r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7af19a5145a4ee99bdf18831bad04bfd
7bdd2a4785b999ef54a2644211d2b2b7190fb8e1
3237bf0111ecdec3615c4d2d49a602f48f800335d0194f52b600bdaefbd63ed0
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3237BF0111ECDEC3615C4D2D49A602F48F800335D0194F52B600BDAEFBD63ED0"
Last-Modified: Thu, 30 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2614
Expires: Fri, 31 Mar 2023 19:23:43 GMT
Date: Fri, 31 Mar 2023 18:40:09 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cca063332ba9a89eadd62a8dd7f81a9b
d473b2a7a32c964599ff3bac8f98fa578f03d1d1
02fb74c7c695ad99f7f2fd7c02ae2b88e2da1c5db339f883333d9090291931dc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "02FB74C7C695AD99F7F2FD7C02AE2B88E2DA1C5DB339F883333D9090291931DC"
Last-Modified: Wed, 29 Mar 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10879
Expires: Fri, 31 Mar 2023 21:41:28 GMT
Date: Fri, 31 Mar 2023 18:40:09 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 374c9e295a804e605c402f48ae7e2446
967394b36ecdff2dd32842f878887f061024c6b3
7652dfcb9e2d620ce1d033be8ecc53166d2881154c15decd60899415e5ac2706
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7652DFCB9E2D620CE1D033BE8ECC53166D2881154C15DECD60899415E5AC2706"
Last-Modified: Thu, 30 Mar 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9530
Expires: Fri, 31 Mar 2023 21:18:59 GMT
Date: Fri, 31 Mar 2023 18:40:09 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ed282214b024a7895d90e229e92bb1cc
1f447aa59287ce2b45860a1a909d005a41305f77
a35ae9f89cbc77ed5fe849acdc2701592799c335f2674776d69c25bca0a00c2e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Type, Alert, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 31 Mar 2023 18:16:12 GMT
content-type: application/json
age: 1437
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
File type PEM certificate\012- , ASCII text
Hash e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: hM8Lj4S8klvG46l/m2zx5o5IKIyckeKS3yMduhXw+mW7Or7JxHxoxx6SEQzkM1H9ObDRcjhPz6w=
x-amz-request-id: 38ZKZNZ9SKK0JR77
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 31 Mar 2023 18:12:17 GMT
age: 1672
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 31 Mar 2023 18:40:09 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
20.226.85.91/ruxitagentjs_ICA2Vfghjqru_10235220309135426.js
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/ruxitagentjs_ICA2Vfghjqru_10235220309135426.js
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /ruxitagentjs_ICA2Vfghjqru_10235220309135426.js HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:09 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: ETag, Pragma, Backoff, Expires, Last-Modified, Content-Type, Alert, Retry-After, Cache-Control, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 31 Mar 2023 18:14:39 GMT
age: 1531
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash fc0bc67cb73720019a64ebe2e6cc00a8
1caa960bc9bf478f88d9401ac9784d42641f513e
a8053d663c8bfb024620c710e40c226c0fc1c82620c511ffed5379ad4191acd9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 5b6731341a66be32757ea461f5bd605a
f9a017cd1195d1eafb3839a899baf75f2e71958f
4bda8352f303d3fb71b8c4b2ecc9fbe75dcfc91dd2232260afb1e37ebbf139fb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
20.226.85.91/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:09 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
www.googletagmanager.com/gtm.js?id=GTM-N2FTFQ
200 OK 53 kB URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-N2FTFQ
IP
File type ASCII text, with very long lines (3707)
Hash ec4984e29783ee10905b52923089c00d
0bb3034c6034acb7648a95bd4e80a5a85145e28c
044ac2552281adba8fb435bd0c504fd1724c8a9d67a329c3165d2233a7604da1
GET /gtm.js?id=GTM-N2FTFQ HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 31 Mar 2023 18:40:10 GMT
expires: Fri, 31 Mar 2023 18:40:10 GMT
cache-control: private, max-age=900
last-modified: Fri, 31 Mar 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 53191
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 782ca4845ea5e0ec981e33231b1e61cb
032116b75e124c57877524e9e4f523b6d7c65820
94d007862fc7a4cd67f582ff22f2339619177435559c1dd5075a08c7240f3520
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94D007862FC7A4CD67F582FF22F2339619177435559C1DD5075A08C7240F3520"
Last-Modified: Wed, 29 Mar 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2691
Expires: Fri, 31 Mar 2023 19:25:01 GMT
Date: Fri, 31 Mar 2023 18:40:10 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash fc0bc67cb73720019a64ebe2e6cc00a8
1caa960bc9bf478f88d9401ac9784d42641f513e
a8053d663c8bfb024620c710e40c226c0fc1c82620c511ffed5379ad4191acd9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: wzmvTCEeDpm6zYGJAd1+JA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: ElN/uIN/6rkMFDOO7sNNBU8fwG8=
ocsp.r2m01.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.r2m01.amazontrust.com/
IP
Hash 874efd01185881df3be4df44587c479e
491957112af984245194e0fa8bf06a9fdd250168
05644382f5e7c5b02216398866161cdd507aa52655adbd34a362fa3c6c9dd5f4
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=141250
Date: Fri, 31 Mar 2023 18:40:10 GMT
Etag: "6426961e-1d7"
Expires: Sun, 02 Apr 2023 09:54:20 GMT
Last-Modified: Fri, 31 Mar 2023 08:13:18 GMT
Server: ECAcc (nya/799C)
X-Cache: Miss from cloudfront
Via: 1.1 db0992ba349fc51d5151ec8330e36c28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: smgx-Y2Ov75s2nIzgCcPezlua68Ne99HLv59SQiQ--03Hx8zj6IHuA==
Age: 6062
20.226.85.91/index.php/login/login/login/index.php
200 OK 751 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/index.php
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 751 kB (751221 bytes)
Hash 47b44fd921e39de4637919484b9f8cc0
bcdf65477946b4d9a52fe3a374fb3c294c226df5
0484fd21f352660e66536a8535c396e01e34d7e0204e4f3998fee8ff32fa279e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/index.php HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:09 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash e2d5e4593c830bd9a297e9d820fce16b
a48bacab5839fbc2a379e0e1f8703da462f3c31d
c273a26e5fb94b4aa7c494bd09daf02419f99307f90de3891951535ae93e8028
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash bd5f736130efca53385a376507e64fbd
60e4def162522bc32731cd670834c76d763e83d4
aa03ff80ff8b3e95f9ff11ad9efaee8a0e4d6dbb4e6acdf36e5fe4a06212625f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
200 OK 30 kB URL HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
IP
File type ASCII text, with very long lines (65451)
Hash 0f83cadc148d2ad7e53c91f6c4ee05bb
90035c5fffedf4b0f099465f6b929a030b46c92b
3f59aa77bbbed7760a9968af27d3c19ffddda021c948edf0bf0c0f828dd308ae
GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30399
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 26 Mar 2023 22:39:16 GMT
expires: Mon, 25 Mar 2024 22:39:16 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 417654
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google.com/recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR
200 OK 580 B URL HTTP/2 www.google.com/recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR
IP
File type ASCII text, with very long lines (913), with no line terminators
Hash e92ab5066d7baab34c33eea6a6c1051d
13127f0c2be9e7597896f76e99a5a6416ef5f007
fd7aac3b907ff6878436bb98167ddda09c354882f5bae75af0178382827272aa
GET /recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Fri, 31 Mar 2023 18:40:10 GMT
date: Fri, 31 Mar 2023 18:40:10 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 580
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash e2d5e4593c830bd9a297e9d820fce16b
a48bacab5839fbc2a379e0e1f8703da462f3c31d
c273a26e5fb94b4aa7c494bd09daf02419f99307f90de3891951535ae93e8028
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 02ddc021542aadb090aa31099f7b9267
cb2091bff4ad6c225faa4c0c02182217bcdc502c
dcca0f6c051c27f611b9e51981fb34bd0c82a317c2e3ae3412ec6de80c596d24
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ
200 OK 9.2 kB URL HTTP/1.1 cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ
IP
File type ASCII text, with very long lines (22651), with no line terminators
Hash bb462b00b14c20c1058237a188f4033b
6cb3f0724e5b750d6d1ae92518a9126314368e7b
ff1a4463eadc1c7e0bce4edd7635a026f7106130efd1c27bd4bb8af6104edf08
GET /df/tag.js?id=PM-N2FTFQ HTTP/1.1
Host: cdn.pmweb.com.br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Encoding: gzip
Content-Type: application/javascript
Date: Fri, 31 Mar 2023 18:40:10 GMT
ETag: W/"64075003-587b"
Expires: Fri, 31 Mar 2023 18:45:10 GMT
Last-Modified: Tue, 07 Mar 2023 14:53:55 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Vary: Accept-Encoding
Content-Length: 9197
Connection: keep-alive
20.226.85.91/index.php/login/login/login/js/3.bundle-d6a6baaa0dc3faae26db.js
200 OK 751 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/js/3.bundle-d6a6baaa0dc3faae26db.js
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 751 kB (751221 bytes)
Hash 47b44fd921e39de4637919484b9f8cc0
bcdf65477946b4d9a52fe3a374fb3c294c226df5
0484fd21f352660e66536a8535c396e01e34d7e0204e4f3998fee8ff32fa279e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/js/3.bundle-d6a6baaa0dc3faae26db.js HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:09 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:11 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 14539c5e0ca6ce826e62bdadad738bbd
92ce1bbc7f338d3e48e35d637513ab0aba610a98
58e8d186f5d0531c2597d267b0a92bb46909e8fa162b2b5f7fa6e50b2e0af357
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "58E8D186F5D0531C2597D267B0A92BB46909E8FA162B2B5F7FA6E50B2E0AF357"
Last-Modified: Fri, 31 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9499
Expires: Fri, 31 Mar 2023 21:18:30 GMT
Date: Fri, 31 Mar 2023 18:40:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 14539c5e0ca6ce826e62bdadad738bbd
92ce1bbc7f338d3e48e35d637513ab0aba610a98
58e8d186f5d0531c2597d267b0a92bb46909e8fa162b2b5f7fa6e50b2e0af357
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "58E8D186F5D0531C2597D267B0A92BB46909E8FA162B2B5F7FA6E50B2E0AF357"
Last-Modified: Fri, 31 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9499
Expires: Fri, 31 Mar 2023 21:18:30 GMT
Date: Fri, 31 Mar 2023 18:40:11 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccede828-1c24-4287-bb00-f793263370cf.jpeg
200 OK 6.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccede828-1c24-4287-bb00-f793263370cf.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8a2b8f737604b7983cf686c82599dc73
aa63be93c4cd641f09ce0d5144ef60aab21caed1
78835586bfd170fee7e6f70b2b426ed186f5aeae969459c6dcbf527ba9c0deec
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccede828-1c24-4287-bb00-f793263370cf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6380
x-amzn-requestid: 0a129a69-0720-47a0-8b0e-b3200de24204
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUn6E19IAMF9SQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260165-564474a42e79d1dc4eb9558f;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:45 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: L6tgzFrj9t69Rnfd9bziAPiROAX0tvcj9Kcg8sXkto8qRFeKqiwkpg==
via: 1.1 b5695e36d7fbc522ece27885d73757ae.cloudfront.net (CloudFront), 1.1 7514e5e25722778fd4b1744d4ecc67e0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 22:17:06 GMT
age: 73385
etag: "aa63be93c4cd641f09ce0d5144ef60aab21caed1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2cbd721e-872e-4eec-8eb5-363663d0ab36.jpeg
200 OK 5.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2cbd721e-872e-4eec-8eb5-363663d0ab36.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8600e41520408df4865627256a0a0736
dffeaf1a8f73ae9f6247b9dc7f05301fefc00aef
9163d80d7b6087b804e6682a50d4f66339d339894cf1c5808f2e5c2e0b3de930
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2cbd721e-872e-4eec-8eb5-363663d0ab36.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5806
x-amzn-requestid: cee5b166-592b-405e-b5f1-e36eb249ec59
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUllFFooAMFQ2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260156-01840fa47177285667bca060;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:30 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: WnrfQr57EWYnXt1xJt9tr5XCuM3gPYULlDdEVpv2Q2kz7MDIPxSPKA==
via: 1.1 88a7ff956a5b49ec3a35abfc0027af12.cloudfront.net (CloudFront), 1.1 aabd01c4a20dae837d162bd972422efc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:47:50 GMT
age: 75141
etag: "dffeaf1a8f73ae9f6247b9dc7f05301fefc00aef"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4de055bc-1569-4c9a-9ff5-b5ce7d869905.jpeg
200 OK 4.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4de055bc-1569-4c9a-9ff5-b5ce7d869905.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 41f0baa1423dbd529f6c47bd51fe708f
f09b44f30b63f5e29dd247f592147ffc6b308e72
313b769259453565919ab14410faea927a23ad75636abc57851dfe67d43ea156
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4de055bc-1569-4c9a-9ff5-b5ce7d869905.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4370
x-amzn-requestid: 5791c184-d5eb-4666-bc94-f838cd0183af
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUllHrcIAMFSWA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260156-15fb3d2f67359d6837df5d0d;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:30 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: SutOql3FzsHZoFN5TXMJZ1NZzBplZK1w0zNIzAN1rUQ2cKeSrCiA6w==
via: 1.1 99db15345b0e5e7ad9c267ae999b8cf4.cloudfront.net (CloudFront), 1.1 44cd593d82a2d200a94217033c614c6a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:47:50 GMT
age: 75141
etag: "f09b44f30b63f5e29dd247f592147ffc6b308e72"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba3e3682-3d0e-4ac1-8330-9ea9ebe92041.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba3e3682-3d0e-4ac1-8330-9ea9ebe92041.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 0530376e431b6563796e4abb0db0bc4e
6921f4bd83a806e1ea8247854ad4c045fa7ee298
d6371c81d5494d5e50fd5cc1cfe1ce28213dfa70ea5a94df82c9f4b3e6430a53
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba3e3682-3d0e-4ac1-8330-9ea9ebe92041.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10490
x-amzn-requestid: 0525e5c4-485e-47eb-ab95-1136e4d5c29a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUnTEztoAMFzMQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260161-54b47454475ff6ee4d880534;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:41 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: jl5cQc_Zqq5xNDMcs5jRHb3HBIjuucl-JHF126hInXrOfv_CG-UqSg==
via: 1.1 8f251d23da31b683c3c9d6fad6ca944c.cloudfront.net (CloudFront), 1.1 b4085435efbe95a420f374958bd145be.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 22:18:02 GMT
age: 73329
etag: "6921f4bd83a806e1ea8247854ad4c045fa7ee298"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa6350b4c-fa14-49e1-a21b-44b6f311dbdc.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa6350b4c-fa14-49e1-a21b-44b6f311dbdc.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 39bdd16276747b1445a79e674a2a3347
d0676f63738484298a78b7abf7e4934c3d256065
67aa526299060c2a39c4baa10fd03f121497dccd5e765676639ed73ac529c34b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa6350b4c-fa14-49e1-a21b-44b6f311dbdc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11061
x-amzn-requestid: 428128ec-c441-4ff7-9c84-880a01672b00
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnVFnFf0IAMFTvQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260223-185c48300f161931310fa35f;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:41:55 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: gc77o7y-moH1HuMEZFe9-00DVAda9baa-5VEPlMA4SIZDJNzQ8jUlA==
via: 1.1 a87682502db4b394cc6ba84510da9f98.cloudfront.net (CloudFront), 1.1 deaaf0548506de20925615eb51a7ea7e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:47:50 GMT
etag: "d0676f63738484298a78b7abf7e4934c3d256065"
content-type: image/jpeg
age: 75141
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b95f765-7590-4263-b0a3-4db9c87a60df.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b95f765-7590-4263-b0a3-4db9c87a60df.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 424b55535e5fd622b2fc96aac1246324
cf7cf08aa8969a86bf03695af2129686fd62fe86
c4bb26a7b2c431282b53b4df9999b9cc8e61369a79c606688a76499b31a65127
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b95f765-7590-4263-b0a3-4db9c87a60df.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10271
x-amzn-requestid: db0d1fe4-060a-4e61-90f3-ec9befee1295
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CkBoXGh5oAMFfzw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6424afce-2e9251552b4acdcb19e02dfc;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Wed, 29 Mar 2023 21:38:22 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: 1cXec9_e-KpzyTwiHaNAaf0y5i12tw7BkZTXnduS5ek7yAAZ0LXTWw==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 d0387b833e3ca8cb748a1296b4b4bf2a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:48:08 GMT
age: 75123
etag: "cf7cf08aa8969a86bf03695af2129686fd62fe86"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5ac54bb3628890e12111d64757053dac
882c767217269bad8ce48c525f3fc09b0b463524
c1ad6c172550ea4fe7b49ec5f913099a74b95f887cb31bfde78e4895b016bc01
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:12 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 5ac54bb3628890e12111d64757053dac
882c767217269bad8ce48c525f3fc09b0b463524
c1ad6c172550ea4fe7b49ec5f913099a74b95f887cb31bfde78e4895b016bc01
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 18:40:12 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
20.226.85.91/index.php/login/login/login/js/vendors.bundle-859d26788acf215a201a.js
200 OK 751 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/js/vendors.bundle-859d26788acf215a201a.js
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 751 kB (751221 bytes)
Hash 47b44fd921e39de4637919484b9f8cc0
bcdf65477946b4d9a52fe3a374fb3c294c226df5
0484fd21f352660e66536a8535c396e01e34d7e0204e4f3998fee8ff32fa279e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/js/vendors.bundle-859d26788acf215a201a.js HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289809153|1680288009146; dtLatC=119; dtSa=-
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:10 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/cartoes-renner/vectors/whatsapp.svg
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/vectors/whatsapp.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/vectors/whatsapp.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash f3ba0fe356004b14c57b7e8cb47055ee
5c618a3a30de7e077ba75d8a5e9f46d37d3de35f
80b7bc85bad1d12031910192ec94fca6ba0ac504236420380f9299303e0f3c32
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=91150
Date: Fri, 31 Mar 2023 18:40:12 GMT
Etag: "6425daf1-1d7"
Expires: Sat, 01 Apr 2023 19:59:22 GMT
Last-Modified: Thu, 30 Mar 2023 18:54:41 GMT
Server: ECAcc (nya/7919)
X-Cache: Miss from cloudfront
Via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: wdMWjIE9HuNTG1WyZ1dCP0V5RpgO2RGJJ3fwXNZF6uW-ti6eyEd6YA==
Age: 3881
www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css
404 Not Found 1.6 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Hash 617f87016391056cbfa3087f986bd536
57c63621d5e3657f9add4229143eb54909902bd0
a38edb7c355cb03d028c7aebd49d71de4b673368cbf77dec0c95088930a90c73
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Fri, 31 Mar 2023 18:40:12 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1620
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js
404 Not Found 1.6 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Hash 3ab3a3944f881ad31c89d08f5e8bb435
3dffffd915706b6f3a4be103ef99b293fd89d2dc
a2b4316623904892860acbdf726e13f1b33e07244baaae92fb9bb0c01e70d69c
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Fri, 31 Mar 2023 18:40:12 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1624
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
20.226.85.91/index.php/login/login/login/vectors/bg-login.svg
200 OK 298 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/bg-login.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 298 kB (298044 bytes)
Hash ff69945a70c8fca2f4c01c505a1fd727
671840b6d6b73ba2f02a942dc9e7841ac72a2a1f
165b3eb13cce34f52c26f14b7396d81216ebf5286887d9a78c06e8c186d3ab1c
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/bg-login.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js
404 Not Found 1.6 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Hash 3ab3a3944f881ad31c89d08f5e8bb435
3dffffd915706b6f3a4be103ef99b293fd89d2dc
a2b4316623904892860acbdf726e13f1b33e07244baaae92fb9bb0c01e70d69c
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Fri, 31 Mar 2023 18:40:12 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1624
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
s3-sa-east-1.amazonaws.com/frame-image-br/bg.png?x-id=real&x-r=
200 OK 0 B URL HTTP/1.1 s3-sa-east-1.amazonaws.com/frame-image-br/bg.png?x-id=real&x-r=
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /frame-image-br/bg.png?x-id=real&x-r= HTTP/1.1
Host: s3-sa-east-1.amazonaws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
x-amz-id-2: UMmeWqenx5DP6Cvl7m2h//sXOOe6L45qendBNFdFmDlHVwmfJxBQ7HFtHFx1//0poXKquF0Drj4=
x-amz-request-id: P3R1WW6D3Y0P5EJF
Date: Fri, 31 Mar 2023 18:40:13 GMT
Last-Modified: Thu, 04 May 2017 08:21:21 GMT
ETag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-meta-s3cmd-attrs: uid:502/gname:staff/uname:user/gid:20/mode:33188/mtime:1493416832/atime:1493796970/md5:d41d8cd98f00b204e9800998ecf8427e/ctime:1493416832
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 0
www.google-analytics.com/analytics.js
200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP
File type ASCII text, with very long lines (1490)
Hash ca7fbbfd120e3e329633044190bbf134
d17f81e03dd827554ddd207ea081fb46b3415445
847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20085
date: Fri, 31 Mar 2023 18:05:12 GMT
expires: Fri, 31 Mar 2023 20:05:12 GMT
cache-control: public, max-age=7200
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 2101
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.google-analytics.com/gtm/js?id=GTM-W9SBWRL&cid=1003849302.1648069470
200 OK 45 kB URL HTTP/2 www.google-analytics.com/gtm/js?id=GTM-W9SBWRL&cid=1003849302.1648069470
IP
File type ASCII text, with very long lines (2206)
Hash 0a592072d39e49b114ca9f9c327125ec
f3416b8f8e9958c6ceeaa83761f31a7316611cd4
19ea1d1494262ed29e6167dcbc34848d6540ef85ac8f9b46417006e27951c7db
GET /gtm/js?id=GTM-W9SBWRL&cid=1003849302.1648069470 HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 31 Mar 2023 18:40:13 GMT
expires: Fri, 31 Mar 2023 18:40:13 GMT
cache-control: private, max-age=900
last-modified: Fri, 31 Mar 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 45362
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/recaptcha__pt_br.js
200 OK 167 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/recaptcha__pt_br.js
IP
File type HTML document, ASCII text, with very long lines (769)
Size 167 kB (167163 bytes)
Hash 22bc1b47413f1f7ea2404c2af231f3e3
4d718fad9e632f0e833186b1c19011f3dcb54223
4b030f11adc0b496a16d73f6c3f6d010a0876191b361ee8676263fe0b6d1579f
GET /recaptcha/releases/vpEprwpCoBMgy-fvZET0Mz6L/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://20.226.85.91
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 167163
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Mar 2023 22:05:55 GMT
expires: Thu, 28 Mar 2024 22:05:55 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 20 Mar 2023 04:02:00 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 160458
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
20.226.85.91/index.php/login/login/login/fonts/Roboto-Bold.woff2
200 OK 751 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/fonts/Roboto-Bold.woff2
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 751 kB (751221 bytes)
Hash 47b44fd921e39de4637919484b9f8cc0
bcdf65477946b4d9a52fe3a374fb3c294c226df5
0484fd21f352660e66536a8535c396e01e34d7e0204e4f3998fee8ff32fa279e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/fonts/Roboto-Bold.woff2 HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/cartoes-renner/images/lojas-renner.png
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/images/lojas-renner.png
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
quad9 Sinkholed
GET /cartoes-renner/images/lojas-renner.png HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:13 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/index.php/login/login/login/fonts/Roboto-Light.woff2
200 OK 751 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/fonts/Roboto-Light.woff2
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 751 kB (751221 bytes)
Hash 47b44fd921e39de4637919484b9f8cc0
bcdf65477946b4d9a52fe3a374fb3c294c226df5
0484fd21f352660e66536a8535c396e01e34d7e0204e4f3998fee8ff32fa279e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/fonts/Roboto-Light.woff2 HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/cartoes-renner/images/favicon.ico
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/images/favicon.ico
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
quad9 Sinkholed
GET /cartoes-renner/images/favicon.ico HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:13 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/cartoes-renner/fonts/Roboto-Bold.woff
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Bold.woff
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Bold.woff HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:13 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/cartoes-renner/fonts/Roboto-Light.woff
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Light.woff
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Light.woff HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:13 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js
404 Not Found 1.6 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Hash 3ab3a3944f881ad31c89d08f5e8bb435
3dffffd915706b6f3a4be103ef99b293fd89d2dc
a2b4316623904892860acbdf726e13f1b33e07244baaae92fb9bb0c01e70d69c
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://20.226.85.91
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Fri, 31 Mar 2023 18:40:14 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1624
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
20.226.85.91/cartoes-renner/fonts/Roboto-Bold.ttf
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Bold.ttf
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Bold.ttf HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:13 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/cartoes-renner/fonts/Roboto-Light.ttf
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Light.ttf
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Light.ttf HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:13 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/index.php/login/login/login/fonts/Roboto-Black.woff2
200 OK 751 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/fonts/Roboto-Black.woff2
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 751 kB (751221 bytes)
Hash 47b44fd921e39de4637919484b9f8cc0
bcdf65477946b4d9a52fe3a374fb3c294c226df5
0484fd21f352660e66536a8535c396e01e34d7e0204e4f3998fee8ff32fa279e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/fonts/Roboto-Black.woff2 HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/index.php/login/login/login/fonts/Roboto-Regular.woff2
200 OK 751 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/fonts/Roboto-Regular.woff2
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 751 kB (751221 bytes)
Hash 47b44fd921e39de4637919484b9f8cc0
bcdf65477946b4d9a52fe3a374fb3c294c226df5
0484fd21f352660e66536a8535c396e01e34d7e0204e4f3998fee8ff32fa279e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/fonts/Roboto-Regular.woff2 HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/cartoes-renner/fonts/Roboto-Black.woff
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Black.woff
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Black.woff HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:14 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/cartoes-renner/fonts/Roboto-Regular.woff
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Regular.woff
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Regular.woff HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:15 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/cartoes-renner/fonts/Roboto-Black.ttf
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Black.ttf
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Black.ttf HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:15 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
20.226.85.91/cartoes-renner/fonts/Roboto-Regular.ttf
404 Not Found 298 B URL HTTP/1.1 20.226.85.91/cartoes-renner/fonts/Roboto-Regular.ttf
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fc0260550b1f102c8f70ca0f40cfee8c
624ca5fde6f0fe88ee9ac952e72e7acef14d99a2
b52f79f7eab3d13d244dc127bd27a28e218606f60a34864e8914eb39d5b24e3f
Analyzer Verdict Alert openphish Lojas Renner
fortinet Spam
quad9 Sinkholed
GET /cartoes-renner/fonts/Roboto-Regular.ttf HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289811531|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 404 Not Found
Date: Fri, 31 Mar 2023 18:40:15 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
ocsp.r2m02.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.r2m02.amazontrust.com/
IP
Hash 498d635f11faf383b19b210547bcb2cf
8bf55a295bf5571d0129f6b20c21cb6039b9bc42
d31e899872643996467ca606b4644128a031d4c457ecd4ccb6ae8e8bb2042318
POST / HTTP/1.1
Host: ocsp.r2m02.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Fri, 31 Mar 2023 18:40:17 GMT
Last-Modified: Fri, 31 Mar 2023 17:03:07 GMT
Server: ECAcc (nya/1C3C)
X-Cache: Miss from cloudfront
Via: 1.1 94eee494c19905cb6933ec8a32a577a0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: rm4ESUG1xFxLRvbVlLc8-7qmTSCKiwAzdhnCFhZE3MWbh9HZZE8kwA==
Age: 5831
20.226.85.91/index.php/login/login/login/vectors/bg-login.svg
200 OK 164 kB URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/bg-login.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators
Size 164 kB (164528 bytes)
Hash 09c22c58ff1633a4f369b25caeded073
79536424f6c0a9bc4ef4a1c317f9ff221229976b
d58d46cde4585d8e70d30ba3aabb1679b66b503aaa0431c6e55c941b9daaaa0e
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/bg-login.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h-vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289814656|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238; _ga=GA1.1.1562178091.1680288013; _gid=GA1.1.1733347320.1680288013
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:16 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/index.php/login/login/login/vectors/google-play-badge-reverse.svg
200 OK 0 B URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/google-play-badge-reverse.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/google-play-badge-reverse.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289809153|1680288009146; dtLatC=119; dtSa=-
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:11 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/index.php/login/login/login/vectors/google-play-badge.svg
200 OK 0 B URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/google-play-badge.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/google-play-badge.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289809153|1680288009146; dtLatC=119; dtSa=-
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:11 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/index.php/login/login/login/vectors/google-play-badge-reverse.svg
200 OK 0 B URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/google-play-badge-reverse.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/google-play-badge-reverse.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/index.php/login/login/login/vectors/app-store-badge.svg
200 OK 0 B URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/app-store-badge.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/app-store-badge.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/index.php/login/login/login/vectors/app-store-badge.svg
200 OK 0 B URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/app-store-badge.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/app-store-badge.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289809153|1680288009146; dtLatC=119; dtSa=-
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:11 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91/index.php/login/login/login/images/celular-login.png
200 OK 0 B URL HTTP/1.1 20.226.85.91/index.php/login/login/login/images/celular-login.png
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Analyzer Verdict Alert openphish Lojas Renner
quad9 Sinkholed
GET /index.php/login/login/login/images/celular-login.png HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289809153|1680288009146; dtLatC=119; dtSa=-
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:11 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js
200 OK 0 B URL HTTP/2 js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js
IP
GET /jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js HTTP/1.1
Host: js-cdn.dynatrace.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://20.226.85.91
Connection: keep-alive
Referer: http://20.226.85.91/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript;charset=utf-8
date: Fri, 31 Mar 2023 17:52:55 GMT
timing-allow-origin: *
x-oneagent-js-injection: true
traffic-source: UNKNOWN
dynatrace-response-source: Cluster
dynatrace-response-id: GWOCXXI0VEYN
expires: Fri, 31 Mar 2023 18:52:55 GMT
cache-control: public, max-age=3600
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: lBjJgy8UzZZSrElyInEi52miU9j9jHHVAG-RwOnlsDY-Pd4S1KCXuQ==
age: 2834
X-Firefox-Spdy: h2
20.226.85.91/index.php/login/login/login/vectors/google-play-badge.svg
200 OK 0 B URL HTTP/1.1 20.226.85.91/index.php/login/login/login/vectors/google-play-badge.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Analyzer Verdict Alert openphish Lojas Renner
fortinet Phishing
quad9 Sinkholed
GET /index.php/login/login/login/vectors/google-play-badge.svg HTTP/1.1
Host: 20.226.85.91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://20.226.85.91/index.php/login/login/login/index.php
Cookie: dtCookie=v_4_srv_-2D96_sn_UBP55SF3B94RISI1AEFG02FOVREASEHM; rxVisitor=1680288009144Q24K5VA7HRNLTCTTI0FIRLCRPMBRC7U3; dtPC=-96$288009134_836h1vFRCFMNHWKRKIDMPRMUCVQATRCQEHRTCB-0e0; rxvt=1680289810611|1680288009146; dtLatC=119; dtSa=-; _pm_id=787501680288010238; _pm_sid=764051680288010238
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 18:40:12 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.2.0
X-Powered-By: PHP/8.2.0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
20.226.85.91
16.12.0.24
23.36.76.226
0.0.0.0