authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
20.254.66.73200 OK 25 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Non-ISO extended-ASCII text, with very long lines (2059)
Hash 3025114ae85d9c2dea7aea2731c3b263
3dc18a0b4871acd511ccf011734e4aa2a81e808c
936e8cb7e06810139eedf1eb60ecd96a433efb40923f64d3065d2d3d7b3c875a
GET /141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20 HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 6ed951622549ed76959631f8a1bf497b
682b2dd2a72190510e3fa7bdb0c0c6f25a322dfb
86f5e5ae2da408a899d16c83b7ca441033ac0c30062cd29f2db1b1b5be666746
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "86F5E5AE2DA408A899D16C83B7CA441033AC0C30062CD29F2DB1B1B5BE666746"
Last-Modified: Sat, 19 Nov 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19397
Expires: Sun, 20 Nov 2022 09:44:07 GMT
Date: Sun, 20 Nov 2022 04:20:50 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash f732c50f6a2482aeea20552e0370c2d0
6f33119d5c38e92a0a62f3a46766ff86014e4d68
a47e38c199c5fecd5594544a3889e1cfca5547d85f19056f06eaeeadf17f4fe9
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5834
Cache-Control: max-age=114457
Content-Type: application/ocsp-response
Date: Sun, 20 Nov 2022 04:20:50 GMT
Etag: "6378b071-1d7"
Expires: Mon, 21 Nov 2022 12:08:27 GMT
Last-Modified: Sat, 19 Nov 2022 10:31:13 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 1cee7787feebac18f9eca273e56e3741
3a7dac544172921e24c2a1701beef5079b21d01b
79ff4a450c749d64e116c00ca3b00d40e968906c5c3881d6eeb2dc6374a4c858
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "79FF4A450C749D64E116C00CA3B00D40E968906C5C3881D6EEB2DC6374A4C858"
Last-Modified: Sat, 19 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2945
Expires: Sun, 20 Nov 2022 05:09:56 GMT
Date: Sun, 20 Nov 2022 04:20:51 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash d130218d0e2841f39c99610fe1a2ab90
29fbe1e177ee55c7a61ae0a206afff271cf5f945
6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 20 Nov 2022 03:44:58 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2153
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 9ewmOQD+ZbBB2WrdDieIikXrBD/nE+iccGLSC7W+UlxiDDMFO7k+JXgg/r0pLX6/nnJpF5Q2O48=
x-amz-request-id: 7E2NGQF5DEWMBTYJ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 20 Nov 2022 03:38:34 GMT
age: 2537
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 20 Nov 2022 04:20:51 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/normalize.css
20.254.66.73200 OK 9.7 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/normalize.css
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash ebb479dd9f58736c30739ce9e551010d
f9751153a26e815f3161abd77e1a2a3f97a02ae6
90cb33de6ced42c1ce82fd4a3a0b014f2ce29179ab85e24ebfa7abd73fabd9d8
GET /141425a8dae60d847ff1722989fa810d/css/normalize.css HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 9696
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/flows.css
20.254.66.73200 OK 8.9 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/flows.css
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash 63b00c36f13f7bd0112c5d3c6e0d1ad0
f5ea43b50ab8c8d12317dcd56d953cd640ec0133
785818872f719d6d46b9e00e9cdb942779f111aec0421d983ad2a6e02b0e8c3a
GET /141425a8dae60d847ff1722989fa810d/css/flows.css HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 8900
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/jquery-ui-1.10.3.custom.min.css
20.254.66.73200 OK 22 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/jquery-ui-1.10.3.custom.min.css
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type ASCII text, with very long lines (1404)
Hash 75c7f7f34cb3c6deb89891e022266252
4ba3a397da8746f97b53186e6ec14e704bda003a
daa294bf8eaa7ddd13aeb7d3d462fb53f0c8b080ed1abe2531360892408327cf
GET /141425a8dae60d847ff1722989fa810d/css/jquery-ui-1.10.3.custom.min.css HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 22332
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/ad-containers.css
20.254.66.73200 OK 7.6 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/ad-containers.css
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash 10cf523dd8bc660eb53f3c56783f5fed
9f6df41bda3d811f4d774544f15573023e25eca8
27fd729324c41d300a6f74a95b20b54feca49388cbffeb89933bb18b5764a7b5
GET /141425a8dae60d847ff1722989fa810d/css/ad-containers.css HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 7585
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/citizensns.min.44438.css
20.254.66.73200 OK 5.8 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/citizensns.min.44438.css
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d9cd3279c50bebdf7371f4c6db6d0d1d
74c0f0bf7786f8bc6d33b831a7d92897fe321fd0
f832c2f83056bbd60a50417f461897bfa4e783df933cafeb7fe91ddf81f6ae33
GET /141425a8dae60d847ff1722989fa810d/css/citizensns.min.44438.css HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 5849
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/cp_challenge/sec-3-5.css
20.254.66.73200 OK 2.3 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/cp_challenge/sec-3-5.css
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash a8d7730ebae7d5a0f9f1b28705910c82
8c2a3f4543d2326f5803e32ceda9ce60572cafc6
e094fbcf1596ac0af1fe05cd7d6b8724b77dc71c9219deb63738ccae1fdeb2ad
GET /141425a8dae60d847ff1722989fa810d/cp_challenge/sec-3-5.css HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 2277
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
20.254.66.73200 OK 61 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash 5c037b9fa5c1436afc0beef12818a53a
e3208a8dd6d2bbd84631b9a59a044653ebd766f0
3e1e20f8191f692da7ac00c865c48320c19e71585d471a02e2b93e3b3c0b1fc3
GET /141425a8dae60d847ff1722989fa810d/css/main.css HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 60617
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/CTZ_Green-01.png
20.254.66.73200 OK 5.3 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/CTZ_Green-01.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type PNG image data, 406 x 50, 8-bit/color RGBA, non-interlaced\012- data
Hash beb4d1c9f430bb08a4ed54df069e8f0c
39950ddd690d1cbe2d08610da5c11c854450523f
bf99a3203217c802888087df8a2c84b92e087829e7e24d38581a57cee763923b
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/CTZ_Green-01.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 5277
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/lock.png
20.254.66.73200 OK 349 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/lock.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type PNG image data, 29 x 29, 8-bit/color RGBA, non-interlaced\012- data
Hash 6f9f05d66a5410b90817d0cc6db92b03
891273e368982cdd9ce5408dda3877c52fe72a2e
9b87191a74f704fe3c917fe2a2f17fa3ac20da84f1c361cd3f41802a437f61d5
GET /141425a8dae60d847ff1722989fa810d/img/lock.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 349
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-linkedin.png
20.254.66.73200 OK 3.2 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-linkedin.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type PNG image data, 25 x 21, 8-bit/color RGBA, non-interlaced\012- data
Hash b187d1cd61b1912b22ebfb4efce30bad
b502a6ed3e50ffe6da8d8d5114fd404650d38ea7
fe3ddc37707c93f338a1f6359dfa03019e096df14454808aaccbb7538aa3c67b
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/footer-follow-linkedin.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 3239
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/fdicFooter.gif
20.254.66.73200 OK 2.2 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/fdicFooter.gif
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 56 x 24\012- data
Hash a0742f4f717eac3a1e61f53cbbec74f2
f85639ee91bccd2bddaf043b80c892ae6b700d49
dddb031e5144ce20d909dbf4829d637738efa477bf5ab4eab67b1990ef0efb2d
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/fdicFooter.gif HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 2245
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/gif
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/equal-housing.gif
20.254.66.73200 OK 1.1 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/equal-housing.gif
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 14 x 9\012- data
Hash 39fc59327cb01ffbd5ab0ece1b08fba4
6cc1099707564164c3de6f94714808cdb1c415a7
319d82f567037eafefea25abbc64ea902db9255c5e7231fe9ddd462e4f5b9149
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/equal-housing.gif HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 1134
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/gif
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-facebook.png
20.254.66.73200 OK 395 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-facebook.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type PNG image data, 28 x 21, 8-bit/color RGB, non-interlaced\012- data
Hash 25dbaaa7fa1bf41ca6614f1d2cf699f5
56a9e2459a275ef7178ff8c90c2b277265f64fb0
eb175662762ef5f2c9011cc1c4f9d09361c50a366fad8a544bda1c439b99d3a0
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/footer-follow-facebook.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 395
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-twitter.png
20.254.66.73200 OK 3.3 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-twitter.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type PNG image data, 25 x 21, 8-bit/color RGBA, non-interlaced\012- data
Hash ab8d8dc7ea3d7b572b2dc47f2aebe5ae
900c9f837d9a015e6609b14eed6d99c384ec5441
9b4ffac9ea755d2aaff724fa471d90fd63ae5648e18f60a67db0a5c3bffd84e5
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/footer-follow-twitter.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 3295
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-youtube.png
20.254.66.73200 OK 3.3 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/footer-follow-youtube.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type PNG image data, 25 x 21, 8-bit/color RGBA, non-interlaced\012- data
Hash 09c8c4f0f417a049b8ab6acdd2581717
2c9dbf84a80167a9c7b41e5955969dd4d1d75c6f
9af5181113e5d0eacfc3d9c0b3ad627dc3ad50708755fbe45ab18e0cad4f3b36
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/footer-follow-youtube.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 3278
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/elh.gif
20.254.66.73200 OK 1.4 kB URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/img/elh.gif
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 31 x 24\012- data
Hash f79e78d673f51194d9b9021cbc72b5b3
79a917fad527cef8d96af24d142653f2f49109b3
56c43c6f5c8209acd47f355810bca2f9b0fc86c4bbdf1361d60fb2d2e2e66f8c
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/img/elh.gif HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/?cont=qerldmlsbwfzaza5&token=107849bf1aa2407151c0c4119281db20
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 1433
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/gif
authctznma1n0.selfip.com/efs/efs/grafx/icon-secure.png
20.254.66.73404 Not Found 315 B URL HTTP/1.1 authctznma1n0.selfip.com/efs/efs/grafx/icon-secure.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /efs/efs/grafx/icon-secure.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/flows.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 404 Not Found
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
authctznma1n0.selfip.com/efs/efs/grafx/flows-tooltip.png
20.254.66.73404 Not Found 315 B URL HTTP/1.1 authctznma1n0.selfip.com/efs/efs/grafx/flows-tooltip.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /efs/efs/grafx/flows-tooltip.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/flows.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 404 Not Found
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
authctznma1n0.selfip.com/efs/efs/grafx/arrow-button-white.png
20.254.66.73404 Not Found 315 B URL HTTP/1.1 authctznma1n0.selfip.com/efs/efs/grafx/arrow-button-white.png
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /efs/efs/grafx/arrow-button-white.png HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/flows.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 404 Not Found
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_roman.woff
20.254.66.73200 OK 94 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_roman.woff
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type ASCII text, with no line terminators
Hash 494d5b5f24f681e3c43b52ea9bb1be4c
005ceb2099f9c3bf423ddb401479ee0a9dd8d63c
02d0c08ceab09da804ddb85b4e50adad35b9688dbcada103e8b03c61c4d393b1
GET /141425a8dae60d847ff1722989fa810d/css/font/citizen_roman.woff HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 94
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_book.woff
20.254.66.73200 OK 93 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_book.woff
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type ASCII text, with no line terminators
Hash 2d3d1e9a820451d4aba30a6189adb344
5c2c9a1aab30b6d9c8af0eb29a59aa490b4cc8ab
15d76789030592dfced7878a6fcbb4222f0780b2e189bd5ffecc28eca68f577b
GET /141425a8dae60d847ff1722989fa810d/css/font/citizen_book.woff HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 93
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_extrabold.woff
20.254.66.73200 OK 98 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_extrabold.woff
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type ASCII text, with no line terminators
Hash 10477bffd26aae2d95743e565223edfa
f38c4988d4931d392cc889f6113d8b3261d631bd
ae61a4d9e2535ffa02754fa06adf4762452a4ee0d7fa2f08ec90d923a0463a30
GET /141425a8dae60d847ff1722989fa810d/css/font/citizen_extrabold.woff HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Last-Modified: Sat, 19 Nov 2022 21:41:51 GMT
Accept-Ranges: bytes
Content-Length: 98
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: font/woff
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_book.ttf
20.254.66.73404 Not Found 315 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_book.ttf
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/css/font/citizen_book.ttf HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 404 Not Found
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_roman.ttf
20.254.66.73404 Not Found 315 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_roman.ttf
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/css/font/citizen_roman.ttf HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 404 Not Found
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_extrabold.ttf
20.254.66.73404 Not Found 315 B URL HTTP/1.1 authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/font/citizen_extrabold.ttf
IP 20.254.66.73:0
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Analyzer Verdict Alert urlquery Phishing - Citizens Bank
GET /141425a8dae60d847ff1722989fa810d/css/font/citizen_extrabold.ttf HTTP/1.1
Host: authctznma1n0.selfip.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/141425a8dae60d847ff1722989fa810d/css/main.css
Cookie: PHPSESSID=ea75a8bfaf04dd0eb6bc851b66a785c3
HTTP/1.1 404 Not Found
Date: Sun, 20 Nov 2022 04:20:51 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
ocsp.sectigo.com/
172.64.155.188200 OK 472 B IP 172.64.155.188:0
Hash 2a5268017008ffb2166d5bea44b13f95
5eb4d1cc2fe740f07c9839dbc2bc785ffb058c2d
212e0380898762a2bbdedd642b12742dcc1146918b0f4735a5b3c737e5b202c3
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 17:40:04 GMT
Expires: Sat, 26 Nov 2022 17:40:03 GMT
Etag: "5eb4d1cc2fe740f07c9839dbc2bc785ffb058c2d"
Cache-Control: max-age=565751,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76ce653df9f5b50f-OSL
ocsp.sectigo.com/
172.64.155.188200 OK 472 B IP 172.64.155.188:0
Hash 2a5268017008ffb2166d5bea44b13f95
5eb4d1cc2fe740f07c9839dbc2bc785ffb058c2d
212e0380898762a2bbdedd642b12742dcc1146918b0f4735a5b3c737e5b202c3
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 20 Nov 2022 04:20:51 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 17:40:04 GMT
Expires: Sat, 26 Nov 2022 17:40:03 GMT
Etag: "5eb4d1cc2fe740f07c9839dbc2bc785ffb058c2d"
Cache-Control: max-age=565751,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 76ce653e0817b4e8-OSL
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
34.102.187.140200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 20 Nov 2022 03:44:49 GMT
cache-control: public,max-age=3600
age: 2162
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 060d538b33e370fcd033339830d33a42
4a37d427988358eb318e18e2678c3484ef4a5ebd
efa33f92547243814b5bd3bca4f94d26055d590a4431611b3ba251a8d774bfbb
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3397
Cache-Control: max-age=106958
Content-Type: application/ocsp-response
Date: Sun, 20 Nov 2022 04:20:51 GMT
Etag: "63789cac-1d7"
Expires: Mon, 21 Nov 2022 10:03:29 GMT
Last-Modified: Sat, 19 Nov 2022 09:06:52 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
52.38.139.17101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 52.38.139.17:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 0y6ksfBBh6BGByuJ1EOKjA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: yRTMiEUThl5s4RGQtIuXr4p8GXQ=
devilsms.live/clve-min.js
199.188.200.254200 OK 51 kB URL HTTP/2 devilsms.live/clve-min.js
IP 199.188.200.254:0
File type ASCII text, with very long lines (65536), with no line terminators
Hash 724ad5d75674097f5d14e70982a3bc6e
87146103e33be6cdf8d828351685c70f2a6cb7e3
d1a51f6f6c798129732b8ae1c654d6a68af918bb63e05b45c75cf4c614c27260
GET /clve-min.js HTTP/1.1
Host: devilsms.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Sun, 27 Nov 2022 04:20:51 GMT
content-type: application/javascript
last-modified: Mon, 07 Feb 2022 11:17:03 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 51069
date: Sun, 20 Nov 2022 04:20:51 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
devilsms.live/cleave.js
199.188.200.254200 OK 18 kB IP 199.188.200.254:0
File type Unicode text, UTF-8 text, with very long lines (1712)
Hash fe9f66e28ad0fde897ddcb9571324491
e5ab8ed2bad2578458397898778be698dff70917
ece3c9456921c261029e7ae1b7eddd2265e8afdf1aeb78f9eafad2ea55d5e92f
GET /cleave.js HTTP/1.1
Host: devilsms.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Sun, 27 Nov 2022 04:20:51 GMT
content-type: application/javascript
last-modified: Sun, 30 Jan 2022 13:07:42 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 18428
date: Sun, 20 Nov 2022 04:20:51 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 09674978f0d63241f9c13551fc25355e
5881bcbfe4d2fc49e63e206d164e321c96642510
1e9c4601538a7bc1faae2fbcb070d2eb0fda54e26e476bf5471dce0637cc1f5b
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 20 Nov 2022 04:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 20 Nov 2022 03:37:03 GMT
Expires: Mon, 21 Nov 2022 03:37:03 GMT
ETag: "5881bcbfe4d2fc49e63e206d164e321c96642510"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
t.me/Devilmask09
149.154.167.99200 OK 4.1 kB IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (3560)
Hash 942dcf9aa76cab19cf1cd069d2ea0632
0d6486dcc2d0e73c7408f01a36d47594b3e8857a
89a7bbd7729755634d09aa4958b5264f28d5f718acbe944f0166ab34eb39969f
GET /Devilmask09 HTTP/1.1
Host: t.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://authctznma1n0.selfip.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:52 GMT
content-type: text/html; charset=utf-8
content-length: 4064
set-cookie: stel_ssid=5ab6ec9199780590fe_16983421715570104296; expires=Mon, 21 Nov 2022 04:20:52 GMT; path=/; samesite=None; secure; HttpOnly
pragma: no-cache
cache-control: no-store
x-frame-options: ALLOW-FROM https://web.telegram.org
content-security-policy: frame-ancestors https://web.telegram.org
content-encoding: gzip
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1d4/6yJZH6zwO-k
142.250.74.35200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1d4/6yJZH6zwO-k
IP 142.250.74.35:0
Hash 6d0852ae04967e107b1eb5155b63554b
45fdca8b189c452adc16365230f7d4f64117ddb7
8ef38309c3e015389e09ee6968439be06bde9c3b098bd4e02ec73a56b16986f7
POST /s/gts1d4/6yJZH6zwO-k HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 20 Nov 2022 04:20:52 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 86ba89363231a3ef683c73ecab87b605
f45afc34e03528160583cdba2fd40add2c574352
20e7b604e58a0360ff5ca54b72fa1837033872db57b8d451a2b08dc9f6ebfcb5
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 20 Nov 2022 04:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 19 Nov 2022 19:45:39 GMT
Expires: Sun, 20 Nov 2022 19:45:39 GMT
ETag: "f45afc34e03528160583cdba2fd40add2c574352"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 86ba89363231a3ef683c73ecab87b605
f45afc34e03528160583cdba2fd40add2c574352
20e7b604e58a0360ff5ca54b72fa1837033872db57b8d451a2b08dc9f6ebfcb5
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 20 Nov 2022 04:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 19 Nov 2022 19:45:39 GMT
Expires: Sun, 20 Nov 2022 19:45:39 GMT
ETag: "f45afc34e03528160583cdba2fd40add2c574352"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 86ba89363231a3ef683c73ecab87b605
f45afc34e03528160583cdba2fd40add2c574352
20e7b604e58a0360ff5ca54b72fa1837033872db57b8d451a2b08dc9f6ebfcb5
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 20 Nov 2022 04:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 19 Nov 2022 19:45:39 GMT
Expires: Sun, 20 Nov 2022 19:45:39 GMT
ETag: "f45afc34e03528160583cdba2fd40add2c574352"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 86ba89363231a3ef683c73ecab87b605
f45afc34e03528160583cdba2fd40add2c574352
20e7b604e58a0360ff5ca54b72fa1837033872db57b8d451a2b08dc9f6ebfcb5
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 20 Nov 2022 04:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 19 Nov 2022 19:45:39 GMT
Expires: Sun, 20 Nov 2022 19:45:39 GMT
ETag: "f45afc34e03528160583cdba2fd40add2c574352"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
telegram.org/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
149.154.167.99200 OK 11 kB URL HTTP/2 telegram.org/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
File type Web Open Font Format (Version 2), TrueType, length 11028, version 1.0\012- data
Hash 1f6d3cf6d38f25d83d95f5a800b8cac3
279f300ca2cbbdf9f5036ef2f438607fbf377daa
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
GET /fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://t.me
Connection: keep-alive
Referer: https://telegram.org/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: application/octet-stream
content-length: 11028
last-modified: Thu, 20 Oct 2022 11:05:33 GMT
etag: "63512b7d-2b14"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
149.154.167.99200 OK 11 kB URL HTTP/2 telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
File type Web Open Font Format (Version 2), TrueType, length 11040, version 1.0\012- data
Hash 5e22a46c04d947a36ea0cad07afcc9e1
6091d981c2a4ee975c7f6b56186ee698040bb804
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
GET /fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://t.me
Connection: keep-alive
Referer: https://telegram.org/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: application/octet-stream
content-length: 11040
last-modified: Thu, 20 Oct 2022 11:05:33 GMT
etag: "63512b7d-2b20"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
telegram.org/img/apple-touch-icon.png
149.154.167.99200 OK 5.6 kB URL HTTP/2 telegram.org/img/apple-touch-icon.png
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
File type PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced\012- data
Hash 295ccdb03006b8dfef45090dafbd46ac
491ab660270e47cbac6a5731c51cca71c1c1b2b1
a51d667d4262047c23e3a2a8aac3b46dc8a58c686cc013f2354011c07bf22cf3
GET /img/apple-touch-icon.png HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: image/png
content-length: 5644
last-modified: Thu, 21 Apr 2022 13:47:47 GMT
etag: "62616083-160c"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn1.telegram-cdn.org/file/ogwiVR2AYW3nyixhLvMQI-hzXaxMuH_VOIKpYNHBhYz1sNr9vkj0MhyBD_D8czwXkT-p4-yi-70eslESaj-93HLv2aY6OeSF9gnJFxgDG58ogATFuHOakwB193Ko6J6VHwFrnK_UOZjL-vpu4EaK1BniIXtvnWlfvejpI-1EmsVZEkAyD9d_OnDNHWKvUCJi_GVA73zFtuMKeVlRouujwnn2s_B1c6Vxrq9zLD2UJpM3z3SMHiiTpYZUW4PK19mzPjHoE5L8kGr1lq8jfZanFBYR_EC0nB5KzUtnz5UXlH8w7Ph25PI7q_gBiTvGCG0yeQZu1LTdBSf8oOit5jnkcg.jpg
34.111.15.3200 OK 21 kB URL HTTP/2 cdn1.telegram-cdn.org/file/ogwiVR2AYW3nyixhLvMQI-hzXaxMuH_VOIKpYNHBhYz1sNr9vkj0MhyBD_D8czwXkT-p4-yi-70eslESaj-93HLv2aY6OeSF9gnJFxgDG58ogATFuHOakwB193Ko6J6VHwFrnK_UOZjL-vpu4EaK1BniIXtvnWlfvejpI-1EmsVZEkAyD9d_OnDNHWKvUCJi_GVA73zFtuMKeVlRouujwnn2s_B1c6Vxrq9zLD2UJpM3z3SMHiiTpYZUW4PK19mzPjHoE5L8kGr1lq8jfZanFBYR_EC0nB5KzUtnz5UXlH8w7Ph25PI7q_gBiTvGCG0yeQZu1LTdBSf8oOit5jnkcg.jpg
IP 34.111.15.3:0
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 320x320, components 3\012- data
Hash 15186a51f12e6bc15f8ef8009f7118f5
75deab06f226241c2f851bad5a4a067096ae6587
1fca06217fb44097735458e04fda12ebcd44145d0372c43a4521d22ced90b672
GET /file/ogwiVR2AYW3nyixhLvMQI-hzXaxMuH_VOIKpYNHBhYz1sNr9vkj0MhyBD_D8czwXkT-p4-yi-70eslESaj-93HLv2aY6OeSF9gnJFxgDG58ogATFuHOakwB193Ko6J6VHwFrnK_UOZjL-vpu4EaK1BniIXtvnWlfvejpI-1EmsVZEkAyD9d_OnDNHWKvUCJi_GVA73zFtuMKeVlRouujwnn2s_B1c6Vxrq9zLD2UJpM3z3SMHiiTpYZUW4PK19mzPjHoE5L8kGr1lq8jfZanFBYR_EC0nB5KzUtnz5UXlH8w7Ph25PI7q_gBiTvGCG0yeQZu1LTdBSf8oOit5jnkcg.jpg HTTP/1.1
Host: cdn1.telegram-cdn.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: image/jpeg
content-length: 20965
access-control-allow-origin: *
x-content-type-options: nosniff
content-security-policy: default-src 'none'; sandbox
x-frame-options: DENY
x-xss-protection: 1; mode=block
access-control-expose-headers: Accept-Ranges, Content-Range, Content-Length
accept-ranges: bytes, bytes
cache-control: public,max-age=7200
etag: "aa1e7c42d28430f0883a3c6f02c0e342783ec4ae"
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
telegram.org/css/bootstrap.min.css?3
149.154.167.99200 OK 11 kB URL HTTP/2 telegram.org/css/bootstrap.min.css?3
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
Hash baef09498e924a5f688466e1a7b16bcd
43d5af5d99858c92912e8edd9b97548262a507be
1cd65c7634084747853865ff2402a94a763eb1722347feeb99255bc948319566
GET /css/bootstrap.min.css?3 HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: text/css
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
etag: W/"5a05e7c6-a61b"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
telegram.org/css/font-roboto.css?1
149.154.167.99200 OK 1.2 kB URL HTTP/2 telegram.org/css/font-roboto.css?1
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
Hash a7369a1b9ba7e91c1cdc49186ea2b6ad
0e7edbb760572763c07b1eeede5d078820974d7f
b87723835c98255e0a67bf8b5f087741e616b3c1e47fe9e5c6aa9cfb6db8cede
GET /css/font-roboto.css?1 HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: text/css
last-modified: Thu, 20 Oct 2022 11:05:33 GMT
etag: W/"63512b7d-1816"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6151
Expires: Sun, 20 Nov 2022 06:03:24 GMT
Date: Sun, 20 Nov 2022 04:20:53 GMT
Connection: keep-alive
telegram.org/css/telegram.css?232
149.154.167.99200 OK 30 kB URL HTTP/2 telegram.org/css/telegram.css?232
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
Hash 295771cb44c838df25af35871b4ebeb6
f012b4a494f4b6dc596f7c718f78d7edf6286400
4397befb1bebe7a38b97bf70649157ca79d033e908b1199ff8c065a725453495
GET /css/telegram.css?232 HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: text/css
last-modified: Tue, 13 Sep 2022 16:00:52 GMT
etag: W/"6320a934-1ca4a"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f7c5da16d7c4384a4c2454d6b0d84710
69fd80fdf2f1ce27b25617589c867cd1c6e5d2ab
a80d1b813523e44d2e59d7c2edd6919c0354873637bb15bccc88f66f5c24e05d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A80D1B813523E44D2E59D7C2EDD6919C0354873637BB15BCCC88F66F5C24E05D"
Last-Modified: Thu, 17 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6151
Expires: Sun, 20 Nov 2022 06:03:24 GMT
Date: Sun, 20 Nov 2022 04:20:53 GMT
Connection: keep-alive
telegram.org/img/tgme/pattern.svg
149.154.167.99200 OK 84 kB URL HTTP/2 telegram.org/img/tgme/pattern.svg
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
Hash c7aeefeedd8a55fd7cd3da21dce3abf8
8f5e1e443eb6fc6ebac117b965a3c607c81df296
43f6d9b4a045fd98fa63ff84d00ef2c5ba935544e0337a4e3e5d562e65ef6d9c
GET /img/tgme/pattern.svg HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://telegram.org/css/telegram.css?232
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: image/svg+xml
last-modified: Thu, 03 Mar 2022 09:45:08 GMT
etag: W/"62208e24-385d7"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ec00dd4-9302-4378-82e1-eb2f8686bdc7.jpeg
34.120.237.76200 OK 14 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ec00dd4-9302-4378-82e1-eb2f8686bdc7.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6653147acce57a88af20de89d4f40239
d097755b7cafd14d6dcf18fe09d0a3237a1057dd
5d0166eacfa748026865e4461b1a1c0fb7373e0fb7de16b266f3eee6b816f5f6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ec00dd4-9302-4378-82e1-eb2f8686bdc7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13671
x-amzn-requestid: 26e11776-b559-4325-9082-df4b9366715e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3jWaFEZoAMFb3w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794c28-0117d3a633ab918d6179fa87;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:35:36 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: IwyX_NEXHb8YvHaYou8CndLh9PR-S7OR-M6hiKNCLXuSB218dIMlfA==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 21:38:45 GMT
age: 24128
etag: "d097755b7cafd14d6dcf18fe09d0a3237a1057dd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b07f2a3-725f-4aa2-afa2-375328b55ea8.jpeg
34.120.237.76200 OK 5.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b07f2a3-725f-4aa2-afa2-375328b55ea8.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4454f87c40e9b7c5de9853c1ec6f0671
119aac07a88e7c358bf353335f3a81039ca9943b
e909f823611609282c643c58ccc7b267dcfc09970e58b66742dc8baf7cda5bf4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b07f2a3-725f-4aa2-afa2-375328b55ea8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5699
x-amzn-requestid: ea538aed-2b5a-4940-b49f-b4703a556956
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3i6KHnQoAMFu3Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794b74-2f756f9a27ddc4b001cdaff2;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:32:36 GMT
x-amz-cf-pop: SEA19-C3, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: w4JqPNmzHlUl4EMM2osU4Z5dtroFWOB0DL5ylePs6XBbIdxpsPItnQ==
via: 1.1 219e8f088c8c2a564bdacafe44be620a.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 21:41:31 GMT
etag: "119aac07a88e7c358bf353335f3a81039ca9943b"
content-type: image/jpeg
age: 23962
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffb73669f-154c-41e7-aadd-11587277938d.webp
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffb73669f-154c-41e7-aadd-11587277938d.webp
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a5447e0a57fbd65d5f719786842dfb40
68dbd2b4ecedb47d3f47bc3690336fe0f3fd3fe6
b6f69c679ecb9978c12f9fc5e03531250e1e13327ac0337532317b91d2ede502
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffb73669f-154c-41e7-aadd-11587277938d.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10330
x-amzn-requestid: c6df2fa3-53ad-4f43-ab26-8754ce25c421
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3jdVGY0oAMF_2w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794c55-0dd776a50b4a8fbb5b29ccae;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:36:21 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: sKTa_b92EIi4H8YgHoEJCm8rVgdfCFJ91I1UNkGLzsPQVOI10I9d7w==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 9c675215120a4ade8754c4357ef2f3ea.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 21:45:57 GMT
age: 23696
etag: "68dbd2b4ecedb47d3f47bc3690336fe0f3fd3fe6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19c1a99-6290-4f30-afcf-c426abf8c229.png
34.120.237.76200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19c1a99-6290-4f30-afcf-c426abf8c229.png
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 907cdf495815b066cbeaccd9c862c544
6082de99b599bc3c9ce14e2641a2bf60f9f187d8
fbccb495391bba54b463e8c4eaf3207af00b098c4b5f816011d240257aa56f6c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19c1a99-6290-4f30-afcf-c426abf8c229.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11562
x-amzn-requestid: f01b0409-b43d-4d9c-92c0-0023c5e49d58
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3jV_GDmIAMFvqA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794c26-69366c73760dcd5b72634f73;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:35:34 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: QNyLmlKXlMlR06NR0JSad678o8CCBsH3bDIvgDIy-j1uoi72NohCrA==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 21:46:32 GMT
age: 23661
etag: "6082de99b599bc3c9ce14e2641a2bf60f9f187d8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0a474c96-6cd7-4e42-a54a-02217768182e.jpeg
34.120.237.76200 OK 8.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0a474c96-6cd7-4e42-a54a-02217768182e.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c8f6118fc03f31862ff68fef8a2b9a7f
318c5d7acd0d36c816b09fcf1b7dc4bfb5ec7e73
cdd4d44f05cc524d7f2b1d6d792ecd8a9a933e52ecb7685a7d7ea786a510ef39
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0a474c96-6cd7-4e42-a54a-02217768182e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8089
x-amzn-requestid: f3c55266-9b03-4b7f-b076-fdf56704318e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b0QQyECioAMFzdQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6377fa6b-3e10cef6117a10a4115cfce7;Sampled=0
x-amzn-remapped-date: Fri, 18 Nov 2022 21:34:35 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: ngJvyUydpRDSiYy9kfeh8JmydmR_K8mjfZtGLgT0qeE2JaABbDMSaQ==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 21:36:28 GMT
age: 24265
etag: "318c5d7acd0d36c816b09fcf1b7dc4bfb5ec7e73"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
telegram.org/js/tgwallpaper.min.js?3
149.154.167.99200 OK 14 kB URL HTTP/2 telegram.org/js/tgwallpaper.min.js?3
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
Hash 7bc61e5f9911b721dca70a9f09098541
09c97e9d199d1f3088187886c829461a169c9e6d
3cfc1ce8d5334cedfa1b13909fa6fc1459ad1847a9e9a9e8bca41a058bd2af8f
GET /js/tgwallpaper.min.js?3 HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: application/javascript
last-modified: Thu, 03 Mar 2022 19:57:25 GMT
etag: W/"62211da5-ba3"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
telegram.org/img/website_icon.svg?4
149.154.167.99200 OK 0 B URL HTTP/2 telegram.org/img/website_icon.svg?4
IP 149.154.167.99:0
ASN #62041 Telegram Messenger Inc
GET /img/website_icon.svg?4 HTTP/1.1
Host: telegram.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://t.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Sun, 20 Nov 2022 04:20:53 GMT
content-type: image/svg+xml
last-modified: Mon, 20 Jul 2020 20:41:37 GMT
etag: W/"5f160181-768"
expires: Thu, 24 Nov 2022 04:20:53 GMT
cache-control: max-age=345600
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2