feeloffernow.com/387/btkmue2/mail/?aid=9907&ac=mailing-wu-id104775&cid=karta-03-FW//feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail/
104.21.46.201302 Found 0 B URL User Request GET HTTP/2 feeloffernow.com/387/btkmue2/mail/?aid=9907&ac=mailing-wu-id104775&cid=karta-03-FW//feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail/
IP 104.21.46.201:443
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/?aid=9907&ac=mailing-wu-id104775&cid=karta-03-FW//feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail/ HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 08 Dec 2023 02:00:05 GMT
content-type: text/html;charset=utf-8
content-length: 0
set-cookie: _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; expires=Fri, 08-Dec-2023 02:30:05 GMT; Max-Age=1800; path=/
SID=9von1fy42xcx49hg955nakmek4b6qbdu; expires=Sat, 09-Dec-2023 02:00:05 GMT; Max-Age=86400; path=/
UID=5032394685173360022; expires=Tue, 08-Dec-2043 02:00:05 GMT; Max-Age=631152000; path=/
PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; expires=Sat, 09-Dec-2023 02:00:05 GMT; Max-Age=86400; path=/387/btkmue2/mail/?aid=9907&ac=mailing-wu-id104775&cid=karta-03-FW//feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail; domain=.feeloffernow.com; secure
PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; expires=Sat, 09-Dec-2023 02:00:05 GMT; Max-Age=86400; path=/387/btkmue2/mail/?aid=9907&ac=mailing-wu-id104775&cid=karta-03-FW//feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail///feeloffernow.com/387/btkmue2/mail; domain=.feeloffernow.com
expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, no-transform, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
vary: Accept-Encoding
x-robots-tag: noindex,nofollow
location: //feeloffernow.com/387/btkmue2/mail/
p3p: CP="NON CURa PSA PSD OUR NAV STA"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gvN8jonReGjLFTIB7t3wsscY4Vlh43BAGihhw%2Bqs0JTU1QzKNeUW5vpmmBM%2BybIgvYMcleNtFJ%2Bzwr7pUCKFMpUvwsw0FKmH6k6AxWlfQ0iHwm5K1l56jDHDM%2B3mRecIFAcj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169acfec84c87-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
feeloffernow.com/387/btkmue2/mail/
104.21.46.201200 OK 28 kB URL User Request GET HTTP/2 feeloffernow.com/387/btkmue2/mail/
IP 104.21.46.201:443
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (953), with CRLF, LF line terminators
Hash 95e5b6b630820fdcf18fb489d4163301
ac9c8ea52c88a718d2a799a1eda32e7e1b38d823
cd72c79ca5b849a35d7dc02a3da0ab71a262aa7a797dcf391c230e98c68ec47a
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/ HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/html;charset=utf-8
content-length: 27680
expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, no-transform, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; expires=Sat, 09-Dec-2023 02:00:06 GMT; Max-Age=86400; path=/387/btkmue2/mail; domain=.feeloffernow.com
vary: Accept-Encoding
x-robots-tag: noindex,nofollow
content-encoding: gzip
p3p: CP="NON CURa PSA PSD OUR NAV STA"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3kGhJzVTqx3%2BgSRgpJSsrMZM30VM7u%2B79bkdT87b5NMS%2FYRAC5OzP5EisfKs41P%2FJVNJGCk2h91UkIxX5vAJlMbH3Eb%2BQIF%2Bx0TYCq4QGxZ7jMrt2mwLbifsD9XiYrP7o2Uk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169ada8074c87-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/slick.min.js
104.17.25.14200 OK 8.7 kB URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.5.9/slick.min.js
IP 104.17.25.14:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File type ASCII text, with very long lines (32012)
Hash d928bf2839f136b12210558c54bc1690
a9c81710a9b592cb99e8d6bf0d941572f2ff6713
4fc7a9c6dd1051ab261a550db0b16147da4236dedfb2efc6311ebff48a045350
GET /ajax/libs/slick-carousel/1.5.9/slick.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript; charset=utf-8
content-length: 8674
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fd5-9e0d"
last-modified: Mon, 04 May 2020 16:16:21 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 765045
expires: Wed, 27 Nov 2024 02:00:06 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sh7l8Z%2BElSwLxnRdDQlNHmxEPCT0CmcTxTKwEj%2FdS1UPJ9GvVbbQ2FabidE%2F0UlzZkGP712HFR57nvqKWsSDN1UFCIpuygR3kVC%2BtHqpMuSeWPM3d9eVak2QqFifJO2%2FsvrpFzEj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 832169b1588095f7-ARN
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
feeloffernow.com/387/btkmue2/mail/pixel_load?w=loaded&vid=rdc4pz1tcgeb4mm874s5ag6e6xkmkahe&chk=1&r=1702000806&uid=862075935308019877
104.21.46.201200 OK 42 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/pixel_load?w=loaded&vid=rdc4pz1tcgeb4mm874s5ag6e6xkmkahe&chk=1&r=1702000806&uid=862075935308019877
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /387/btkmue2/mail/pixel_load?w=loaded&vid=rdc4pz1tcgeb4mm874s5ag6e6xkmkahe&chk=1&r=1702000806&uid=862075935308019877 HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/gif
content-length: 42
set-cookie: UID=5032394685173360022; expires=Tue, 08-Dec-2043 02:00:06 GMT; Max-Age=631152000; path=/
PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; expires=Sat, 09-Dec-2023 02:00:06 GMT; Max-Age=86400; path=/387/btkmue2/mail; domain=.feeloffernow.com
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
p3p: CP="NON CURa PSA PSD OUR NAV STA"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hqIEatDMQ6Vgc0gS%2BbnK0nZ0LdeZEDoc2d6OZUlKHj8%2BjoN2rR3ar9Fd6hmjtzFRCisja2pLwLud2wZI28DdZ3hCuEeEmzgfULomZjB6WzFI9f0Ev3fKiGV0EWq2sFdLaKJO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ef94c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_middle.gif
104.21.46.201200 OK 104 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_middle.gif
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 217 x 1\012- data
Hash 77ce724db7f8560011c027baf9dd2ca0
ea99f1acb6def8fc0ff46ab13bf76c99495db74a
003a406bbd16a51f1de5a0149d42295508b25e4cbb1ca06b14a951033d56bd05
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_middle.gif HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/gif
content-length: 104
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
etag: "65113d00-68"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FbUDOPrZIRHUAvy4Jho9pnF011mLYJivu78PTPveF%2Bu7VNu4HFl1eUFfIZijguM%2Fc3mTWnJYj%2B9in1kZihRzci3e4%2FtG9Sqz%2F1IudcQZaRMu6O15rMJ9X%2FLYlOljqoxjokeX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 832169b35ad44c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_middle.gif
104.21.46.201200 OK 110 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_middle.gif
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 227 x 1\012- data
Hash 112cb5bb4a4c20c9af1ba96a30288c8b
c0c6aece0e201f7dc10ba389d561170351d721d2
88d155ed6f5764f815a48f3948f0d94c2c38d443e855f62b239e728b2f353a31
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_middle.gif HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/gif
content-length: 110
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
etag: "65113d00-6e"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ld8B6CIG3usQigsMzrPFunvm11wm%2BudJ1GcWL%2B5Dd%2FZnUZlQU0LjoiqtmEuqDVnLrMzuo0ZuVzUpj%2FBguYAY5BGBCeG6yndBCjVpwzBIEqMfa9aGlNs6dbb1Jexr4CaC%2Babl"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 832169b36aeb4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/order_style_edu.css
104.21.46.201200 OK 2.8 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/order_style_edu.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
Hash 85946d1256e3ee00496abd0200353ecf
41e5da58a968664b16de88c97692dd0521ced36e
b25a2c011c2eb5bcb9f14bf6e6b28ea9e5e77646de6d2cbc6229a84b304462f9
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/order_style_edu.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:55:39 GMT
vary: Accept-Encoding
etag: W/"65113cfb-98d"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uSRR2fPcuIGJMSsz7%2BW0Z25zJoYifBpj8aSTM3%2FJEkHc1Ds88lqC0RnYChWa7qQG4%2FjJnHdsAXir39BNTZyHYG13bdYkhxUAVUDgA7fc9G4kMd55HxDCMdns40ROBPBX3ZFj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b11e784c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml
35.244.181.201 444 B URL aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml
IP 35.244.181.201:0
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (332)
Hash 3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463
GET /update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-01-19-16-42-22.chain; p384ecdsa=IzZW4qKxvU9oMinJ95nTbkf7wtfoi8O1MDJbOMgBKflkiiRxGFh0Raer8MvR9J0jJcczQz4D6S2T0Uce_aw3gN9uRGU-cYrmxfxrC98ItoaNKANmAi20sxcvgwovVbUX
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Fri, 08 Dec 2023 02:00:18 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 7
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
2.18.121.73 512 kB URL ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
IP 2.18.121.73:0
File type Zip archive data, at least v2.0 to extract, compression method=deflate\012- data
Size 512 kB (511815 bytes)
Hash 152eda253e242e18443ef3282495bc7c
ff0fa85565f21ec4931baad4573b4c0bd08c4019
8e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48
GET /openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1
Host: ciscobinary.openh264.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Last-Modified: Thu, 16 Nov 2023 07:38:15 GMT
ETag: 152eda253e242e18443ef3282495bc7c
Content-Length: 511815
Accept-Ranges: bytes
X-Timestamp: 1700120294.87662
Content-Type: application/zip
X-Trans-Id: tx8c0ef9e37b1a4ab29193d-0065580fd1dfw1
Cache-Control: public, max-age=136088
Expires: Sat, 09 Dec 2023 15:48:33 GMT
Date: Fri, 08 Dec 2023 02:00:25 GMT
Connection: keep-alive
feeloffernow.com/387/btkmue2/mail/cc723deeecba32784a2a921f5c48437754/track.js
104.21.46.201200 OK 4.0 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/cc723deeecba32784a2a921f5c48437754/track.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (4207), with no line terminators
Hash 0e8552726271d93c65b2c13119d7d7b9
217f304d5bea522fc61611154bd64d085d5dc935
616c0ad31244d4467e9d70a1a8d501caa0be3a849eaedc4c6b948f613e3ab85e
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/cc723deeecba32784a2a921f5c48437754/track.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:54:21 GMT
vary: Accept-Encoding
etag: W/"65113cad-fd1"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5OEPg2RQWBTt8xCP5lDznn2YqtF8Mj7gzBvL6%2FRWXJk8gtyh4%2Bsz1OJdbznJovv3BDhTREk16t6Xvkdp3gcDIC1bW6PWPVEtRBJhMb4hUhW4TOpZy%2B30mPOby9VjvkYoKFoQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b12e994c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim5.jpg
104.21.46.201200 OK 15 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim5.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 245x184, components 3\012- data
Hash 3233b0cbd1c1de7cc6439b6c8eca57ee
eac7702d9a5b57c7f1c36bfc55fad6ab1e08755e
c601acbd3ab7a80b6e9300f936463df83954ec34865521fe7b2bb725c6b5f8a2
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim5.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-38e8"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fe2zfzkcDGXb2v79es84hToAAdXW1xiWW6bRkAQ%2BCu1HxwmP7ehVkEk88Ie0HOIGhroapiKcXBHu9Md5e%2B2AMELJAe9vmXkX%2BW%2FAFe2W3N49OzcHbXWn9tiCpAksZcJlpfIU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14edb4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/textSizeMod.js
104.21.46.201200 OK 561 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/textSizeMod.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (662), with no line terminators
Hash 54f2fd88d93c27f9baca8cab1b153089
03f718f24a221a54f42761af33debe26b42ffe62
714376ed1d42d71028c967fd81528e6b2241c92123a3944417486e2a4d56e160
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/textSizeMod.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-231"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k3EiP4fcbzMKO7NK9u0oOuEkFzYaEB2Z7Dh5O86fLiJnhhKb%2FXnRsK08g5mGdC5lAjm9mRWwoRu8KBAi2VnsZNWblqN3i7inC5wviR4ugws%2BPp8G1yGUW4gPp6XFseGzZe3m"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b289294c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/daebb52a70bac58c7d8594e575f56b115d/plugins/countdown/jquery.countdown-pl.js
104.21.46.201200 OK 908 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/daebb52a70bac58c7d8594e575f56b115d/plugins/countdown/jquery.countdown-pl.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type Unicode text, UTF-8 text, with very long lines (963), with no line terminators
Hash 138d1c98c8e4ba6c66ec93fb90cb1521
fe48fa91e87c08e5098476aa2c3c1bae41a938e5
5a8eb8be4dd9000e517faf228b53ae9cbd0e4644bbd667ef6f98101b93a9bceb
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/daebb52a70bac58c7d8594e575f56b115d/plugins/countdown/jquery.countdown-pl.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:55:40 GMT
vary: Accept-Encoding
etag: W/"65113cfc-38c"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I1p9Hb9tjh1DrScMmu%2FfyHxTD%2F36x3994MM2oGwyLg7Ru4tTZ4BDz4aOGNWCYl0C8PSllQgw7H%2ByQUAl2DK0TgtJDnToK7YJZ8wxEp7roquezVOQjLtx%2B0JDXLDKHQf6URcG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b12e8f4c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/author.jpg
104.21.46.201200 OK 8.2 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/author.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 193x193, components 3\012- data
Hash 9d097be2144f3d5e977fea79c8ed4255
e228966fb7d3ea46f2bc198400abc638622f7b73
bbe0331ace4eff705dc71b8a13e64b09cdc694f5c9ba5ab3e0893f99bfad3270
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/author.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:24 GMT
vary: Accept-Encoding
etag: W/"65113d28-1fde"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mCPv3qX8PJLiSk00HPJw%2FuOAsvK7yfoFj%2F6A8viikLDLm3GSYNgY2KIzJeHgqmZrH%2FGgM3diyKQdL4mwuvYKUyzzD0fkYo5%2FVixJ69O1IWgZAegokDrmXxeFCgYzuACEDXDY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b13eb34c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/chart2.jpg
104.21.46.201200 OK 26 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/chart2.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 653x330, components 3\012- data
Hash 86b56fd180f8a920ca76104678d76437
e27c86350bfd7344fd40665f01104733bb471b47
ceb07e89ceddc78993417d16231409fd634a7740a9755aba29700b31e6b849cf
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/chart2.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-63eb"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QO0JyInTQYsmyEWHz5BYqfCRO9ngC0q8YkGRB7Q4J10fnvm%2FdF8OwLA3SG4yYEr89%2Bff7dh4iTR2iHFlXzK6x4Tb5NQk1McxuIJxAPMo3DarIPa5Cq5if1qrmqZt7uUMHH1Q"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ef14c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/cc80b675a2bae5051167c1de7f4a71fb89/bootstrap/bootstrap.min.css
104.21.46.201200 OK 121 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/cc80b675a2bae5051167c1de7f4a71fb89/bootstrap/bootstrap.min.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (65371)
Size 121 kB (121260 bytes)
Hash 2f624089c65f12185e79925bc5a7fc42
8eb176c70b9cfa6871b76d6dc98fb526e7e9b3de
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/cc80b675a2bae5051167c1de7f4a71fb89/bootstrap/bootstrap.min.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:55:34 GMT
vary: Accept-Encoding
etag: W/"65113cf6-1d9ac"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tVRP%2FUB%2FM7pcNY94l%2FpnvdhuWzZOAOIB1eFTPoWEhjCYpjTYdHYMpKePCazX6tB4PV%2Fsvys%2F6CoE59wOCXEpwvSlp5KTji38On3xFEP%2BkPBRrbixyzF4evmdNgafgnByo35v"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b11e7c4c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim6.jpg
104.21.46.201200 OK 7.7 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim6.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 210x169, components 3\012- data
Hash 231561c5dd1b119660ba8d0e5110b412
2580a3f5ea8534b95a00f61585c85c5c549deefd
54d6981dbb4b26871b7a994b14590696eabae08df6ba1146eaab4c9e716df479
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim6.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-1e3e"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iVXh7X43pIxoNr9lK3rhgGtebP9v73IeKJTU8Pbxi3rh6ma9XKY2uTo%2FzFQUYlx%2FgMJHicZb7GsAXfb5tz1uN2IbGCZAhSi%2BO%2BWIiwkYV%2BJus1ZACzftfY1ueJDzSq15n9F8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14eee4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/index_form.css
104.21.46.201200 OK 287 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/index_form.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with no line terminators
Hash bbdb3b077807489a3df239f154582500
332d700e409fefdc9aca4277bdbadc33085e2897
80f592d24fbf78bee20188708137127365243019605498b476caf9b1f9a99c61
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/index_form.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:55:39 GMT
vary: Accept-Encoding
etag: W/"65113cfb-11f"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=biH8ulT1uVM0w0xMd%2BxsiETLjDo3rSbJhdfs6qZ%2BxbC%2FqqmawfFgZq4gvnLmt2IgJ5YWCZusKicfyMJKbXe0Y7gqqmShuN6yHy8qEEfIS54TZvkMxNgIV0qRlh%2Ft29meA4RT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ef54c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_bottom.gif
104.21.46.201200 OK 1.2 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_bottom.gif
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 217 x 55\012- data
Hash 9c2d1a35779e42735273a6ddbbf9a2a7
dd59ea3a4b9b7a1e643fa23cfd65469cee9ee0a4
82b6ab63725c9476f1cb5f636d63e1778605565db425b48fc5bb3284e6bd6d94
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_bottom.gif HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/gif
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
vary: Accept-Encoding
etag: W/"65113d00-49d"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8RSS%2BGEf97GeD%2Fhe6badk6h96IQo9CsadY65JdBdwLT0zTo7MYfklIjnZ4EYXQfqo2BkXN6roBx8qrppccOIj6Iiu5RxZ3065g%2Be3SLjZStO%2FziuydGjSVqy2qSHlYTOkB5z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b36adb4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/jquery.pnotify.default.css
104.21.46.201200 OK 2.1 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/jquery.pnotify.default.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (2149), with no line terminators
Hash e85709d6ca0d74e87e1961fc7e986d87
14789316235f29ea33aa47e905384aff95c12dad
d9ff8d4ddc0329667e37e010abd3d16b8dcc098fcc0bebb05f98665aa35ebe1e
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/jquery.pnotify.default.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-806"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FES%2F6aY73Bt694Ul9sC0EOWn9zcKSrQauirJL8uQtTD4Nt4%2F8gmTXaEsxko%2BABHPFeF86WZaadLstDEtbqfylGWTweNXxrbgFjpilPTavldLreKPCIfRw9wBOtYqnpu7TVpT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b12e964c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/order_styles.css
104.21.46.201200 OK 2.8 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/order_styles.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (2919), with no line terminators
Hash 4a3c478d0fba6baff6b3d9cbc0394675
c8dbe2fe251cf25564cc90a609111ed62423e8de
94980869b0042891a5b0cddb30184235d9854ef76ebebdde771747952c99ccaf
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/order_styles.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-ac9"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6g624bmf%2B0FXRHCLKYDSIE5ub5jXGivGpA485gAFWWdDXBCOTGwuqbfMecXPM5SHraT2sYW6FL9oh2u6hWFQu2Rdqymxx8kKThlt55Ao8pmCXWq6jSbYLNRxkWvyHJ1%2FJCGl"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ef44c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/index_form_rwd.css
104.21.46.201200 OK 463 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/index_form_rwd.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (487), with no line terminators
Hash 11afd8086a84ca7e3cc6d889d0f4c90f
61a357ea2413a11a9aabd34b1da425c78cb1a12e
a75ef9a4d92114d41f3d80a6a4679fae565029eeed8ed0a5ee09e40f0f7de7e2
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/037e359b6cbad4ea4f3ce8bba50d4dcefb/kr/form/index_form_rwd.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:55:40 GMT
vary: Accept-Encoding
etag: W/"65113cfc-1cf"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F376zUu0MF14QT7hbvOOn0NUMKP%2FJEvxQ4%2FFFsreapCxMLNLU3MphFu7RQAoG6%2Bbb9hlCrxex6zOzkWN6eswWk2WXdluD4kzxMD9TJPCECA4eU0qjNb5FtNsLHKXJachkKGA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ef74c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_bottom.gif
104.21.46.201200 OK 1.7 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_bottom.gif
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 227 x 42\012- data
Hash d37ac3f4f0411e982740570a48527094
ebc7a7ffa1f549f4c1dc161e7ae2bd347fcc17be
056217c76ecd5999bb65ab92acf764fb791b86a64d88e24cda08965a8e6c1d7a
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_bottom.gif HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/gif
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
vary: Accept-Encoding
etag: W/"65113d00-6cc"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lp850%2BEuquXNwbfyVbbMDJDZQpyMobuvq3KtN1yCatl00OVEgnDnL0oxMGntSB34mwn57u7CmvCNo%2FerPZZB%2F9o6RDDpCDar%2FLyuNbkRBWt4vfPI0BkVH5AtKpNWw9g8yZwF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b36aed4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/favicon.ico
104.21.46.201200 OK 318 B URL GET HTTP/3 feeloffernow.com/favicon.ico
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type MS Windows icon resource - 1 icon, 16x16, 16 colors, 4 bits/pixel\012- data
Hash 0eb6a3e58fb0f61f080bfd48d9be4a2d
669802179243bd9c47aae26d03090f5f8e40a015
3755ed10fae26af17e06f7ff740b9138c0f6b47b524d6bbbaae98f999433e1ea
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /favicon.ico HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:07 GMT
content-type: image/x-icon
p3p: CP="NON CURa PSA PSD OUR NAV STA"
cache-control: max-age=14400
cf-cache-status: HIT
age: 25
last-modified: Fri, 08 Dec 2023 01:59:42 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rih5d%2Bq1uz725r1%2ByXF0q9iR8%2BbSY64lgUlweFQwKL%2BZkKJHDGv5pB%2FT%2Fa2Xi0637Hf%2FPpJQkdDK%2BSx%2B47898Ej1tAeUjCuaXHZFy%2FjJq%2Brw7mxaAQLTfAL5g4bxYZ4hfWIo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 832169b3ebd04c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/slick.min.css
104.21.46.201200 OK 1.3 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/slick.min.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (1276), with no line terminators
Hash 4a70a937b2620f6bba8bf99b96c9e9f8
f149d68214aa07b466223ab03da18adbcbb14143
b9811f9f571e747d90c59b3dafcc49ef225807b15f2b06e1c92f14d02739653b
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/slick.min.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-4fc"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D8XcxVv66PbxCKkizAzgkPXBni2IrCVmxPhphjw7nKN0iMVrCnLQFnLjbwlo5j5SuJ9yJZh34UkY0ML9gGavTtF%2B37nd6Bt2k0YV9WmJxppgqrVvr0rsQkJJt1YYoZyDxDIB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b11e6f4c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/slick-theme.min.css
104.21.46.201200 OK 2.4 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/slick-theme.min.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type Unicode text, UTF-8 text, with very long lines (2387), with no line terminators
Hash f102ba8280b20190946a8f5cf83b5b56
4cffcf46b44006a05358f54043e977841b9ed8a1
60e65cfe5a8b8c4302761cf8df92f3dbbb3cae2136a58ee5daeaf5321926b550
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/slick-theme.min.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-955"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KZbryQJDdgw0YxTrGQ06Tuu5pPT7%2FwAesb9t3NfC7cuKkLuZBKrq2P9d3VLpJHtsg6ucjCajLJplwxZotImMlZKeEPOikKOevHvEmr58fYBBtzfag%2FqXfKisLIVNujyckwIu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b11e744c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/style.css
104.21.46.201200 OK 12 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/style.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type assembler source, ASCII text
Hash c75ccb227ee35f7cfa732281a8d0aa4e
7345e993f7e11592b9442b829e428f0037dae189
f2b4f1aae785021b71483f11fc89b2b09029f16226d8c82492ffa98feed16903
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/style.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-2fec"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hpT4tgJXUp3fI2Ud2fJVhOm8Bx8%2BGxmXnIZEDkRhDZNneLtQwEeN1ycqxvBVx8nAhgB6jZg2%2Fr2z3buKDidIGDazyKog55%2BWsmWA5SbcjkksubcJKXbi6RVP5Y8iXk9jnJGv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b11e754c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim0.jpg
104.21.46.201200 OK 19 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim0.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 295x200, components 3\012- data
Hash a1113ddde67b55eff92bf79b7c5b03ab
faee0edc763745d5b498e9b1d1d15c890e67e904
32d8a9ecfef22f0d3181e7c7f890d018d76959e6298e52412ad159e1ee5e47ad
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim0.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-4bd1"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6x8AB%2FD2rbalc2lDrrn6%2Bb1CmJddtAqgW6aq8IxDvX18Nbuz3FouaHVsf45S2TxicGoknz00CCWrvRGf36yqNTeO7lHemINWYUVys0aFeFUTGPH2X6iIAtwhlxT5CQhasG6B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b13eb84c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/8818530214ba98850ab5e39e290cd5d583/ui/bootstrap-3.3.5/css/bootstrap.min.css
104.21.46.201200 OK 122 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/8818530214ba98850ab5e39e290cd5d583/ui/bootstrap-3.3.5/css/bootstrap.min.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (65371)
Size 122 kB (122540 bytes)
Hash 5d5357cb3704e1f43a1f5bfed2aebf42
08df9a96752852f2cbd310c30facd934e348c2c5
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/8818530214ba98850ab5e39e290cd5d583/ui/bootstrap-3.3.5/css/bootstrap.min.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:55:41 GMT
vary: Accept-Encoding
etag: W/"65113cfd-1deac"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zawXABGmpPLuA1aHFllk5Cwz6lfbcobNXLnzXyrvJMEXMzaSRak7CIUolLNhMVPNGcQOTIEKFWN4VVMwwvXpxS2aIbuUy2FOKszu77J4TnHgKFSGMBqVJCxnj8%2BshMKdbrga"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b11e6d4c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim4.jpg
104.21.46.201200 OK 10 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim4.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 248x186, components 3\012- data
Hash dc58cee831e289856c13b0979e6694ca
fac7ec40a2848bca82ac3524e485225f27f0553d
0e10704e96bb1960c2a9baf06caeb99b97617b00d256c8bf73ec0b164d3e6264
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim4.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-2726"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x7QyWjtaE1XM47aoTXdz54mrLb6m6OEPv1LNZbcDx58KZXvyO%2FqaEDk%2BTOab35%2Bx9I9kBa6Mwo9TNJ2psVutPY40%2BkxFLsusgDadMJYiKZFO10oESDHQqeaFPyx4zA59jAax"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ed74c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_top.gif
104.21.46.201200 OK 2.3 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_top.gif
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 217 x 61\012- data
Hash c6812b805885e754376c2ac4cab88149
0010416f00cbc61da5e71f4dbf3f660730a43268
3d2b59bafbb906d2b8893c519384750282684d8c2c0fb103791f69ba94dad470
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_1_top.gif HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/gif
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
vary: Accept-Encoding
etag: W/"65113d00-928"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FOuEvIfSqRLYoY31DfqNhFbKxijoC6GOCSIi8Ho4Af%2F6QvovtJxNujZvbXzgj5hy75Pf3vcNduQ2bpq%2FK9Cs1jRsIsaKUld6l6VTf2Oc1yIlZ7G7BRct%2F2Uzt6M4eE57CHKY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b35ad04c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim1.jpg
104.21.46.201200 OK 25 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim1.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 295x200, components 3\012- data
Hash 138840bbf6f8fe18ad12c8d8c17dce34
ad25d70c8a8592ffffed3c4da7eb65ec93b7e344
386876e60775fcf5db229cd8db51aca1e6302a3677595b8fb77fecb7cb66b56e
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim1.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-616c"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dnf9sBeABbBnRPet2j0pZnuqE31AgN%2B8bwJj07Opixb4hW97RkrqQ48jc1kEAH5VZ4PCwysHlJCQ6o9h%2BAY1nakidyYBD1v3%2FoD%2Bq2XzJR0nRXLlNeSI98cEqj%2B5Os7EpAEn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b13ebc4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/chart.jpg
104.21.46.201200 OK 14 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/chart.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 440x330, components 3\012- data
Hash 2588cc166e77a974b64a415d064d5bb8
9f4f1460e9b1c160f9620aea7842243ec7f0656f
63810bd41698a2f271a9aba2d4e8e990d2e156fb05e2ebe3697898031e15b857
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/chart.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:24 GMT
vary: Accept-Encoding
etag: W/"65113d28-3682"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KHJ55u1pTMMyELy%2FOOH8%2FlS2hHJGlhLZQBqBjjug%2F9bYjMyAkSeBNPDZsB3CgjqdcbxEvrRRJ2s5IeH4ALopidCDnKporQVKU921AVLQB%2BYN5EavB9F69pM%2Fs6g%2B4owZP%2F3E"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ede4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/cc723deeecba32784a2a921f5c48437754/con0.js
104.21.46.201200 OK 1.6 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/cc723deeecba32784a2a921f5c48437754/con0.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (1689), with no line terminators
Hash beba6b6102096e3351a5cd5d929aa10d
1296694e00cd50b656aa2134ef8e00577c39afbe
a8505f9ad6b349589fb29539e4d3567012a57d887f2618f933021bedb69cc6e0
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/cc723deeecba32784a2a921f5c48437754/con0.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:54:21 GMT
vary: Accept-Encoding
etag: W/"65113cad-661"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T04bMwnvsqY%2Fl9YF4XsXadMgq262bntaJALjii7JjfkqoC3u%2BWFAltpFYvQNcCX%2BlNDywy1OwBBJKqEZGFsmDtoM%2B%2FV8M%2F8%2FADcj1QlaESuKJZKVXozcA9izy50jjM7zH%2FY1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ef84c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/27c0a4969cbaf68f1226a07ad16bf6cad2/fonts/font-awesome/font.css
104.21.46.201200 OK 32 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/27c0a4969cbaf68f1226a07ad16bf6cad2/fonts/font-awesome/font.css
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type troff or preprocessor input, ASCII text, with very long lines (357)
Hash 1c9951dc80563d3cade77d24bd9ec6c2
f1b833eb1145739ad239f8c8c13af84f721f0789
5a0a34a3f1b325560a6da50a8f83ac2efad83aa9658d2df02b8dcaf05dade449
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/27c0a4969cbaf68f1226a07ad16bf6cad2/fonts/font-awesome/font.css HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: text/css
last-modified: Mon, 25 Sep 2023 07:55:37 GMT
vary: Accept-Encoding
etag: W/"65113cf9-7e2c"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F3sMEahoJTw5TCvrIGJ8HsjYsIfei5flTEwqJvqJcYv99jbk%2FREdqv4CMJP2HxffsUOZi%2Fq7B6sep3OxZAGCIWB%2BKPvm%2BO1Drz4GRsxitTKhz5LcMQPEb6CtLNYJLIPLWs3a"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b11e764c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/textSizeMod.js
104.21.46.201200 OK 561 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/textSizeMod.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (662), with no line terminators
Hash 54f2fd88d93c27f9baca8cab1b153089
03f718f24a221a54f42761af33debe26b42ffe62
714376ed1d42d71028c967fd81528e6b2241c92123a3944417486e2a4d56e160
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/textSizeMod.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-231"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K9mXcLtcLTk8u%2FxuBWifgkJU632nkh7AkRtiwQ0G0VtJpnU%2BwpZOPLOHV0LolyNfi56rsrzZM5ifLs773bUK4Yy259NZYYGbiMoHH1CnMltCyWatD1qtaBHdfV8SjKNpa%2FYw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b12e894c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/daebb52a70bac58c7d8594e575f56b115d/plugins/countdown/jquery.countdown.js
104.21.46.201200 OK 32 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/daebb52a70bac58c7d8594e575f56b115d/plugins/countdown/jquery.countdown.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
Hash c5fc2c12a3a9bf68073852a08987089e
5f0a7830897416ec9811b68d6ee385cd12862a06
776ae3aec2ed828f72a269db4580e361dd509bbb8da2c5a0d54901e8a53064bf
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/daebb52a70bac58c7d8594e575f56b115d/plugins/countdown/jquery.countdown.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:55:41 GMT
vary: Accept-Encoding
etag: W/"65113cfd-7ec0"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y76U%2BxQ6pRISP9akUGA%2FoWv7i8qPcdovubXv53mB5SHBdqSaUWFjKjZOAcFINhVprGbQWW5%2BgNowdPYJZ86XsKeeTTPXYnkT01FSEE85dtvljjLtcUnoNOnmaxE2VpOYGstw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b12e8b4c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim2.jpg
104.21.46.201200 OK 18 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim2.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, progressive, precision 8, 295x200, components 3\012- data
Hash a4bc8e5afabd3a09594e7948c970c722
ff07cb27d042e68d07c09ebbe410c749e987aad6
40950ad48cba9883121caa93d86399cf8ac8ee4f1bd1d3cc5fd4be714b4e27bc
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim2.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-45d8"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yWjZQxfKPPe1G7TFj9BcuCHXMSgwsniKunZ7cAtSmzXwwf2O6xdhuTMZETm5RGiVWm%2FtLWalIjkOw%2FOT1zSUdi68ePLuBjLJexeC8Zyw8%2B1simICoYs%2F3vrRlUtt2VDXQYMA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b13ebf4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim3.jpg
104.21.46.201200 OK 11 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim3.jpg
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 277x180, components 3\012- data
Hash 8686b785a2b03acf7719dc690304aa4f
384a1e44e4a903f189627cbad9189cec99729070
14b978853e1a475b659127586770e1a06542555a66fdacf58f7979f0f9933565
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/testim3.jpg HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/jpeg
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-2c9a"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NzDKk%2BV4GBhYgg81IpGm752Hvt9hKdL8CoZ6mG9XmxZFga31dbrFCUe8kxpJqQB08HelCQEaLXMsU9MwOIzjyenSE9W4ebEqLUxskHaMxsxFoXKrQ73GK8hg9ad%2FnOzJBFhW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b14ed54c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_top.gif
104.21.46.201200 OK 1.5 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_top.gif
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 227 x 27\012- data
Hash 23f52c51965b088d3600af3007eb1cb1
3f41342ef3f03b8f4d617a170c5e6f2a7638493e
3580bfb6aae7b9776ae8821046bff843a525f95a35ca2eb9527d3274dfc59e87
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_2_top.gif HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/gif
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
vary: Accept-Encoding
etag: W/"65113d00-5c5"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w6XoSWaXVX7qBMxNsB5vEIpP6YK4O8%2FpPxfIIf%2FXywDBkqKyFbQnI5%2F3fD4XR4Td7GHdoMNb8iQlUfgzvLxD9zRFtChkH0BjKdQbqI2aL7fVNcbeapc9xtZcHnulcU1TVvPI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b36ae44c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_3.gif
104.21.46.201200 OK 4.2 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_3.gif
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type GIF image data, version 89a, 418 x 96\012- data
Hash 356a025994dca6584488a0daddbc5aa3
5faa1b5abf9221b906439352796f8f71658579a4
ad8a4b433fe5ef16e2612cb51d1115e0d09a921e29e1ef13e1ee456bbb681472
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/popup_3.gif HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:07 GMT
content-type: image/gif
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
vary: Accept-Encoding
etag: W/"65113d00-1091"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=czDCj6xfw88HUsJk79ezfksKd5%2BpLq5BqbV2w4MQLG%2BGAjEOM6Mh3XseTLabQi5GNaUhe8mKBWv4mk46NFMklCIEVmBgRnDqc2k6%2BqSrZKm63bCrFE9hzNWN%2Fwb4Jwch8lm1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b3bb7c4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/jquery.pnotify.min.js
104.21.46.201200 OK 15 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/jquery.pnotify.min.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (552)
Hash 1c1184d605a2d99fe3918447f1de3980
12165f8300851684dde46d17bea9f368882925d6
97213b369fa90c68142d1c588945009bbd7198bccb46e12ce2c1bb78ad12769c
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/jquery.pnotify.min.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-3b3b"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wPPGTuxipI%2FaK899%2Bhjj4p0SXWZ4mcglT98dTu2gDkti6Oij9BsZGHrdkvSwWYuqZwhzWgg4pHT0kllEYMC6kTq8OJP4eYAx7u1YB3r8CauFBUxjD2%2FGf2wSkeBYM%2F70Gnwz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b12e934c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/bullets.png
104.21.46.201200 OK 262 B URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/bullets.png
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced\012- data
Hash 266883e34d559a67c8b81609624b8e97
1e04902a8ac3a97b049d496921c8dc8a01320404
9564c79737e42e308de5edf633af0e938f8a304b5b31109d6ecd56ac00ae4965
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/bullets.png HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/1f2902a14eba5f1a6f509f409f7b222817/style.css
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/png
last-modified: Mon, 25 Sep 2023 07:56:25 GMT
vary: Accept-Encoding
etag: W/"65113d29-106"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VUajTYKgavtLoSyKqQGwEVYBRxJ0cMjwaZdpAngATKHxUpHhFqNFwNc0ZTDcVXSHQwCe2e%2By4RvokYB%2BPRy8ah9JmrA840Gan3kPU4A%2Bsy4fKz3sbT55OVWAX5xNqah19VBx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b2f9e24c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_2.png
104.21.46.201200 OK 3.5 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_2.png
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type PNG image data, 101 x 137, 8-bit colormap, non-interlaced\012- data
Hash dfae6bc19f0b122c14ed467e1fdc53d7
cfe1e481212d001bceebce72a3d507750fa031b2
9bc96716225f557d20a3f3510f22994ae6022c6f09fc90686d614401663a299b
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_2.png HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/png
last-modified: Mon, 25 Sep 2023 07:55:44 GMT
vary: Accept-Encoding
etag: W/"65113d00-dc2"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JqM5TYFnLGN64hjzqlLlxa1rIr5sgAgpADhBY5VPPy6o%2FrKYTuf%2Fqx%2BN6t10xJkjwa1T%2FsMeMgvp8ocG5MvDSiyVsEfCx71ek6UooS2SbSLJS5KwNHNSs6LvZc%2BcStU0AZLm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b37afc4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_1.png
104.21.46.201200 OK 3.7 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_1.png
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type PNG image data, 247 x 64, 8-bit colormap, non-interlaced\012- data
Hash fc23b06af6b599fc743d7ac8f0ba2e86
8c6312f22b3f859286479f3bc98a5f66a1386769
3c09a7c8bfdcdcac665a2bb19855e3ec5c6c5cac84b3f287d7fe0c1ebfe6fb65
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_1.png HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/png
last-modified: Mon, 25 Sep 2023 07:55:42 GMT
vary: Accept-Encoding
etag: W/"65113cfe-e8f"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cft8z9Zd%2FBzhhwXzwTvXtUQ0Z8iZiDToJ7PkZRfk%2FdlIUJ0UTXSNpHEPikIhbN6APBzCEs9EVPK5wE4Qr0yMfEtfUwhzpEz5ZkcQvPkH0T0tRWoKFtrHi7X%2FgVdNnMQGg0aj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b36aef4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_3.png
104.21.46.201200 OK 4.4 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_3.png
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type PNG image data, 297 x 140, 8-bit colormap, non-interlaced\012- data
Hash c818cdbb075f8bfd781e0a74c0257d7d
53499b3646234b632c8cb7f533316d78a508a4e6
e452cf8b07bdaa78218d23a9566571001f867a3f1a022f45a0cefa333e798321
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/fa856a1c94ba98ed3bd287918cd146d841/arrow_3.png HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: image/png
last-modified: Mon, 25 Sep 2023 07:55:43 GMT
vary: Accept-Encoding
etag: W/"65113cff-1100"
expires: Fri, 15 Dec 2023 01:59:42 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 24
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ISJXZHA12VPCsAhdpxdmTQX2%2Fqd2oaK4H7zTy4jRLkdzj3wAPmvyXmha586xm1JGjfla0vJ6imK6N6XzwvNpRdGjSgwXJhDD6qiYJ%2BuXaRhreoYF31Jq4XZ%2ByoGrbXVPcw%2BL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b37afe4c88-HEL
alt-svc: h3=":443"; ma=86400
feeloffernow.com/387/btkmue2/mail/b1d58de9b1ba04ab0867a53e989f29000a/jquery/jquery.min.js
104.21.46.201200 OK 96 kB URL GET HTTP/3 feeloffernow.com/387/btkmue2/mail/b1d58de9b1ba04ab0867a53e989f29000a/jquery/jquery.min.js
IP 104.21.46.201:443
Requested by https://feeloffernow.com/387/btkmue2/mail/
Certificate IssuerGoogle Trust Services LLC
Subjectfeeloffernow.com
Fingerprint19:A3:E9:A0:52:09:D6:40:69:09:E2:70:14:94:52:30:66:A9:B2:D1
ValidityTue, 14 Nov 2023 08:05:11 GMT - Mon, 12 Feb 2024 08:05:10 GMT
File type ASCII text, with very long lines (32086)
Hash 8101d596b2b8fa35fe3a634ea342d7c3
d6c1f41972de07b09bfa63d2e50f9ab41ec372bd
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
Analyzer Verdict Alert OpenPhish phishing Generic/Spear Phishing
GET /387/btkmue2/mail/b1d58de9b1ba04ab0867a53e989f29000a/jquery/jquery.min.js HTTP/1.1
Host: feeloffernow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://feeloffernow.com/387/btkmue2/mail/
Cookie: PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; PHPSESSID=a48c8e5821e9adc5872b8a210e46a0c7; _t_co=1702000805.6f2d6bec62b5271e71042cc1e55c65429d9c707d; SID=9von1fy42xcx49hg955nakmek4b6qbdu; UID=5032394685173360022
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 08 Dec 2023 02:00:06 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 07:55:39 GMT
vary: Accept-Encoding
etag: W/"65113cfb-1762a"
expires: Fri, 15 Dec 2023 01:59:41 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 25
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y%2FuJJti1%2Fi1GSG3ABdQMx2xE4g0khnCNKPpJ1Yti5PYeB3JQZkHKEWVE2no5Abjlf7oM0DmaPm0niOkoM5rFfCc6mAPv%2BWdfWeXYiLq7phheqVjuUkxZVBZnKWv9qb3mdlNB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 832169b12e7f4c88-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400