Report - ww2.viewpage-pag781216.us/

Report Overview

Submitted URL
ww2.viewpage-pag781216.us/
IP
185.107.56.198
ASN
#43350 NForce Entertainment B.V.
Submitted
2022-10-26 20:19:10
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ww2.viewpage-pag781216.us	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	357 B	500 B	185.107.56.198
bilqi-omv.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.5 kB	5.3 kB	3.212.50.125
web.countertrck.com	606732	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.3 kB	1.6 kB	18.193.235.10
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	35.161.136.21
ajax.googleapis.com	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	395 B	31 kB	142.250.74.74
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.77.32
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.0 kB	2.4 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	364 B	1.5 kB	34.102.187.140
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	686 B	1.4 kB	142.250.74.35
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	51 kB	34.120.237.76
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.9 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
www.nuggitgames.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	15 kB	233 kB	138.201.157.209

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-10-26	medium	ww2.viewpage-pag781216.us/	Phishing
2022-10-26	medium	www.nuggitgames.com/ngsskm/no/alert.ogg	Phishing
2022-10-26	medium	www.nuggitgames.com/ngsskm/no/sounds/win.mp3	Phishing
2022-10-26	medium	www.nuggitgames.com/ngsskm/no/sounds/spin.mp3	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (9)

	URL	Size	First Seen	Last Seen
	bilqi-omv.com/zcvisitor/6cdfeeb3-556b-11ed-b420-123b2121a343/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=e5dbc150-6f19-11e8-9eb3-0e497388635c	747 B	2023-03-10	2023-03-10
Pretty URL bilqi-omv.com/zcvisitor/6cdfeeb3-556b-11ed-b420-123b2121a343/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=e5dbc150-6f19-11e8-9eb3-0e497388635c IP 3.212.50.125 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 15:59:15 Last Seen2023-03-10 15:59:15 Times Seen1 Hash 5514a8b1656c8b80a9fddffd40c85bea 51ae18992e2f8c1e421e5c022bdb47bc40f36904 b30be7331424a80e9f92d59798dd7471cb56781ed1d51bd6d3323c74373ab8c4 Loading...

	bilqi-omv.com/zcredirect?visitid=6cdfeeb3-556b-11ed-b420-123b2121a343&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false	849 B	2023-03-10	2023-03-10
Pretty URL bilqi-omv.com/zcredirect?visitid=6cdfeeb3-556b-11ed-b420-123b2121a343&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false IP 3.212.50.125 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 15:59:15 Last Seen2023-03-10 15:59:15 Times Seen1 Hash 8c30a689fbbc2ea6a954fb2fa7f031ef 810eb16dec436f4cb67f60da5df723ad18351d97 5de4b5c7b7c37065b0040135508b97112d6e550adcc385b6875b80f9c27dddf3 Loading...

	www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013	981 B	2023-03-07	2024-01-14
Pretty URL www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013 IP 138.201.157.209 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:01 Last Seen2024-01-14 23:45:35 Times Seen78 Hash e1c712bbf0d369735fe582aa028f8e2e 4577d00199c650eef3a87f60178ecf4160a7ab14 7556078f5ea4caf187f2f69e8d6b0146bc702d9f0f28c774babff3b1a5035996 Loading...

	www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013	1.4 kB	2023-03-08	2024-01-14
Pretty URL www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013 IP 138.201.157.209 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 14:44:39 Last Seen2024-01-14 23:45:35 Times Seen42 Hash 753ec151cca90efd0197d9a637001dd4 bdba281dcf8686a84bf6e581124cbe0d7429b9a7 225cc655a78d4b3077d5b18e597b6840798dbbaca0901a66636d7de2014cd5cc Loading...

	www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013	223 B	2023-03-07	2023-04-05
Pretty URL www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013 IP 138.201.157.209 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:11 Last Seen2023-04-05 02:04:52 Times Seen30 Hash cc3db641a6ae877f6d98ecb287311e47 72b8cff7175140e9977b1d86f738e3c0fb8b2270 65fd2720806b09618630e3ed9841ac1cb0d0ce2d57322a6a89291eb783d471c8 Loading...

	www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013	202 B	2023-03-07	2024-01-14
Pretty URL www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013 IP 138.201.157.209 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:01 Last Seen2024-01-14 23:45:35 Times Seen49 Hash 5bc64eee70b910ed4d235b6e496b133c caff534c56dbb08fb0d57addb60dfe05ccaa1cf6 c3c9847b107d9f01b3b016bc6e644a68a78073115672ca17e71ad734d1e2d88d Loading...

	www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013	1.0 kB	2023-03-07	2023-04-05
Pretty URL www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013 IP 138.201.157.209 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:01 Last Seen2023-04-05 02:04:52 Times Seen87 Hash 65c4d1f25fb339b5f6149e853b8cd58c a9ab805d3e4e6afbd5356a06939be94b60bd1fc3 fa877dc071e7b21532886df1283f07bce44c43dc94954a29094bcb12b5985996 Loading...

	ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js	86 kB	2023-03-07	2024-04-20
Pretty URL ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js IP 142.250.74.74 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:01 Last Seen2024-04-20 16:12:23 Times Seen5772 Hash 6fc159d00dc3cea4153c038739683f93 5d7e5bbfa540f0e53bd599e4305e1a4e815b5dd1 8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce Loading...

	www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013	2.7 kB	2023-03-07	2024-01-14
Pretty URL www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013 IP 138.201.157.209 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:11 Last Seen2024-01-14 23:45:35 Times Seen55 Hash 88d4a621b6403051bf33f027a20fc484 ffd5167e4c0abd7bc53ae97f3c7980f5f5457850 04bf9d8d09980d28754c15ab7c48f456b36a9fbc653290879e1ea69db7c59bff Loading...

HTTP Transactions (42)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
4c9ec202b798d350b6582220b7bb8457
d16ca24cd60b349231ad06fa5db32f54a3bc9e09
df036d315a613ac6396b77afb0a4ea5f793091786be0cbf3f3a0d043bc1d1d3c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DF036D315A613AC6396B77AFB0A4EA5F793091786BE0CBF3F3A0D043BC1D1D3C"
Last-Modified: Wed, 26 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13272
Expires: Thu, 27 Oct 2022 00:00:11 GMT
Date: Wed, 26 Oct 2022 20:18:59 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
45bfdf3b823cd24564c8ac296a8b5b19
b0c442eb4f87556b3beb18ca8039dd4399b73f16
32113c679dda1f710ba67e537fdd0d435ccc186a238e3b14e48deb7b0700c693

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4721
Cache-Control: max-age=138644
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2022 20:18:59 GMT
Etag: "6358fe56-1d7"
Expires: Fri, 28 Oct 2022 10:49:43 GMT
Last-Modified: Wed, 26 Oct 2022 09:31:02 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
45bfdf3b823cd24564c8ac296a8b5b19
b0c442eb4f87556b3beb18ca8039dd4399b73f16
32113c679dda1f710ba67e537fdd0d435ccc186a238e3b14e48deb7b0700c693

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3587
Cache-Control: max-age=137509
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2022 20:18:59 GMT
Etag: "6358fe56-1d7"
Expires: Fri, 28 Oct 2022 10:30:48 GMT
Last-Modified: Wed, 26 Oct 2022 09:31:02 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8db408c487f7d35bba323046736e8d3a
01b91e2dce7c6d3de9adfe6ff4d38f9b24ab7db0
9aeafc72c1a969243e1fc96f68ce18888034a749ee70582208bf814bd40b61a5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9AEAFC72C1A969243E1FC96F68CE18888034A749EE70582208BF814BD40B61A5"
Last-Modified: Tue, 25 Oct 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6027
Expires: Wed, 26 Oct 2022 21:59:26 GMT
Date: Wed, 26 Oct 2022 20:18:59 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
4736bac84ca28f2b1e961159fb4ea098
1319612979f53896fcfeacd4215c2715d4951e4c
5e81213e111ddf68c7f884f72b4e06fc4dc95eb902c3cf0762236b2418840dba

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
Alt-Used: 0

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 26 Oct 2022 19:41:38 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2241
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: eUPB7X3qfVAcas5qXeGsDJGQ1PnTJe2ogfB2hEa5Jh5Q4+c6xL8rZmbVrcLNoopVsrMDZE0D3AJQdm7dAwzT3w==
x-amz-request-id: GWKB45TV6RVDS9TY
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 26 Oct 2022 20:09:31 GMT
age: 568
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 26 Oct 2022 20:18:59 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ww2.viewpage-pag781216.us/

185.107.56.198

302 Found

11 B

URL HTTP/1.1
ww2.viewpage-pag781216.us/
IP
185.107.56.198:0
ASN
#43350 NForce Entertainment B.V.

File type
ASCII text, with no line terminators
Size
11 B (11 bytes)
Hash
32682312d17c7cbf18e73594f5570319
60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET / HTTP/1.1
Host: ww2.viewpage-pag781216.us
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Wed, 26 Oct 2022 20:18:59 GMT
location: http://bilqi-omv.com/zcvisitor/6cdfeeb3-556b-11ed-b420-123b2121a343/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=e5dbc150-6f19-11e8-9eb3-0e497388635c
server: nginx
set-cookie: sid=6cd26808-556b-11ed-ab8a-7af00d19eadf; path=/; domain=.viewpage-pag781216.us; expires=Mon, 13 Nov 2090 23:33:07 GMT; max-age=2147483647; HttpOnly

bilqi-omv.com/zcvisitor/6cdfeeb3-556b-11ed-b420-123b2121a343/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=e5dbc150-6f19-11e8-9eb3-0e497388635c

3.212.50.125

200

996 B

URL HTTP/1.1
bilqi-omv.com/zcvisitor/6cdfeeb3-556b-11ed-b420-123b2121a343/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=e5dbc150-6f19-11e8-9eb3-0e497388635c
IP
3.212.50.125:0
ASN
#14618 AMAZON-AES

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
996 B (996 bytes)
Hash
19fe7eff524f1b4b312f855e92302b73
ff0351668ef7914a7eb8c0077fa76e9b4518dc7c
5cd71a1a5a84eb75a64bd935831e634fb7b9bb89002ab7ac47cc999347be19f0

HTTP Headers

GET /zcvisitor/6cdfeeb3-556b-11ed-b420-123b2121a343/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=e5dbc150-6f19-11e8-9eb3-0e497388635c HTTP/1.1
Host: bilqi-omv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 
Date: Wed, 26 Oct 2022 20:19:00 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: wvQmSuVz

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
dd283dfc036535bdeb8a8be1310ef930
d3b1c300dd75d7af630e0f3112e49d7492d66c17
578f9256faa188facb3f2d68b02b0c7fb2e30e02e2e74234d015429563cba7aa

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6448
Cache-Control: max-age=135315
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2022 20:19:00 GMT
Etag: "6358ea97-1d7"
Expires: Fri, 28 Oct 2022 09:54:15 GMT
Last-Modified: Wed, 26 Oct 2022 08:06:47 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

bilqi-omv.com/zcredirect?visitid=6cdfeeb3-556b-11ed-b420-123b2121a343&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false

3.212.50.125

200

1.8 kB

URL HTTP/1.1
bilqi-omv.com/zcredirect?visitid=6cdfeeb3-556b-11ed-b420-123b2121a343&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false
IP
3.212.50.125:0
ASN
#14618 AMAZON-AES

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (871)
Size
1.8 kB (1828 bytes)
Hash
c015c688f09d401bbc0f4f38fe24949c
4c3b115a11e1e1db601c3cb12884795f0502b1d9
afaba149dc7107081610c0be08ef0b38b8c4915e996862be0da76e4565337fa4

HTTP Headers

GET /zcredirect?visitid=6cdfeeb3-556b-11ed-b420-123b2121a343&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false HTTP/1.1
Host: bilqi-omv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bilqi-omv.com/zcvisitor/6cdfeeb3-556b-11ed-b420-123b2121a343/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=e5dbc150-6f19-11e8-9eb3-0e497388635c
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 
Date: Wed, 26 Oct 2022 20:19:00 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
redirected: JS
Server: bPgSDkBb

web.countertrck.com/zp-redirect?target=https%3A%2F%2Fwww.nuggitgames.com%2Fngsskm%2Fno%2Findex-uni.html%3Fcep%3DrXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH%26lptoken%3D16a06637817973b44013&caid=53c8519d-dbda-48a9-b0f2-6aadb0b9a2c6&zpid=6cdfeeb3-556b-11ed-b420-123b2121a343&cid=&rt=R

18.193.235.10

302 Found

0 B

URL HTTP/2
web.countertrck.com/zp-redirect?target=https%3A%2F%2Fwww.nuggitgames.com%2Fngsskm%2Fno%2Findex-uni.html%3Fcep%3DrXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH%26lptoken%3D16a06637817973b44013&caid=53c8519d-dbda-48a9-b0f2-6aadb0b9a2c6&zpid=6cdfeeb3-556b-11ed-b420-123b2121a343&cid=&rt=R
IP
18.193.235.10:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /zp-redirect?target=https%3A%2F%2Fwww.nuggitgames.com%2Fngsskm%2Fno%2Findex-uni.html%3Fcep%3DrXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH%26lptoken%3D16a06637817973b44013&caid=53c8519d-dbda-48a9-b0f2-6aadb0b9a2c6&zpid=6cdfeeb3-556b-11ed-b420-123b2121a343&cid=&rt=R HTTP/1.1
Host: web.countertrck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://bilqi-omv.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 302 Found
server: nginx
date: Wed, 26 Oct 2022 20:19:00 GMT
content-length: 0
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
pragma: no-cache
set-cookie: cep-v4=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH; Max-Age=86400; Expires=Thu, 27-Oct-2022 20:19:00 GMT; Domain=web.countertrck.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2

bilqi-omv.com/favicon.ico

3.212.50.125

404

653 B

URL HTTP/1.1
bilqi-omv.com/favicon.ico
IP
3.212.50.125:0
ASN
#14618 AMAZON-AES

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators
Size
653 B (653 bytes)
Hash
ba2732b1b2fa2626ffaa15f62f9e7d66
203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe
879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: bilqi-omv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bilqi-omv.com/zcredirect?visitid=6cdfeeb3-556b-11ed-b420-123b2121a343&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false

HTTP/1.1 404 
Date: Wed, 26 Oct 2022 20:19:00 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 653
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Language: en
Server: wvQmSuVz

push.services.mozilla.com/

35.161.136.21

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.161.136.21:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: BOP9qL5cnjs7AjeXnY5yhA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: uuC7H14GN4uyuVT0kW2nsD87dr0=

www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013

138.201.157.209

200 OK

19 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (2104)
Size
19 kB (18603 bytes)
Hash
15340cb4eb2770b831147acfbf309ae2
8c7e9bc87e7bab952a0aaa958f1f38153efde7f7
e8323fb09399bd0b01ad075ef2c2ebc9af8155e704f6a7fa1b69e240490751b7

HTTP Headers

GET /ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013 HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://bilqi-omv.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:00 GMT
server: Apache
accept-ranges: bytes
x-mod-pagespeed: 1.13.35.2-0
cache-control: max-age=0, no-cache, s-maxage=10
vary: Accept-Encoding,User-Agent
content-encoding: gzip
x-robots-tag: noindex, noarchive, nosnippet
content-length: 18603
content-type: text/html; charset=UTF-8
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/images/NO.png

138.201.157.209

200 OK

1.2 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/images/NO.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 50 x 40, 8-bit colormap, non-interlaced\012- data
Size
1.2 kB (1182 bytes)
Hash
1dbbdc570a6ab11660aae86783af4b21
c16bacdbf508f6896d590f482d79ce1e62c2d63a
4c7188a23412702bfc654a613cc7bcb30182265f832d60fbb667b35b1b75d27c

HTTP Headers

GET /ngsskm/no/images/NO.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:00 GMT
server: Apache
content-length: 1182
last-modified: Sat, 08 Feb 2020 05:04:31 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-HbvcVwpqsR"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/style.css

138.201.157.209

200 OK

2.8 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/style.css
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text
Size
2.8 kB (2786 bytes)
Hash
cd4dfdbd77843c1253ea7209570cb047
bc6337064ba083703c97a4d770cb8c2679816520
8cce0dc5aa152c162192f9503a76f454638ef4aa346508d3f961e1775f91b2f5

HTTP Headers

GET /ngsskm/no/style.css HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:00 GMT
server: Apache
last-modified: Sat, 08 Feb 2020 05:04:25 GMT
accept-ranges: bytes
cache-control: max-age=2592000
expires: Fri, 25 Nov 2022 20:19:00 GMT
vary: Accept-Encoding,User-Agent
content-encoding: gzip
x-robots-tag: noindex, noarchive, nosnippet
content-length: 2786
content-type: text/css
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/images/slot-start.png

138.201.157.209

200 OK

26 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/images/slot-start.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
26 kB (26084 bytes)
Hash
f491647556e492de92530b48827690aa
6296c44299f5acb17cb2c06e37391a70672b1fd3
efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d

HTTP Headers

GET /ngsskm/no/images/slot-start.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:00 GMT
server: Apache
content-length: 26084
last-modified: Sat, 08 Feb 2020 05:04:44 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-9JFkdVbkkt"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
f046e6113dd1e5e499c765516be08b17
c2253055e09b46209469853cad8720e64f84a1bf
18663a8f0b5d4d7581b771da6c2dc897bc2b82d51d7dac1a56d22f9bebab6fb3

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2022 20:19:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js

142.250.74.74

200 OK

30 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js
IP
142.250.74.74:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (32069)
Size
30 kB (30089 bytes)
Hash
4ae540714475aa934955496d990ab15f
b7724c4d72a422b86f5dc06571ff4bc86f0308a3
ca0222f8799d862ca8c427d6c612878f47043c9445ad0e1567f1f80e83c965e2

HTTP Headers

GET /ajax/libs/jquery/2.2.0/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30089
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 26 Oct 2022 19:07:26 GMT
expires: Thu, 26 Oct 2023 19:07:26 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 4295
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/images/slot-result-1.png

138.201.157.209

200 OK

20 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/images/slot-result-1.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
20 kB (20370 bytes)
Hash
1fbd2b26e61236d5bcfdfeb6adbd2c8c
c9034272d28dab018b73f1967a679c734f987a1f
c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963

HTTP Headers

GET /ngsskm/no/images/slot-result-1.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:00 GMT
server: Apache
content-length: 20370
last-modified: Sat, 08 Feb 2020 05:04:34 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-H70rJuYSNt"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/images/slot-spin.gif

138.201.157.209

200 OK

88 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/images/slot-spin.gif
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
GIF image data, version 89a, 410 x 279\012- data
Size
88 kB (87599 bytes)
Hash
617c16c5e04c8603dd7f157862b1c682
1306296f9a666a7fc50f339a2a924ce8a3a18169
7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e

HTTP Headers

GET /ngsskm/no/images/slot-spin.gif HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:00 GMT
server: Apache
content-length: 87599
last-modified: Sat, 08 Feb 2020 05:04:41 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-YXwWxeBMhg"
x-content-type-options: nosniff
content-type: image/gif
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/images/slot-result-2.png

138.201.157.209

200 OK

27 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/images/slot-result-2.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
27 kB (26733 bytes)
Hash
b6ca0bfea4d0cec334f128f5c2c44cff
f6dc006902542a929187af718d9f6a244e5472b5
b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435

HTTP Headers

GET /ngsskm/no/images/slot-result-2.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:00 GMT
server: Apache
content-length: 26733
last-modified: Sat, 08 Feb 2020 05:04:37 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-tsoL_qTQzs"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/red-arrow-right.png

138.201.157.209

200 OK

1.4 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/red-arrow-right.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 50 x 50, 8-bit colormap, non-interlaced\012- data
Size
1.4 kB (1362 bytes)
Hash
881bdc037be8895ba5d8d53456890e7e
4e105c89e2a1475520bb74c9c20bf2f9e906fcb3
9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f

HTTP Headers

GET /ngsskm/no/red-arrow-right.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
content-length: 1362
last-modified: Sat, 08 Feb 2020 05:04:23 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-iBvcA3voiV"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/red-arrow-left.png

138.201.157.209

200 OK

1.3 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/red-arrow-left.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 50 x 50, 8-bit colormap, non-interlaced\012- data
Size
1.3 kB (1334 bytes)
Hash
92d3e482cacea857c5dfaf9fa3a21dfb
3f12c410c77d763cc4719ec367a18417b8300758
4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef

HTTP Headers

GET /ngsskm/no/red-arrow-left.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
content-length: 1334
last-modified: Sat, 08 Feb 2020 05:04:20 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-ktPkgsrOqF"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/images/slot-win.png

138.201.157.209

200 OK

14 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/images/slot-win.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
14 kB (14391 bytes)
Hash
939b6a73c96383ac0842317037f3a0f0
0654b62431c8ba522833950b8166d7a16e2a6b56
b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837

HTTP Headers

GET /ngsskm/no/images/slot-win.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
content-length: 14391
last-modified: Sat, 08 Feb 2020 05:04:47 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:43 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-k5tqc8ljg6"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/alert.ogg

138.201.157.209

206 Partial Content

6.1 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/alert.ogg
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
Ogg data, Vorbis audio, mono, 44100 Hz, ~70000 bps, created by: Xiph.Org libVorbis I (1.3.2)\012- data
Size
6.1 kB (6061 bytes)
Hash
c24ec40453460f0d5617767016ebc7fe
c360aea4f0d0a34920ddacd376503734142438b9
6c24b85e36500836887748ab5fcfa2663bd6ab39d28f73e75aa5a669bf9386cb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ngsskm/no/alert.ogg HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 206 Partial Content
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
last-modified: Sat, 08 Feb 2020 05:04:11 GMT
accept-ranges: bytes
content-length: 6061
cache-control: max-age=172800, s-maxage=10
expires: Fri, 28 Oct 2022 20:19:01 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
content-range: bytes 0-6060/6061
content-type: audio/ogg
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/sounds/win.mp3

138.201.157.209

206 Partial Content

10 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/sounds/win.mp3
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 32 kbps, 32 kHz, Monaural\012- data
Size
10 kB (10391 bytes)
Hash
bca40777013dec4a99eaa8b0b98a7fef
bc1c833577a1dcd82ad01a90e82898bc7b47cad7
635e9ee8fcd18bd4c3ae173f00f4c5cbf15ee90a27a302440e2e77c371314176

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ngsskm/no/sounds/win.mp3 HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 206 Partial Content
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
last-modified: Sat, 08 Feb 2020 05:04:54 GMT
accept-ranges: bytes
content-length: 10391
cache-control: max-age=172800, s-maxage=10
expires: Fri, 28 Oct 2022 20:19:01 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
content-range: bytes 0-10390/10391
content-type: audio/mpeg
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/sounds/spin.mp3

138.201.157.209

206 Partial Content

8.8 kB

URL HTTP/2
www.nuggitgames.com/ngsskm/no/sounds/spin.mp3
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
MPEG ADTS, layer III, v2, 32 kbps, 16 kHz, JntStereo\012- data
Size
8.8 kB (8784 bytes)
Hash
5a2e10964c7fea8b0181831184bc0d97
8f5233dd6be372e7749c6cd8440db5b43de5a9c9
9b8fa3d6ccb98804102ffd59ee70c19e5d7ca7efabbe6c0d4471a1935348ee3d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ngsskm/no/sounds/spin.mp3 HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 206 Partial Content
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
last-modified: Sat, 08 Feb 2020 05:04:51 GMT
accept-ranges: bytes
content-length: 8784
cache-control: max-age=172800, s-maxage=10
expires: Fri, 28 Oct 2022 20:19:01 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
content-range: bytes 0-8783/8784
content-type: audio/mpeg
X-Firefox-Spdy: h2

www.nuggitgames.com/ngsskm/no/arrow.png

138.201.157.209

200 OK

154 B

URL HTTP/2
www.nuggitgames.com/ngsskm/no/arrow.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 12 x 12, 4-bit colormap, non-interlaced\012- data
Size
154 B (154 bytes)
Hash
4daf12b0677dd9ae8923d3154187d1d8
d20e8f0a0c1a72d20cd421ba5e162ff938896e51
5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e

HTTP Headers

GET /ngsskm/no/arrow.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
content-length: 154
last-modified: Sat, 08 Feb 2020 05:04:13 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:44 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-Ta8SsGd92a"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
f046e6113dd1e5e499c765516be08b17
c2253055e09b46209469853cad8720e64f84a1bf
18663a8f0b5d4d7581b771da6c2dc897bc2b82d51d7dac1a56d22f9bebab6fb3

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2022 20:19:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.nuggitgames.com/ngsskm/no/favicon.png

138.201.157.209

200 OK

805 B

URL HTTP/2
www.nuggitgames.com/ngsskm/no/favicon.png
IP
138.201.157.209:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced\012- data
Size
805 B (805 bytes)
Hash
496b2b04c683aa1aee40aea9b8a9bd2b
e248732ed7105d6e618436ed2dad8556239243a1
ac90a1d4eed03e30376b0d3f7529652269e51bc2b0455797cb1acb34941f9ec2

HTTP Headers

GET /ngsskm/no/favicon.png HTTP/1.1
Host: www.nuggitgames.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nuggitgames.com/ngsskm/no/index-uni.html?cep=rXOPYNFB_wNM_XGh_Zf0jOdXNhqPVaKUI297qGcKZrAy5AW66VqdYXovRbs6W_4lnDMqj7s94vz3bx68BMy0XmNFcvOpMNATUxLiKOARubA2hEDMA9YATKbhWSvBeLZoHfKrk04TPKmTvCDh65pwRQ-MCk5eKvFl-ASFkv75bh9YsEWac1ZChN1nMETA33c5Gc7Mdikfy63CHJM6zLXS2SOkwuEOQEbj9Iv_7dZh3SBSgmL5Xy30dgU4yWHei_t3I2iKE0sRaWE9s6aXac8kZTCz5Cz-HUSgfhTob_p9WPqWe-bO5Rjc32rXJcmYcwQLJKJp94ibbju2QyhmqRmxfY3VyU9zgd9xa9MqOWyW4k5VzC3P8wU5TD3IV_ZX6L8se2WDwqAKEruhLomF7FQSPDwcUoiFSLXXOKKdFFb2a7OvXmpu0qhM_Fc8uZUH2u1Mg9GA5kEMKmYTYm3iVBE2FQhfg8XlvKuqVLHgY99ksHKuKMvPyNHL4GRrj62VOCh2rUYSFRUsVzMvr_u2iV1Ka7n4IOojdlRCDS954WO8NOwQvoHOnV4FFXUkuhBFl2rH&lptoken=16a06637817973b44013
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Wed, 26 Oct 2022 20:19:01 GMT
server: Apache
content-length: 805
last-modified: Sat, 08 Feb 2020 05:04:15 GMT
accept-ranges: bytes
expires: Thu, 26 Oct 2023 10:06:45 GMT
x-robots-tag: noindex, noarchive, nosnippet
vary: User-Agent
cache-control: max-age=31536000
etag: W/"PSA-SWsrBMaDqh"
x-content-type-options: nosniff
content-type: image/png
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
358ecd0ec047d700042e2a62f9847199
7bf4c552f47536fe451dc6ccfb0930c592084ef9
e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27"
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3647
Expires: Wed, 26 Oct 2022 21:19:49 GMT
Date: Wed, 26 Oct 2022 20:19:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
358ecd0ec047d700042e2a62f9847199
7bf4c552f47536fe451dc6ccfb0930c592084ef9
e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27"
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3647
Expires: Wed, 26 Oct 2022 21:19:49 GMT
Date: Wed, 26 Oct 2022 20:19:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
358ecd0ec047d700042e2a62f9847199
7bf4c552f47536fe451dc6ccfb0930c592084ef9
e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27"
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3647
Expires: Wed, 26 Oct 2022 21:19:49 GMT
Date: Wed, 26 Oct 2022 20:19:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
358ecd0ec047d700042e2a62f9847199
7bf4c552f47536fe451dc6ccfb0930c592084ef9
e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27"
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3647
Expires: Wed, 26 Oct 2022 21:19:49 GMT
Date: Wed, 26 Oct 2022 20:19:02 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5da11cdb-c8be-46f4-95b0-792c49d930a7.jpeg

34.120.237.76

200 OK

8.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5da11cdb-c8be-46f4-95b0-792c49d930a7.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.6 kB (8553 bytes)
Hash
5987bcd44ab0db5313aa4f409a8a212f
691a36cde98a9fe1660745dd811e0be2ae67036c
e47ce3587c647b52669f675dc7e84e21555f82138091fb04febc951b4c06ba30

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5da11cdb-c8be-46f4-95b0-792c49d930a7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8553
x-amzn-requestid: 69931a9c-027e-428e-a88d-61c5fac64daa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: alJ2iEnzoAMFZAA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63585690-12c78c5157fb3fa41a13548c;Sampled=0
x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:12 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: zfjAcNokC0aMpSY3juYAi_Wo1MMRskGGJ0y9jb7x3Ps9R6wfiUg-IQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Tue, 25 Oct 2022 21:57:47 GMT
age: 80475
etag: "691a36cde98a9fe1660745dd811e0be2ae67036c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fda327ff0-bd82-4034-a53b-e04d5c486276.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.1 kB (8090 bytes)
Hash
531f350512ac7712d932234803aa4602
2fb4599ad3d513a160c1f29fefda27b45852c381
7a4da3420f736c098806676359b8ff80578a2e1e98fc0e20e45e2d6192e1d566

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fda327ff0-bd82-4034-a53b-e04d5c486276.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8090
x-amzn-requestid: a84a2888-e0eb-40d3-8377-9c1ea2af733c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aVb2oH2uoAMFueA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63520cf7-204870ee3f63ced427033eb5;Sampled=0
x-amzn-remapped-date: Fri, 21 Oct 2022 03:07:35 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: jwBhqae0PIjVzu-VeqFVHYgltjj8u8DvOdI4tBzPryx9DZK76So83g==
via: 1.1 1de1880e08f1cae7d1aca174a29a5c1e.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 07:47:30 GMT
age: 45092
etag: "2fb4599ad3d513a160c1f29fefda27b45852c381"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F057530b7-f6b8-4f9b-b6fc-8fdc4a101f36.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.8 kB (6831 bytes)
Hash
1cc61ad4b1d66ab4bce27288ee690e12
324e13ad5c99f628d713e55a2994ad4042ece70e
62cd88bc19bc1f0be2a37c3e990897158acd3d55aa3ddd299144d4f9596ba34e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F057530b7-f6b8-4f9b-b6fc-8fdc4a101f36.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6831
x-amzn-requestid: cc6f38ff-ab33-4b18-8cae-aa6bc061962f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: alKjPH7ToAMFSiw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635857ae-3db2790d0e6c5fab6c4bc81f;Sampled=0
x-amzn-remapped-date: Tue, 25 Oct 2022 21:39:58 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: tiWbOUwlRzaT2EnCWIgoFaT_ho55s3tgRxalb7yBbI21Pv0BhfLJOg==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 02d90bf99fd6253b329a53c82f19e224.cloudfront.net (CloudFront), 1.1 google
date: Tue, 25 Oct 2022 22:05:09 GMT
age: 80033
etag: "324e13ad5c99f628d713e55a2994ad4042ece70e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6fe27cf2-33a8-42cc-a8cd-f5e804e60e26.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.9 kB (7929 bytes)
Hash
c3ae78510434fd68063fc144bf614382
3bb87ca5274ce9f6d81da60ab940d23ccd12843b
f42d89328435cb37cba1111903a6bd5e900857d0942e1506ea2115b4e6301541

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6fe27cf2-33a8-42cc-a8cd-f5e804e60e26.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7929
x-amzn-requestid: 6324abd6-8e27-4903-8bfc-a0fc6a8625be
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: alK9LEeoIAMF5mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63585854-2900343b1ae208a903fe58fd;Sampled=0
x-amzn-remapped-date: Tue, 25 Oct 2022 21:42:44 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 5MR4UzoW6rVsSpEyPAWrcFb2LCRICaG-toy3JflaXRrzZwcgMs48VQ==
via: 1.1 331202b5b8aab67acbf389883133f256.cloudfront.net (CloudFront), 1.1 5397b304713f6301c7c94ac084b6ed08.cloudfront.net (CloudFront), 1.1 google
date: Tue, 25 Oct 2022 22:09:07 GMT
etag: "3bb87ca5274ce9f6d81da60ab940d23ccd12843b"
content-type: image/jpeg
age: 79795
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fae122c0f-a41b-4abc-a703-a5de223ae39a.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8439 bytes)
Hash
db946866312c734e0c5f91ca76255b2f
e8b8236baab9106a426a415eb01494cc4cc91ad1
a695e7bc87da2c6d9f5669c09e662fe22982e69cb139466efa5093429fe19866

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fae122c0f-a41b-4abc-a703-a5de223ae39a.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8439
x-amzn-requestid: e0eed725-0725-4f5a-9c91-fec13ad0ebe5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ajKYQGWhIAMFdhw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63578a9b-2a0115120e75f5271cea992f;Sampled=0
x-amzn-remapped-date: Tue, 25 Oct 2022 07:04:59 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: pf98qKWMjPBID3auXFKPhj1kt67xEWF_e2CpRMQ7_HkPJGzJ3cK1qw==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 07:18:26 GMT
age: 46836
etag: "e8b8236baab9106a426a415eb01494cc4cc91ad1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fadc5382d-fbb1-4d8e-8ee0-d7dcda16508e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.5 kB (4524 bytes)
Hash
91ee720c15dc69de45080d0c951353af
5292b31a99d90bcb7071f327b93d52034bdf9dcb
7fbe9f0f6db08fd539f2e8d4ac22e3b4d5ca14f7cde69f8424cce8b361d026e6

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fadc5382d-fbb1-4d8e-8ee0-d7dcda16508e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4524
x-amzn-requestid: a493efe7-11c7-4032-b36b-7f838f8180bc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aljicH_6IAMFqpQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63587fa9-0f15eae7680ea7b15e5e47ec;Sampled=0
x-amzn-remapped-date: Wed, 26 Oct 2022 00:30:33 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: NQJHFIbLMzw0aGwCkVGIEIHOMHprTpvLkLQRKgrGeVj35sk7sW4IUg==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Wed, 26 Oct 2022 00:36:34 GMT
age: 70948
etag: "5292b31a99d90bcb7071f327b93d52034bdf9dcb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations