Report - goldfieldssanddrags.com.au/

Report Overview

Submitted URL
goldfieldssanddrags.com.au/
IP
110.173.224.245
ASN
#45926 Web In A Box
Submitted
2022-10-27 06:31:44
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
18

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	4.0 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	364 B	1.5 kB	34.102.187.140
fonts.googleapis.com	8877	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	898 B	142.250.74.10
fonts.gstatic.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	442 B	8.4 kB	216.58.207.195
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.4 kB	6.2 kB	23.36.77.32
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
goldfieldssanddrags.com.au	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	6.1 kB	1.1 MB	110.173.224.245
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.27.12.161
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
www.facebook.com	99	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.3 kB	4.1 kB	31.13.72.36
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	60 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-10-27	medium	goldfieldssanddrags.com.au/	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/shadowbox-3.0.3/shadowbox.js	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/ckeditor/ckeditor.js	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/ckfinder/ckfinder.js	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/Images/xradiowest,P20logo.jpg.pagespeed.ic.9bv8uz-3qo.webp	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/ckfinder/userfiles/images/400x261xF03241B0-FF91-4EBC-AF0F-499097C444E2.jpeg.pagespeed.ic.vCUw671qKb.webp	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/Images/xdms,P20logo.jpg.pagespeed.ic.IAlIPl_2qD.webp	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/Images/xhot,P20fm,P20logo.jpg.pagespeed.ic.kvkt1L2fFh.webp	Phishing
2022-10-27	medium	goldfieldssanddrags.com.au/Includes/tiza-webfont.woff	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	goldfieldssanddrags.com.au/shadowbox-3.0.3/shadowbox.js	66 kB	2023-03-10	2023-11-18
Pretty URL goldfieldssanddrags.com.au/shadowbox-3.0.3/shadowbox.js IP 110.173.224.245 ASN #45926 Web In A Box Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 16:21:43 Last Seen2023-11-18 01:27:54 Times Seen5 Hash 55f745331234da8cb7bbef1247ad89ca d84334eca7f87c7c521632ec5fbf9a78da4deb70 586467f581b92d0506e5f5c1d462f553a78c5333a1f290c94dd98e43116721c3 Loading...

	goldfieldssanddrags.com.au/ckeditor/ckeditor.js	367 kB	2023-03-10	2023-11-07
Pretty URL goldfieldssanddrags.com.au/ckeditor/ckeditor.js IP 110.173.224.245 ASN #45926 Web In A Box Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 16:21:43 Last Seen2023-11-07 14:30:03 Times Seen5 Hash a6829cb59b567c40f09d006d30fa578f b430c1dfcf1223ee49105a717209a68c75e3d221 c01d89a6b1754c1287a92919c06c62e16f7224a954d3c89ab26a9a832b83f8c1 Loading...

	goldfieldssanddrags.com.au/ckfinder/ckfinder.js	256 kB	2023-03-10	2023-03-10
Pretty URL goldfieldssanddrags.com.au/ckfinder/ckfinder.js IP 110.173.224.245 ASN #45926 Web In A Box Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 16:21:43 Last Seen2023-03-10 16:21:43 Times Seen1 Hash 6c7810f33349b3320e528581464de0db 5c2ab72d6e6b24c28c8cace0767d09a13b1d3fe0 0ad35196623642cd91a4fec7ac0f60e98f240b30a7ef7875f5db89d907208641 Loading...

	goldfieldssanddrags.com.au/	134 B	2023-03-10	2023-03-10
Pretty URL goldfieldssanddrags.com.au/ IP 110.173.224.245 ASN #45926 Web In A Box Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 16:21:43 Last Seen2023-03-10 16:21:43 Times Seen1 Hash 97ee4148ffe1db51b774a75be51fd483 9a9b5ef28eebb5e5341bda4f069baf2511fb307e 1418f50cc7895766ef5eeb10a094386759759e601698f8a483025c16ed83588f Loading...

	goldfieldssanddrags.com.au/	17 B	2023-03-07	2023-11-27
Pretty URL goldfieldssanddrags.com.au/ IP 110.173.224.245 ASN #45926 Web In A Box Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:59:25 Last Seen2023-11-27 17:20:11 Times Seen20 Hash accbeb75c2956a8aec8f881efc46c171 f51cf375dcb65b1aef60a4b8f15768bf67a0d97d b83a922493434f042ffc2fd0cbb830b02a160928bdda1b934e97366133ae1d10 Loading...

	goldfieldssanddrags.com.au/	490 B	2023-03-10	2023-03-10
Pretty URL goldfieldssanddrags.com.au/ IP 110.173.224.245 ASN #45926 Web In A Box Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 16:21:43 Last Seen2023-03-10 16:21:43 Times Seen1 Hash 1765046824e91846a5cd473e63484891 959dd424b37bd45120dca31b9ca5ad6172ca89ba 06016f26e9b641277457c7011079ff4d1369b1b9f67361db5bb63fbb461470ba Loading...

HTTP Transactions (40)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a39eea1096852891690eaee02a64383e
c273000f799fc3676e8e3ef3617611a31252cffc
d9d95319013d64bc2ef6d9870f4adba902ee970b6f9e96279c9ed86f556e0001

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D9D95319013D64BC2EF6D9870F4ADBA902EE970B6F9E96279C9ED86F556E0001"
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10210
Expires: Thu, 27 Oct 2022 09:21:42 GMT
Date: Thu, 27 Oct 2022 06:31:32 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: SdlkvqpQG+tu3dLGJXqXCftu38S+76BGJAgqRSmHQPagj8Izg/xZasAsBQV3m1WmeRE1c1nvgDE=
x-amz-request-id: 566VHPATXQ68MV26
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 27 Oct 2022 06:09:42 GMT
age: 1310
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
45bfdf3b823cd24564c8ac296a8b5b19
b0c442eb4f87556b3beb18ca8039dd4399b73f16
32113c679dda1f710ba67e537fdd0d435ccc186a238e3b14e48deb7b0700c693

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5486
Cache-Control: max-age=102656
Content-Type: application/ocsp-response
Date: Thu, 27 Oct 2022 06:31:32 GMT
Etag: "6358fe56-1d7"
Expires: Fri, 28 Oct 2022 11:02:28 GMT
Last-Modified: Wed, 26 Oct 2022 09:31:02 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
45bfdf3b823cd24564c8ac296a8b5b19
b0c442eb4f87556b3beb18ca8039dd4399b73f16
32113c679dda1f710ba67e537fdd0d435ccc186a238e3b14e48deb7b0700c693

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5486
Cache-Control: max-age=102656
Content-Type: application/ocsp-response
Date: Thu, 27 Oct 2022 06:31:32 GMT
Etag: "6358fe56-1d7"
Expires: Fri, 28 Oct 2022 11:02:28 GMT
Last-Modified: Wed, 26 Oct 2022 09:31:02 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
4736bac84ca28f2b1e961159fb4ea098
1319612979f53896fcfeacd4215c2715d4951e4c
5e81213e111ddf68c7f884f72b4e06fc4dc95eb902c3cf0762236b2418840dba

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
Alt-Used: 0

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 27 Oct 2022 05:41:41 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2991
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

goldfieldssanddrags.com.au/

110.173.224.245

200 OK

6.4 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (2485), with CRLF, LF line terminators
Size
6.4 kB (6362 bytes)
Hash
f7700e6429d1d4238dc6ff536413c0b2
c5dfdccb452de0997b00b541d52f50482962c4eb
7a3025aecb2159b24b7145290c17c909f0d11700511abcc7b337dc31e0ef945d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET / HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:32 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
set-cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3; path=/
x-mod-pagespeed: 1.13.35.2-0
vary: Accept-Encoding
content-encoding: gzip
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0, no-cache
content-length: 6362
content-type: text/html; charset=utf-8

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
dd283dfc036535bdeb8a8be1310ef930
d3b1c300dd75d7af630e0f3112e49d7492d66c17
578f9256faa188facb3f2d68b02b0c7fb2e30e02e2e74234d015429563cba7aa

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3596
Cache-Control: max-age=95711
Content-Type: application/ocsp-response
Date: Thu, 27 Oct 2022 06:31:32 GMT
Etag: "6358ea97-1d7"
Expires: Fri, 28 Oct 2022 09:06:43 GMT
Last-Modified: Wed, 26 Oct 2022 08:06:47 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

fonts.googleapis.com/css?family=Pathway+Gothic+One

142.250.74.10

200 OK

361 B

URL HTTP/1.1
fonts.googleapis.com/css?family=Pathway+Gothic+One
IP
142.250.74.10:0
ASN
#15169 GOOGLE

File type
ASCII text
Size
361 B (361 bytes)
Hash
e760d6eb1dfa919b9f32c3c55ed931cc
cc4b70d3b145917f68ce3c62356edb12792e7894
cd2bc83cddbf99a1ec30bd7210b82f4307895179ff0bac86e5e1ad77361c533a

HTTP Headers

GET /css?family=Pathway+Gothic+One HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/

HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Thu, 27 Oct 2022 06:31:32 GMT
Date: Thu, 27 Oct 2022 06:31:32 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e36c852b5e145f2f09fe73111fb162e1
e439c6a462f86a3003d6464a8b9999b1c4d1e210
52a721168d0c41cb0854ff8c730fce3b79db2e804b383238e95ff1401922bd74

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "52A721168D0C41CB0854FF8C730FCE3B79DB2E804B383238E95FF1401922BD74"
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2206
Expires: Thu, 27 Oct 2022 07:08:19 GMT
Date: Thu, 27 Oct 2022 06:31:33 GMT
Connection: keep-alive

push.services.mozilla.com/

52.27.12.161

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.27.12.161:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: RQHBusV+BI59Yh6LCcZnvw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 2LDR0+dklC5Du4w5VnrlJXQPUqU=

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 27 Oct 2022 06:31:33 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

goldfieldssanddrags.com.au/A.Includes,,_stylesheet.css+shadowbox-3.0.3,,_shadowbox.css,Mcc.SWYPQG3nit.css.pagespeed.cf.ATtb0mcWzB.css

110.173.224.245

200 OK

2.7 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/A.Includes,,_stylesheet.css+shadowbox-3.0.3,,_shadowbox.css,Mcc.SWYPQG3nit.css.pagespeed.cf.ATtb0mcWzB.css
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
ASCII text, with very long lines (6995), with no line terminators
Size
2.7 kB (2692 bytes)
Hash
44e954acbe0f75767d159e1e38189d1a
e5aa1faaa07e028fec8731ad73b9386fa56beeee
f5d64048d370ab49aee19db7912c5d0686216c04d5e3efce86c0389555c9c24d

HTTP Headers

GET /A.Includes,,_stylesheet.css+shadowbox-3.0.3,,_shadowbox.css,Mcc.SWYPQG3nit.css.pagespeed.cf.ATtb0mcWzB.css HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:33 GMT
server: Apache
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:31 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:31 GMT
x-original-content-length: 5910
vary: Accept-Encoding
content-encoding: gzip
content-length: 2692
content-type: text/css

goldfieldssanddrags.com.au/shadowbox-3.0.3/shadowbox.js

110.173.224.245

200 OK

20 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/shadowbox-3.0.3/shadowbox.js
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
ASCII text, with very long lines (28615), with CRLF line terminators
Size
20 kB (19517 bytes)
Hash
54c6dc6bbbc9feefcc632661401fcf4f
169dd11c9f34c0cdc5fedda142a1710822e3bf2c
36f4175288f2f01bd41d211e1ce6e37d1d90f2ef4e73cffa0f28e01426d1878f

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /shadowbox-3.0.3/shadowbox.js HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:33 GMT
server: Apache
last-modified: Wed, 27 Apr 2016 05:04:52 GMT
etag: "101e8-5317059976890-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 19517
content-type: application/javascript

goldfieldssanddrags.com.au/ckeditor/ckeditor.js

110.173.224.245

200 OK

117 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/ckeditor/ckeditor.js
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
Unicode text, UTF-8 (with BOM) text, with very long lines (3176), with CRLF line terminators
Size
117 kB (116816 bytes)
Hash
59eb2bb2eba7e1c91ec05d510e728d46
cd285c7e6f4ee6906a0a19cf920701d5d3dab9ba
09fc5f24be81fff6780782b1bb725757dd3c8ddccaef29a707f75194a688a780

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ckeditor/ckeditor.js HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:33 GMT
server: Apache
last-modified: Thu, 16 Jun 2016 07:41:31 GMT
etag: "599ad-535605ddbffe5-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
transfer-encoding: chunked
content-type: application/javascript

goldfieldssanddrags.com.au/ckfinder/ckfinder.js

110.173.224.245

200 OK

80 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/ckfinder/ckfinder.js
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
Unicode text, UTF-8 (with BOM) text, with very long lines (48808), with CRLF line terminators
Size
80 kB (80180 bytes)
Hash
5c470dc3f3e96eb026877e1066fbe873
7ff8ec7da49367835195e88535e487e355f88d1e
d5171922355dbb0817d0e3d6d911f251e1cca857eadc0d567ea30a05823019ce

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ckfinder/ckfinder.js HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:33 GMT
server: Apache
last-modified: Thu, 16 Jun 2016 07:39:13 GMT
etag: "3e961-5356055a1173c-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
transfer-encoding: chunked
content-type: application/javascript

www.facebook.com/plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fgoldfieldssanddrags.kalgoorlie&width=230&height=35&colorscheme=light&layout=standard&action=like&show_faces=false&send=false&appId=165403476853610

31.13.72.36

301 Moved Permanently

0 B

URL HTTP/1.1
www.facebook.com/plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fgoldfieldssanddrags.kalgoorlie&width=230&height=35&colorscheme=light&layout=standard&action=like&show_faces=false&send=false&appId=165403476853610
IP
31.13.72.36:0
ASN
#32934 FACEBOOK

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fgoldfieldssanddrags.kalgoorlie&width=230&height=35&colorscheme=light&layout=standard&action=like&show_faces=false&send=false&appId=165403476853610 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Location: https://www.facebook.com/plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fgoldfieldssanddrags.kalgoorlie&width=230&height=35&colorscheme=light&layout=standard&action=like&show_faces=false&send=false&appId=165403476853610
Content-Type: text/plain
Server: proxygen-bolt
Date: Thu, 27 Oct 2022 06:31:34 GMT
Connection: keep-alive
Content-Length: 0

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
262ee317a7d41424cef3f541f6e538d3
1c298c901f93a95e99bdc63259f415ab84a13783
c263ddf8d0a398b0b7e11f7efa9cb901bf877d939f388eb6089a236bbbdc2be4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C263DDF8D0A398B0B7E11F7EFA9CB901BF877D939F388EB6089A236BBBDC2BE4"
Last-Modified: Wed, 26 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13302
Expires: Thu, 27 Oct 2022 10:13:16 GMT
Date: Thu, 27 Oct 2022 06:31:34 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
262ee317a7d41424cef3f541f6e538d3
1c298c901f93a95e99bdc63259f415ab84a13783
c263ddf8d0a398b0b7e11f7efa9cb901bf877d939f388eb6089a236bbbdc2be4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C263DDF8D0A398B0B7E11F7EFA9CB901BF877D939F388EB6089A236BBBDC2BE4"
Last-Modified: Wed, 26 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13302
Expires: Thu, 27 Oct 2022 10:13:16 GMT
Date: Thu, 27 Oct 2022 06:31:34 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9247b163-9d83-4148-9c1f-890b5e2b0a45.jpeg

34.120.237.76

200 OK

7.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9247b163-9d83-4148-9c1f-890b5e2b0a45.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.5 kB (7542 bytes)
Hash
bd4d7051e9d8525d8ed7d5249b24068d
cbad9147991b1a1b27088f90fe7078d1056a9633
4701cc21f58c8ac8b8ad78a34973b3ade538255868afbf59be40e7f1365bcc20

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9247b163-9d83-4148-9c1f-890b5e2b0a45.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7542
x-amzn-requestid: 95e8df21-80b6-400a-bcd5-41efdab9cc57
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aocwLH0lIAMFT2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6359a800-3300914f11c46b9902b30fe4;Sampled=0
x-amzn-remapped-date: Wed, 26 Oct 2022 21:34:56 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 4aCnw-Gulpqp0Vsa-kZQuR4y22SLWYZP9HbtIz2eMuI1lpPqb3kddg==
via: 1.1 d0387b833e3ca8cb748a1296b4b4bf2a.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 21:47:48 GMT
etag: "cbad9147991b1a1b27088f90fe7078d1056a9633"
content-type: image/jpeg
age: 31426
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fabc32527-e3a5-4250-9792-7b6bceea4bac.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.3 kB (9256 bytes)
Hash
e307787eef6193fe4988367feb5e07d9
f50d8270aeb43fb15457d961f925cf2b38060240
d69ba1c958614a831462b81a046bb6a59e353db0b63d23b060b84df124057452

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fabc32527-e3a5-4250-9792-7b6bceea4bac.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9256
x-amzn-requestid: 25249b1e-6ef4-432c-b370-a645259c0727
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aoeDVHAyIAMFo9Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6359aa15-73f252de0cc8d8246183f658;Sampled=0
x-amzn-remapped-date: Wed, 26 Oct 2022 21:43:49 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: V7UFjzwuVqIZJiJg_Q3BWuSd8B_aghBauo7NYg2EYT3MDme-jggsYA==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 22:11:54 GMT
age: 29980
etag: "f50d8270aeb43fb15457d961f925cf2b38060240"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
262ee317a7d41424cef3f541f6e538d3
1c298c901f93a95e99bdc63259f415ab84a13783
c263ddf8d0a398b0b7e11f7efa9cb901bf877d939f388eb6089a236bbbdc2be4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C263DDF8D0A398B0B7E11F7EFA9CB901BF877D939F388EB6089A236BBBDC2BE4"
Last-Modified: Wed, 26 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13302
Expires: Thu, 27 Oct 2022 10:13:16 GMT
Date: Thu, 27 Oct 2022 06:31:34 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
262ee317a7d41424cef3f541f6e538d3
1c298c901f93a95e99bdc63259f415ab84a13783
c263ddf8d0a398b0b7e11f7efa9cb901bf877d939f388eb6089a236bbbdc2be4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C263DDF8D0A398B0B7E11F7EFA9CB901BF877D939F388EB6089A236BBBDC2BE4"
Last-Modified: Wed, 26 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13302
Expires: Thu, 27 Oct 2022 10:13:16 GMT
Date: Thu, 27 Oct 2022 06:31:34 GMT
Connection: keep-alive

34.120.237.76

200 OK

6.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc5a9dae4-226e-42f6-b38d-d6f3f560ed69.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.8 kB (6806 bytes)
Hash
8240214ef7bc82b09de023cde217beb9
0f432e521fc4392f528042c711139dc0becc5598
2d5f1a426441536086c8278651808dc6e3e819ec18b48048520a4dedbc8a08ce

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc5a9dae4-226e-42f6-b38d-d6f3f560ed69.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6806
x-amzn-requestid: bdf4f489-b474-4143-881f-521ad5dee74b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aocwUGb9oAMFRGg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6359a801-2a1e822f6b1dd3304c8f0527;Sampled=0
x-amzn-remapped-date: Wed, 26 Oct 2022 21:34:57 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: oxLrpXYZuUBO5qEKrFYAkh3lx2ZE7Jph8tcq0b4dWIHxUODXP3FDDQ==
via: 1.1 95b0ac620fa3a80ee590ecf1cda1c698.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 21:47:49 GMT
etag: "0f432e521fc4392f528042c711139dc0becc5598"
content-type: image/jpeg
age: 31425
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

18 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2013af8a-e057-44cd-8dca-381e200609e6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
18 kB (18182 bytes)
Hash
ed4462f023dbabb596a2e3b521425ca1
61b82445b422a5f917bb10640beb6d73eb0e62c3
a02af2897331acc123bf7d54b30929e3bc062a0875b5dea95302ddf60d808ded

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2013af8a-e057-44cd-8dca-381e200609e6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 18182
x-amzn-requestid: f1232b1f-32ac-4820-b186-b3bfb928c0b4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aYvSKFF4oAMF2Wg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63535f40-0b9bc4d27b7534176cc278ed;Sampled=0
x-amzn-remapped-date: Sat, 22 Oct 2022 03:10:56 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 6Ep7Z_31m6kPwBoVaHyE2TioMdDmF_SkwT5kl326QvWN1pFEX_sy6Q==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 10:29:50 GMT
age: 72104
etag: "61b82445b422a5f917bb10640beb6d73eb0e62c3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
262ee317a7d41424cef3f541f6e538d3
1c298c901f93a95e99bdc63259f415ab84a13783
c263ddf8d0a398b0b7e11f7efa9cb901bf877d939f388eb6089a236bbbdc2be4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C263DDF8D0A398B0B7E11F7EFA9CB901BF877D939F388EB6089A236BBBDC2BE4"
Last-Modified: Wed, 26 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13302
Expires: Thu, 27 Oct 2022 10:13:16 GMT
Date: Thu, 27 Oct 2022 06:31:34 GMT
Connection: keep-alive

34.120.237.76

200 OK

7.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F468f05a4-ac72-4a66-8993-53a827bffd49.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.4 kB (7436 bytes)
Hash
134b31ca1a6cb74ab6f6c21e27114883
bb13bb4f8876e00be7fb70e0b4f6cd52d0165458
539ee95d515835ade79c63a5c85c138678019563ac0e2f86bcfd7fcc0dc9dce2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F468f05a4-ac72-4a66-8993-53a827bffd49.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7436
x-amzn-requestid: 58eb8ffe-f4e6-40f0-a5b0-8c5cb3d32b21
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: apWAYGh4IAMF0Yg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635a039b-742161244dced54246938f0d;Sampled=0
x-amzn-remapped-date: Thu, 27 Oct 2022 04:05:47 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: KVQ_mvfxGRPLkqBXDjCksjKai7YkIRYvhoRxXJ31A38fDNyJaBl1Wg==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 27 Oct 2022 04:10:46 GMT
age: 8448
etag: "bb13bb4f8876e00be7fb70e0b4f6cd52d0165458"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd980e84d-7557-46f4-86fa-a1750bc0556c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.3 kB (4328 bytes)
Hash
67c7146ff56c9463c0b083309a978ea0
707b7879deeb50d13d83aafc7293995e937024a7
b7165804db9a86623445ee8dce01ac6cbbf65cc7f99b60089ca4382a230b093e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd980e84d-7557-46f4-86fa-a1750bc0556c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4328
x-amzn-requestid: 0d4e3cd2-261d-48ca-9eaa-e8781bba8208
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aocvjFZtIAMFWlg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6359a7fc-78d12691124af7052d77f5be;Sampled=0
x-amzn-remapped-date: Wed, 26 Oct 2022 21:34:52 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: zhIR7YHR6tsp4mlWUeYqCk2QjLPiE_uyUwpSptMBqCjjtJQE6Fb5cw==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 21:47:44 GMT
etag: "707b7879deeb50d13d83aafc7293995e937024a7"
content-type: image/jpeg
age: 31430
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
b3f691dd015f1e89124ff513ef96aef9
1f8bc004da03321868fa1218f6c21916a944b2a0
5c74f21a5e9897d6671a87e1100749c46eda882c5d49aae706841f5968c5adab

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5008
Cache-Control: max-age=167344
Content-Type: application/ocsp-response
Date: Thu, 27 Oct 2022 06:31:34 GMT
Etag: "6359fce6-1d7"
Expires: Sat, 29 Oct 2022 05:00:38 GMT
Last-Modified: Thu, 27 Oct 2022 03:37:10 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

31.13.72.36

200 OK

0 B

URL HTTP/2
www.facebook.com/plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fgoldfieldssanddrags.kalgoorlie&width=230&height=35&colorscheme=light&layout=standard&action=like&show_faces=false&send=false&appId=165403476853610
IP
31.13.72.36:0
ASN
#32934 FACEBOOK

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fgoldfieldssanddrags.kalgoorlie&width=230&height=35&colorscheme=light&layout=standard&action=like&show_faces=false&send=false&appId=165403476853610 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://goldfieldssanddrags.com.au/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: ZEx7nJV0z8y+qD6LABqz6qOAKhwYlX3Wel7HhooQtmITetqC2+ezDIg2FtMJU569FXHoZQs8bNEtIFbW27c4UQ==
content-length: 0
date: Thu, 27 Oct 2022 06:31:34 GMT
priority: u=3,i
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
b3f691dd015f1e89124ff513ef96aef9
1f8bc004da03321868fa1218f6c21916a944b2a0
5c74f21a5e9897d6671a87e1100749c46eda882c5d49aae706841f5968c5adab

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5008
Cache-Control: max-age=167344
Content-Type: application/ocsp-response
Date: Thu, 27 Oct 2022 06:31:34 GMT
Etag: "6359fce6-1d7"
Expires: Sat, 29 Oct 2022 05:00:38 GMT
Last-Modified: Thu, 27 Oct 2022 03:37:10 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

goldfieldssanddrags.com.au/Images/xradiowest,P20logo.jpg.pagespeed.ic.9bv8uz-3qo.webp

110.173.224.245

200 OK

3.1 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Images/xradiowest,P20logo.jpg.pagespeed.ic.9bv8uz-3qo.webp
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 198x67, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
3.1 kB (3094 bytes)
Hash
f5bbfcbb3fb7aa8277d01086e1294712
69657ce1f1c8a2bb0919efe2700d24cdcb92afa2
76f13b0ff776e151f56ccd3a8f1a346c26dc6cadaaaeab0dff677bb16e05638c

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /Images/xradiowest,P20logo.jpg.pagespeed.ic.9bv8uz-3qo.webp HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
link: <http://goldfieldssanddrags.com.au/Images/radiowest%20logo.jpg>; rel="canonical"
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:10 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:10 GMT
x-original-content-length: 38129
content-length: 3094
content-type: image/webp

goldfieldssanddrags.com.au/ckfinder/userfiles/images/400x261xF03241B0-FF91-4EBC-AF0F-499097C444E2.jpeg.pagespeed.ic.vCUw671qKb.webp

110.173.224.245

200 OK

32 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/ckfinder/userfiles/images/400x261xF03241B0-FF91-4EBC-AF0F-499097C444E2.jpeg.pagespeed.ic.vCUw671qKb.webp
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 400x261, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
32 kB (31714 bytes)
Hash
bc2530ebbd6a29b3dd21e3a6be2f42f8
e26027e277bcf744c5a7d11ce050aa43db94d3a9
d0584645ad2b64dcba5085b072494ea3f97dd1e62530b3865f41068113ba6d06

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ckfinder/userfiles/images/400x261xF03241B0-FF91-4EBC-AF0F-499097C444E2.jpeg.pagespeed.ic.vCUw671qKb.webp HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
link: <http://goldfieldssanddrags.com.au/ckfinder/userfiles/images/F03241B0-FF91-4EBC-AF0F-499097C444E2.jpeg>; rel="canonical"
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:10 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:10 GMT
x-original-content-length: 456231
content-length: 31714
content-type: image/webp

goldfieldssanddrags.com.au/Images/xdms,P20logo.jpg.pagespeed.ic.IAlIPl_2qD.webp

110.173.224.245

200 OK

2.8 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Images/xdms,P20logo.jpg.pagespeed.ic.IAlIPl_2qD.webp
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 192x79, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
2.8 kB (2838 bytes)
Hash
2009483e5ff6a839805988138d6b821e
4bdd6ded393cc50a23ae55d3af6c98be45399b1e
a70c8e49eb18750ad6614f906e24459110a56dacecb2cfefcd5e7ad5fd3e2e23

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /Images/xdms,P20logo.jpg.pagespeed.ic.IAlIPl_2qD.webp HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
link: <http://goldfieldssanddrags.com.au/Images/dms%20logo.jpg>; rel="canonical"
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:10 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:10 GMT
x-original-content-length: 32420
content-length: 2838
content-type: image/webp

goldfieldssanddrags.com.au/Images/xhot,P20fm,P20logo.jpg.pagespeed.ic.kvkt1L2fFh.webp

110.173.224.245

200 OK

2.9 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Images/xhot,P20fm,P20logo.jpg.pagespeed.ic.kvkt1L2fFh.webp
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 194x71, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size
2.9 kB (2884 bytes)
Hash
92f92dd4bd9f1612eb764b37b40a1835
b4df1494f57024ec9cc25e861acbba4a6825871b
6e44afde512cfe4c2a187947585bd72abcc0c0f3549c323eaf29359310ea6d47

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /Images/xhot,P20fm,P20logo.jpg.pagespeed.ic.kvkt1L2fFh.webp HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
link: <http://goldfieldssanddrags.com.au/Images/hot%20fm%20logo.jpg>; rel="canonical"
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:10 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:10 GMT
x-original-content-length: 26748
content-length: 2884
content-type: image/webp

fonts.gstatic.com/s/pathwaygothicone/v14/MwQrbgD32-KAvjkYGNUUxAtW7pEBwx-tS1Zf.woff2

216.58.207.195

200 OK

7.7 kB

URL HTTP/1.1
fonts.gstatic.com/s/pathwaygothicone/v14/MwQrbgD32-KAvjkYGNUUxAtW7pEBwx-tS1Zf.woff2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 7664, version 1.0\012- data
Size
7.7 kB (7664 bytes)
Hash
ddb86a7e867f626554dab8539dcc5a3f
063a49f80334a98eed3aa66c60700f83feae7e4f
96bf4d70d0fcf69ce33ed735e720a716dab9a1232995a24882ec242323db467b

HTTP Headers

GET /s/pathwaygothicone/v14/MwQrbgD32-KAvjkYGNUUxAtW7pEBwx-tS1Zf.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://goldfieldssanddrags.com.au
Connection: keep-alive
Referer: http://fonts.googleapis.com/

HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 7664
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 20 Oct 2022 13:20:28 GMT
Expires: Fri, 20 Oct 2023 13:20:28 GMT
Cache-Control: public, max-age=31536000
Age: 580266
Last-Modified: Mon, 09 May 2022 18:44:31 GMT
Content-Type: font/woff2

goldfieldssanddrags.com.au/Images/xGSDA-banner20152.png.pagespeed.ic.yyg8CorZnJ.png

110.173.224.245

200 OK

40 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Images/xGSDA-banner20152.png.pagespeed.ic.yyg8CorZnJ.png
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
PNG image data, 1115 x 230, 8-bit/color RGBA, non-interlaced\012- data
Size
40 kB (39974 bytes)
Hash
cb283c0a8ad99c9e35e897ba5cc16ab5
698a9f885c8a579b38e9b8323e7b8842f122e09a
a511450a7fcdd8368a9d72cec5433c9213e21063713f77cffb5f8b6ac18002f3

HTTP Headers

GET /Images/xGSDA-banner20152.png.pagespeed.ic.yyg8CorZnJ.png HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/A.Includes,,_stylesheet.css+shadowbox-3.0.3,,_shadowbox.css,Mcc.SWYPQG3nit.css.pagespeed.cf.ATtb0mcWzB.css
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
link: <http://goldfieldssanddrags.com.au/Images/GSDA-banner20152.png>; rel="canonical"
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:10 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:10 GMT
x-original-content-length: 59310
content-length: 39974
content-type: image/png

goldfieldssanddrags.com.au/Images/xmainbox,P20bottom.png.pagespeed.ic.7JVkZnLsni.png

110.173.224.245

200 OK

9.3 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Images/xmainbox,P20bottom.png.pagespeed.ic.7JVkZnLsni.png
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
PNG image data, 1130 x 63, 8-bit/color RGBA, non-interlaced\012- data
Size
9.3 kB (9321 bytes)
Hash
ec95646672ec9e2d9b364411de270b4c
0fcf06142fbc57f3510a130cc994e743be5f31d2
3adb5872e82047cd88871be028775015a6b9854c1cc3c3e10c9c7617ebf9b33b

HTTP Headers

GET /Images/xmainbox,P20bottom.png.pagespeed.ic.7JVkZnLsni.png HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/A.Includes,,_stylesheet.css+shadowbox-3.0.3,,_shadowbox.css,Mcc.SWYPQG3nit.css.pagespeed.cf.ATtb0mcWzB.css
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
link: <http://goldfieldssanddrags.com.au/Images/mainbox%20bottom.png>; rel="canonical"
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:10 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:10 GMT
x-original-content-length: 12189
content-length: 9321
content-type: image/png

goldfieldssanddrags.com.au/Images/xdirt,P20bg.png.pagespeed.ic.jY9QS0z_Kj.png

110.173.224.245

200 OK

347 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Images/xdirt,P20bg.png.pagespeed.ic.jY9QS0z_Kj.png
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
PNG image data, 524 x 321, 8-bit/color RGBA, non-interlaced\012- data
Size
347 kB (347188 bytes)
Hash
8d8f504b4cff2a38c53941ba95082453
b53571599cbf92a0702f2e8b9e238f5d8d3f595c
6f2203a133f5ea8becdabfe090d94b29e1f51d2f29bf814ec4091bee8ab5978d

HTTP Headers

GET /Images/xdirt,P20bg.png.pagespeed.ic.jY9QS0z_Kj.png HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/A.Includes,,_stylesheet.css+shadowbox-3.0.3,,_shadowbox.css,Mcc.SWYPQG3nit.css.pagespeed.cf.ATtb0mcWzB.css
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
link: <http://goldfieldssanddrags.com.au/Images/dirt%20bg.png>; rel="canonical"
accept-ranges: bytes
expires: Fri, 27 Oct 2023 06:31:10 GMT
cache-control: max-age=31536000
etag: W/"0"
last-modified: Thu, 27 Oct 2022 06:31:10 GMT
x-original-content-length: 358709
content-length: 347188
content-type: image/png

goldfieldssanddrags.com.au/Images/favicon.ico

110.173.224.245

200 OK

33 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Images/favicon.ico
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
33 kB (32988 bytes)
Hash
44a2b17ccb4bc0274eaa14ae24f3ee1c
dba17e06fac1eb7b441569986ce91f27ae0f9acc
3a0c370215a753f8608cfb703dd4817ec3050c20ce77101217acd80caa8be1a8

HTTP Headers

GET /Images/favicon.ico HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:35 GMT
server: Apache
last-modified: Wed, 27 Apr 2016 04:59:56 GMT
etag: "80dc-5317047f12601"
accept-ranges: bytes
content-length: 32988
content-type: image/vnd.microsoft.icon

goldfieldssanddrags.com.au/Includes/tiza-webfont.woff

110.173.224.245

200 OK

358 kB

URL HTTP/1.1
goldfieldssanddrags.com.au/Includes/tiza-webfont.woff
IP
110.173.224.245:0
ASN
#45926 Web In A Box

File type
Web Open Font Format, TrueType, length 358312, version 1.0\012- data
Size
358 kB (358312 bytes)
Hash
b1ad49b3b7fc432925f0e62a73f6e9fb
f6c246004eb8ad6acb903fc65a6276cdb651c3e6
6b1c1054cf468901bc8eca2bdc8a19253c34c55cc2551f10d2b2ff684973066c

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /Includes/tiza-webfont.woff HTTP/1.1
Host: goldfieldssanddrags.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://goldfieldssanddrags.com.au/A.Includes,,_stylesheet.css+shadowbox-3.0.3,,_shadowbox.css,Mcc.SWYPQG3nit.css.pagespeed.cf.ATtb0mcWzB.css
Cookie: PHPSESSID=ak2d1eplnm0t4auj8q64ren0p3

HTTP/1.1 200 OK
date: Thu, 27 Oct 2022 06:31:34 GMT
server: Apache
last-modified: Wed, 27 Apr 2016 05:07:07 GMT
etag: "577a8-5317061a5b6b4"
accept-ranges: bytes
content-length: 358312
content-type: font/woff

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (40)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size