r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6295
Expires: Fri, 02 Dec 2022 11:45:09 GMT
Date: Fri, 02 Dec 2022 10:00:14 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 0c748388899e8a8d3680355da2ea5020
903c620cd137613daafb0da0508c37b2f4a67212
39eab80e022a9a1732872d9926b0ace80f818ec5c535e36a18b539ea63786fb2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1699
Cache-Control: max-age=89957
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 10:00:14 GMT
Etag: "63888270-1d7"
Expires: Sat, 03 Dec 2022 10:59:31 GMT
Last-Modified: Thu, 01 Dec 2022 10:31:12 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11372
Expires: Fri, 02 Dec 2022 13:09:46 GMT
Date: Fri, 02 Dec 2022 10:00:14 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 02 Dec 2022 09:18:11 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2523
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: cM47jJGH2MnIM+9hQdCTye+2FaeuLmLbEaZIJIlzghQs3FMg5An+AA2YktG4S9DkboiUKIK6kBw=
x-amz-request-id: SCYK4QPNEKDDJVX9
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 02 Dec 2022 09:46:39 GMT
age: 815
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 10:00:14 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.instachaat.com/2/index.php
34.100.154.146301 Moved Permanently 421 B URL HTTP/1.1 www.instachaat.com/2/index.php
IP 34.100.154.146:0
ASN #396982 GOOGLE-CLOUD-PLATFORM
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash eadbdc107804dd537f7365bd6ff66b23
ef1c29969b6fc06988736d7ab6ed4a237bcc27cf
7546c86246a9458fff482f969df42eaa40f7f8f77785fd8939c23743a103bfb8
GET /2/index.php HTTP/1.1
Host: www.instachaat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 02 Dec 2022 10:00:14 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 421
Connection: keep-alive
Location: https://www.instachaat.com/2/index.php
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
34.102.187.140200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 02 Dec 2022 09:08:57 GMT
cache-control: public,max-age=3600
age: 3077
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 7f1f8fc556d1f7e0aea3e1208ee2fd1c
09c341a56ff876479cfc8a0505a5fef4a5d110f1
65adcf58887bcc23f73379f74ab19a61cfbb93285c95c64b44a6716eeacc1482
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1699
Cache-Control: max-age=171298
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 10:00:14 GMT
Etag: "6389c02e-1d7"
Expires: Sun, 04 Dec 2022 09:35:12 GMT
Last-Modified: Fri, 02 Dec 2022 09:06:54 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
54.148.84.125101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 54.148.84.125:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: LQCDsSbnj1Z5Xe7WjcBcxw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 9ZmfIKF07kubeaqW8GNCsMWS+Eo=
ocsp.r2m01.amazontrust.com/
54.230.80.227200 OK 471 B URL HTTP/1.1 ocsp.r2m01.amazontrust.com/
IP 54.230.80.227:0
Hash 752414d76752268cdb10c687ea063943
51bca0ce9af44743c109a0e52eafa572ef7aa3bf
6298273654aa78362335f836a56bdc5f692090fac3fd4a3b0b025a280e862b02
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=142220
Date: Fri, 02 Dec 2022 10:00:16 GMT
Etag: "638945bc-1d7"
Expires: Sun, 04 Dec 2022 01:30:36 GMT
Last-Modified: Fri, 02 Dec 2022 00:24:28 GMT
Server: ECS (dcb/7F80)
X-Cache: Miss from cloudfront
Via: 1.1 09ae414c9d6c5323d5147457ada70ec6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: fvUT_iXnu1aVTvAb5h-Gr82gEtcrJXWm9V9LzwwuIF2uvoMuCoiNVA==
Age: 3968
ae.etisalatt.com/prizewheel/fonts/SuisseIntl-Regular.woff2
54.230.111.11200 OK 80 kB URL HTTP/2 ae.etisalatt.com/prizewheel/fonts/SuisseIntl-Regular.woff2
IP 54.230.111.11:0
File type Web Open Font Format (Version 2), TrueType, length 79768, version 1.0\012- data
Hash 0cb2891ce4f48dff7e5c080eda8183bc
21b194737d3729714edac200d045a7db779ede56
b07af22f80a5af0f4c1487766d15c7f93ef0943b0044e10220422f14512094db
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/fonts/SuisseIntl-Regular.woff2 HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 79768
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:40 GMT
etag: "0cb2891ce4f48dff7e5c080eda8183bc"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: bhZ4YaUQGnZcdX9tO-jmdkm-uAooSOOqeNk3TB_aZkNf_VLp-oxm_g==
age: 49201
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/fonts/SuisseIntl-SemiBold.woff2
54.230.111.11200 OK 52 kB URL HTTP/2 ae.etisalatt.com/prizewheel/fonts/SuisseIntl-SemiBold.woff2
IP 54.230.111.11:0
File type Web Open Font Format (Version 2), TrueType, length 52304, version 1.0\012- data
Hash 3ad99a5c100306be6c2ec31e047fcf1f
549718e3a8da70946c6b5b0bf7ee9817d7477327
2c8fbf5368e55ff0e5a02e4cf5bb9b827f9659af23485f8b064678f07f6ab7f6
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/fonts/SuisseIntl-SemiBold.woff2 HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 52304
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:40 GMT
etag: "3ad99a5c100306be6c2ec31e047fcf1f"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: _zpcaU9msgs6G5y05aWwIokH7IOJI1w5cCXRBdAQ3STSGv_cRRZCXA==
age: 49201
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/search.svg
54.230.111.11200 OK 368 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/search.svg
IP 54.230.111.11:0
File type SVG Scalable Vector Graphics image\012- , ASCII text
Hash 2d2cb719b2a957b1948e70a9444781a3
9ca28ea6c081a2339e2cf32ba1b03431d2b396a9
d0d99424026d78e5e5c9cf56ba72836e7d52faf2ea898e69f1b89ee98d24e103
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/search.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 368
last-modified: Thu, 17 Nov 2022 07:12:38 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 01 Dec 2022 13:52:51 GMT
etag: "2d2cb719b2a957b1948e70a9444781a3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: y4jEX7_r5LqqvDM4c3k0_xjy7JzcL2YZNHomVQd706mEpFLIUopZQA==
age: 72446
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/uae.svg
54.230.111.11200 OK 325 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/uae.svg
IP 54.230.111.11:0
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with CRLF line terminators
Hash 8ae6708cbab0fe2eeddb8152d87e302c
4356a8be735e79a9b77261d53d0ebbd0ada77b2c
5e8518b8716de2fbd27c171d1626e100cff78483c33b50d4b91f37f2780f297a
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/uae.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 325
last-modified: Thu, 17 Nov 2022 07:12:39 GMT
accept-ranges: bytes
server: AmazonS3
date: Fri, 02 Dec 2022 07:57:05 GMT
etag: "8ae6708cbab0fe2eeddb8152d87e302c"
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: -Iz382bAXUp3435N1VPiigDuP2mQ-_3DB3T1t5sOYyvUq5cAENi5HQ==
age: 30225
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/prizewheel.webp
54.230.111.11200 OK 31 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/prizewheel.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash 4248a5c6c2063318cebff6fcd8d9a890
4b91d45199382e7faa8fd44c4aec09f455bf20f4
d46c09c521e1d4ff4aa70e3697b673ab7c746644bd58ccabf011cafa312d9a27
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/prizewheel.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 30582
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:37 GMT
etag: "4248a5c6c2063318cebff6fcd8d9a890"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: kvoxEtWJcUeH7Fvap5_TZkCQbQu9IPL7I2q68AmopS7TdDrV4XcF5Q==
age: 49200
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/iphone-13-pro.webp
54.230.111.11200 OK 14 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/iphone-13-pro.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash f38d9716425e68a47a2344619f9a8544
37cd461d83845e693f695cd41d54184e314ab2d2
213bbef0df4e8023d6cc1233ce04c873c7895ff7daa8835759717446ef2e674e
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/iphone-13-pro.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 14536
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:35 GMT
etag: "f38d9716425e68a47a2344619f9a8544"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: KxfmhPvc8iOH1eYCpFlDO79NtWvwyL04DBlNniYDZjYpByvj6bw8bA==
age: 49201
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/amex-card.svg
54.230.111.11200 OK 728 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/amex-card.svg
IP 54.230.111.11:0
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (442)
Hash 1e98590c575d77cfe48fc31435d023f8
71eae56d1544692141c2915b7bfb22b2a216f428
95c4f695e62afe789334a5d7daf5787632c66d9383e98a587daa06f4a8126f48
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/amex-card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 728
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:34 GMT
etag: "1e98590c575d77cfe48fc31435d023f8"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 11UnRTEqHTAho6CJdPaxrilG_9VxgPAf_9j9DLzgA0NUeOocmz2YMA==
age: 49201
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/card.svg
54.230.111.11200 OK 394 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/card.svg
IP 54.230.111.11:0
File type SVG Scalable Vector Graphics image\012- , ASCII text
Hash 4e5e506bb14a57f7d811018693925919
d52fcc5757c13cc50828a95bc668d6048d8b753c
4a2b069397940679ab99f94c81bf8c6f321640a4eae150bf11ad8ffde21b7386
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 394
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:34 GMT
etag: "4e5e506bb14a57f7d811018693925919"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: NASv4mzVaWt68f1M81T-pk8vnXQEaWM2X56F8u7m7HGyOI4Lrwj3cQ==
age: 49201
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/loader.gif
54.230.111.11200 OK 13 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/loader.gif
IP 54.230.111.11:0
File type GIF image data, version 89a, 80 x 80\012- data
Hash 33ebb0e5ec119476888a159bc240379a
3cff4e01aff8f5d31c69ed8a1d524f3c3969d3a8
741379665c0e88a3b4358a269c7673989f5d8056ed0fdc5d7da3baf0675a5caf
GET /prizewheel/img/loader.gif HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/gif
content-length: 13139
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:36 GMT
etag: "33ebb0e5ec119476888a159bc240379a"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: s9u2GVCZ2DIjMujiNhnvtwoJL4Khs8bEoGSD3AoqlfNznwFovp4HiQ==
age: 49201
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/prizewheel_static.webp
54.230.111.11200 OK 7.6 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/prizewheel_static.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash 24b39078b176ca248faea502d4bb4eb8
d3ff0c1079d55766bafe4f106202ead23b297b0c
9b4891241f589e47eee9eac29338b61ff53597864d355d2a69a5670c72f6b781
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/prizewheel_static.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 7572
last-modified: Thu, 17 Nov 2022 07:12:37 GMT
accept-ranges: bytes
server: AmazonS3
date: Fri, 02 Dec 2022 08:54:07 GMT
etag: "24b39078b176ca248faea502d4bb4eb8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: PFB0AWaNvFTAI7Pyn3beMp8tU-XQpFZSepsPll1_9DReQHKRxUiAZQ==
age: 3970
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/002.webp
54.230.111.11200 OK 746 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/002.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash d408e6a5447573b7fe391e13bf90993b
943e29a7857d3e374c7bf833f538143698b4c9d6
e2b8564b25c3345c3f35b91d9b23f0b8634622cbb9a5aa6b11328ef94f157415
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/002.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 746
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:30 GMT
etag: "d408e6a5447573b7fe391e13bf90993b"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: wLTDFzHouKfQRGhXtYOW3lMlPYICLemXAh9-Vbr4qnvcV4_55E36WA==
age: 49200
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/001.webp
54.230.111.11200 OK 4.6 kB URL HTTP/2 ae.etisalatt.com/prizewheel/profile/001.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash cbcbae1c4221bae18207c5a4b1fb92c7
26a4c72e0c3423cf093102c44807a5bff2cec5e6
85f9561d0f2e0169aaf46364b76ed893be8836f003d18e3256686638f29238d0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/001.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 4636
last-modified: Thu, 17 Nov 2022 07:12:30 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 01 Dec 2022 16:37:23 GMT
etag: "cbcbae1c4221bae18207c5a4b1fb92c7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: jS-LF87CzPpA3A6EEDiNSwJgO-yDNNVQxBM24F9PkQhZxpSq_dmxXg==
age: 62574
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/003.webp
54.230.111.11200 OK 1.6 kB URL HTTP/2 ae.etisalatt.com/prizewheel/profile/003.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash b3bc9451c2ec692eb1acd27af41217fd
84d8b211525c2d13c3942094f27fe170d332e49a
72b87e4a02658ddea2609db003787433dc4e25687abf66add082c60f2255de3c
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/003.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 1618
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:31 GMT
etag: "b3bc9451c2ec692eb1acd27af41217fd"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: bf2gzZbDWYhj3rxh9vDnB2O5qB2FpHCURV2g91tLZuwSN8EvIQ2WpQ==
age: 49200
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/005.webp
54.230.111.11200 OK 550 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/005.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash eea3d6e3d24609790bbc352794acc8d1
7821649a541c7e9f19e00d905eccb679a5007a50
43429df5d87a8bacaef1c0403b1435f001d20959df564211a42dee11422b192d
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/005.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 550
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:32 GMT
etag: "eea3d6e3d24609790bbc352794acc8d1"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 7w9PpQ9XbGuWKfSu7fH81kAsI6L5LnSLFdDr21Ive6W-nqCo1FXN6A==
age: 49200
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/proof.webp
54.230.111.11200 OK 107 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/proof.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 675x999, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size 107 kB (106552 bytes)
Hash 7a41c57a5f20f59df0c86a456df03b73
3af18f77f0c86315713cd2813364df2955b53ce9
2a73f37536709b848382998dcb9f0d83412d4f6287e9d08cfb2a7fc3a849efb1
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/proof.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 106552
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:38 GMT
etag: "7a41c57a5f20f59df0c86a456df03b73"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: yoWYREB7B9o9w_hgaZdzusC_ci8ux40Q0vdv06QNrla0PHFNK-NYKg==
age: 49200
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/004.webp
54.230.111.11200 OK 844 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/004.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 69d268d0aefc87f40a5dc7511996e4b3
2d6736aefa2c14a12f2cf3d11a453a5b4c73cc04
5bf6ed337a2677aabf8c18b9803a223f8355d3fc4f5502f30372e8213073b068
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/004.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 844
last-modified: Thu, 17 Nov 2022 07:12:31 GMT
accept-ranges: bytes
server: AmazonS3
date: Fri, 02 Dec 2022 10:00:16 GMT
etag: "69d268d0aefc87f40a5dc7511996e4b3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: URVrLHVS1qjjOANrO8Aq2lSlnX_LJZntgmXXp-aioV8mzmN_wsJcsg==
age: 732
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/006.webp
54.230.111.11200 OK 4.2 kB URL HTTP/2 ae.etisalatt.com/prizewheel/profile/006.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash 69284801ce9f9b405a549996d5a1c430
f03477f2889ba5b4a7b4a208589926e3aa65e020
e987099e2192f064e85639dbe8d688cafc230b55ce69672d100b31fd3a37e093
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/006.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 4196
date: Fri, 02 Dec 2022 01:36:33 GMT
last-modified: Thu, 17 Nov 2022 07:12:32 GMT
etag: "69284801ce9f9b405a549996d5a1c430"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: xU2UMKnHTPdsUmNv5_0Aqik3jfpv6OcTxpPU2aVzVXF4UtmJEf9rPw==
age: 30224
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/007.webp
54.230.111.11200 OK 832 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/007.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 6f81c766e00137c85cf67b14980650e5
6f2bf6b5b23739baa3d857d3d215d4bdec9826c9
cd4bd93d59f8db1ee2d2be6a3ee251f6f3bfbd87370634f56913e9694bedceb7
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/007.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 832
last-modified: Thu, 17 Nov 2022 07:12:33 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 01 Dec 2022 17:22:00 GMT
etag: "6f81c766e00137c85cf67b14980650e5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: HvnAFTTlanzu5hu8H8x5xvM0Je-hbBmiCaVO6LZL3leo1NSDYb_3Ig==
age: 59897
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/008.webp
54.230.111.11200 OK 670 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/008.webp
IP 54.230.111.11:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash b9ef42055973840578c52f466cc7798e
fc46fcdfb9433f24432609297a3c26e704bba129
d9d9c952d9c4ed5d1c8b9a6de53451458d638c7612c5f9ac91cb0f526bc255d7
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/008.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 670
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:33 GMT
etag: "b9ef42055973840578c52f466cc7798e"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 1PIpD8lGaS10ONWUmIZEfaj8ephms0vRQAtEb1wu3S4AjAuLco484g==
age: 49200
X-Firefox-Spdy: h2
link.etisalatt.com/d/.js?lpref=&lpurl=https%3A%2F%2Fae.etisalatt.com%2Fprizewheel%2Findex.html%3Fcpid%3D9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82%26lpid%3D435ea389-2042-42b8-b48b-e6293e001196%23&lpt=Etisalat%20UAE&vtm=1669975214761
3.69.133.112200 OK 3.9 kB URL HTTP/2 link.etisalatt.com/d/.js?lpref=&lpurl=https%3A%2F%2Fae.etisalatt.com%2Fprizewheel%2Findex.html%3Fcpid%3D9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82%26lpid%3D435ea389-2042-42b8-b48b-e6293e001196%23&lpt=Etisalat%20UAE&vtm=1669975214761
IP 3.69.133.112:0
File type ASCII text, with very long lines (1887)
Hash c66fc367868af5136d18ad2f45389422
9f3c5b90464efc4511d918a6cef1efc02e6e5846
99720987fe8d57ef3587c586fc00c477abc40445073b07a5b62266c3f1e4a794
GET /d/.js?lpref=&lpurl=https%3A%2F%2Fae.etisalatt.com%2Fprizewheel%2Findex.html%3Fcpid%3D9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82%26lpid%3D435ea389-2042-42b8-b48b-e6293e001196%23&lpt=Etisalat%20UAE&vtm=1669975214761 HTTP/1.1
Host: link.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 10:00:16 GMT
content-type: application/javascript;charset=UTF-8
content-length: 3915
access-control-allow-origin: *
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: 9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82-v4=0xA6Hpemn5Y7RpuRg040C24pLuSkUtAM9PFPddauGAE; Max-Age=86400; Expires=Sat, 03-Dec-2022 10:00:16 GMT; Domain=link.etisalatt.com; Path=/; Secure; HttpOnly;SameSite=None
cep-v4=uT_KQprIPuDqrLtTl0VElcNDFAOds8M7xsaE_FqWxLkddK3q4oPwgMMt0QuAhAFhymrBmwo2mAwrJWTB-Rw6T_tHy275MUboFzn0pLi8t6Mo7LKTPq7MbTctt_M75fJgYmoLphWN4B8foDmYLJG7pGwzLfXc0RRC_HWcmmfeba1rqIvfxjUVX2uqnqLvgfMrqKvENFDZsYj0mBq2ZzS-QYw3RRMFs7geTxxmGqdjAbl96bqEo6wunrAnyFrX36THb6EeY9F4AMWsng_K7sxqJMvPpzpYZnQohqJjuuHRR3OUti6XLgkthMmbXS4We2hZT-KFFRrlH8hRcCUElhQttgQFv65cqeDu74_NoIlQIGRcoRMYwkQ4Y8JokYfW1R05; Max-Age=86400; Expires=Sat, 03-Dec-2022 10:00:16 GMT; Domain=link.etisalatt.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12756
Expires: Fri, 02 Dec 2022 13:32:52 GMT
Date: Fri, 02 Dec 2022 10:00:16 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12756
Expires: Fri, 02 Dec 2022 13:32:52 GMT
Date: Fri, 02 Dec 2022 10:00:16 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12756
Expires: Fri, 02 Dec 2022 13:32:52 GMT
Date: Fri, 02 Dec 2022 10:00:16 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg
34.120.237.76200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 498ab4412ed5cf977bc23e4e870894b0
23753fe8af09ec8ffa10eed4d201a71833885c99
036042656f15e42b4d1537c45f5b8e7190c70305fa9a69c1287c6739ad0b7122
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7334
x-amzn-requestid: a6b8b420-8394-496b-8be8-26dee52e3887
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoHJOoAMF75g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-0b38d07f518c8b3134457df2;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 17nFm7AQdmRYS_af-EJ4XBVw8l3YudcphlpcZMveuVjvjhhYdkAQsw==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:33:10 GMT
age: 41226
etag: "23753fe8af09ec8ffa10eed4d201a71833885c99"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F356e23df-cb76-452a-b299-da5410086837.png
34.120.237.76200 OK 16 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F356e23df-cb76-452a-b299-da5410086837.png
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 82ea44d6cb116fb1f5752ce9bb87e345
f799dfd89a4f5a452dc837b8616549f578fb4184
e9087e7fce332289d67d4d5646d0233c2f2d871cc88dc1c51d5ea1e9f2fb5abd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F356e23df-cb76-452a-b299-da5410086837.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 15495
x-amzn-requestid: 977cdbce-3a9c-4006-a5a1-5c4c82bd4a94
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfHDIFxzIAMFzEw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891ee0-4b2cb3a16ca745537a8caf8c;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:38:40 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nwKxQKsw8g5zCzfMFu_XpOac5rhImez29TKrycGJzozZyHTzoCHASw==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:20:06 GMT
age: 42010
etag: "f799dfd89a4f5a452dc837b8616549f578fb4184"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg
34.120.237.76200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b986f9fcbeca91ed5c8d58fbfaf47d19
6e6c8bd2bce144cc4da1cd7be375b046b60dca79
07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 00:54:54 GMT
age: 32722
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb8ec880-52b8-4350-bb47-d051878e78f1.jpeg
34.120.237.76200 OK 6.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb8ec880-52b8-4350-bb47-d051878e78f1.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 25c68d8b1fae82820f93efca500fd848
45cf5e1a54ee491497ffe08a8e39fe97ba3c8a48
f0ec6b6f6ba0a931c9b71f5bc7ad1e5b89c8e4d8b7441f35eeebfba418d0e588
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb8ec880-52b8-4350-bb47-d051878e78f1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6882
x-amzn-requestid: 6b5f15a5-c15b-46bf-9fd5-5d013d37a0eb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGfrG3WIAMFc9Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891dfd-6038ca700dfb4489230c2683;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2O6x-8-ESFDtlhcjVyGxEXCZcLbbfhsCVQeX02lbNMupPWmM-fKuLA==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:47:56 GMT
age: 43940
etag: "45cf5e1a54ee491497ffe08a8e39fe97ba3c8a48"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F449f29d0-f60b-4dec-8b5b-0a1971bab406.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F449f29d0-f60b-4dec-8b5b-0a1971bab406.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4c7113338bc3310b13d23ca415c177e2
2cb4edc6b161c6d2d5b47aa498ae54e677966466
3a83adce869dd7eb064c583bf7ff93c57fabd7ea2da872f7d1f7d868b8a492e9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F449f29d0-f60b-4dec-8b5b-0a1971bab406.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10270
x-amzn-requestid: ac2d2825-2ec4-435e-9921-3ea6524df1dc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfG1nEvYoAMFliA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891e8a-4419423112b5723e3dba46ea;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:37:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: NQ21d2_5JO2Ym-LEnDecub9bK6wUyvM2zUf_XpfMGag83fVWlMjT8w==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:50:09 GMT
age: 43807
etag: "2cb4edc6b161c6d2d5b47aa498ae54e677966466"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg
34.120.237.76200 OK 2.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b47431190f34eccf0a6efb98e2a32b7d
9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Fw6nrporwF27NW0-vXpaolW79nDXLF2RyS-lqhhp1osHt7q98VpI3g==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:34:47 GMT
age: 44729
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/favicon.ico
54.230.111.11200 OK 15 kB URL HTTP/2 ae.etisalatt.com/prizewheel/favicon.ico
IP 54.230.111.11:0
File type MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Hash 468be2d13b619822bf5a6e4ae09120b5
de89070bf03e3eb5a92bc076ffdd69077422cdc0
c5c0fa9d5188821b69fa4f1609dfe58d5fa1c25dcfc858f2998f6cdaf188a3ba
GET /prizewheel/favicon.ico HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Cookie: vl-9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82=1; vl-cep=cep=uT_KQprIPuDqrLtTl0VElcNDFAOds8M7xsaE_FqWxLkddK3q4oPwgMMt0QuAhAFhymrBmwo2mAwrJWTB-Rw6T_tHy275MUboFzn0pLi8t6Mo7LKTPq7MbTctt_M75fJgYmoLphWN4B8foDmYLJG7pGwzLfXc0RRC_HWcmmfeba1rqIvfxjUVX2uqnqLvgfMrqKvENFDZsYj0mBq2ZzS-QYw3RRMFs7geTxxmGqdjAbl96bqEo6wunrAnyFrX36THb6EeY9F4AMWsng_K7sxqJMvPpzpYZnQohqJjuuHRR3OUti6XLgkthMmbXS4We2hZT-KFFRrlH8hRcCUElhQttgQFv65cqeDu74_NoIlQIGRcoRMYwkQ4Y8JokYfW1R05
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/x-icon
content-length: 15406
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:28 GMT
etag: "468be2d13b619822bf5a6e4ae09120b5"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: MJ6g9BeG2Sudy2PPwCgB3MOuQRipHwh4UbaOwiGQ73UAGUdLF79riA==
age: 49201
X-Firefox-Spdy: h2
ocsp.r2m01.amazontrust.com/
54.230.80.227200 OK 471 B URL HTTP/1.1 ocsp.r2m01.amazontrust.com/
IP 54.230.80.227:0
Hash 752414d76752268cdb10c687ea063943
51bca0ce9af44743c109a0e52eafa572ef7aa3bf
6298273654aa78362335f836a56bdc5f692090fac3fd4a3b0b025a280e862b02
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: 'max-age=158059'
Date: Fri, 02 Dec 2022 10:00:16 GMT
Server: ECS (dcb/7F7F)
X-Cache: Miss from cloudfront
Via: 1.1 09ae414c9d6c5323d5147457ada70ec6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Jl2gmlJ2Tb2KsO7N8Md-zd1H70-pDOsr9NUHQpIpP0h9YJIHdS4m6Q==
push.m-android.com/js/pub.min.js
108.178.23.116200 OK 1.5 kB URL HTTP/2 push.m-android.com/js/pub.min.js
IP 108.178.23.116:0
File type ASCII text, with very long lines (2752)
Hash 31c303586c1b78e33984bd252b8e2644
8083e2aad4cbf8242a4e6fb53657d49552b85f82
d2c713c2734353dc0ef2896d057021e9b04f35bb7c851d920d390941769c66be
Analyzer Verdict Alert fortinet Malware
GET /js/pub.min.js HTTP/1.1
Host: push.m-android.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 10:00:16 GMT
content-type: application/javascript
content-length: 1482
last-modified: Fri, 09 Sep 2022 11:46:08 GMT
vary: Accept-Encoding
etag: "631b2780-5ca"
content-encoding: gzip
expires: Sat, 03 Dec 2022 10:00:16 GMT
cache-control: max-age=86400
strict-transport-security: max-age=31536000; includeSubdomains;
X-Firefox-Spdy: h2
push.m-android.com/sw.js
108.178.23.116200 OK 776 B IP 108.178.23.116:0
Hash f72a11763f13b05c1f2379d13387dd05
002fbf7672d3f4655b89b6413d160e4185ce9900
70d744bbd19a0cc35c8d9f1d8ba181c6cdc902f95799ac750da4adc3ad987b11
Analyzer Verdict Alert fortinet Malware
GET /sw.js HTTP/1.1
Host: push.m-android.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 10:00:17 GMT
content-type: application/javascript
content-length: 776
last-modified: Mon, 03 Oct 2022 07:40:54 GMT
vary: Accept-Encoding
etag: "633a9206-308"
content-encoding: gzip
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
54.230.111.11200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
IP 54.230.111.11:0
GET /prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196 HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
content-type: text/html
last-modified: Tue, 22 Nov 2022 14:44:58 GMT
server: AmazonS3
content-encoding: gzip
date: Fri, 02 Dec 2022 07:57:05 GMT
etag: W/"5737d3553d7e35e28fa0bbfdb24ecc16"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: Ig1Qk7mGXM1EqtT4bwG5RiiSmqjBrngsfJ71RweGSZDIBhHCUDev4g==
age: 56817
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/master-card.svg
54.230.111.11200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/master-card.svg
IP 54.230.111.11:0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/master-card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
date: Fri, 02 Dec 2022 01:36:32 GMT
last-modified: Thu, 17 Nov 2022 07:12:37 GMT
etag: W/"383d03288df6951e039f2d64cb85b250"
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: V_0_1AvqqEbMdgAilkpNryYMIU75caZ93WXROpMZtPVI_7bjI7RCGg==
age: 30225
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/visa-card.svg
54.230.111.11200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/visa-card.svg
IP 54.230.111.11:0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/visa-card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Thu, 17 Nov 2022 07:12:39 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:24:53 GMT
etag: W/"cae299f35ae42f860950fe24b886acc4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: fSQjr5GJ3_qlZFKqWNnoLhF-DKsBRkeFgZ_78EGi4n4WW3JppRhK6A==
age: 56124
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/logo.svg
54.230.111.11200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/logo.svg
IP 54.230.111.11:0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/logo.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Thu, 17 Nov 2022 07:12:36 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:24:53 GMT
etag: W/"adf96b2af4c33acd7e2f1baaaa4736aa"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: -zFhlvHY-JJdVBRXvmONw7OehdszxAnT_qCI-lB_WN1X7BQQs8KNVQ==
age: 56124
X-Firefox-Spdy: h2
www.instachaat.com/2/index.php
34.100.154.146302 Found 0 B URL HTTP/2 www.instachaat.com/2/index.php
IP 34.100.154.146:0
ASN #396982 GOOGLE-CLOUD-PLATFORM
GET /2/index.php HTTP/1.1
Host: www.instachaat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 302 Found
server: nginx
date: Fri, 02 Dec 2022 10:00:15 GMT
content-type: text/html; charset=UTF-8
location: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/cart.svg
54.230.111.11200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/cart.svg
IP 54.230.111.11:0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/cart.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Thu, 17 Nov 2022 07:12:34 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:36:25 GMT
etag: W/"ad8a3c2c7aa3989adac1b8c8958c328d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: vyYZgdF9o6Srtkuew6j_8OR_XI2LdWPRrPyBua4QRkPwPzqoWgi4IQ==
age: 55432
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/style.css
54.230.111.11200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/style.css
IP 54.230.111.11:0
GET /prizewheel/style.css HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: text/css
last-modified: Thu, 17 Nov 2022 07:12:30 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 16:37:22 GMT
etag: W/"b40373fb05795bc162f91d9d78aff281"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: RJERpbihAlerJfVOW16AtdCQZRDoWbNCqlV92L2kB92pkIwregWZkA==
age: 62575
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/script.js
54.230.111.11200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/script.js
IP 54.230.111.11:0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/script.js HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: application/javascript
last-modified: Thu, 17 Nov 2022 07:12:29 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:36:23 GMT
etag: W/"916dcb4886c7cd4afa6996f6dfb76cb3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 7ptIiAMU2xdQhlpHcJo1RPP580CQDJJGw_Y03ruxd3JZQ0yuemS9Vw==
age: 55434
X-Firefox-Spdy: h2