Overview

URLlilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=
IP 162.241.203.66 (United States)
ASN#46606 UNIFIEDLAYER-AS-1
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-03-09 13:15:54 UTC
StatusLoading report..
IDS alerts2
Blocklist alert11
urlquery alerts
5
Phishing - Wells Fargo
Tags wellsfargo financial phishing

Domain Summary (10)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
push.services.mozilla.com (1) 2140 2014-10-24T10:27:06Z 2023-03-24T18:17:07Z 606 127 34.209.185.33
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-22T01:36:00Z 2023-03-24T16:33:49Z 3246 44429 34.120.237.76
ocsp.digicert.com (1) 86 2012-05-21T09:02:23Z 2023-03-25T04:18:49Z 341 739 192.229.221.95
firefox.settings.services.mozilla.com (2) 867 2020-06-04T22:08:41Z 2023-03-24T18:14:23Z 782 2372 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03T13:26:46Z 2023-03-24T18:20:20Z 413 5894 34.160.144.191
lilicamanequinsfiber.com.br (10) 0 2022-07-07T11:02:19Z 2023-03-25T17:19:38Z 4205 396452 162.241.203.66
is5.mzstatic.com (1) 12450 2015-02-21T15:15:45Z 2023-03-25T14:30:29Z 396 24201 95.101.10.25
connect.secure.wellsfargo.com (1) 11812 2017-01-31T16:32:35Z 2023-03-24T22:35:33Z 384 20095 95.101.10.194
r3.o.lencr.org (7) 344 2020-12-02T09:52:13Z 2023-03-25T05:09:02Z 2366 6203 23.33.119.27
contile.services.mozilla.com (1) 1114 2021-05-27T20:32:35Z 2023-03-25T05:09:25Z 333 391 34.117.237.239

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-03-09 13:15:44 UTC medium  162.241.203.66 Client IP ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M4 
2023-03-09 13:15:44 UTC medium  162.241.203.66 Client IP ET PHISHING Possible Wells Fargo Phishing Landing - Title over non SSL 

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2023-03-08 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Wells Fargo & Company

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-03-09 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm (...) Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/auth/static/prefs/atadun.js Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/auth/static/scripts/conutils-6.2.2.js Phishing
2023-03-09 medium lilicamanequinsfiber.com.br/auth/static/prefs/atadun.js Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 162.241.203.66
Date UQ / IDS / BL URL IP
2023-06-02 04:04:03 UTC 0 - 0 - 236 toplitoral.com/ 162.241.203.66
2023-05-18 13:03:33 UTC 0 - 0 - 7 proguildgg.com/eoll/?1 162.241.203.66
2023-05-18 13:03:31 UTC 0 - 0 - 9 proguildgg.com/ire/?1 162.241.203.66
2023-05-17 19:27:30 UTC 0 - 0 - 7 proguildgg.com/eoll/?189971 162.241.203.66
2023-05-17 18:23:02 UTC 0 - 0 - 6 metashakti.com.br/ 162.241.203.66


Last 5 reports on ASN: UNIFIEDLAYER-AS-1
Date UQ / IDS / BL URL IP
2023-06-02 05:55:06 UTC 0 - 0 - 8 www.control.everything.resolve.panel.xamerica (...) 162.144.64.26
2023-06-02 05:51:15 UTC 0 - 0 - 13 eplkxjil.bestagentaz.com/fby/YXBydWRraXlAdWty (...) 69.49.228.234
2023-06-02 05:42:05 UTC 3 - 0 - 1 marsanltda.cl/email/verification/sf_rand_stri (...) 108.167.149.244
2023-06-02 05:40:44 UTC 4 - 0 - 0 borges.tv.br/admin/v3rif/sf_rand_string_lower (...) 192.185.177.11
2023-06-02 05:01:17 UTC 2 - 0 - 0 qrtnd.sa.com/magic/city/sf_rand_string_lowerc (...) 162.241.71.248


Last 5 reports on domain: lilicamanequinsfiber.com.br
Date UQ / IDS / BL URL IP
2023-05-28 11:59:47 UTC 0 - 0 - 2 lilicamanequinsfiber.com.br/wp-content/themes (...) 34.102.136.180
2023-04-28 09:01:40 UTC 0 - 0 - 2 lilicamanequinsfiber.com.br/wp-content/themes (...) 34.102.136.180
2023-04-08 05:48:04 UTC 0 - 0 - 1 lilicamanequinsfiber.com.br/ 34.102.136.180
2023-03-29 08:50:20 UTC 0 - 0 - 1 lilicamanequinsfiber.com.br/wp-content/themes (...) 34.102.136.180
2023-03-10 17:57:47 UTC 0 - 0 - 7 lilicamanequinsfiber.com.br/wp-content/themes (...) 162.241.203.66


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-03-09 05:44:32 UTC 5 - 0 - 9 lilicamanequinsfiber.com.br/wp-content/themes (...) 162.241.203.66
2023-03-09 05:44:51 UTC 5 - 0 - 8 lilicamanequinsfiber.com.br/wp-content/themes (...) 162.241.203.66
2023-03-09 05:42:53 UTC 5 - 0 - 8 lilicamanequinsfiber.com.br/wp-content/themes (...) 162.241.203.66
2023-03-09 05:43:13 UTC 5 - 0 - 10 lilicamanequinsfiber.com.br/wp-content/themes (...) 162.241.203.66
2023-03-09 05:42:34 UTC 5 - 0 - 8 lilicamanequinsfiber.com.br/wp-content/themes (...) 162.241.203.66

JavaScript

Executed Scripts (10)

Executed Evals (0)

Executed Writes (2)
#1 JavaScript::Write (size: 137) - SHA256: d9dffbcc83330592c41af1e78d70fe06529969a7a298b38d429b59cc6a54e2ff
< script type = "text/javascript"
id = "childscript1"
src = "http://lilicamanequinsfiber.com.br/auth/static/scripts/conutils-6.2.2.js" > < /script>
#2 JavaScript::Write (size: 124) - SHA256: 649b1bb698dddb557615f1b104518cba08e2df24e6249ad5c3346ab398eb86e0
< script type = "text/javascript"
id = "ndscript1"
src = "http://lilicamanequinsfiber.com.br/auth/static/prefs/atadun.js" > < /script>


HTTP Transactions (31)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "EBCB744A032452533C000C0A9F193FD2566B2389729C41B6C5ED69B9E4CD42D4"
Last-Modified: Tue, 07 Mar 2023 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3034
Expires: Thu, 09 Mar 2023 14:06:17 GMT
Date: Thu, 09 Mar 2023 13:15:43 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "84518FA2565F7F63933D3C552E1DC07F84C71F4A3DF5D2821484C371EF57B924"
Last-Modified: Tue, 07 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10758
Expires: Thu, 09 Mar 2023 16:15:01 GMT
Date: Thu, 09 Mar 2023 13:15:43 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "560F8228FEDC912E05B84AF1D19FCEFCA3FEC82415180DF5D18C5B2A3F533A68"
Last-Modified: Tue, 07 Mar 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4274
Expires: Thu, 09 Mar 2023 14:26:57 GMT
Date: Thu, 09 Mar 2023 13:15:43 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Content-Length, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 09 Mar 2023 13:08:57 GMT
age: 406
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    84db75194692d4afe13196bda6f22da8
Sha1:   4c1f49bc973a4917f146d93c8d598344edc021f6
Sha256: a3bec66f95b3bdf1d310c726e8ed05f7b06c1901c62381a94582d581844d2c23
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: shS4ehwhy7FhGH42IrZP75nZagW3X4QtNHSaxRT3ooP9FMOd2v/YvbyVxwq/eBbDqM3bEr+GEi2VMgRqoamIbQ==
x-amz-request-id: EZY2G3KT22QTSB4F
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 09 Mar 2023 12:36:02 GMT
age: 2381
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    b5ba6334e73496995e3e3a9ecd0eb323
Sha1:   ad80d3b7718c28364e8c2004fb38a13a1747e462
Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Thu, 09 Mar 2023 13:15:43 GMT
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Type, Last-Modified, Retry-After, Expires, Pragma, Content-Length, Cache-Control, Alert, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 09 Mar 2023 13:03:42 GMT
age: 721
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "B06E4961E184D51008F4ADB9C8FE571F08B21B4728E5EAC0BB4795861E03AA2F"
Last-Modified: Tue, 07 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4278
Expires: Thu, 09 Mar 2023 14:27:01 GMT
Date: Thu, 09 Mar 2023 13:15:43 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: GaCdxziONKjdncrmyLFvUg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             34.209.185.33
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: uJwUIgcYbugHErGDtRMRn6Mx/dQ=

                                        
                                            GET /wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg= HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             162.241.203.66
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=iso-8859-1
                                            
Date: Thu, 09 Mar 2023 13:15:43 GMT
Server: Apache
Location: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/
Content-Length: 310
Keep-Alive: timeout=5, max=75
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   310
Md5:    10f58882ed84d6edaa084dd28c23b4c1
Sha1:   23b18ef497c842afec016c64533658167277e6f1
Sha256: 9fe88fe27edb5536e3a28f35152091e1048544889b378b129dc8c48b51302b26

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/css%20js/a HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 200 OK
                                            
Date: Thu, 09 Mar 2023 13:15:44 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 08 Mar 2023 18:02:29 GMT
Accept-Ranges: bytes
Content-Length: 471
Keep-Alive: timeout=5, max=75


--- Additional Info ---
Magic:  ASCII text, with very long lines (471), with no line terminators
Size:   471
Md5:    0f9b3140d06c22a22b4ee760b55b969b
Sha1:   18a353b358256301561165c578836549b1470d8f
Sha256: c5bbf24cf64a90ae2d6c90f4bc1571626d09b4c5d6e0af0badd1d2e72ae49cfb

urlquery:
  - Phishing - Wells Fargo
  - Phishing - Wells Fargo
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/css%20js/nd HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 200 OK
                                            
Date: Thu, 09 Mar 2023 13:15:44 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 08 Mar 2023 18:02:29 GMT
Accept-Ranges: bytes
Content-Length: 38396
Keep-Alive: timeout=5, max=75


--- Additional Info ---
Magic:  ASCII text, with very long lines (38394)
Size:   38396
Md5:    c6c79f344c8bbcee4b90542af9600a8b
Sha1:   8e07711e26c3271972d9739293d0c60151bd9009
Sha256: 23a1000b5986d9613a9089ad8bde53bb675e0555ecbddffd81bd6c0781112c35

urlquery:
  - Phishing - Wells Fargo
  - Phishing - Wells Fargo
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/ HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             162.241.203.66
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
Date: Thu, 09 Mar 2023 13:15:44 GMT
Server: Apache
Vary: Accept-Encoding
Content-Encoding: gzip
Accept-Ranges: none
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (28334), with CRLF line terminators
Size:   313823
Md5:    8bc693ebe19b74608123533b2a9711d3
Sha1:   733eb5b42c81ec76d9c22a3265fc51c03855658d
Sha256: 59c406ad503726308b0476c5bb0555b4dfbf757381dc9b667432b714d6be53d3

Blocklists:
  - openphish: Wells Fargo & Company
  - fortinet: Phishing
IDS:
  - ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M4
  - ET PHISHING Possible Wells Fargo Phishing Landing - Title over non SSL
                                        
                                            GET /wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/css%20js/atadun.js HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Date: Thu, 09 Mar 2023 13:15:45 GMT
Server: Apache
Last-Modified: Wed, 08 Mar 2023 18:02:29 GMT
Accept-Ranges: none
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 512
Keep-Alive: timeout=5, max=73
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   512
Md5:    3ec977ce2f5a3ac9bb8128a8844b9197
Sha1:   097bf1315b439ccb34af9bf75b7755135eb61881
Sha256: d71180a7648da48253c4c70315b9e3ced286ab624ada20310d4d4752e9fe3dd2

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/css%20js/conutils-6.js HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Date: Thu, 09 Mar 2023 13:15:45 GMT
Server: Apache
Last-Modified: Wed, 08 Mar 2023 18:02:29 GMT
Accept-Ranges: none
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4188
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (9948), with no line terminators
Size:   4188
Md5:    23c694aa702fd9e861cf5bc53376957c
Sha1:   9c195c29344e78c404d9284ca62cb692fafdfd1c
Sha256: 21df6c65d8a0329143870509340c82a478f490a04b3017cd28e2c4744392f69f

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/css%20js/login-userprefs.js HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Date: Thu, 09 Mar 2023 13:15:45 GMT
Server: Apache
Last-Modified: Wed, 08 Mar 2023 18:02:29 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   33399
Md5:    75079e4c1687e66009dda9fc914dae09
Sha1:   d8b5822c5f792be8c618156dea426a137aef8836
Sha256: 730cb4cf117c5dbc3b391698a3151401a2e821b220264f2bc1f7478fa458b3d1

Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "8F8B0574EA2DC28302DEE0A9868C1C145F66A6735353D236A8BD024C624F55A1"
Last-Modified: Thu, 09 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4266
Expires: Thu, 09 Mar 2023 14:26:51 GMT
Date: Thu, 09 Mar 2023 13:15:45 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "8F8B0574EA2DC28302DEE0A9868C1C145F66A6735353D236A8BD024C624F55A1"
Last-Modified: Thu, 09 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4266
Expires: Thu, 09 Mar 2023 14:26:51 GMT
Date: Thu, 09 Mar 2023 13:15:45 GMT
Connection: keep-alive

                                        
                                            GET /auth/static/prefs/atadun.js HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 404 Not Found
Content-Type: text/html
                                            
Date: Thu, 09 Mar 2023 13:15:45 GMT
Server: Apache
Last-Modified: Thu, 06 Oct 2022 20:52:17 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 836
Keep-Alive: timeout=5, max=73
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Size:   836
Md5:    e73571aebce42792b40325ac9117da29
Sha1:   d3fe79abd3a925079c1133a0d3c46fd8941514f7
Sha256: 2726faa315039af16d833fbca9694060c9cece0cbe9dd3069bdbba15d073aef2

Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "8F8B0574EA2DC28302DEE0A9868C1C145F66A6735353D236A8BD024C624F55A1"
Last-Modified: Thu, 09 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4266
Expires: Thu, 09 Mar 2023 14:26:51 GMT
Date: Thu, 09 Mar 2023 13:15:45 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff38cea88-980c-4bc3-9bc7-9a1bd822bec7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7804
x-amzn-requestid: c100b707-4225-449e-b028-4d9f9da81b3f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BfIm7H1_IAMFRYA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6409215f-192127435abb06342b869fff;Sampled=0
x-amzn-remapped-date: Wed, 08 Mar 2023 23:59:27 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: yaOxtlUTgbRwPPBnoaojhuHQpKYLKsn3R1BKlJlBK4kkrG3EElHuTQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 b618c0f73dc30c968057784ed0185d7a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 09 Mar 2023 00:14:35 GMT
etag: "f849869251bd94a51243604d94f9dd708930d3e2"
age: 46870
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7804
Md5:    8f45f111388e764cdc6482be2307e0a1
Sha1:   f849869251bd94a51243604d94f9dd708930d3e2
Sha256: 8e7b32b34a50ba9ca3834a7d915b245590bd19d96ae13aa9881cdea8b7f5fcc2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff126aba3-5053-41e8-9adc-5cb3d542d065.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 8421
x-amzn-requestid: f161f3bb-2b66-4ec8-a2d0-460296e59d8b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BezfVHwPoAMF9CQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6408ff95-7fd8848f23e348491da23bc3;Sampled=0
x-amzn-remapped-date: Wed, 08 Mar 2023 21:35:17 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: UxccdNn1zcfmf6dLfofsW97SALSwT6zQ4-AxC4JW9xXmtxUCtHHFFg==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 bb763d35677c62f9f5d9728bba884662.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Mar 2023 21:45:27 GMT
etag: "ec77a342171a7b2df5b4bb4ff267eb9e7b6fdc9d"
age: 55818
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8421
Md5:    f57df98d880821f3ed2d1227ea1e29c0
Sha1:   ec77a342171a7b2df5b4bb4ff267eb9e7b6fdc9d
Sha256: d9c8877d58e5625ffd72222372334fa857611de3e444732e4ac025571df9e333
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37ece9b2-aae4-4d23-bfb3-7f05cb233ec9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5746
x-amzn-requestid: 7ace51d8-c6f7-4af6-b15b-195e9f0c02cd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Bbf_TFS2IAMFXJw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6407ad2e-7ff3c32c44da36b34fa05dac;Sampled=0
x-amzn-remapped-date: Tue, 07 Mar 2023 21:31:26 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: n5y9ZTR4okRkws43vQUwsQ81aHCGHcN-oW-Fe1LoUZDkSxHEvuiFLA==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 b618c0f73dc30c968057784ed0185d7a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Mar 2023 21:41:18 GMT
age: 56067
etag: "2a1d0d6d3b97c60dd0be824b690ff1065791ade8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5746
Md5:    b9be9bf929c52e34e0ce8d4445a4d180
Sha1:   2a1d0d6d3b97c60dd0be824b690ff1065791ade8
Sha256: a0bf6f93dc3b40aa06693c40998a486af18648db8ba24486c7ad2abe41c5d0fa
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fab5f13a1-64f5-41ac-aa1b-5fb0a6b438d4.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4770
x-amzn-requestid: 963dae3d-8336-4a5b-8b25-c3617f946d73
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BUZkWFhLIAMF6FQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6404d61b-1b705b460f7539f97c3dd7e5;Sampled=0
x-amzn-remapped-date: Sun, 05 Mar 2023 17:49:15 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: HM56vjzUqmaOjBHUlhgopx3n5qjLe3x6v-AleC5P9ZRCJt5ndUZSsw==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 6af3b573d8970d5db2a4d03354335b84.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Mar 2023 22:35:48 GMT
age: 52797
etag: "bc714ee0389e279919dde08149be61c4dc9ab0a7"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4770
Md5:    cd029abcba5db74cecb02bad1a036c43
Sha1:   bc714ee0389e279919dde08149be61c4dc9ab0a7
Sha256: 10ae90728b38f7aeba134961a7b80c68c213a09eeef618ef3d66f3305b19834e
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F834c2aef-aac4-479f-968e-6e2512e6b3a7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6557
x-amzn-requestid: 0596691a-f410-4aaf-9b05-f9e24f776901
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BezeKGgGIAMF4UA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6408ff8d-4a4a6e5e1ba9967f11131c82;Sampled=0
x-amzn-remapped-date: Wed, 08 Mar 2023 21:35:09 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: 1XWxXaZjyNC3WJc099cqyObZeW32Ir4ufa9mGOKLLtrAJJwBu6nydw==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 82893cc36087a50f9a150a621d10e740.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Mar 2023 21:45:27 GMT
etag: "bb9f22ac357ef47cac278a35acfec2a3c45b9778"
age: 55818
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6557
Md5:    0a2b1e2520b334c727a108a6ef9e3a5b
Sha1:   bb9f22ac357ef47cac278a35acfec2a3c45b9778
Sha256: 44395dbddf288edbb6e450aedbdbef228904b39ff4816a11113be7e5c7f209b2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffcb7b5b1-0c4b-408c-8cd5-9eefd08402b5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4779
x-amzn-requestid: 2b17d9dd-5471-4d32-b49b-d02d656ff32d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BWPHqF6oIAMF9rA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64059230-40d6f50a5c99b19a09bc10f6;Sampled=0
x-amzn-remapped-date: Mon, 06 Mar 2023 07:11:44 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: Q9-UoPTYCnyFdkOejus088TOAvKfyxOTRSI27U0KPo_kxF3Bn1iORQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 da4fa914888b330b3e8a08632b8e41be.cloudfront.net (CloudFront), 1.1 google
date: Thu, 09 Mar 2023 08:07:50 GMT
age: 18475
etag: "014fa1c8bb655e3dc2d7047fe1934fa3d4d28195"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4779
Md5:    05f4cdc3272aedc4a6fb7b7eef4177fd
Sha1:   014fa1c8bb655e3dc2d7047fe1934fa3d4d28195
Sha256: 27b6a951f9fe1bbc7ab5290a170aa0506f1e5fc12b188427b3eead0140ee3fab
                                        
                                            GET /auth/static/scripts/conutils-6.2.2.js HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 404 Not Found
Content-Type: text/html
                                            
Date: Thu, 09 Mar 2023 13:15:45 GMT
Server: Apache
Last-Modified: Thu, 06 Oct 2022 20:52:17 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 836
Keep-Alive: timeout=5, max=73
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Size:   836
Md5:    e73571aebce42792b40325ac9117da29
Sha1:   d3fe79abd3a925079c1133a0d3c46fd8941514f7
Sha256: 2726faa315039af16d833fbca9694060c9cece0cbe9dd3069bdbba15d073aef2

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /auth/static/prefs/atadun.js HTTP/1.1 
Host: lilicamanequinsfiber.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/wp-content/themes/twentytwentyone/inc/lkjl/gixm2e=/2m2ztu=/zzkntg=/

                                        
                                             162.241.203.66
HTTP/1.1 404 Not Found
Content-Type: text/html
                                            
Date: Thu, 09 Mar 2023 13:15:45 GMT
Server: Apache
Last-Modified: Thu, 06 Oct 2022 20:52:17 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 836
Keep-Alive: timeout=5, max=72
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Size:   836
Md5:    e73571aebce42792b40325ac9117da29
Sha1:   d3fe79abd3a925079c1133a0d3c46fd8941514f7
Sha256: 2726faa315039af16d833fbca9694060c9cece0cbe9dd3069bdbba15d073aef2

Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             192.229.221.95
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3584
Cache-Control: 'max-age=158059'
Date: Thu, 09 Mar 2023 13:15:46 GMT
Last-Modified: Thu, 09 Mar 2023 12:16:02 GMT
Server: ECAcc (ska/F77E)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /image/thumb/Purple118/v4/96/c7/76/96c776f8-3a0e-cda9-130d-8feadb33e5a2/source/1200x630bb.jpg HTTP/1.1 
Host: is5.mzstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/

                                        
                                             95.101.10.25
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                            
Server: daiquiri/3.0.0
Content-Length: 22987
x-apple-jingle-correlation-key: FTJIURWXYVJNSRFBDXD5YAATLE
x-apple-request-uuid: 2cd28a46-d7c5-52d9-44a1-1dc7dc001359
b3: 2cd28a46d7c552d944a11dc7dc001359-8ab2a599beeb4608
x-b3-traceid: 2cd28a46d7c552d944a11dc7dc001359
x-b3-spanid: 8ab2a599beeb4608
apple-seq: 0.0
apple-tk: false
apple-originating-system: UnknownOriginatingSystem
Last-Modified: Tue, 28 Feb 2023 01:04:40 GMT
ETag: "MSwxLjQuMC0yM0IsVmVyc2lvbiAxMi4xIChCdWlsZCAyMUM1MiksMTY3NzU0NjI4MDYxMSxpc0J1aWxkVmVyc2lvbk5vdFNldCw2MDE1NCxub0VmZmVjdA=="
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Type,ETag,Cache-Control,Expires,Last-Modified
Timing-Allow-Origin: *
Strict-Transport-Security: max-age=31536000; includeSubDomains
x-daiquiri-instance: daiquiri:33624002:pv50p00it-hyhk12033901:7987:23RELEASE10:daiquiri-amp-processing-shared-int-001-pv
CDNUUID: 10c745f2-323d-4e04-8f13-8fa0529ba83f-709107294
Cache-Control: no-transform, max-age=14978945
Date: Thu, 09 Mar 2023 13:15:46 GMT
X-Cache: TCP_HIT from a95-101-10-21.deploy.akamaitechnologies.com (AkamaiGHost/11.0.0-46340752) (-)
Connection: keep-alive


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 630x630, components 3\012- data
Size:   22987
Md5:    0de02bcccca1f6c60cbe81eb5b29d98c
Sha1:   2da739cec7d4d3cb6a98018ef79239432675d3f1
Sha256: a28ddc4b77e206e26f2f7949deab7b8d3a190f4676e9b59bcdcc004a41c91778
                                        
                                            GET /jenny/nd HTTP/1.1 
Host: connect.secure.wellsfargo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lilicamanequinsfiber.com.br/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             95.101.10.194
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=ISO-8859-1
                                            
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Vary: accept-encoding
Content-Encoding: gzip
Content-Length: 17964
Date: Thu, 09 Mar 2023 13:15:46 GMT
Connection: keep-alive
Set-Cookie: ADRUM_BTa=R:35|g:2607d389-a852-425f-867d-fb64820cec87; Expires=Thu, 09-Mar-2023 13:16:16 GMT; Path=/; Secure ADRUM_BTa=R:35|g:2607d389-a852-425f-867d-fb64820cec87|n:wellsfargo-prod_43732a1d-9afc-4e95-ad69-f4ac78c780a7; Expires=Thu, 09-Mar-2023 13:16:16 GMT; Path=/; Secure SameSite=None; Expires=Thu, 09-Mar-2023 13:16:16 GMT; Path=/; Secure ADRUM_BT1=R:35|i:302812; Expires=Thu, 09-Mar-2023 13:16:16 GMT; Path=/; Secure ADRUM_BT1=R:35|i:302812|e:4; Expires=Thu, 09-Mar-2023 13:16:16 GMT; Path=/; Secure ISD_AB_COOKIE=A; Max-Age=7200; path=/; Domain=connect.secure.wellsfargo.com; Secure; httpOnly DCID=J2lulgY%2fzECpdfaLN8opJ7TfxlcF3UPykkVnmgEnoqYhKKTdDyrlwDl0DU47wC98; Domain=connect.secure.wellsfargo.com; Path=/; Expires=Thu, 09 Mar 2023 13:30:46 GMT;Httponly; Secure _abck=142D9213F62EC66098BAF78D704EB388~-1~YAAQvgplX1Ka9sCGAQAAjWiDxgm7bv396BDlYflhq7zMGO1f6RotYAZurxJG87IB6ye63+hb0oX4DCHSmADxGgiK8Y3AlcyMSKCueOvd+S148I4akJ/5t+YGE0hdVVQGdlS0J7ZhQ8uB6mqbggKEDke+QQtSVb1Itn7Qt1f2goek2jh3cNnunMwmqaNGaHFSYuKXJ6+aJsdDJ8b3HiB/6pO1Tko+UglvUQdGuWjvSPdhgMCT55bRaV6Fjc2yzijoyOyN5Ms1njAqpUyE2SxiCmQxP6kEUvWUaVLHCPaa+tf3Re2P3FGsjJ5eDJb0nVXKQ/S3viMEEvnm9IQsgK0/nfBAKG6wi9JJ+9aSblr49eB6+QQZxPDux5hs/8BidGxLTg==~-1~-1~-1; Domain=.wellsfargo.com; Path=/; Expires=Fri, 08 Mar 2024 13:15:46 GMT; Max-Age=31536000; Secure bm_sz=B6587E9ECE28277AB784E3227E7FE078~YAAQvgplX1Oa9sCGAQAAjWiDxhMHN2LWSh6JZn2fgj1UacPbkzN1iAnZf4nj2a2OHmX4g08qmRkILLnT9baHN1WQQuXV23T8YE8IvnJjcxFePdDM+74sHAWg6Y3k9br9Vb8jlikl0PBK3fmmmueyCjNffQHbZyQ9kdPvrXs8qRT7w/y5QnyzPmSr1sJnHrb/DRBIfVM77sXzLGbNpwz++S98Wr9/wMpFze7o6qBdX4ICozuCNAaFSqJlulEy1rPqaNeIVFPqcAV06Gy/nozaGLvNAECzkC9Iw/VTGN9Vl4i6myLatUn9~4405313~3420465; Domain=.wellsfargo.com; Path=/; Expires=Thu, 09 Mar 2023 17:15:46 GMT; Max-Age=14400
Strict-Transport-Security: max-age=31536000 ; includeSubDomains


--- Additional Info ---
Magic:  ASCII text, with very long lines (2293)
Size:   17964
Md5:    8c137d63d1d9d4aefb73b41e3894ccd6
Sha1:   9b9510d1dc9aa4041c2dcdc984744cd940796fb0
Sha256: ff670a6fc972b6a3cdf0d21a873c656480c396774e37de88c8433722db06a38f