Report - pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net

Report Overview

Submitted URL
pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
IP
104.18.2.35
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-25 08:30:33
Access
public
Website Title
pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Final URL
pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Tags
suspicious
urlquery detections
Suspicious - Anti-debugging code

Detections

urlquery
3
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev	unknown	unknown	No data	No data	1.1 kB	246 kB	104.18.2.35
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-25	950 B	105 kB	142.250.74.106
encrypted-tbn0.gstatic.com	unknown	2008-02-11	2013-05-31	2024-04-24	1.0 kB	15 kB	142.250.74.142
kit.fontawesome.com	1868	2012-10-18	2019-12-16	2024-04-24	495 B	12 kB	172.64.147.188
ka-f.fontawesome.com	3598	2012-10-18	2019-12-17	2024-04-24	1.7 kB	168 kB	172.67.139.119

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev	Sinkholed
2024-04-25	medium	pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	kit.fontawesome.com/585b051251.js	12 kB	2023-11-29	2024-05-04
Pretty URL kit.fontawesome.com/585b051251.js IP 172.64.147.188 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-29 01:32:53 Last Seen2024-05-04 20:22:07 Times Seen8698 Hash 55d343a40c7166a79fd314f13cbb2e93 96904a849c32ca220e0aaa2ae3e81cf2b5cdf764 a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a Loading...

	pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net	456 B	2023-09-03	2024-04-25
Pretty URL pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net IP 104.18.2.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-03 08:41:14 Last Seen2024-04-25 23:58:54 Times Seen13 Hash cea427bd9dfd29ad285959a6eb573a95 1770f0ee5f1aa0ba56784de8d25f4598e77f1e9c ad2d2818fe7e9c020a1b5dfbc337ffed576345f6022b72986bd33030824cc25a Loading...

	pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net	382 B	2024-04-25	2024-04-25
Pretty URL pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net IP 104.18.2.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-25 10:30:39 Last Seen2024-04-25 23:58:54 Times Seen2 Hash 937b8795a2469613bb89f0e951d45bbb 0437309e13412ea495a027cc50c6c5182c417bdb a656191c451edd23dd3816a527e3a94287246026fb0fbddac732f8dc29cf4eaa Loading...

	pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net	138 B	2024-04-25	2024-04-25
Pretty URL pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net IP 104.18.2.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-25 10:30:39 Last Seen2024-04-25 23:58:54 Times Seen2 Hash 7fb4cb7080b857e9deca0c0c5f6046a0 818a372ef910f208034a2914e18b34eb934fb094 a016f53dffc120ccc3135e643501d1e55af79a18a3130def2ed3682c26125ad3 Loading...

HTTP Transactions (10)

URL IP Response Size

pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net

104.18.2.35

200 OK

218 kB

URL User Request GET HTTP/1.1
pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
IP
104.18.2.35:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, ASCII text, with very long lines (38267), with CRLF line terminators
Size
218 kB (217814 bytes)
Hash
34caf691d75ee0c4872eeda3d2ee681b
7a640597431af90a38970b7a1a30d8001295cf27
7ab2441b9f484d90e9e5fdb9be38c2fb990cbb582817a13d92fc72a5a6298301

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Anti-debugging code
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net HTTP/1.1
Host: pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 08:30:09 GMT
Content-Type: text/html
Content-Length: 217814
Connection: keep-alive
Accept-Ranges: bytes
ETag: "34caf691d75ee0c4872eeda3d2ee681b"
Last-Modified: Tue, 23 Apr 2024 12:13:31 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 879cf823a9a1b509-OSL

fonts.googleapis.com/css?family=Archivo+Narrow&display=swap

142.250.74.106

200 OK

92 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
gzip compressed data, max compression
Size
92 kB (91527 bytes)
Hash
f81e11ab55c6a4aab60cf8f3121143b8
4d890c4131e4745b1c22b86f850f7e8e15cc16b3
1584288b8d60ad9990e96f1bfb3711eb5e0890513c467847d6e8b519537802ea

HTTP Headers

GET /css?family=Archivo+Narrow&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 25 Apr 2024 08:30:10 GMT
date: Thu, 25 Apr 2024 08:30:10 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ0Ic36DMjM-hj8Kj7skh11nPiz4G8ruqNFfg&usqp=CAU

142.250.74.142

200 OK

7.9 kB

URL GET HTTP/2
encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ0Ic36DMjM-hj8Kj7skh11nPiz4G8ruqNFfg&usqp=CAU
IP
142.250.74.142:443
ASN
#15169 GOOGLE

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
PNG image data, 259 x 194, 8-bit colormap, non-interlaced
Size
7.9 kB (7944 bytes)
Hash
456c75188eac8be4fb026e7d070ad2f2
4b5dbe2a43cc0a9ec4a07e0bad3c337ba49e7eac
f172cd1acb6022b518801ff76a14ee58ceb90f4295fd83b9b445b5653653569c

HTTP Headers

GET /images?q=tbn:ANd9GcQ0Ic36DMjM-hj8Kj7skh11nPiz4G8ruqNFfg&usqp=CAU HTTP/1.1
Host: encrypted-tbn0.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-length: 7944
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 08:30:11 GMT
expires: Fri, 25 Apr 2025 08:30:11 GMT
cache-control: public, max-age=31536000
last-modified: Sat, 15 Feb 2020 18:50:09 GMT
content-type: image/png
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRVWa0KS-gYJCvaW5Lgx15zYZiDHdxDBoTNWH_BeMnU5c46nWDW4x6-fQvgjw&s

142.250.74.142

200 OK

5.7 kB

URL GET HTTP/2
encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRVWa0KS-gYJCvaW5Lgx15zYZiDHdxDBoTNWH_BeMnU5c46nWDW4x6-fQvgjw&s
IP
142.250.74.142:443
ASN
#15169 GOOGLE

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 204x192, components 3
Size
5.7 kB (5655 bytes)
Hash
3f1a30bc572a123cf57e301d782f238f
c25f2d51cb0bfb7c7e7947b2590599581cd5e34e
cc7694bd168ad8b32ddf9eacae3ed9d513959c3fcf8d21fe178e5af524a17575

HTTP Headers

GET /images?q=tbn:ANd9GcRVWa0KS-gYJCvaW5Lgx15zYZiDHdxDBoTNWH_BeMnU5c46nWDW4x6-fQvgjw&s HTTP/1.1
Host: encrypted-tbn0.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-length: 5655
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 08:30:11 GMT
expires: Fri, 25 Apr 2025 08:30:11 GMT
cache-control: public, max-age=31536000
last-modified: Sun, 14 Jan 2024 20:57:09 GMT
content-type: image/jpeg
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/favicon.ico

104.18.2.35

404 Not Found

27 kB

URL GET HTTP/1.1
pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/favicon.ico
IP
104.18.2.35:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, ASCII text, with very long lines (611)
Size
27 kB (27242 bytes)
Hash
df3d48946e8d3f5a83608308edbb4b86
47b9c40c97abf2658df96b1c06109324e15e1a00
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 08:30:11 GMT
Content-Type: text/html
Content-Length: 27242
Connection: keep-alive
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 879cf837cc63b509-OSL

fonts.googleapis.com/css?family=Archivo+Narrow&display=swap

142.250.74.106

200 OK

13 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
gzip compressed data, max compression
Size
13 kB (12631 bytes)
Hash
6076f5bd7db985a46f3d372f78ad16b5
de4ce97a8ba3d637161133abd867e2470a6829c2
e7286767292c826c6af59e8f18ab73bc8e21fd465efa5f8da3c11abccc753c35

HTTP Headers

GET /css?family=Archivo+Narrow&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 25 Apr 2024 08:30:10 GMT
date: Thu, 25 Apr 2024 08:30:10 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

kit.fontawesome.com/585b051251.js

172.64.147.188

200 OK

12 kB

URL GET HTTP/2
kit.fontawesome.com/585b051251.js
IP
172.64.147.188:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerDigiCert Inc
Subject*.fontawesome.com
Fingerprint93:F9:69:8C:73:B0:08:60:65:F3:39:41:39:66:D3:2B:78:3A:6E:3D
ValidityMon, 04 Dec 2023 00:00:00 GMT - Fri, 03 Jan 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (11461)
Size
12 kB (11893 bytes)
Hash
55d343a40c7166a79fd314f13cbb2e93
96904a849c32ca220e0aaa2ae3e81cf2b5cdf764
a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a

HTTP Headers

GET /585b051251.js HTTP/1.1
Host: kit.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 08:30:11 GMT
content-type: text/javascript
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, stale-while-revalidate=30
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
x-request-id: F8jwilf61zaxu1oifv0C
cf-cache-status: REVALIDATED
server: cloudflare
cf-ray: 879cf835dcf556a9-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251

172.67.139.119

200 OK

27 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
IP
172.67.139.119:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
ASCII text, with very long lines (26500)
Size
27 kB (26682 bytes)
Hash
76f34b71fc9fb641507ff6a822cc07f5
73ed2f8f21cd40fb496e61306acbb5849d4dbff4
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

HTTP Headers

GET /releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Origin: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 08:30:11 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"76f34b71fc9fb641507ff6a822cc07f5"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 475d4ecb64796af058573c6f1048e898.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: SYGQgDET01Gr-EcJIAOKVa8G-YX5PIa70pHFsrzW43qx6o2awDDH3Q==
age: 64492
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o2zu1wothwu4AVBARKFXwIK8uk3yoANpRew40Mvsfmmj74jG3a4jTIasRXnk5mOLTvcQNeuYnwGf1%2BN2kNYTwmykYYwoSOt5WYLh6aK%2BkJgmCoyypAVPnTt0wKMC3ZGQzI%2FRV1w1lQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879cf8373aeb568e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251

172.67.139.119

200 OK

60 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
IP
172.67.139.119:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
ASCII text, with very long lines (60130)
Size
60 kB (60312 bytes)
Hash
a12ec7ebe75a4d59a5dd6b79e2ba2e16
28f5dcc595ee6d4163481ef64170180502c8629b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

HTTP Headers

GET /releases/v5.15.4/css/free.min.css?token=585b051251 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Origin: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 08:30:11 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 b9f0050ca4d212d7c855e005be54b1ac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: PzbnBluKMTeVqW5NCXWwQSj2PpU0zgWzwz9-UlsDVsNdZSi49Fm8eg==
age: 64492
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KYIn2vQzAVbBjkCmNyTqa%2BFoMAS74maJ9A7J7g2JetY3skdbTcDZ1aK1gng3fLSdfw70H9Im5TupAylBqldNNXK23z89C2aqLbIEBClJR0826jnERFB9IQxKXBTFNRLNXXapkXtJCw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879cf8373aea568e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2

172.67.139.119

200 OK

78 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
IP
172.67.139.119:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/2_5474357000.html?domain=mail.nm.medience.co.jp&user=emplus&email=emplus@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196
Size
78 kB (78168 bytes)
Hash
a9fd1225fb2cd32320e2b931dca01089
44ec5c6a868b4ce62350d9f040ed8e18f7a1d128
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7

HTTP Headers

GET /releases/v5.15.4/webfonts/free-fa-solid-900.woff2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-e5c2c5311c064a7bb152dc2d6b4b0d49.r2.dev/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 08:30:11 GMT
content-type: font/woff2
content-length: 78168
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:58:24 GMT
etag: "a9fd1225fb2cd32320e2b931dca01089"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
x-cache: Hit from cloudfront
via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: kyk2-S5D3zPt5Zsb1gxr9VgbipWuOcMp4RLWCoezERjsiYpIwHzJPA==
age: 64491
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dtmSCSjkQ5%2FZ3nGVnSPF4v8%2F6giUypEvYbycn8K8c2Ts7A3EArSKxbQ8WFE3nlVkGT9aQ0FRSupwbELt4pux05zqDrzgRUVTTCXoueYiFqWVv%2BSz%2BRTqDHawW2NQcn398wNGlmGezA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879cf8378b84568e-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (10)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size