eaa9400242faf4a2fac3daa f708ad894d421f32ed297a914632db6bc1577841d1c210b34f1a0821ea0aaa4b Loading...

HTTP Transactions (5)

URL IP Response Size

greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/

178.159.36.195

200 OK

2.9 kB

URL User Request GET HTTP/1.1
greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
IP
178.159.36.195:443
ASN
#213058 Private Internet Hosting LTD

Certificate
IssuerLet's Encrypt
Subjectcpcontacts.greenlovedeliveries.com
FingerprintCA:BA:3E:2C:9C:0E:6B:70:E5:C1:82:B0:46:93:F9:C8:6B:CB:9B:84
ValidityMon, 06 Nov 2023 07:47:15 GMT - Sun, 04 Feb 2024 07:47:14 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (307), with CRLF line terminators
Size
2.9 kB (2893 bytes)
Hash
6aeb5d9841c9cf67f799a4241c24a2ef
3ed3b212d7aeb162f1906a367cfee305fc22df39
5cb87bc2a6808c85ad3371a9402eb512744ec2d6146f852c7fa4d62a540d06c4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /firstfinancial/otp2.php/wellsfargo.com/ HTTP/1.1
Host: greenlovedeliveries.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 11 Nov 2023 11:24:38 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

104.17.24.14

200 OK

27 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (32030)
Size
27 kB (27192 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://greenlovedeliveries.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 11 Nov 2023 11:24:39 GMT
content-type: application/javascript; charset=utf-8
content-length: 27192
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-152b5"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1231433
expires: Thu, 31 Oct 2024 11:24:39 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6HnIZhWyvfqu8yEJ7KBfq7OSnEBd%2Fyptte82wfxzUPnoeU9k7UYaEe0stpxd42ExndiHTbq4bElJJlr1pHmwQ%2FV3P7k%2Fe9OxAlpRis1bqrkie42vgPjERdrC6VIN8KCPtmTqecQa"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82462b883f1a7131-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/img/logo.png

178.159.36.195

200 OK

2.9 kB

URL GET HTTP/1.1
greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/img/logo.png
IP
178.159.36.195:443
ASN
#213058 Private Internet Hosting LTD

Requested by
https://greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
Certificate
IssuerLet's Encrypt
Subjectcpcontacts.greenlovedeliveries.com
FingerprintCA:BA:3E:2C:9C:0E:6B:70:E5:C1:82:B0:46:93:F9:C8:6B:CB:9B:84
ValidityMon, 06 Nov 2023 07:47:15 GMT - Sun, 04 Feb 2024 07:47:14 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (307), with CRLF line terminators
Size
2.9 kB (2893 bytes)
Hash
6aeb5d9841c9cf67f799a4241c24a2ef
3ed3b212d7aeb162f1906a367cfee305fc22df39
5cb87bc2a6808c85ad3371a9402eb512744ec2d6146f852c7fa4d62a540d06c4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /firstfinancial/otp2.php/wellsfargo.com/img/logo.png HTTP/1.1
Host: greenlovedeliveries.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 11 Nov 2023 11:24:39 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

greenlovedeliveries.com/favicon.ico

178.159.36.195

404 Not Found

315 B

URL GET HTTP/1.1
greenlovedeliveries.com/favicon.ico
IP
178.159.36.195:443
ASN
#213058 Private Internet Hosting LTD

Requested by
https://greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
Certificate
IssuerLet's Encrypt
Subjectcpcontacts.greenlovedeliveries.com
FingerprintCA:BA:3E:2C:9C:0E:6B:70:E5:C1:82:B0:46:93:F9:C8:6B:CB:9B:84
ValidityMon, 06 Nov 2023 07:47:15 GMT - Sun, 04 Feb 2024 07:47:14 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: greenlovedeliveries.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Sat, 11 Nov 2023 11:24:40 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js

52.92.197.80

200 OK

176 kB

URL GET HTTP/1.1
s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js
IP
52.92.197.80:443
ASN
#16509 AMAZON-02

Requested by
https://greenlovedeliveries.com/firstfinancial/otp2.php/wellsfargo.com/
Certificate
IssuerAmazon
Subject*.s3-us-west-2.amazonaws.com
Fingerprint29:D7:48:C0:C9:57:6E:93:C1:56:5D:91:7F:98:4A:4F:63:B5:CA:1D
ValidityTue, 10 Oct 2023 00:00:00 GMT - Sat, 03 Aug 2024 23:59:59 GMT

File type
ASCII text, with very long lines (544)
Size
176 kB (176433 bytes)
Hash
f0b02d9f2d3c6679556e63935ac23320
384bb74cdb2840da6eaa9400242faf4a2fac3daa
f708ad894d421f32ed297a914632db6bc1577841d1c210b34f1a0821ea0aaa4b

HTTP Headers

GET /s.cdpn.io/3/jquery.inputmask.bundle.js HTTP/1.1
Host: s3-us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://greenlovedeliveries.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: pXVroY6jDKzZcofCupl9l1m3Krr5Gg8QfF4JOeEtOU2bWYVjJBuHiE6hE5K9gTsq4kzSf0nWF3o=
x-amz-request-id: WSRCNJ5VPW1GCQ1K
Date: Sat, 11 Nov 2023 11:24:40 GMT
Last-Modified: Wed, 30 Nov 2016 13:28:36 GMT
ETag: "f0b02d9f2d3c6679556e63935ac23320"
Cache-Control: public
Expires: Mon, 30 Nov 2026 13:28:34 GMT
x-amz-version-id: null
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Content-Length: 176433

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size