billing-config.nitrologistics.co Open in urlscan Pro
165.232.136.226 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://billing-config.nitrologistics.co/
Submission Tags: phishingrod
Submission: On October 25 via api (October 25th 2023, 10:57:53 am UTC) from DE — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 165.232.136.226, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is billing-config.nitrologistics.co.
TLS certificate: Issued by R3 on October 25th 2023. Valid for: 3 months.

This is the only time billing-config.nitrologistics.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	165.232.136.226 165.232.136.226	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
10	13.32.121.38 13.32.121.38	16509 (AMAZON-02) (AMAZON-02)
2	99.83.175.58 99.83.175.58	16509 (AMAZON-02) (AMAZON-02)
14	4

1 165.232.136.226 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

billing-config.nitrologistics.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 13.32.121.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-38.fra60.r.cloudfront.net

cdn.plaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.175.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: a00c498d38b9d4d60.awsglobalaccelerator.com

f.plaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	plaid.com cdn.plaid.com — Cisco Umbrella Rank: 29632 f.plaid.com — Cisco Umbrella Rank: 86469	698 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 720	31 KB
1	nitrologistics.co billing-config.nitrologistics.co	1 KB
14	3

	Domain	Requested by
10	cdn.plaid.com	billing-config.nitrologistics.co cdn.plaid.com
2	f.plaid.com	cdn.plaid.com
1	ajax.googleapis.com	billing-config.nitrologistics.co
1	billing-config.nitrologistics.co
14	4

This site contains no links.

Subject Issuer	Validity	Valid
billing-config.nitrologistics.co R3	`2023-10-25` - `2024-01-23`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
secure.plaid.com DigiCert EV RSA CA G2	`2023-03-09` - `2024-04-08`	a year	crt.sh
f.plaid.com Amazon RSA 2048 M01	`2023-02-08` - `2024-03-09`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://billing-config.nitrologistics.co/
Frame ID: FAB341BA2FE256CE2E604C1D1190FEFF
Requests: 3 HTTP requests in this frame

Frame: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Frame ID: 0ABC5FAD8B3F463581831A221607F439
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

730 kB
Transfer

2263 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
billing-config.nitrologistics.co/ 3 KB
1 KB 868ms
502ms Document
text/html 165.232.136.226
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-config.nitrologistics.co/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 165.232.136.226 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: b744987713e3bdf0fed37e00b51fc5fb715b7c86456723d22a4eb4c513a01293

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 25 Oct 2023 10:57:48 GMT
ETag: W/"b57-1jKxOHSf7rVUagSezCiR9KoEaWk"
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked
X-Powered-By: Express

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 37ms
7ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: billing-config.nitrologistics.co
URL: https://billing-config.nitrologistics.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://billing-config.nitrologistics.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 10:19:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175077
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 22 Oct 2024 10:19:51 GMT

GET
H2 200 link-initialize.js Show response
cdn.plaid.com/link/v2/stable/ 143 KB
43 KB 67ms
32ms Script
application/javascript 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/v2/stable/link-initialize.js
Requested by: Host: billing-config.nitrologistics.co
URL: https://billing-config.nitrologistics.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a0e22d29ee4d80856e3cd0976d0fc0f3dbad67842edfc72c1d65a6685f523494

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://billing-config.nitrologistics.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:45:20 GMT
x-amz-version-id: qaY.hcp8PeJJl69g41lNr_.wlllpw9Ia
content-encoding: gzip
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-request-id: 3K8QMGE1XB8W5JV3
x-amz-cf-pop: FRA60-P1
x-amz-server-side-encryption: AES256
age: 47549
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-amz-id-2: qBDFOPr2YRzsCLaTIDh7sEb0qiGwcHV7s3XnYe+R7HdMoJbLDpTEWHL8Rcg3r6eFPbO0QurlK4UCh7OSU2j9zA==
last-modified: Tue, 24 Oct 2023 21:33:02 GMT
server: AmazonS3
etag: W/"654734d64ed45b8737793fa35a65b626"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache,must-revalidate,max-age=0
x-amz-cf-id: irGZcpzSBIBgAZh-qvLslegX5Embcd1-gDb0bH3GPnj5N1zIWQ06kA==

GET
H2 200 link.html Show response
cdn.plaid.com/link/v2/stable/ Frame 0ABC 4 KB
2 KB 423ms
422ms Document
text/html 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link-initialize.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7bde329ee8fe92e6e225047a2e48f58236b664ca2367d0dfd0760c1a1a51d114

Request headers

Referer: https://billing-config.nitrologistics.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 47383
cache-control: no-cache,must-revalidate,max-age=0
content-encoding: gzip
content-type: text/html
date: Tue, 24 Oct 2023 21:48:07 GMT
etag: W/"7e55148f43950b82be631e46a8fae4f9"
last-modified: Tue, 24 Oct 2023 21:33:02 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-id: 7haTUGz6b7E4qJ7F2oGQO74OC0BbTO17tfFXUOSmCibjNvAa66x1_w==
x-amz-cf-pop: FRA60-P1
x-amz-id-2: eAzPN+RieHN8hxm3fFVJce+KCHUEmFZq1fcwvDO9+HcuU4qFd97gA9EYca1v26Zn+KRhiLUh7p8=
x-amz-replication-status: COMPLETED
x-amz-request-id: JQ61Y921KFT9MF2A
x-amz-server-side-encryption: AES256
x-amz-version-id: jS5KlG9v73hDDqf3EQfp9J75ZJLG0x4N
x-cache: Hit from cloudfront

GET
H2 200 cern-regular.woff2
cdn.plaid.com/link/2.0.1688/assets/fonts/ Frame 0ABC 17 KB
18 KB 11ms
10ms Font
binary/octet-stream 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/assets/fonts/cern-regular.woff2
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7591acf55dd6a1a5dd5e3a6855eb5771f9dc4ed67f5f176f471410ee1aebfd4a

Request headers

Referer
Origin: https://cdn.plaid.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: Z.ef4nXTqpTDua4M85fT70HxN4zaAbB7
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17700
last-modified: Tue, 24 Oct 2023 21:32:57 GMT
server: AmazonS3
etag: "273b6676336d321f31be867ea84c8355"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=10800
accept-ranges: bytes
x-amz-cf-id: dP8hJJI3X1Ilq1TiLBFzNjUyZItKKGqN4hyMeBUgy8KW4DpFl4pC0Q==

GET
H2 200 cern-medium.woff2
cdn.plaid.com/link/2.0.1688/assets/fonts/ Frame 0ABC 17 KB
17 KB 12ms
11ms Font
binary/octet-stream 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/assets/fonts/cern-medium.woff2
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2fddec74a4e435cc802dafd517492cdf11bc75cee5cc5cd6111b20d6b0148c16

Request headers

Referer
Origin: https://cdn.plaid.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: 0bWdzXkKbO2Mon2t9jEAzSPYyfoSrf0E
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 16916
last-modified: Tue, 24 Oct 2023 21:32:57 GMT
server: AmazonS3
etag: "939cf5e9e5beaad5a090dc90f236bb23"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=10800
accept-ranges: bytes
x-amz-cf-id: JQX4doaxa_5FYjqJSa9l1v4aA4KHE0bqf2vmvGY9UWVCzgrisYgHsA==

GET
H2 200 cern-bold.woff2
cdn.plaid.com/link/2.0.1688/assets/fonts/ Frame 0ABC 17 KB
17 KB 17ms
16ms Font
binary/octet-stream 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/assets/fonts/cern-bold.woff2
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 23b6f848a307d3bb176323c63fcfb6d6c05605c167d7c520839a442d001d9917

Request headers

Referer
Origin: https://cdn.plaid.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: xKzwk.OmK6C6hwjf0sG6NHnM2KaAlLsH
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 16960
last-modified: Tue, 24 Oct 2023 21:32:56 GMT
server: AmazonS3
etag: "efe98d3eaea79d39d52bfa0889ae6208"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=10800
accept-ranges: bytes
x-amz-cf-id: 4sQKjXeKq0MY2NFxpccv1Ztd9v4MrlyhyN1gIK1Luy91KhherP1I1w==

GET
H2 200 cern-semibold.woff2
cdn.plaid.com/link/2.0.1688/assets/fonts/ Frame 0ABC 17 KB
17 KB 12ms
11ms Font
binary/octet-stream 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/assets/fonts/cern-semibold.woff2
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9ed6303dd1906e0b4fefa02991f13267307ddcb06b364dba845cf52c2dce92bc

Request headers

Referer
Origin: https://cdn.plaid.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: iOPz0il7o6fyWTfOu3Zoa_xCZTKkE9BW
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17136
last-modified: Tue, 24 Oct 2023 21:32:57 GMT
server: AmazonS3
etag: "c2128bd59d8274e818fc1e75c279d520"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=10800
accept-ranges: bytes
x-amz-cf-id: nd-23nw5St17iUAsCXS-BPyqTynYi4EDJSvHAf372R45OHOYT6sOjw==

GET
H2 200 cern-extrabold.woff2
cdn.plaid.com/link/2.0.1688/assets/fonts/ Frame 0ABC 17 KB
17 KB 21ms
20ms Font
binary/octet-stream 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/assets/fonts/cern-extrabold.woff2
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89e2e0b3011aae11493a3949307691f0edbb49e1f61947d11c1b43c219d25cdd

Request headers

Referer
Origin: https://cdn.plaid.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: 2r0hLwCZ67W_CuUAqD.43p4ltdxStE97
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 16980
last-modified: Tue, 24 Oct 2023 21:32:57 GMT
server: AmazonS3
etag: "51979bdebc8812520774c8afacd1e34e"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=10800
accept-ranges: bytes
x-amz-cf-id: 3zHGXLramk5FFvMUz5cmWCp_V7GfYTGCWgCdjK2AwUV2AmeK2_UJxQ==

GET
H2 200 flink.css
cdn.plaid.com/link/2.0.1688/ Frame 0ABC 121 KB
17 KB 11ms
10ms Stylesheet
text/css 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/flink.css
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e94b0091503fb5e936004b4aa5db5bafbe423af1af246d7b8ffd5459c9d958ea

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: l9mqo_PFmbwU44HfP4WCyYJxRKVFleh1
content-encoding: gzip
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 24 Oct 2023 21:32:57 GMT
server: AmazonS3
etag: W/"b582e3960e961209a96cb06f17a0de4c"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=10800
x-amz-cf-id: Y3JE8H-3x0pmTVjYIr1Ow7FP41PNGS0-Z80QjCO46OiYmS3YswV65Q==

GET
H2 200 vendors~flink.js Show response
cdn.plaid.com/link/2.0.1688/ Frame 0ABC 866 KB
262 KB 16ms
16ms Script
application/javascript 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/vendors~flink.js
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a0fe355b90c5b33f80faec7477ed31dfb8af3e8aa5d8dce6dac707e77ddd348

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: pc8SA1I0pqwRhYRjeK.gbYFnAnGhpSOD
content-encoding: gzip
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 24 Oct 2023 21:33:04 GMT
server: AmazonS3
etag: W/"9197b1f50abe47b9a26fe5227775fdc8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=10800
x-amz-cf-id: LoFcmcIswqE3mRo8rUGZftcCzXNasWNg2dgbMA0WTrGf8pmHHK-K4w==

GET
H2 200 flink.js Show response
cdn.plaid.com/link/2.0.1688/ Frame 0ABC 956 KB
286 KB 20ms
19ms Script
application/javascript 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/2.0.1688/flink.js
Requested by: Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/v2/stable/link.html?isLinkInitialize=true&token=link-production-a368e108-f05d-4fd3-92fc-061bb9f97a90&origin=https%3A%2F%2Fbilling-config.nitrologistics.co&uniqueId=1&version=2.0.1688
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 85f965afbddd5b22784cace271520fc9d69a501c9d10e078785e339525060c18

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 21:48:08 GMT
x-amz-version-id: gAAqozm0KzRt1iAW3KRMe9eldejsTTn3
content-encoding: gzip
via: 1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
age: 47382
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 24 Oct 2023 21:32:57 GMT
server: AmazonS3
etag: W/"87bf9c8a311d5e54c99aef83588b2cf6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=10800
x-amz-cf-id: 89kziiCAV1594T-prY6fWi2gAsmG44BJEnXaoPdbgRYpG72rb_jwdA==

GET
H2 200 N7Sq Show response
f.plaid.com/P_NS/Y9N0JYl/ Frame 0ABC 96 B
464 B 301ms
100ms XHR
text/plain 99.83.175.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.plaid.com/P_NS/Y9N0JYl/N7Sq

Requested by

Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/2.0.1688/vendors~flink.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.83.175.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a00c498d38b9d4d60.awsglobalaccelerator.com

Software

nginx/1.22.1 /

Resource Hash

bfaa457cfa1eda9605b4b19aa53ad2923f1809aa44b44ba60ebdc6d6f5bb9e6a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 10:57:49 GMT
content-security-policy: default-src 'none'; frame-ancestors 'none'
referrer-policy: no-referrer
strict-transport-security: max-age=63072000
server: nginx/1.22.1
x-content-type-options: nosniff
x-frame-options: DENY
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Retry-After
cache-control: max-age=31536000, immutable, private
timing-allow-origin: *
x-robots-tag: noindex
content-length: 96

POST
H2 200 / Show response
f.plaid.com/ Frame 0ABC 417 B
929 B 387ms
192ms XHR
text/plain 99.83.175.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://f.plaid.com/?ci=js/3.8.23

Requested by

Host: cdn.plaid.com
URL: https://cdn.plaid.com/link/2.0.1688/vendors~flink.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.83.175.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a00c498d38b9d4d60.awsglobalaccelerator.com

Software

nginx/1.22.1 /

Resource Hash

a7341717fbecdb108cc672a537c1ec8a36c6d3fa96acbf0a9a75543411681f35

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Oct 2023 10:57:50 GMT
content-security-policy: default-src 'none'; frame-ancestors 'none'
referrer-policy: no-referrer
strict-transport-security: max-age=63072000
server: nginx/1.22.1
x-content-type-options: nosniff
vary: Origin
x-frame-options: DENY
content-type: text/plain
access-control-allow-origin: https://cdn.plaid.com
access-control-expose-headers: Retry-After
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 417

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.plaid.com/	1970-01-21 00:29:27	Name: _iidt Value: yVgR4Wyq/jM8BiE7OvD0xBhA+tT7PBZmwLJ/hYlKzBB1OYEfylKIj0t6hAXDFKBUzZeAGLGbShpsXw==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
billing-config.nitrologistics.co
cdn.plaid.com
f.plaid.com
13.32.121.38
165.232.136.226
2a00:1450:4001:82b::200a
99.83.175.58
23b6f848a307d3bb176323c63fcfb6d6c05605c167d7c520839a442d001d9917
2fddec74a4e435cc802dafd517492cdf11bc75cee5cc5cd6111b20d6b0148c16
5a0fe355b90c5b33f80faec7477ed31dfb8af3e8aa5d8dce6dac707e77ddd348
7591acf55dd6a1a5dd5e3a6855eb5771f9dc4ed67f5f176f471410ee1aebfd4a
7bde329ee8fe92e6e225047a2e48f58236b664ca2367d0dfd0760c1a1a51d114
85f965afbddd5b22784cace271520fc9d69a501c9d10e078785e339525060c18
89e2e0b3011aae11493a3949307691f0edbb49e1f61947d11c1b43c219d25cdd
9ed6303dd1906e0b4fefa02991f13267307ddcb06b364dba845cf52c2dce92bc
a0e22d29ee4d80856e3cd0976d0fc0f3dbad67842edfc72c1d65a6685f523494
a7341717fbecdb108cc672a537c1ec8a36c6d3fa96acbf0a9a75543411681f35
b744987713e3bdf0fed37e00b51fc5fb715b7c86456723d22a4eb4c513a01293
bfaa457cfa1eda9605b4b19aa53ad2923f1809aa44b44ba60ebdc6d6f5bb9e6a
e94b0091503fb5e936004b4aa5db5bafbe423af1af246d7b8ffd5459c9d958ea
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

billing-config.nitrologistics.co Open in urlscan Pro 165.232.136.226 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

25 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

730 kBTransfer

2263 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

1 Cookies

Indicators

billing-config.nitrologistics.co Open in urlscan Pro
165.232.136.226 Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

730 kB
Transfer

2263 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions