Report - demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php

Report Overview

Submitted URL
demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php
IP
151.139.128.10
ASN
#20446 STACKPATH-CDN
Submitted
2023-01-29 07:02:28
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
22

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2.0 kB	5.3 kB	23.36.77.32
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	1.0 kB	2.1 kB	142.250.74.131
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	34.217.157.108
fonts.gstatic.com	unknown	2014-09-09T02:40:21Z	2023-03-13T08:44:36Z	982 B	43 kB	216.58.207.227
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	62 kB	34.120.237.76
demo2.cloudwp.dev	unknown	2019-04-13T02:23:16Z	2023-03-12T20:27:54Z	6.4 kB	10 kB	151.139.128.10
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.9 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-01-29 07:02:24	medium	Client IP	5.252.118.36	ET INFO Dotted Quad Host DLL Request
2023-01-29 07:02:24	high	Client IP	5.252.118.36	ThreatFox botnet C2 traffic (url - confidence level: 100%)

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-01-12	medium	demo2.cloudwp.dev/	Generic/Spear Phishing
2023-01-12	medium	demo2.cloudwp.dev/	Generic/Spear Phishing
2023-01-12	medium	demo2.cloudwp.dev/	Generic/Spear Phishing
2023-01-12	medium	demo2.cloudwp.dev/	Generic/Spear Phishing
2023-01-12	medium	demo2.cloudwp.dev/	Generic/Spear Phishing
2023-01-12	medium	demo2.cloudwp.dev/	Generic/Spear Phishing

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-29	medium	demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php	Phishing
2023-01-29	medium	demo2.cloudwp.dev/images/no-grid.svg	Phishing
2023-01-29	medium	demo2.cloudwp.dev/images/boldgrid-logo-vertical-black.svg	Phishing
2023-01-29	medium	demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php	Phishing
2023-01-29	medium	demo2.cloudwp.dev/inactive.htm	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (8)

	URL	Size	First Seen	Last Seen
	demo2.cloudwp.dev/inactive.htm	158 B	2023-03-12	2023-05-21
Pretty URL demo2.cloudwp.dev/inactive.htm IP 151.139.128.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 06:48:34 Last Seen2023-05-21 14:08:42 Times Seen2 Hash 57eedf7a45fd8feb171178a7fbf568c1 87cd6e5c24587daf342b640ea47adaee2054edcc d09642ae2c3742e6f42fe9f312c9124227db0e5d51324fdb2b951233391c77c3 Loading...

	demo2.cloudwp.dev/inactive.htm	6.6 kB	2023-03-13	2023-03-13
Pretty URL demo2.cloudwp.dev/inactive.htm IP 151.139.128.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 10:51:33 Last Seen2023-03-13 10:51:33 Times Seen1 Hash b151626c72508b23e558a6a392d0c241 6801b52314d9c936a759dfb91f8f61772eabc177 50e622f2e404dcba581b47a2928f16ccd47f2bd508efffb575e36a370e85345e Loading...

	demo2.cloudwp.dev/inactive.htm	47 B	2023-03-07	2023-11-03
Pretty URL demo2.cloudwp.dev/inactive.htm IP 151.139.128.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:09:11 Last Seen2023-11-03 21:42:13 Times Seen17 Hash 9c20fa58583deb1e24d875781f0c57af d97b7559290e16cd6d970a0ef0ae3e07503563a3 ebda92a8fb246aa0daf57cc1fe84a4a89a869ad255c634e0d9de352f75232450 Loading...

	demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7	394 B	2023-03-07	2023-04-05
Pretty URL demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7 IP 151.139.128.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:09:11 Last Seen2023-04-05 02:03:52 Times Seen13 Hash 69c4d76cc0f341cc5af7df58d97334fa 6b5e1fb807f3c0beecbe1c38b77ca9dbfd424553 70256497a27ea851bc21640c6d4c52390ddbc3061e2b259b1070fb9de763874e Loading...

	demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7	24 kB	2023-03-13	2023-03-13
Pretty URL demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7 IP 151.139.128.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 10:51:33 Last Seen2023-03-13 10:51:33 Times Seen1 Hash 8f12be2158eb0696b3220eb604c86307 bb7896bc29356c66f518e64bc86073b2ffb41b6a ffa49488aa8c30c2501a2fe69eff2e113240cbef0dcd86039cab58b2709d408f Loading...

	demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7	197 B	2023-03-07	2023-04-05
Pretty URL demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7 IP 151.139.128.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:09:11 Last Seen2023-04-05 02:03:52 Times Seen13 Hash 0e05adfe4caf903b2d7d059e5e6f61ba 90d85786f53509186ad96d5c262a1c9361cc728b 8bdad92a93e8a14cd91bdd08a0975ae2eaf77002fecde576f58b4c0fd849d518 Loading...

	demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM	5.8 kB	2023-03-13	2023-03-13
Pretty URL demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM IP 151.139.128.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 10:51:33 Last Seen2023-03-13 10:51:33 Times Seen1 Hash 6f1490341ae2075832fdd76525272960 03de5b6443bf2774da969f33be0fd3dd37546a30 a20f81c3b1a27628fa8d016b685283e6237a063cb5e811920d700733c71410ec Loading...

		Size	First Seen	Last Seen
	#1 Write - bc758d86e37e314f4812eaf9767c6ad4	87 B	2023-03-07	2024-02-25
Pretty Observations First Seen2023-03-07 12:09:11 Last Seen2024-02-25 12:41:54 Times Seen320 Hash bc758d86e37e314f4812eaf9767c6ad4 a1fae42bd02a6b91210c61c0c966705b4624f28a 9f4a8d9a47dccdf390021e4db6a1111d7b98de2a9cfa6431ea3069ef5ee95d33 Loading...

HTTP Transactions (31)

URL IP Response Size

demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php

151.139.128.10

301 Moved Permanently

0 B

URL HTTP/1.1
demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
openphish	Generic/Spear Phishing
fortinet	Phishing

HTTP Headers

GET /trial-8utzx30w/one/new9/new9/c.php HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Sun, 29 Jan 2023 07:02:17 GMT
Accept-Ranges: bytes
Cache-Control: max-age=0
Location: https://demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php
X-HW: 1674975737.cds227.sk1.h2,1674975737.cds220.sk1.c
Link: <http://demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php>; rel="canonical"
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 0

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a2104f935c638b4767ca5ae0d738ef23
85c6af15af749be0ceeae6de17c36925b750f166
5d4789a3696bd7faa9916768cb627bbc89bf70a756d80e53860cbac13c2bc8b1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5D4789A3696BD7FAA9916768CB627BBC89BF70A756D80E53860CBAC13C2BC8B1"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7351
Expires: Sun, 29 Jan 2023 09:04:48 GMT
Date: Sun, 29 Jan 2023 07:02:17 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3eb88dea4fe00db1182370e72683c3ab
ca520abf1e91bfd2aef40c6a1270a911071e8922
d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9445
Expires: Sun, 29 Jan 2023 09:39:42 GMT
Date: Sun, 29 Jan 2023 07:02:17 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 29 Jan 2023 06:43:08 GMT
content-type: application/json
age: 1149
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
302c7548412192add063ad6c8b99cf3b
e5d178931a27db036ce8daae302594d3ff7050b8
fc2bd9091006189e67e8074093805ee5492ce16e1dbfba32e083abeeae34969d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FC2BD9091006189E67E8074093805EE5492CE16E1DBFBA32E083ABEEAE34969D"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2436
Expires: Sun, 29 Jan 2023 07:42:53 GMT
Date: Sun, 29 Jan 2023 07:02:17 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: xfnGEyx5N/Ee0BKajc5QX/bP42BHTZIgTuoRtrFENox0YtJKJmMyVuQxNU0bL8GrsN8ltw2bdsgq81LqVevohg==
x-amz-request-id: 146QBXF7HQD45W2K
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 29 Jan 2023 06:21:17 GMT
age: 2460
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sun, 29 Jan 2023 07:02:17 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Last-Modified, Pragma, ETag, Retry-After, Content-Type, Content-Length, Expires, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
content-type: application/json
date: Sun, 29 Jan 2023 07:02:17 GMT
etag: "1648230346554"
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
16a7b6a7128312e2f985d30df18c4487
6017bff79ffb525d9c7f9f32b999b74b5dc69602
663fd12209627f08e759c2ed1c76278a5da79dae1e0b46082dd1bb44775f7a16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "663FD12209627F08E759C2ED1C76278A5DA79DAE1E0B46082DD1BB44775F7A16"
Last-Modified: Fri, 27 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8257
Expires: Sun, 29 Jan 2023 09:19:55 GMT
Date: Sun, 29 Jan 2023 07:02:18 GMT
Connection: keep-alive

push.services.mozilla.com/

34.217.157.108

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.217.157.108:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: YhWk2KLgjL0xN4XEcJVQPg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: fcU6Q2fmsL6XlIKWycYbpb5yd4s=

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
8cf65fcdafa84b63cf7005fe57927fcb
3f7d163a96e7f00eb2de9828624ec46e22b4b40a
dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 07:02:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.gstatic.com/s/exo2/v3/-A4eIjQkAwKL411pgtQ4VA.woff2

216.58.207.227

200 OK

20 kB

URL HTTP/2
fonts.gstatic.com/s/exo2/v3/-A4eIjQkAwKL411pgtQ4VA.woff2
IP
216.58.207.227:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 19516, version 1.65\012- data
Size
20 kB (19516 bytes)
Hash
d4ca8d74b0e60bc12aff23761498c73d
403689d08005fec559afc2f3070d5d2817d62595
25706f2aee8b387e4ce26b4cbcf4a6b79d385c1415f21baa41706fc7ed4520ea

HTTP Headers

GET /s/exo2/v3/-A4eIjQkAwKL411pgtQ4VA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://demo2.cloudwp.dev
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 19516
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 27 Jan 2023 02:34:02 GMT
expires: Sat, 27 Jan 2024 02:34:02 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 27 Aug 2014 15:24:19 GMT
content-type: font/woff2
age: 188897
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
8cf65fcdafa84b63cf7005fe57927fcb
3f7d163a96e7f00eb2de9828624ec46e22b4b40a
dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 07:02:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
8cf65fcdafa84b63cf7005fe57927fcb
3f7d163a96e7f00eb2de9828624ec46e22b4b40a
dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 07:02:19 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.gstatic.com/s/josefinsans/v9/C6HYlRF50SGJq1XyXj04z04GofcKVZz6wtzX_QUIqsI.woff2

216.58.207.227

200 OK

22 kB

URL HTTP/2
fonts.gstatic.com/s/josefinsans/v9/C6HYlRF50SGJq1XyXj04z04GofcKVZz6wtzX_QUIqsI.woff2
IP
216.58.207.227:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 22244, version 1.0\012- data
Size
22 kB (22244 bytes)
Hash
6a6b4d48d3990297f8feb86f96e8386e
beef652f807f9bb675aed8738aead08fdea31611
70716a99384f70e8f55280615bf0ddf84d17c5561769e1671ee736bda8c2796a

HTTP Headers

GET /s/josefinsans/v9/C6HYlRF50SGJq1XyXj04z04GofcKVZz6wtzX_QUIqsI.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://demo2.cloudwp.dev
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 22244
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 26 Jan 2023 04:00:28 GMT
expires: Fri, 26 Jan 2024 04:00:28 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 06 Oct 2014 20:36:34 GMT
content-type: font/woff2
age: 270111
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
dfb84426fed94988d5c90372baff059c
f1c4740830034ff8a5759d59ae3f657ea524d083
d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20065
Expires: Sun, 29 Jan 2023 12:36:44 GMT
Date: Sun, 29 Jan 2023 07:02:19 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
dfb84426fed94988d5c90372baff059c
f1c4740830034ff8a5759d59ae3f657ea524d083
d97efec67504b084ca6ff9e2af973b45b916f90aa021603e3615806bb2737b6a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D97EFEC67504B084CA6FF9E2AF973B45B916F90AA021603E3615806BB2737B6A"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20065
Expires: Sun, 29 Jan 2023 12:36:44 GMT
Date: Sun, 29 Jan 2023 07:02:19 GMT
Connection: keep-alive

demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7

151.139.128.10

200 OK

848 B

URL HTTP/2
demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type
data
Size
848 B (848 bytes)
Hash
37922e03fe302cb2ff58af67e1fa3106
7e1e0179c164c774d9af9b9b0d48556d1d88c2aa
afb3341b97eaea393e2e438a339ddc70b4440e22e4094ddb88936b1829f775d3

HTTP Headers

POST /sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7 HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 500
Origin: https://demo2.cloudwp.dev
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7
Cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; spcsrf=066ba08b3635d3c5c245c9033e40410c; UTGv2=h4138db03b762ba5dd7178461fd75bd5cc52; sp_lit=07BHlFPMz5hNlHSKKnWQCw==; PRLST=OM; adOtr=c5a6701f506
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Sun, 29 Jan 2023 07:02:19 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private,  max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
x-hw: 1674975739.cds243.sk1.hn,1674975739.cds249.sk1.sc,1674975739.cdn2-wafbe02-arn1.stackpath.systems.-.i,1674975739.cds249.sk1.p
access-control-allow-origin: *
X-Firefox-Spdy: h2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4bff98d2-c029-496d-b1f3-f17f0e92e273.jpeg

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4bff98d2-c029-496d-b1f3-f17f0e92e273.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (12124 bytes)
Hash
7da187381befeffa83fbaed380f2932e
7f4750e505e965f129c096ef40bc24c392051025
f47a20d681386b3341f23d286fb2f0a2a789bde75bdbc2d14c4747721e13d7a5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4bff98d2-c029-496d-b1f3-f17f0e92e273.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12124
x-amzn-requestid: 4032a848-72f7-4fbf-a0b2-e9cd7a2d1853
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fVMBEGtwIAMF_Zw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1f3a0-6eec6555074c2fba0be0d90e;Sampled=0
x-amzn-remapped-date: Thu, 26 Jan 2023 03:29:36 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ixuvPYw-yLJbABGhAMsaZPkbpCy6H-R-QXKxMlIBRQgBYvnERkOs_Q==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 12:06:16 GMT
age: 68163
etag: "7f4750e505e965f129c096ef40bc24c392051025"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.4 kB (7417 bytes)
Hash
6af6f32397882f56d14d22348e44a9f1
5a626376807e7507fa3a204c4e4e9e44aa074a37
478f32e98c0a1f0d62fa337795ca88b7927e14b684b681f7629b648bc2d709a5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7417
x-amzn-requestid: 53032353-8613-49b0-944d-3742236cf50c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fYcMmFeQIAMF3Yw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d340b6-7fe2226327d90db014527c08;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 03:10:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: zd8cTO2N1JO-OK3hCDwVO8naClCsg0raJLboRFle-DPSKhR_7k8-Yg==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 981753271eb5b6d11bc29d52f173a5da.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 03:16:35 GMT
age: 13544
etag: "5a626376807e7507fa3a204c4e4e9e44aa074a37"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.2 kB (9167 bytes)
Hash
3be81f83687ddb6c93d3ff3c09a9dba2
50a48e737310d3f31840db4301b25927fbcc12c5
e78c909e2381898e7f546183784a05dff47c31734c95358aaada8c2777ad47be

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9167
x-amzn-requestid: f644ca78-a07a-43d1-96e4-95bcdecff7fb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fPGLfFtOIAMFp7w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cf83e2-202ca7160544acd24259bd5d;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 07:08:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: xRwqrWS66l4qJfg2HnGphN1dbrIUod9XKW3zTk_-Km9AQRPyV2UqWg==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 20:46:16 GMT
age: 36963
etag: "50a48e737310d3f31840db4301b25927fbcc12c5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce27f1aa-8d31-4110-a47f-73de0b95926d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11470 bytes)
Hash
10a6491e2c1dfde68c7cd7297e70700f
d0f195319825a6d3e5e50ad15b2fcab27cb65896
4d9353d5874e5ea03c25e1562db5f479c222a48db526fdd10ede7c2e6a4dd874

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce27f1aa-8d31-4110-a47f-73de0b95926d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11470
x-amzn-requestid: 62d61967-9380-4ca9-b11a-531425dbd2ae
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fIf6WFgAIAMF6gw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cce042-6d9fe51029094b7f37c0a648;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 07:05:38 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: rUIvvkZQ028ey3klplI-x9oZFugon5HsAWT-SN2GQo5hBeBJWqoMAg==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 04:01:15 GMT
age: 10864
etag: "d0f195319825a6d3e5e50ad15b2fcab27cb65896"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5dcfee7f-f43c-4828-8113-8ba8eb26f727.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10168 bytes)
Hash
d5ed99a9aed6f367efc5c9498ce87ff1
3123eb6f550c51fe17fc62eff943b3739e239a9b
536f45bf2eb41f7056df8b34964538005d6a0a4c6157def3fbdd9487f8c79027

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5dcfee7f-f43c-4828-8113-8ba8eb26f727.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10168
x-amzn-requestid: fe58fe3c-dd23-4614-b5a2-e91ef68c2ab7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fFOD7H-NIAMFcxw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cb907f-687fc51741d7ff97182d1955;Sampled=0
x-amzn-remapped-date: Sat, 21 Jan 2023 07:13:03 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: SORDxKQP-GudaCfRIbrmexyEeJXBExRipfF8sPHI-UkaYhR_RkDjvQ==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 00:55:27 GMT
age: 22012
etag: "3123eb6f550c51fe17fc62eff943b3739e239a9b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.6 kB (5594 bytes)
Hash
4c77437e3a7361861aed8bfecbfe6bd6
fefd238c13c0fdfb7d964c90fcc8a8cbbf953034
282d15c443cb6232ae0a30046a0dc24360617355a4651cdba59b11e6f7313d8a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5594
x-amzn-requestid: d56c9b84-dc1f-4d5c-91bf-7db55058bf67
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLyeEGOloAMFpzA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ce3126-5013a6b971d6800c5c85a4eb;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 07:03:02 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: uPJu2SzvWcfqukF9t0PKG5iK7LrTnk1Cn5nioD4MklQgDAZnbiH8Gw==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 14:55:48 GMT
age: 57991
etag: "fefd238c13c0fdfb7d964c90fcc8a8cbbf953034"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

demo2.cloudwp.dev/images/no-grid.svg

151.139.128.10

200 OK

748 B

URL HTTP/2
demo2.cloudwp.dev/images/no-grid.svg
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type
SVG Scalable Vector Graphics image\012- HTML document, Unicode text, UTF-8 text, with very long lines (799)
Size
748 B (748 bytes)
Hash
fcebd70ebc58ff18fc16d5046b8327e0
8f9b173ec90e8c044c36e8d3e433adcbbea347f6
518b8561325dbb40ab1b4e06724feff581982bf209e60b4b7cc54983b6dd577b

Detections

Analyzer	Verdict	Alert
openphish	Generic/Spear Phishing
fortinet	Phishing

HTTP Headers

GET /images/no-grid.svg HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/inactive.htm
Cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; spcsrf=066ba08b3635d3c5c245c9033e40410c; UTGv2=h4138db03b762ba5dd7178461fd75bd5cc52; sp_lit=07BHlFPMz5hNlHSKKnWQCw==; PRLST=OM
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Sun, 29 Jan 2023 07:02:19 GMT
etag: "1480970958"
cache-control: max-age=30
content-encoding: gzip
content-length: 748
content-type: image/svg+xml
last-modified: Mon, 05 Dec 2016 20:49:18 GMT
accept-ranges: bytes
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-hw: 1674975739.cds243.sk1.hn,1674975739.cds222.sk1.sc,1674975739.cds222.sk1.pr
link: <https://demo2.cloudwp.dev/images/no-grid.svg>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2

demo2.cloudwp.dev/images/boldgrid-logo-vertical-black.svg

151.139.128.10

200 OK

1.8 kB

URL HTTP/2
demo2.cloudwp.dev/images/boldgrid-logo-vertical-black.svg
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (4396), with no line terminators
Size
1.8 kB (1806 bytes)
Hash
5e37ed8b16c8e17b3d2da3c160274f74
a6f17c0b1d96de15eabe44d39133be2a72e3b800
a73c7101f349ebad8c84b448946034f907d4c6f7d384c5dd77b389a4ec14e266

Detections

Analyzer	Verdict	Alert
openphish	Generic/Spear Phishing
fortinet	Phishing

HTTP Headers

GET /images/boldgrid-logo-vertical-black.svg HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/inactive.htm
Cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; spcsrf=066ba08b3635d3c5c245c9033e40410c; UTGv2=h4138db03b762ba5dd7178461fd75bd5cc52; sp_lit=07BHlFPMz5hNlHSKKnWQCw==; PRLST=OM
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Sun, 29 Jan 2023 07:02:19 GMT
etag: "1480711858"
cache-control: max-age=30
content-encoding: gzip
content-length: 1806
content-type: image/svg+xml
last-modified: Fri, 02 Dec 2016 20:50:58 GMT
accept-ranges: bytes
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-hw: 1674975739.cds243.sk1.hn,1674975739.cds016.sk1.sc,1674975739.cds016.sk1.pr
link: <https://demo2.cloudwp.dev/images/boldgrid-logo-vertical-black.svg>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2

demo2.cloudwp.dev/favicon.ico

151.139.128.10

200 OK

1.2 kB

URL HTTP/2
demo2.cloudwp.dev/favicon.ico
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Size
1.2 kB (1189 bytes)
Hash
6af2b6286c753a22bf1dd95100bd3093
004c513c359ae3c57ed85910f27804def11e2d26
9a187b9fc2a7a7ebeae725b685c4a33848f94b2cf69d276a227401c10a268058

Detections

Analyzer	Verdict	Alert
openphish	Generic/Spear Phishing

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/inactive.htm
Cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; spcsrf=066ba08b3635d3c5c245c9033e40410c; UTGv2=h4138db03b762ba5dd7178461fd75bd5cc52; sp_lit=07BHlFPMz5hNlHSKKnWQCw==; PRLST=OM; adOtr=c5a6701f506
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Sun, 29 Jan 2023 07:02:20 GMT
cache-control: max-age=30
content-length: 1189
content-type: image/x-icon
last-modified: Tue, 21 Apr 2015 20:19:14 GMT
accept-ranges: bytes
etag: "5536b0c2-4a5"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-hw: 1674975739.cds243.sk1.hn,1674975739.cds015.sk1.sc,1674975740.cds015.sk1.pr
link: <https://demo2.cloudwp.dev/favicon.ico>; rel="canonical"
X-Firefox-Spdy: h2

demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php

151.139.128.10

301 Moved Permanently

0 B

URL HTTP/2
demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
openphish	Generic/Spear Phishing
fortinet	Phishing

HTTP Headers

GET /trial-8utzx30w/one/new9/new9/c.php HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 301 Moved Permanently
date: Sun, 29 Jan 2023 07:02:18 GMT
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/html; charset=iso-8859-1
set-cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; path=/; HttpOnly; SameSite=Lax;
SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; path=/; HttpOnly; SameSite=Lax;
spcsrf=f61164d612a3fe79a86f68e4db1b3eba; path=/; SameSite=Strict; HttpOnly;  expires=Sun, 29-Jan-23 09:02:17 GMT
adOtr=obsvl; path=/; SameSite=Lax; expires=Thu, 2 Aug 2001 20:47:11 UTC
UTGv2=D-h414a8324adadc96d754f92118da6f07ec49; path=/; SameSite=Lax; expires=Fri, 28-Jul-23 07:02:17 GMT
pragma: no-cache
expires: Sun, 20 Apr 1975 05:05:00 GMT
location: https://demo2.cloudwp.dev/inactive.htm
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
link: <https://demo2.cloudwp.dev/trial-8utzx30w/one/new9/new9/c.php>; rel="canonical"
x-hw: 1674975737.cds243.sk1.hn,1674975737.cds220.sk1.sc,1674975738.cdn2-wafbe03-arn1.stackpath.systems.-.wx,1674975738.cds220.sk1.p
access-control-allow-origin: *
X-Firefox-Spdy: h2

demo2.cloudwp.dev/inactive.htm

151.139.128.10

200 OK

0 B

URL HTTP/2
demo2.cloudwp.dev/inactive.htm
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
openphish	Generic/Spear Phishing
fortinet	Phishing

HTTP Headers

GET /inactive.htm HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; spcsrf=f61164d612a3fe79a86f68e4db1b3eba; UTGv2=D-h414a8324adadc96d754f92118da6f07ec49
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

HTTP/2 200 OK
date: Sun, 29 Jan 2023 07:02:18 GMT
cache-control: private
content-encoding: gzip
content-type: text/html; charset=utf-8
last-modified: Fri, 09 Jul 2021 17:42:39 GMT
vary: Accept-Encoding
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
set-cookie: spcsrf=066ba08b3635d3c5c245c9033e40410c; path=/; SameSite=Strict; HttpOnly;  expires=Sun, 29-Jan-23 09:02:18 GMT
UTGv2=D-h4138db03b762ba5dd7178461fd75bd5cc52; path=/; SameSite=Lax; expires=Fri, 28-Jul-23 07:02:18 GMT
sp_lit=07BHlFPMz5hNlHSKKnWQCw==; path=/; SameSite=Strict; HttpOnly; expires=Sun, 29-Jan-23 07:07:18 GMT
link: <https://demo2.cloudwp.dev/inactive.htm>; rel="canonical"
x-hw: 1674975738.cds243.sk1.hn,1674975738.cds018.sk1.sc,1674975738.cdn2-wafbe03-arn1.stackpath.systems.-.wx,1674975738.cds018.sk1.p
access-control-allow-origin: *
X-Firefox-Spdy: h2

demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7

151.139.128.10

200 OK

0 B

URL HTTP/2
demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7 HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/inactive.htm
Cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; spcsrf=066ba08b3635d3c5c245c9033e40410c; UTGv2=h4138db03b762ba5dd7178461fd75bd5cc52; sp_lit=07BHlFPMz5hNlHSKKnWQCw==; PRLST=OM
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Sun, 29 Jan 2023 07:02:19 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private,  max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
x-hw: 1674975739.cds243.sk1.hn,1674975739.cds220.sk1.sc,1674975739.cdn2-wafbe03-arn1.stackpath.systems.-.i,1674975739.cds220.sk1.p
access-control-allow-origin: *
X-Firefox-Spdy: h2

demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM

151.139.128.10

200 OK

0 B

URL HTTP/2
demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM
IP
151.139.128.10:0
ASN
#20446 STACKPATH-CDN

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /sbbi/?sbbpg=sbbShell&gprid=OM HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=OM&sbbgs=h4138db03b762ba5dd7178461fd75bd5cc52&ddl=7
Cookie: SPSI=7a15c650f604eeeaf1f78fdc368fc397; SPSE=Gf1SSbIP/rHxRHxAOc/BtvTQkyFSpiTdRAEQkdQx8fUGqrMT8cPJwyeWY4tmFOgoXAcpVAUNBEJhPObYzWlWjw==; spcsrf=066ba08b3635d3c5c245c9033e40410c; UTGv2=h4138db03b762ba5dd7178461fd75bd5cc52; sp_lit=07BHlFPMz5hNlHSKKnWQCw==; PRLST=OM; adOtr=c5a6701f506
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Sun, 29 Jan 2023 07:02:19 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private,  max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
x-hw: 1674975739.cds243.sk1.hn,1674975739.cds241.sk1.sc,1674975739.cdn2-redis01-arn1.stackpath.systems.-.i,1674975739.cds241.sk1.p
access-control-allow-origin: *
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (8)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (31)

URL HTTP/1.1

IP