offers.winnewoffers.com/campaign/f50d566b-80f3-4943-8d12-3e8b17d48551
308 Permanent Redirect 0 B URL HTTP/1.1 offers.winnewoffers.com/campaign/f50d566b-80f3-4943-8d12-3e8b17d48551
IP
ASN #14061 DIGITALOCEAN-ASN
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /campaign/f50d566b-80f3-4943-8d12-3e8b17d48551 HTTP/1.1
Host: offers.winnewoffers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 308 Permanent Redirect
Connection: close
Location: https://offers.winnewoffers.com/campaign/f50d566b-80f3-4943-8d12-3e8b17d48551
Server: Caddy
Date: Sun, 04 Dec 2022 15:29:59 GMT
Content-Length: 0
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cfec3d7283a9b66d2be426ce54d210f3
808c1feb1ba918951d1928c1f6bfc0c253262774
1bad6c06aa3e88dcbc125fc98a6cb753eb2b18d2c8dd61da21d12209aeeda3f9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1BAD6C06AA3E88DCBC125FC98A6CB753EB2B18D2C8DD61DA21D12209AEEDA3F9"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14781
Expires: Sun, 04 Dec 2022 19:36:20 GMT
Date: Sun, 04 Dec 2022 15:29:59 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash fb2c0697c6d9a96a5411dd2952947458
79e57f831ec396bbdaa5bfe9472a05e6c9fb31f4
3fd7edcc349ab4402f62e54a142be6b4cecf0e7ee3f431d3168bdf0643ba4d92
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2882
Cache-Control: max-age=157760
Content-Type: application/ocsp-response
Date: Sun, 04 Dec 2022 15:29:59 GMT
Etag: "638c76f5-1d7"
Expires: Tue, 06 Dec 2022 11:19:19 GMT
Last-Modified: Sun, 04 Dec 2022 10:31:17 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1ea206ac3c440825741687351f8c6e4e
2f38dafd8c43dcce2411a0590bc5c02cd6286735
7d7232c8c91bcd18161ba2c9d23e3bff159604e058bd5b3fc1c7fcbcd03a7ee3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7232C8C91BCD18161BA2C9D23E3BFF159604E058BD5B3FC1C7FCBCD03A7EE3"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5081
Expires: Sun, 04 Dec 2022 16:54:41 GMT
Date: Sun, 04 Dec 2022 15:30:00 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 04 Dec 2022 15:20:07 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 593
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: ZAY5tl3OXiKdhdCSzU6VfXMfbyD5DKIUt2zd1OWt7tmoIQPidFJPOf9GlYMEnhLslFuWLVydXUaW4SlFVFvMGQ==
x-amz-request-id: XR53846W1CWHM1CC
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 04 Dec 2022 14:47:01 GMT
age: 2579
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 04 Dec 2022 15:30:00 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
offers.winnewoffers.com/campaign/f50d566b-80f3-4943-8d12-3e8b17d48551
302 Found 0 B URL HTTP/2 offers.winnewoffers.com/campaign/f50d566b-80f3-4943-8d12-3e8b17d48551
IP
ASN #14061 DIGITALOCEAN-ASN
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /campaign/f50d566b-80f3-4943-8d12-3e8b17d48551 HTTP/1.1
Host: offers.winnewoffers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 302 Found
access-control-allow-headers: Authorization, Origin, Content-Type, Accept
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
allow: POST, GET, OPTIONS
content-type: application/json
date: Sun, 04 Dec 2022 15:30:00 GMT
location: http://games.winnewoffers.com/cl/22d8636f5bd06fdd?p1=ce6bpu0r0ndpa40vu9fg&p2=&source=&site=
server: Caddy
set-cookie: skro-visited-cpid-f50d566b-80f3-4943-8d12-3e8b17d48551=1; Path=/; Domain=offers.winnewoffers.com; Max-Age=86400; HttpOnly; Secure; SameSite=None
skro-last-clicked-id=ce6bpu0r0ndpa40vu9fg; Path=/; Domain=offers.winnewoffers.com; Max-Age=86400; HttpOnly; Secure; SameSite=None
content-length: 0
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 04 Dec 2022 15:11:19 GMT
cache-control: public,max-age=3600
age: 1121
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
games.winnewoffers.com/cl/22d8636f5bd06fdd?p1=ce6bpu0r0ndpa40vu9fg&p2=&source=&site=
302 Found 642 B URL HTTP/1.1 games.winnewoffers.com/cl/22d8636f5bd06fdd?p1=ce6bpu0r0ndpa40vu9fg&p2=&source=&site=
IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 3a3e951188b1644b9e8f87da18c2ca99
fea143cc2960906f084b5a85189102d0c1acfc34
2de25ba3291216febc50bae9576fd21404bfaff720785e861c19cff4001d51da
GET /cl/22d8636f5bd06fdd?p1=ce6bpu0r0ndpa40vu9fg&p2=&source=&site= HTTP/1.1
Host: games.winnewoffers.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Server: nginx
Date: Sun, 04 Dec 2022 15:30:00 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 642
Connection: keep-alive
X-Powered-By: PHP/8.1.13
Cache-Control: no-cache
Location: https://cupme.org/cl/367c72c2265e715e?p1=4163414861&p2=33861&p3=16384&source=&site=
X-Frame-Options: DENY
Set-Cookie: sbc22d8636f5bd06fdd=eyJpdiI6IjVPV05NRGJNcGJKQi9KdWRSMGowd3c9PSIsInZhbHVlIjoiNHgvTkVCaG8yODNyOHhBN0dzL0xKQT09IiwibWFjIjoiMzdmNjdhMWQwNGMzM2E2NWI2NWZhYTFjYWEwZjZlODVlNTliNTk5YzkxZjRkNzk5Zjk1ODYyMDY2MDY3YmM2MyIsInRhZyI6IiJ9; expires=Sun, 04 Dec 2022 16:30:00 GMT; Max-Age=3600; path=/; httponly; samesite=lax
vis=eyJpdiI6ImRpQ1d0SHdRTk5uSkM5dTFRQkJjUHc9PSIsInZhbHVlIjoiRFNQQlkvTjVkdGdRVUJzUlZQT2hIUT09IiwibWFjIjoiNDMwYTYzNzkyNjk5ZjQxODNjMTA3YzZiYjZlNzVjZTY2MDQ0NWZhNGY0YWYwOTgwMTM5NWU1ZDRiZDU2MmIwOCIsInRhZyI6IiJ9; expires=Sat, 04 Mar 2023 15:30:00 GMT; Max-Age=7776000; path=/; httponly; samesite=lax
Expires: Thu, 01 Jan 1970 00:00:01 GMT
ocsp.digicert.com/
200 OK 279 B IP
Hash 0bdcf946e38cbec8f0d9f4ce6d2b2fce
a461602b6147188ff5dcbe787c9f4ad152a389aa
b32d65ce5e16268e8d12e09ecb56ba75227eea22cd18b414fa589003fb04fbee
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=159510
Content-Type: application/ocsp-response
Date: Sun, 04 Dec 2022 15:30:00 GMT
Etag: "638c890e-117"
Expires: Tue, 06 Dec 2022 11:48:30 GMT
Last-Modified: Sun, 04 Dec 2022 11:48:30 GMT
Server: nginx
Content-Length: 279
ocsp.digicert.com/
200 OK 471 B IP
Hash 31b129c94a90b1e695b21395cb54e378
a3cae46b48d469cc61ab0581303bcd5f5b654db9
fac3f681be358a20f78958dff10c89b7a91365c5114c81246c1bc34c1362ba1e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2863
Cache-Control: max-age=152674
Content-Type: application/ocsp-response
Date: Sun, 04 Dec 2022 15:30:00 GMT
Etag: "638c632b-1d7"
Expires: Tue, 06 Dec 2022 09:54:34 GMT
Last-Modified: Sun, 04 Dec 2022 09:06:51 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 279 B IP
Hash 0bdcf946e38cbec8f0d9f4ce6d2b2fce
a461602b6147188ff5dcbe787c9f4ad152a389aa
b32d65ce5e16268e8d12e09ecb56ba75227eea22cd18b414fa589003fb04fbee
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 0
Cache-Control: max-age=159510
Content-Type: application/ocsp-response
Date: Sun, 04 Dec 2022 15:30:00 GMT
Etag: "638c890e-117"
Expires: Tue, 06 Dec 2022 11:48:30 GMT
Last-Modified: Sun, 04 Dec 2022 11:48:30 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 279
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: CqxDXekDu9JU4QhmJ5vUpg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: SlDjrIacWeYuyG9hMPAb42XHXYY=
ocsp.sectigo.com/
200 OK 472 B IP
Hash 27c8fb5922ac842e5d6341a93dacc8ee
5be10edca607c91ae44e22227c0ce6057da0eb75
628f5cd2fe34f1079de6f818f7b9f3ee15e9e82eccb594214a0742498fe7d13e
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 04 Dec 2022 15:30:01 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Thu, 01 Dec 2022 07:17:42 GMT
Expires: Thu, 08 Dec 2022 07:17:41 GMT
Etag: "5be10edca607c91ae44e22227c0ce6057da0eb75"
Cache-Control: max-age=315459,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 774594b4498cb527-OSL
digitaltechnology.co/campaign/no/?cid=8&ref=affgg&click_id=4163414878&source=1
200 OK 248 B URL HTTP/1.1 digitaltechnology.co/campaign/no/?cid=8&ref=affgg&click_id=4163414878&source=1
IP
File type HTML document text\012- exported SGML document, ASCII text
Hash fe3fdab9d1ceea5307884dc07ee41cd9
0e5dfe47db323a11068ca995b3813a98213b4505
7efc62fc3453e85bc3b8dc24498ed1b0fd7c207dac5c5fcec241163bab09066e
GET /campaign/no/?cid=8&ref=affgg&click_id=4163414878&source=1 HTTP/1.1
Host: digitaltechnology.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 200 OK
Date: Sun, 04 Dec 2022 15:30:01 GMT
Server: Apache/2.4.37 (centos)
X-Powered-By: PHP/7.2.24
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: : 1;mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Feature-Policy: self
Set-Cookie: LSW_WEB01=LSW_WEB01; path=/
prod.digitaltechnology.co/consent/request?productId=1176&responseUrl=https%3A%2F%2Fnorway.docubay.com%2F%3Fmsisdn%3D47xxxxxxx&trafficSource=ADV&trxid=790d51854dded68837e2c055e46abe60
302 0 B URL HTTP/1.1 prod.digitaltechnology.co/consent/request?productId=1176&responseUrl=https%3A%2F%2Fnorway.docubay.com%2F%3Fmsisdn%3D47xxxxxxx&trafficSource=ADV&trxid=790d51854dded68837e2c055e46abe60
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /consent/request?productId=1176&responseUrl=https%3A%2F%2Fnorway.docubay.com%2F%3Fmsisdn%3D47xxxxxxx&trafficSource=ADV&trxid=790d51854dded68837e2c055e46abe60 HTTP/1.1
Host: prod.digitaltechnology.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://digitaltechnology.co/campaign/no/?cid=8&ref=affgg&click_id=4163414878&source=1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
HTTP/1.1 302
Location: http://checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http%3A%2F%2Fprod.digitaltechnology.co%2Fv1%2Fredirect%2Fno%2Ftelnor%3Ftransaction_id%3D679r5ynFYBlY
Content-Language: en-US
Content-Length: 0
Date: Sun, 04 Dec 2022 15:30:00 GMT
Connection: close
Server: TEST
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: : 1;mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Feature-Policy: self
Set-Cookie: JSESSIONID=F1FB26C6FB2D927C76C95867A287B9B8; Path=/; HttpOnly
LSW_WEB01=LSW_WEB01; path=/
checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http%3A%2F%2Fprod.digitaltechnology.co%2Fv1%2Fredirect%2Fno%2Ftelnor%3Ftransaction_id%3D679r5ynFYBlY
302 Found 364 B URL HTTP/1.1 checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http%3A%2F%2Fprod.digitaltechnology.co%2Fv1%2Fredirect%2Fno%2Ftelnor%3Ftransaction_id%3D679r5ynFYBlY
IP
File type HTML document text\012- HTML document, ASCII text, with very long lines (364), with no line terminators
Hash 3bd8664c522ba5982572b14a259a9e62
2d651d97857541c7873f42ba0885cd12c6b72ff3
e5e0e2e604ff87501940b26c8c67c39e10a6f769696200dc65b8befdc2e6dd1c
GET /purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http%3A%2F%2Fprod.digitaltechnology.co%2Fv1%2Fredirect%2Fno%2Ftelnor%3Ftransaction_id%3D679r5ynFYBlY HTTP/1.1
Host: checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Date: Sun, 04 Dec 2022 15:30:01 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.21.4
X-Frame-Options: ALLOWALL
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Location: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Cache-Control: no-cache
X-Request-Id: 8a3f6201-34c7-4b14-8787-ab7226fce2ce
X-Runtime: 0.011277
Vary: Origin
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3674
Expires: Sun, 04 Dec 2022 16:31:16 GMT
Date: Sun, 04 Dec 2022 15:30:02 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3674
Expires: Sun, 04 Dec 2022 16:31:16 GMT
Date: Sun, 04 Dec 2022 15:30:02 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3674
Expires: Sun, 04 Dec 2022 16:31:16 GMT
Date: Sun, 04 Dec 2022 15:30:02 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6df54ea7-8915-4ac7-af2b-6a71ce14dbf4.webp
200 OK 5.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6df54ea7-8915-4ac7-af2b-6a71ce14dbf4.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 43309032a892c486f9985ef520df696e
36f4682ca6a33ff80ee02129c77e6f27e996ede0
24225ff504f30405d9ec3feb2555c738fcca0d6b265f285aa9c73a64c78a496e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6df54ea7-8915-4ac7-af2b-6a71ce14dbf4.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5681
x-amzn-requestid: 8f0d66b8-d532-48d9-9a29-74540cd6ab3a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cltXnEotIAMFqkA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638bc296-27349a376ff819ab63b04a81;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 21:41:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Uz-wJTZjej3sjP-O68BQ4hB_kkAecG0o7GkeZUan90ZgV87g0Cg_ZA==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 3cd7af07832481c336aa1c93c9b4a6fe.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:52:38 GMT
age: 63444
etag: "36f4682ca6a33ff80ee02129c77e6f27e996ede0"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d571e0e-b14e-436b-8156-2e49aad75d4f.png
200 OK 16 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d571e0e-b14e-436b-8156-2e49aad75d4f.png
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 14dcca2a9c4792d835ee709bcd947402
1d702df3a64258628f4124eafd580695f2d350af
da01dcd8fef7c50bdb6f7a8a6a4955694092f479df3dba72f7fa69d7280d07b2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d571e0e-b14e-436b-8156-2e49aad75d4f.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 16143
x-amzn-requestid: dc86fad4-4e53-42c9-9b0a-5e4d2cfcd087
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cdGyLGqmoAMFnaA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638851a7-0ea324b31e8c6578098b8ab9;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 07:03:03 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: kRs3oBWnSs5asyPdvz6kkooy7pqm2Yr8R_2x8EXCVn3dBz_aEJurRQ==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 07:26:41 GMT
age: 29001
etag: "1d702df3a64258628f4124eafd580695f2d350af"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd528f6ee-d348-431d-8220-5c8b154b2941.jpeg
200 OK 8.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd528f6ee-d348-431d-8220-5c8b154b2941.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash db1701b7b9d161a0c935bb6e10b17893
22a8c4bd58c729c1abcf794466e8f3231dfb034b
b495524a33e5b1d3ba34cfbe867ada0da956c061370b1fcde06b23a6194a9787
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd528f6ee-d348-431d-8220-5c8b154b2941.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8315
x-amzn-requestid: f1bcc33b-aad9-4d3b-b1f9-49282f2d4fb9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: clsAMGVboAMFfxg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638bc067-13472a097177d4751c8f7a8c;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 21:32:23 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 6UQ_BhPmpVpe9w6gsExB-EpNq_syeCCK6fr4Y1FFK1jDJh_n1Sd0Eg==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:52:47 GMT
age: 63435
etag: "22a8c4bd58c729c1abcf794466e8f3231dfb034b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8f00caab-057c-4cc2-a163-fd0bb4d0b5f7.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8f00caab-057c-4cc2-a163-fd0bb4d0b5f7.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1521243a6fc065bb631bfbde22886fa2
527220e4e8cd1065ce05fcd0694d0d703d817e2e
b83ebf768bbfb34f49d5467f3dfb43ceb3ca3d30d3454e6f37db9aef72d7689a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8f00caab-057c-4cc2-a163-fd0bb4d0b5f7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11482
x-amzn-requestid: d1db05ab-bd5d-4ad4-96b4-8f439152e435
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: clssNEeAoAMFh_g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638bc181-0221c53842a2f5ef071e8071;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 21:37:05 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: t1vmY4fBoLpFjqHbLyMewgUrpvRjqG4QTAuA4BeB4Gl2jqbxI0gYQA==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:50:08 GMT
age: 63594
etag: "527220e4e8cd1065ce05fcd0694d0d703d817e2e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61cc2744-b517-4404-bfa2-25fadadfa3f3.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61cc2744-b517-4404-bfa2-25fadadfa3f3.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2636f91bb8fa4d9bb7bef114c248a9ae
8637105f41058bc0d2b259d462b560881928adb6
3d93fd8fcf1af31d00ccbd453142dbea5f2b91d7f58373095943ed40a31ed1f7
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61cc2744-b517-4404-bfa2-25fadadfa3f3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10431
x-amzn-requestid: f79ab5e7-8c1b-4827-a531-aaa19c1d80aa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: clsCGEwxIAMF34g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638bc073-6358d2950955884c470c0a89;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 21:32:35 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: PQ7xh995cd1UVi3z42EVZGjQjHLLvtAP5BBC-xLEEGr4mEiXS6fC-w==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:47:06 GMT
age: 63776
etag: "8637105f41058bc0d2b259d462b560881928adb6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fae18d1b5-3b75-4897-bd1b-03651e437c2e.jpeg
200 OK 4.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fae18d1b5-3b75-4897-bd1b-03651e437c2e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c01fe1cccdb3b672bbade6d98217ffe9
a9a529dc9894827f6243a1bf57f81caa4fe88fc2
c43da6212c79a08e22e78e04e99e8f5422e64b4b0a87f30b7907f1b4bc675c71
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fae18d1b5-3b75-4897-bd1b-03651e437c2e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4666
x-amzn-requestid: 850d341f-5ccb-453c-8adf-a8194f8fbdad
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: clr_-GiboAMFwww=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638bc066-766293f2526e637235067aca;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 21:32:22 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: z5uqgjB-Bsl0U55a8aFi37cpJ65Vnbjm6bJ2GnMpaO7RXsMZsOCbPQ==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:44:01 GMT
age: 63961
etag: "a9a529dc9894827f6243a1bf57f81caa4fe88fc2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 5ec118c64c7c28ea4ee6e159a6d85a4f
b4359b52e2b4025500219b8d26a4909e4e48c485
9988d067735d62c8482d3170ee667ee9a26c70cf0cb9f6febc8d86c75d953dce
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sun, 04 Dec 2022 15:30:01 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sat, 03 Dec 2022 21:11:13 GMT
Expires: Sun, 04 Dec 2022 21:11:13 GMT
ETag: "b4359b52e2b4025500219b8d26a4909e4e48c485"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
telenor.checkout.sla-alacrity.com/assets/es-module-shims.min-00d63bab8ac9742a4abcbecf1d17a40754778ee14aa2bcde069754c5265053e9.js
200 OK 11 kB URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/es-module-shims.min-00d63bab8ac9742a4abcbecf1d17a40754778ee14aa2bcde069754c5265053e9.js
IP
File type ASCII text, with very long lines (31512)
Hash ffc905f143a2582f0e569cb9a2d2074a
bae4fef1e3c2e90eeea4f19f01abbf981e3a8a02
d3a6cdd18e3135b2cdcc17e09d35bb02ca8f0c64120f6e111ad3a457a9946b22
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/es-module-shims.min-00d63bab8ac9742a4abcbecf1d17a40754778ee14aa2bcde069754c5265053e9.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 10867
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/tailwind-f9b7d004f09d04874f4228e500e0a5ac1ec12899ff30c3c7d6a635b8a3011e67.css
200 OK 2.5 kB URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/tailwind-f9b7d004f09d04874f4228e500e0a5ac1ec12899ff30c3c7d6a635b8a3011e67.css
IP
File type ASCII text, with very long lines (10270)
Hash c04b0ab99213ae3642beae2ac7f87a86
8f4523383fd4f2f9255d4ecbc0438aefb1dce209
041905d0d38c16faf840fb9254f1844515c1464fca446c17f17f121158a3e1cb
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/tailwind-f9b7d004f09d04874f4228e500e0a5ac1ec12899ff30c3c7d6a635b8a3011e67.css HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: text/css
content-length: 2537
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/application-e659e1a0d2dcc91d56eddcca4f93f92fd0442b4faecd20fde43719c7bd4fc36b.css
200 OK 706 B URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/application-e659e1a0d2dcc91d56eddcca4f93f92fd0442b4faecd20fde43719c7bd4fc36b.css
IP
Hash 92dc36d696640dd370a24bd0d38e8a57
30a3942a3d18e53b6db56ef36bf372df5d5e8989
5d575ad602719a85301374d7c27bd6784fa10c9dae170b5cb33f1c9a40087340
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/application-e659e1a0d2dcc91d56eddcca4f93f92fd0442b4faecd20fde43719c7bd4fc36b.css HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: text/css
content-length: 706
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/inter-font-8c3e82affb176f4bca9616b838d906343d1251adc8408efe02cf2b1e4fcf2bc4.css
200 OK 1.6 kB URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/inter-font-8c3e82affb176f4bca9616b838d906343d1251adc8408efe02cf2b1e4fcf2bc4.css
IP
File type ASCII text, with very long lines (519)
Hash 86745b2429e4866652f5186e30be3203
4086aecd5d9e56d814480d6fae63d8b1937994bf
8e91248ae998ad184472e2c069e27e6799fefccc86b080a0e38b77d8005d2a90
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/inter-font-8c3e82affb176f4bca9616b838d906343d1251adc8408efe02cf2b1e4fcf2bc4.css HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: text/css
content-length: 1607
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/application-37f365cbecf1fa2810a8303f4b6571676fa1f9c56c248528bc14ddb857531b95.js
200 OK 133 B URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/application-37f365cbecf1fa2810a8303f4b6571676fa1f9c56c248528bc14ddb857531b95.js
IP
Hash c4a9268b0368b4ce02f757b73d288a50
916dbd2a596ebfff11f317c2e5ef0ba399dd3578
fff6df124e67b779fdea9075763d3639491669469c90d5c5ebdf54e435f06912
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/application-37f365cbecf1fa2810a8303f4b6571676fa1f9c56c248528bc14ddb857531b95.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 133
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/stimulus.min-900648768bd96f3faeba359cf33c1bd01ca424ca4d2d05f36a5d8345112ae93c.js
200 OK 8.4 kB URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/stimulus.min-900648768bd96f3faeba359cf33c1bd01ca424ca4d2d05f36a5d8345112ae93c.js
IP
File type ASCII text, with very long lines (33070)
Hash 904d12fdfd3780aceb6e1d81bb6ecd9d
63de560bf831a4c9da5e1990cb47ab9b5aee779a
aab9267b75f462b2b5714cbc6097f9759acece340cc246cf512c13381809b20c
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/stimulus.min-900648768bd96f3faeba359cf33c1bd01ca424ca4d2d05f36a5d8345112ae93c.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 8385
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/Inter-roman.latin.var-4b87a3d384ea557b10afa9570b753eda868b12b5e51eea0977ffa6e641998f6a.woff2
200 OK 52 kB URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/Inter-roman.latin.var-4b87a3d384ea557b10afa9570b753eda868b12b5e51eea0977ffa6e641998f6a.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 51896, version 3.983\012- data
Hash dec25f4c0751dfa3830eb3d9edbdc8ba
f4cf732763710b1578dcb10fada6484284e39ac3
5156501c82759bb0891d4a37c4eb6bce023623d762572a946c56a17d8ae37bd8
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/Inter-roman.latin.var-4b87a3d384ea557b10afa9570b753eda868b12b5e51eea0977ffa6e641998f6a.woff2 HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://telenor.checkout.sla-alacrity.com/assets/inter-font-8c3e82affb176f4bca9616b838d906343d1251adc8408efe02cf2b1e4fcf2bc4.css
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/font-woff2
content-length: 51896
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/turbo.min-e5023178542f05fc063cd1dc5865457259cc01f3fba76a28454060d33de6f429.js
200 OK 19 kB URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/turbo.min-e5023178542f05fc063cd1dc5865457259cc01f3fba76a28454060d33de6f429.js
IP
File type Unicode text, UTF-8 text, with very long lines (42217)
Hash 72d37262df99bd369d4120aeb944c766
e3f0c0426809a65bfa93a713498b289b81f8f244
9ce0dcf8ae798076d65aa4d1e084e9ef934a2cbe7a6c846c20714e5ce0200914
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/turbo.min-e5023178542f05fc063cd1dc5865457259cc01f3fba76a28454060d33de6f429.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 19356
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/controllers/index-2db729dddcc5b979110e98de4b6720f83f91a123172e87281d5a58410fc43806.js
200 OK 254 B URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/controllers/index-2db729dddcc5b979110e98de4b6720f83f91a123172e87281d5a58410fc43806.js
IP
Hash 5601c6895557594c6abed971289c6000
35d0edc26c442fb04e797102c4f8d8a275fdedaa
eeca187559acb390809e997f40958bdc82a7758fc906ec4f21f868c92092c440
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/controllers/index-2db729dddcc5b979110e98de4b6720f83f91a123172e87281d5a58410fc43806.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 254
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/stimulus-loading-1fc59770fb1654500044afd3f5f6d7d00800e5be36746d55b94a2963a7a228aa.js
200 OK 1.0 kB URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/stimulus-loading-1fc59770fb1654500044afd3f5f6d7d00800e5be36746d55b94a2963a7a228aa.js
IP
Hash c9f11aa7251f0b44271cf8ed2deba1a9
84bd099b6f9c87c64cffb84a286c62812c9d2efa
f20bba5234871dfeada88408971fbe4c044ddb9ab78fa386dc974901bd32c355
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/stimulus-loading-1fc59770fb1654500044afd3f5f6d7d00800e5be36746d55b94a2963a7a228aa.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 1011
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/controllers/application-368d98631bccbf2349e0d4f8269afb3fe9625118341966de054759d96ea86c7e.js
200 OK 159 B URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/controllers/application-368d98631bccbf2349e0d4f8269afb3fe9625118341966de054759d96ea86c7e.js
IP
Hash f55be6778815e69dcb1a136e124d5e1b
bb4b7e2cf3b9c5805653636f013f554c3c1030ac
e4d8c29a3bb8ba082793dd5b02b2c441799b0b85654a3d3104061ba47378b22d
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/controllers/application-368d98631bccbf2349e0d4f8269afb3fe9625118341966de054759d96ea86c7e.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 159
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/favicon.ico
200 OK 0 B URL HTTP/2 telenor.checkout.sla-alacrity.com/favicon.ico
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /favicon.ico HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: image/vnd.microsoft.icon
content-length: 0
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:56:51 GMT
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/assets/controllers/purchase_controller-408936cd1bc6228f93e5d0bbb058a6f7e777a4303d6857c1c251797b3378ab02.js
200 OK 701 B URL HTTP/2 telenor.checkout.sla-alacrity.com/assets/controllers/purchase_controller-408936cd1bc6228f93e5d0bbb058a6f7e777a4303d6857c1c251797b3378ab02.js
IP
Hash fd7154baae382391cd57e8c13f53ad23
73799cc12cec2b12926afcb40a0abd127503d044
f0906a38c720bec79078d96661c0dbf38a80b35ae33a1763353ecf486d8cd7a1
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /assets/controllers/purchase_controller-408936cd1bc6228f93e5d0bbb058a6f7e777a4303d6857c1c251797b3378ab02.js HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: application/javascript
content-length: 701
server: nginx/1.21.4
last-modified: Tue, 22 Nov 2022 10:57:39 GMT
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
fd.sla-alacrity.com/88y4xxf50hh8.js
200 OK 8.2 kB URL HTTP/2 fd.sla-alacrity.com/88y4xxf50hh8.js
IP
File type ASCII text, with very long lines (8175), with no line terminators
Hash 5a7ad528eb707f924b6b54855a9de6cd
798703781bee62fc01627873314670494944fef8
54a53c0c7a7f27653bb962d0dfe61a0e46a0c3cdeaa764c4582ea08109cfbf46
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
GET /88y4xxf50hh8.js HTTP/1.1
Host: fd.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/
Origin: https://telenor.checkout.sla-alacrity.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:03 GMT
content-type: application/javascript
content-length: 8175
server: nginx/1.21.4
access-control-allow-origin: *
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
access-control-expose-headers:
access-control-max-age: 7200
last-modified: Tue, 22 Nov 2022 10:39:14 GMT
vary: Origin
X-Firefox-Spdy: h2
fd.sla-alacrity.com/token?partner=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&ref=
200 OK 30 kB URL HTTP/2 fd.sla-alacrity.com/token?partner=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&ref=
IP
Hash e55ab4f0726861626e159a5a166ed9eb
ad6b4fa36a150bf4d93b6f13edbec2f3a1b38dd3
4113b57b63ef7cef14aab31ae3cdc92702a4bee50f4e45ad8c09f518f65c08e4
GET /token?partner=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&ref= HTTP/1.1
Host: fd.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/
Origin: https://telenor.checkout.sla-alacrity.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:03 GMT
content-type: text/plain; charset=utf-8
server: nginx/1.21.4
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-expose-headers:
access-control-max-age: 1728000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
access-control-allow-headers: Origin,Accept,Content-Type,X-Requested-With,X-CSRF-Token
vary: Accept, Origin
etag: W/"85cb24dd881bd91ff962561c4ef89fa1"
cache-control: max-age=0, private, must-revalidate
x-request-id: 6a8e4c7a-d967-4b56-84aa-024a710c6cdb
x-runtime: 0.183310
content-encoding: gzip
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/update/token
204 No Content 0 B URL HTTP/2 telenor.checkout.sla-alacrity.com/update/token
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
POST /update/token HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
Content-Type: application/json
Origin: https://telenor.checkout.sla-alacrity.com
Content-Length: 100
Connection: keep-alive
Cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 204 No Content
date: Sun, 04 Dec 2022 15:30:04 GMT
server: nginx/1.21.4
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
cache-control: no-cache
x-request-id: 9dad76d3-7151-45e3-8c5b-bb1b4257328b
x-runtime: 0.028331
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash e1ea32709e515a74e1f2895ae193849c
3d9c3ca7572a4781fbb7865ee92897988b265853
f8940d1289d80cc964e816c4ef26ee3eb3101abe807c1e76a37d058ba7af03cf
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=126443
Date: Sun, 04 Dec 2022 15:30:04 GMT
Etag: "638c07e7-1d7"
Expires: Tue, 06 Dec 2022 02:37:27 GMT
Last-Modified: Sun, 04 Dec 2022 02:37:27 GMT
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 4f01f770085624552bc30a98954f963a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: _yOQVRezVzkICpExG0nbulkhxRobrkJJXaxVVvsYVTVOvZZ9dcODQQ==
dob.payment.io/v2/log
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
POST /v2/log HTTP/1.1
Host: dob.payment.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dob.payment.io/v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099
Content-Type: text/plain;charset=UTF-8
Origin: https://dob.payment.io
Content-Length: 197
Connection: keep-alive
Cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:04 GMT
content-length: 0
set-cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad;Version=1;Path=/;HttpOnly
vary: Accept-Encoding
X-Firefox-Spdy: h2
dob.payment.io/v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099
200 OK 223 kB URL HTTP/2 dob.payment.io/v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (54939), with NEL line terminators
Size 223 kB (222655 bytes)
Hash 65baa34acade21b29de12a64a6c1d6ca
fecfb88ec93e1aa6bc9f65405b145f0b23df81ec
044b958f75e94f7c081e83964bce351f4623dafaa894cd79a8f4b6c7687c6cf8
GET /v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099 HTTP/1.1
Host: dob.payment.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:04 GMT
content-type: text/html
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
content-security-policy: base-uri 'none'; object-src 'none'; script-src 'nonce-e20904d934ac43a1a94d2592d188a35d'; style-src 'nonce-e20904d934ac43a1a94d2592d188a35d' https://fonts.googleapis.com 'nonce-e20904d934ac43a1a94d2592d188a35d'; font-src https://fonts.gstatic.com data:; default-src 'none'; img-src data:; connect-src 'self'; form-action 'none'; frame-ancestors 'none'; report-uri /csp-violation-report
set-cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad;Version=1;Path=/;HttpOnly
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
dob.payment.io/v2/log
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
POST /v2/log HTTP/1.1
Host: dob.payment.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dob.payment.io/v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099
Content-Type: text/plain;charset=UTF-8
Origin: https://dob.payment.io
Content-Length: 19
Connection: keep-alive
Cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:04 GMT
content-length: 0
set-cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad;Version=1;Path=/;HttpOnly
vary: Accept-Encoding
X-Firefox-Spdy: h2
dob.payment.io/web-vitals
200 OK 0 B URL HTTP/2 dob.payment.io/web-vitals
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
POST /web-vitals HTTP/1.1
Host: dob.payment.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 150
Origin: https://dob.payment.io
Connection: keep-alive
Referer: https://dob.payment.io/v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099
Cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:04 GMT
content-length: 0
set-cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad;Version=1;Path=/;HttpOnly
vary: Accept-Encoding
X-Firefox-Spdy: h2
dob.payment.io/web-vitals
200 OK 0 B URL HTTP/2 dob.payment.io/web-vitals
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
POST /web-vitals HTTP/1.1
Host: dob.payment.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 151
Origin: https://dob.payment.io
Connection: keep-alive
Referer: https://dob.payment.io/v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099
Cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:04 GMT
content-length: 0
set-cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad;Version=1;Path=/;HttpOnly
vary: Accept-Encoding
X-Firefox-Spdy: h2
dob.payment.io/consent-vitals
200 OK 0 B URL HTTP/2 dob.payment.io/consent-vitals
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Telenor
urlquery phishing Phishing - Telenor
POST /consent-vitals HTTP/1.1
Host: dob.payment.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 169
Origin: https://dob.payment.io
Connection: keep-alive
Referer: https://dob.payment.io/v3/consent?token=9695bcd3-4855-4a30-8905-2ba2eefb6988&errorUrl=https%3A%2F%2Ftelenor.checkout.sla-alacrity.com%2Fcallback%2Ferror%3Fid%3D6549b6f009f350f133cdc1c822c5e099
Cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:04 GMT
content-length: 0
set-cookie: sessionId=573c271c9666404ea3d8f8cdfdf6e8ad;Version=1;Path=/;HttpOnly
vary: Accept-Encoding
X-Firefox-Spdy: h2
cupme.org/cl/367c72c2265e715e?p1=4163414861&p2=33861&p3=16384&source=&site=
302 Found 0 B URL HTTP/2 cupme.org/cl/367c72c2265e715e?p1=4163414861&p2=33861&p3=16384&source=&site=
IP
GET /cl/367c72c2265e715e?p1=4163414861&p2=33861&p3=16384&source=&site= HTTP/1.1
Host: cupme.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 302 Found
date: Sun, 04 Dec 2022 15:30:00 GMT
content-type: text/html; charset=UTF-8
location: https://digitaltechnology.co/campaign/no/?cid=8&ref=affgg&click_id=4163414878&source=1
x-powered-by: PHP/8.1.13
cache-control: no-cache
x-frame-options: DENY
set-cookie: sbc367c72c2265e715e=eyJpdiI6IjNSdU9ZSHhXWlR6a1h4UWRIblFLRWc9PSIsInZhbHVlIjoiUE9aNXVjK2NUenQ2bXVLOTVzOGJSQT09IiwibWFjIjoiMTYxNzFiNzExMWJjNTEyNmJhNzBjMmVhYTFmODgzM2U4MDliYThjY2U2ZjE0OGI3YWI2ZjAyMTg5ZDdlYWZlOCIsInRhZyI6IiJ9; expires=Sun, 04 Dec 2022 16:30:00 GMT; Max-Age=3600; path=/; httponly; samesite=lax
vis=eyJpdiI6Ik14d3JRbzF0MTBoNllyWTQ2eWJUU0E9PSIsInZhbHVlIjoiUlJNZ2dEVTBQc2wyZEhvRFhiUUlCQT09IiwibWFjIjoiZmRmMDBlODdiZGI3NjVlOTFiOTZiMWMyYTczN2U5MDRiMmQyZWViOGE5MmRjNzk0MDQyYzE1NWMzYjI0MWQ2ZCIsInRhZyI6IiJ9; expires=Sat, 04 Mar 2023 15:30:00 GMT; Max-Age=7776000; path=/; httponly; samesite=lax
expires: Thu, 01 Jan 1970 00:00:01 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ikvs%2FBqXgu7IdEFUkxGSW4VOh9otCfglol82LYVKS1mQunnEmYa8uTdR5U3fmiI%2BQNw4mnD%2Fk9hQX1%2Fmei1tdxadvHrTDkWWX0yongKHyHBgNRLzfWCqo8MoRQ0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 774594b238aeb50b-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
200 OK 0 B URL HTTP/2 telenor.checkout.sla-alacrity.com/purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY
IP
GET /purchase?correlator=679r5ynFYBlY&merchant=partner:a0dfd008377a0dc98ff2e28b18cf12fd8f912bc2&service=campaign:d078d24ebb8575b50f1090890b2c0c446bb36c30&redirect_url=http://prod.digitaltechnology.co/v1/redirect/no/telnor?transaction_id=679r5ynFYBlY HTTP/1.1
Host: telenor.checkout.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:02 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.4
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
link: </assets/tailwind-f9b7d004f09d04874f4228e500e0a5ac1ec12899ff30c3c7d6a635b8a3011e67.css>; rel=preload; as=style; nopush,</assets/inter-font-8c3e82affb176f4bca9616b838d906343d1251adc8408efe02cf2b1e4fcf2bc4.css>; rel=preload; as=style; nopush,</assets/application-e659e1a0d2dcc91d56eddcca4f93f92fd0442b4faecd20fde43719c7bd4fc36b.css>; rel=preload; as=style; nopush,</assets/es-module-shims.min-00d63bab8ac9742a4abcbecf1d17a40754778ee14aa2bcde069754c5265053e9.js>; rel=preload; as=script; nopush
etag: W/"a5497bc082985badac86fabb9c9003db"
cache-control: max-age=0, private, must-revalidate
set-cookie: _checkout_telenor_session=rzGhTLf0hjg9WU3HVBEuSgOpXC%2BcCKiUU2jSYAAPa8KsP%2FiJWRLD5SsmEhLfPjWsUGSJKs1tw3QZHkeEe4FNyhniC4ORrdnlPOVCefZXXmKHVZd6d39S5rORZQa7zJ5uX%2BFq5to7MMDPrAnCR2pxdSekJBCCnatGBvH0ex0prgr0nGqFIkLRCfa5LIMmiSjslrl505WVOiPOHLFtADn%2BQQFtK37C2uI0UNKmpWuiOoWlDGmYiJfr9ABTli2SQa1aB1In5f5I16wrcvw5dbbPAV98TAY2Crq583K%2FLEn2zdKb--qox0bqJcK9OCFDY6--YlVkwpGL49cDQ9cQQbahdg%3D%3D; path=/; HttpOnly; SameSite=Lax
x-request-id: 5bbfc887-5819-4328-ac2d-27b175d903b7
x-runtime: 0.184931
content-encoding: gzip
X-Firefox-Spdy: h2
fd.sla-alacrity.com/token/fingerprint?token=840c5289-3d33-4a84-b86e-7d1476c4f09c&fingerprint=9e4947f35751465411fd1a4f5c358c78
200 OK 0 B URL HTTP/2 fd.sla-alacrity.com/token/fingerprint?token=840c5289-3d33-4a84-b86e-7d1476c4f09c&fingerprint=9e4947f35751465411fd1a4f5c358c78
IP
POST /token/fingerprint?token=840c5289-3d33-4a84-b86e-7d1476c4f09c&fingerprint=9e4947f35751465411fd1a4f5c358c78 HTTP/1.1
Host: fd.sla-alacrity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telenor.checkout.sla-alacrity.com/
Origin: https://telenor.checkout.sla-alacrity.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Content-Length: 0
TE: trailers
HTTP/2 200 OK
date: Sun, 04 Dec 2022 15:30:04 GMT
content-type: text/plain; charset=utf-8
server: nginx/1.21.4
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-expose-headers:
access-control-max-age: 1728000
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
access-control-allow-headers: Origin,Accept,Content-Type,X-Requested-With,X-CSRF-Token
vary: Accept, Origin
etag: W/"2689367b205c16ce32ed4200942b8b8b"
cache-control: max-age=0, private, must-revalidate
x-request-id: 475ed303-ab59-4a91-b92d-29320acb6c0e
x-runtime: 0.177077
content-encoding: gzip
X-Firefox-Spdy: h2
165.232.67.139
188.165.202.101
52.17.1.48
34.120.237.76
23.36.76.226
104.18.32.68
93.184.220.29