| assets.adobedtm.com/71dcbb11123ce6b2e1ce4d47fd79a130aad3fc95/satelliteLib-177113f60f763788009998023cd15615fe2168a2.js |  2.18.172.233 | 200 OK | 151 kB |
URL GET HTTP/2assets.adobedtm.com/71dcbb11123ce6b2e1ce4d47fd79a130aad3fc95/satelliteLib-177113f60f763788009998023cd15615fe2168a2.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (32729) Size151 kB (151408 bytes) Hash23f31c247d234d09f4468b0085ff2a73 55ae54cc32b2cc21b326ccc8fae2d7039cae88ca 0db6c3f365ed3db6fdae09adb90e2770d625a96da69624dd3ab5fe6d4cff34c7
GET /71dcbb11123ce6b2e1ce4d47fd79a130aad3fc95/satelliteLib-177113f60f763788009998023cd15615fe2168a2.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "23f31c247d234d09f4468b0085ff2a73:1713182442.487605"
last-modified: Mon, 15 Apr 2024 12:00:42 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:42:46 GMT
date: Fri, 19 Apr 2024 15:42:46 GMT
content-length: 151408
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/telegraph-view.png |  104.21.56.131 | 403 Forbidden | 6.2 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/telegraph-view.png IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (501) Hash4d361471c290252ecb3235516700e9ff 1934406b88cd8344b0bf9c52cf3fd0e0be73c3f9 0209e7fc011980b1892fe5baeb60bc3f00de30e2b95d2eb2e1aac51234512ca0
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/telegraph-view.png HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 530 No Reason Phrase
date: Fri, 19 Apr 2024 15:42:46 GMT
content-type: text/html; charset=UTF-8
content-length: 6193
cf-ray: 876e01a2bec356c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QLUf8L02zmq2593r34VSfvDMDx1BWKiq2t2OQr1BxmXGvlWzE%2FMOCTQ0r5gmB9XQ5EajtCCpZHOJNXqxMZ5ZSXdFpGTTbaOAA2yVdqG5AIDBlx3x9mYC1CLp7ycMNyEINbn%2BIwVu%2FeLdmTiEzvqgGw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| www.telegraph.co.uk/martech/js/core.min.js | 2.18.174.13 | 200 OK | 33 kB |
URL GET HTTP/2www.telegraph.co.uk/martech/js/core.min.js IP2.18.174.13:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65530), with no line terminators Hashcc29070148547ea7e6cb9e671cab2f06 3e4818c9a33a649fe1393dca2f6308e5ae3a401f 46b831f111a057fbe7aab444640bc8c55f9b3a57af4a076d8c17c8d7ad2e2180
GET /martech/js/core.min.js HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-guploader-uploadid: ABPtcPp8BHhObsx0QTQ7AY1oFbw-iuzG9kL-9IftSd6fzLIt6PuiPNZI6bKxY-Z8Mk-DxlNno7VUJ7lYnQ
last-modified: Fri, 19 Apr 2024 12:17:00 GMT
etag: "cc29070148547ea7e6cb9e671cab2f06"
x-goog-generation: 1713529020215515
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 137457
x-goog-meta-goog-reserved-file-mtime: 1713528946
content-type: text/javascript
x-goog-hash: crc32c=M74+hA==, md5=zCkHAUhUfqfmy55nHKsvBg==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
server: UploadServer
content-encoding: gzip
content-length: 32647
cache-control: public, max-age=161
expires: Fri, 19 Apr 2024 15:45:27 GMT
date: Fri, 19 Apr 2024 15:42:46 GMT
vary: Accept-Encoding
akamai-x-true-cache-ttl: 300
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| cf.eip.telegraph.co.uk/particle-embed/js/particle.js |  35.190.33.26 | 200 OK | 28 kB |
URL GET HTTP/2cf.eip.telegraph.co.uk/particle-embed/js/particle.js IP35.190.33.26:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (22428) Hash90f86a35e5520fca933e297878dcdbad 20df8cf3b6460713063c5fa2534310185d51e0ef feb0cc16532a991069a25bec704314e1ffc72c57e70b44e3443ffef02d52eebb
GET /particle-embed/js/particle.js HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-amz-id-2: 5dJd2q+6cADPfgDEYEE5SSy9rKcK4iFYN2c14lRYjSjY7t5oqkRAVfn/UN02JKZRtRL/ltJeTyQ=
x-amz-request-id: CG2J527GWPAC3PB6
x-amz-meta-cache-control: max-age=30,s-maxage=300,must-revalidate
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
content-length: 28076
date: Fri, 19 Apr 2024 15:41:33 GMT
age: 73
last-modified: Wed, 28 Feb 2024 13:22:18 GMT
etag: W/"90f86a35e5520fca933e297878dcdbad"
content-type: application/javascript
vary: Accept-Encoding
cache-control: public,max-age=30,s-maxage=300,must-revalidate
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| secure.telegraph.co.uk/customer/lib/tmgrefresh.js |  184.86.2.245 | 200 OK | 658 B |
URL GET HTTP/1.1secure.telegraph.co.uk/customer/lib/tmgrefresh.js IP184.86.2.245:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectsecure.telegraph.co.uk Fingerprint23:AC:E5:52:2D:CA:5F:27:B0:E9:34:9F:35:0A:8D:9D:15:6C:32:8A ValidityWed, 07 Feb 2024 00:00:00 GMT - Thu, 06 Feb 2025 23:59:59 GMT
File typeJavaScript source, ASCII text Hash92ec6e06684a6792d58813ca7438ffc2 af889814e64cae60cea74e095007459a36609604 7c601d4676fde2d9005955fb79c2970b3b9a1b1ab23be2cc5f7d031be98bd0b1
GET /customer/lib/tmgrefresh.js HTTP/1.1
Host: secure.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Last-Modified: Thu, 11 Apr 2024 05:33:31 GMT
ETag: "0c014de3684631ee9d71932ea4ec168f"
X-GUploader-UploadID: ABPtcPrXTNkWvaHte-lpLvkcy6plRfhre_jkseSkAnt5oGUu5YHunc9-577hs359bjikKJ5NuTQ
Vary: Accept-Encoding
x-goog-generation: 1712813611501414
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 658
Content-Type: text/javascript
Content-Encoding: gzip
x-goog-hash: crc32c=Hw+TBg==
x-goog-storage-class: MULTI_REGIONAL
Accept-Ranges: bytes
Content-Length: 658
Server: UploadServer
Cache-Control: public, max-age=207
Expires: Fri, 19 Apr 2024 15:46:13 GMT
Date: Fri, 19 Apr 2024 15:42:46 GMT
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1713541366215_386095662_260687463_37_11151_9_15_-";dur=1
|
|
| static.telegraph.co.uk/telegraph-advertising/tmg-cmp.min.js | 54.230.111.83 | 200 OK | 9.5 kB |
URL GET HTTP/1.1static.telegraph.co.uk/telegraph-advertising/tmg-cmp.min.js IP54.230.111.83:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subjectstatic.telegraph.co.uk Fingerprint59:3D:E8:4F:6A:00:D8:BE:21:3C:3C:92:85:B3:B2:44:F9:C1:C6:64 ValidityMon, 22 Jan 2024 00:00:00 GMT - Wed, 19 Feb 2025 23:59:59 GMT
File typeASCII text, with very long lines (36995), with no line terminators Hash2af884ea13d393314523df162b36b212 20cfdbdbdd3d9b5cb70d4d1ebb5c62b6d85114c0 e847dee5dedf9e1033e72c740fe77cbcc0260bfef55b3e6ceeca590a46ee5469
GET /telegraph-advertising/tmg-cmp.min.js HTTP/1.1
Host: static.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 18 Apr 2024 09:08:39 GMT
x-goog-generation: 1713431319178591
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 36995
x-goog-meta-goog-reserved-file-mtime: 1713431285
x-goog-hash: crc32c=eTiq+g==, md5=KviE6hPTkzFFI98WKzayEg==
x-goog-storage-class: MULTI_REGIONAL
X-GUploader-UploadID: ABPtcPrhe9oL-yIJe6upk5LN6LLqEaCnQCJTSaDCl2Rhe2OE6cLY5nfDEpfFn9y5oGbf7pFVWZE
Server: UploadServer
Content-Encoding: gzip
Date: Fri, 19 Apr 2024 15:40:26 GMT
Cache-Control: public,max-age=300
Expires: Fri, 19 Apr 2024 15:45:26 GMT
ETag: W/"2af884ea13d393314523df162b36b212"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 b2b04ca80b95df6bc86478a1bf96b7cc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: BwAxI-EUZGu8KDY867-Sz4zWoGDFZmrcOYn-teKENoduEHU4N07EHA==
Age: 140
|
|
| static.telegraph.co.uk/telegraph-advertising/tmg-gpt.min.js | 54.230.111.83 | 200 OK | 43 kB |
URL GET HTTP/1.1static.telegraph.co.uk/telegraph-advertising/tmg-gpt.min.js IP54.230.111.83:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subjectstatic.telegraph.co.uk Fingerprint59:3D:E8:4F:6A:00:D8:BE:21:3C:3C:92:85:B3:B2:44:F9:C1:C6:64 ValidityMon, 22 Jan 2024 00:00:00 GMT - Wed, 19 Feb 2025 23:59:59 GMT
File typeASCII text, with very long lines (65536), with no line terminators Hash89155e5a94981fcccbbeb1d317c96c3c f6a539a26efe26fb87808325c713752ee93d692c a6050d44c321d16aab5043e5408dcc9f75a3f78d2c5eaadf449fa2d9a577e03f
GET /telegraph-advertising/tmg-gpt.min.js HTTP/1.1
Host: static.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-GUploader-UploadID: ABPtcPpuV8DunTOnXcj91fHnBJjeTxh8zXsSyYRCp79k-Uh_bufK8L8fsDPncfMlfHVTnK_rvw
Last-Modified: Thu, 18 Apr 2024 09:08:38 GMT
x-goog-generation: 1713431318682152
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 224006
x-goog-meta-goog-reserved-file-mtime: 1713431285
x-goog-hash: crc32c=t5dyWw==, md5=iRVeWpSYH8zLvrHTF8lsPA==
x-goog-storage-class: MULTI_REGIONAL
Server: UploadServer
Content-Encoding: gzip
Date: Fri, 19 Apr 2024 15:40:31 GMT
Cache-Control: public,max-age=300
Expires: Fri, 19 Apr 2024 15:45:31 GMT
ETag: W/"89155e5a94981fcccbbeb1d317c96c3c"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 4bbc14b5834fc74ccd249b954b43a08c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 06p4QwURRDE-34tkkpek3181Lsjl2zLWVlxH9AcfNidpDTwiKl0cow==
Age: 135
|
|
| cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9/css/homePageRendererHTML.css | 143.204.55.11 | 200 OK | 3.6 kB |
URL GET HTTP/2cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9/css/homePageRendererHTML.css IP143.204.55.11:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
File typegzip compressed data, from Unix Hash412551ec07353a84c26e57bf62db70d9 e611352dc9c4b6fabe1e640f07b1fdfa7aff6125 b02ae402b5e20d84bcffc116abdb19fa7e17572aab668bf14384d16965910508
GET /d36ccaa4-b656-42b1-ac86-aeecac880dc9/css/homePageRendererHTML.css HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
last-modified: Wed, 22 Nov 2023 10:34:57 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 19 Apr 2024 15:40:31 GMT
cache-control: max-age=30,s-maxage=30,must-revalidate
etag: W/"fc0fefdd93bc2405e34d7622b424983a"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: G72hn2ADh1MGIWDARK184S5iOm8apBMWnaJdtpEk8X15FBua-R9Nkg==
age: 159
x-robots-tag: googlebot:noindex,indexifembedded
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/UK-SVG.svg | 104.21.56.131 | 521 No Reason Phrase | 6.8 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/UK-SVG.svg IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (394) Hash8dc8914f9816a7bdd1eb998c1274bb6d 88be114c2e2d6f99c18b83ed5cce63bab6544d9a c8340877b232301c2c5d31a09f48cf839c4fc0a3fbdbb700c0464808f5696ce4
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/UK-SVG.svg HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 521 No Reason Phrase
date: Fri, 19 Apr 2024 15:42:47 GMT
content-type: text/html; charset=UTF-8
content-length: 6834
cf-ray: 876e01a27e6c56c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4gUMNGukT%2BSbMZg4J39Nk0pjXTATSPFyE0yznWlnNw8G%2BZUtTHV5wL%2FO%2B3YL5r2EPdBgO4MqcDOedDTK1DGdZrGCguUKet30v3ECqgrQ0lnnVefVy3vnn0Agxqtv9T0Ivbl23b4houm7%2BYFjf2Ejkg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/austin-news-uprights-vf-basic-web.woff2 | 104.21.56.131 | 403 Forbidden | 44 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/austin-news-uprights-vf-basic-web.woff2 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash2386017cab459c7f7658524d8a4747cd 60b59df562b3bc393c2f282421f20c44e4f038a7 0d12a27253dfda80192317f0e509a6deadcdd7d21fd3c139fabb7b8b9cfce39a
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/austin-news-uprights-vf-basic-web.woff2 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://will76.g5gm64rpby.workers.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:47 GMT
content-type: text/plain;charset=UTF-8
content-length: 44
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uf73PzQK%2FdT80d4%2Fb%2BFzF8GSn9ypPRHEwLpH76qjVv6lOf2TeKXD9IbcWV1QhaJrbT22xU%2FSVcnZZHqaLLsOCEy3R5M6CV2bgU2MOTCAmGqL37hetYzyl5ZVcbJ9N6LG%2FE3eIRHdi5yXU1r1k5kB%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01a25e4d56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/18/TELEMMGLPICT000374409722_17134611218440_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 | 104.21.56.131 | 200 OK | 9 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/18/TELEMMGLPICT000374409722_17134611218440_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash9d1ead73e678fa2f51a70a933b0bf017 d205cbd6783332a212c5ae92d73c77178c2d2f28 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/music/2024/04/18/TELEMMGLPICT000374409722_17134611218440_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:47 GMT
content-type: text/plain; charset=utf-8
content-length: 9
cf-ray: 876e01a2bebc56c0-OSL
cf-cache-status: MISS
cache-control: no-cache
vary: Accept-Encoding
pragma: no-cache
user-id: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JoRvY8ggjf9tc12kYRjo0XVNLHOobhP%2F2MxMTJ5aitz9Wy8kyzVFqFrWktkaW%2FbORWGr4qf2ljdzW1eiSDeTAGyuksFy%2BJvf22L1RdBBVRXbPZXCdZrVYwdWZXDOJPcZ8PQ4o4DyhL4Hhw9m0wzcoA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-d0d23c36e35c0ca1afe7a849443941c7-lc.min.css | 104.21.56.131 | 403 Forbidden | 43 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-d0d23c36e35c0ca1afe7a849443941c7-lc.min.css IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hasha68af2301bc73ce47355aec64dbebca5 d96855d7c1fe8420b47a7eda6341e59ff4f001ce 9d55b37c646e6bb26e27154aeb5fd15edc1601465a033973b9d1ca107a49e120
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-d0d23c36e35c0ca1afe7a849443941c7-lc.min.css HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:48 GMT
content-type: text/plain;charset=UTF-8
content-length: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0D4fSGsrIOtZ7Eza7PQM7pQ6pfq93pKuH4PcpSRukGGE%2FYYhurmsTKFiqUU%2FD%2BIBgZALFul4ka19Ru0vD1ciXu8ChKcrVCHux%2BZKGg3eXy3%2BBVml%2BhT98FcEXh4Mqu3aAbxt%2F%2BwY6%2FuXjzSn2waCEw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01a26e5256c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/letters_to_editor.png | 104.21.56.131 | 530 No Reason Phrase | 6.2 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/letters_to_editor.png IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (501) Hash79442073bb8b8cf8d6580c6eceebcddf 147cbf2221ef168472eaa736199cd6b1ceee78cd 3e90aa11f7d8802181616ae657cbacad20e2497314463fd41d606025a857dbaf
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/letters_to_editor.png HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 530 No Reason Phrase
date: Fri, 19 Apr 2024 15:42:48 GMT
content-type: text/html; charset=UTF-8
content-length: 6193
cf-ray: 876e01afeb8b56c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kH0%2F4HRa7NdERDtJQHD8Eb%2BJTCzNiHU6mDF0Gp54v9v5mJMd%2B%2B9%2B6PCr7yDvW3xgXo7UaI%2FVA15Ah%2FzS%2FFDuuBA2aRrurbPmQdtQUZhCfHtSS%2BvZw1ZtKDxnrnj6s18AOrOmNwjLWKP37q6NJAXV%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| cf.eip.telegraph.co.uk/particle-embed/js/particle.js | 35.190.33.26 | 200 OK | 28 kB |
URL GET HTTP/2cf.eip.telegraph.co.uk/particle-embed/js/particle.js IP35.190.33.26:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (22428) Hash90f86a35e5520fca933e297878dcdbad 20df8cf3b6460713063c5fa2534310185d51e0ef feb0cc16532a991069a25bec704314e1ffc72c57e70b44e3443ffef02d52eebb
GET /particle-embed/js/particle.js HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
x-amz-id-2: xeRzk9v5FBy4qrORPjNs6UWnWYkyFRVC7F4VEwpniP1Npwsoc9Die+3hb7re+CA2kKgszK7y+yE=
x-amz-request-id: 1QPBD2PTC07DQ9BM
x-amz-meta-cache-control: max-age=30,s-maxage=300,must-revalidate
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
content-length: 28177
date: Fri, 19 Apr 2024 15:38:12 GMT
age: 276
last-modified: Wed, 28 Feb 2024 13:22:18 GMT
etag: W/"90f86a35e5520fca933e297878dcdbad"
content-type: application/javascript
vary: Accept-Encoding
cache-control: public,max-age=30,s-maxage=300,must-revalidate
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true | 143.204.55.11 | 200 OK | 616 B |
URL GET HTTP/2cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true IP143.204.55.11:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
File typegzip compressed data, from Unix Hash37c74b57f5060ed1366a3babc188946a c9275660d1c843889656b32d78f52a327dab4503 6bec9f4b41d4266f2024d9611f82c7b42a44b3272946d31cdd6464ddef7cd03a
GET /d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/html
last-modified: Wed, 22 Nov 2023 10:34:39 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 19 Apr 2024 15:41:30 GMT
etag: W/"4514f374d26e7dbf3f5b67dfa4eeb68f"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: zd3MytCDodB17IBeIePa3ITakTdeOB8YzVGVOGqRH7fm8z9qOM-yGg==
age: 125
cache-control: max-age=60,must-revalidate
x-robots-tag: googlebot:noindex,indexifembedded
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
|
|
| cf.eip.telegraph.co.uk/assets/_css/fontsv08.css | 35.190.33.26 | 200 OK | 1.0 kB |
URL GET HTTP/3cf.eip.telegraph.co.uk/assets/_css/fontsv08.css IP35.190.33.26:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeASCII text, with CRLF line terminators Hash345248fb1b1aa55a7111365112d8c029 204dd633466272e262f77ed54de2ba77b54d368f 58475be71fe5dc8ed871ea2d40fc90e3b776e56cda325e119f5dea2969103174
GET /assets/_css/fontsv08.css HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
x-amz-id-2: D1wbsFwM3OfLbYtKzhIyr6uumF2CPDliFbM08hGbqjDl8JJnIc2THA7NjeSyHyzLsSe0KZ85tE8=
x-amz-request-id: VBBG007QBMR5JX8J
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
content-length: 1045
date: Sat, 06 Apr 2024 05:05:46 GMT
age: 1161422
last-modified: Mon, 22 Jan 2024 14:45:49 GMT
etag: W/"345248fb1b1aa55a7111365112d8c029"
content-type: text/css
vary: Accept-Encoding
cache-control: public,max-age=86400,s-maxage=2592000
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/USA-SVG.svg | 104.21.56.131 | 403 Forbidden | 1.7 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/USA-SVG.svg IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ISO-8859 text, with very long lines (979) Hashf654623533329aa5ba64b6894ba14aae 71edfbab2ba6a6d89d7e551ae391bcb2c0b32a1c 72be460c9519d26cee1e1ea23e7751caca4297b18c848fe42780fd5c09c12f62
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/USA-SVG.svg HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:47 GMT
content-type: text/html; charset=GBK
cf-ray: 876e01a28e8356c0-OSL
cf-cache-status: MISS
cache-control: max-age=600
expires: Fri, 19 Apr 2024 15:52:47 GMT
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1cYlB8HvXv6ePM39AVxO%2FrSJAdPmbbjsJnl5ZS0ChIJea8%2BDy7G19BgjP%2FvqT3EtxQ0O9CCW8ZnYz4T24m%2BCD2jIq3g1pQDTpsPEjb6CtzLpycdPyxqt%2BsTNGh9vn2C3PLGcaTF7bSFI3psew5ybdw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-b719fdf665c61f9440830226ea36eac9-lc.min..js | 104.21.56.131 | 405 Method Not Allowed | 32 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-b719fdf665c61f9440830226ea36eac9-lc.min..js IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
Hash60f65e7842f73015190b9468502ac238 196b6c9293b7dbe6a2d338a4ad5c1bed5f85cdb8 9fea5132e2822eba8b386b293395d2ec31e50ff942cd065cc084ef3c78b501c5
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-b719fdf665c61f9440830226ea36eac9-lc.min..js HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 405 Method Not Allowed
date: Fri, 19 Apr 2024 15:42:47 GMT
content-type: text/html; charset=utf-8
cf-ray: 876e01a26e5a56c0-OSL
cf-cache-status: BYPASS
cache-control: no-cache, no-store
set-cookie: acw_tc=276077ac17135413674522720ebfc93cc220cddcac2589a71d64faae1ec9d1;path=/;HttpOnly;Max-Age=1800
strict-transport-security: max-age=31536000
vary: Accept-Encoding
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z1wt%2FDE48xTQ5K%2BHWfiszC9HtWvAdfxo4rVL8pE0%2Fw7JxNS9mYjoOm600VyFeOlWrRxy0uJ7A1280Y%2BRh3pDinf2uO8yZcfabdutCiLnRnW%2BCsKZgyTqOCeff%2BXCN3c3yH0ny7Pp3hn4Ko2VTYsPsw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| cf.eip.telegraph.co.uk/embeds/23__tiles/styles.css | 35.190.33.26 | 200 OK | 2.0 kB |
URL GET HTTP/3cf.eip.telegraph.co.uk/embeds/23__tiles/styles.css IP35.190.33.26:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
Hash93082a1f45262ba0ba5bcad69c32b232 d7582d7ec576a2103598496720e766052b4929e9 9a3fc7709b084e835a170a2ce8a75985800c9f35446b84cb323e759dd535e5ef
GET /embeds/23__tiles/styles.css HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
x-amz-id-2: Vj6ijXKaG7ZJpdjPHCYZ0ek+hpKBzmKwFSgf9iBCTD9p1fNIDKHQzKw1EIFCjuwykGPrhN5Dcik=
x-amz-request-id: M9VSMAK4SMCRCF6N
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
content-length: 1987
date: Fri, 12 Apr 2024 19:04:00 GMT
age: 592728
last-modified: Sat, 20 Jan 2024 12:34:21 GMT
etag: W/"93082a1f45262ba0ba5bcad69c32b232"
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=3600,s-maxage=604800,public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| cf.eip.telegraph.co.uk/embeds/23__tiles/script.js | 35.190.33.26 | 200 OK | 2.4 kB |
URL GET HTTP/3cf.eip.telegraph.co.uk/embeds/23__tiles/script.js IP35.190.33.26:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeHTML document, ASCII text, with very long lines (2364) Hashf7ec6502dcb372d94047b9d509a91328 4fb87181929b92daaf995e7b986a75b4cc372766 cd10546309c8793aa03158f9a2b2d91a6ef2cfaa7ae2305a310e37afef1b5000
GET /embeds/23__tiles/script.js HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
x-amz-id-2: diRgh2LDUqebHWmibMoXfGsV+vXHvFx6QdeB6q31pBhcFjMpC8eSNbndlskIpqrOgDdiW+PIjI4=
x-amz-request-id: M9VV479872WCGV4B
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
content-length: 2396
date: Fri, 12 Apr 2024 19:04:00 GMT
age: 592728
last-modified: Fri, 22 Dec 2023 18:13:40 GMT
etag: W/"f7ec6502dcb372d94047b9d509a91328"
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=3600,s-maxage=604800,public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| cf.eip.telegraph.co.uk/visuals-cms/particles/helpers.js | 35.190.33.26 | 200 OK | 28 kB |
URL GET HTTP/3cf.eip.telegraph.co.uk/visuals-cms/particles/helpers.js IP35.190.33.26:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (22431) Hash8a86ca6db85330eed1f7a018c8043625 912282ff54d7173e36568c677c66c070dd2cfde9 766b13654bfea5da1944b7d8ef08b7f407611acb02905bb4b88a5d8a5419d374
GET /visuals-cms/particles/helpers.js HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
x-amz-id-2: X0w68xvnWlWtyU95sFJ2NgdcdQCoEUAn/Ck5fvRPIoGrpyuN3oz0it/bU5hF4+3Msw0Ce8vb8UM=
x-amz-request-id: YCVR0YTW95QCYK43
x-amz-meta-cache-control: max-age=30,s-maxage=300,must-revalidate
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
content-length: 28438
date: Fri, 19 Apr 2024 15:38:48 GMT
age: 240
last-modified: Wed, 28 Feb 2024 13:22:17 GMT
etag: W/"8a86ca6db85330eed1f7a018c8043625"
content-type: application/javascript
vary: Accept-Encoding
cache-control: public,max-age=30,s-maxage=300,must-revalidate
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.telegraph.co.uk/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/doric-news-uprights-vf-basic-web.woff2 | 2.18.174.13 | 200 OK | 27 kB |
URL GET HTTP/2www.telegraph.co.uk/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/doric-news-uprights-vf-basic-web.woff2 IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 26808, version 1.0 Hashd3638636961c30e60e4509fd34a8bfa3 24403bf7d5a2844947c3ff0814bb76fe9b1050e8 bef522b0c3369a5cf089cffb0ed13485558d8f67c49847765f87e44beb538856
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/doric-news-uprights-vf-basic-web.woff2 HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cf-particle-html.eip.telegraph.co.uk
DNT: 1
Connection: keep-alive
Referer: https://cf.eip.telegraph.co.uk/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 08 Feb 2024 13:21:47 GMT
etag: W/"68b8-610deb18a13ee-gzip"
content-security-policy: frame-ancestors 'self' *.telegraph.co.uk;
x-vhost: publish, ${SERVER_NAME}
content-type: font/woff2
x-content-type-options: nosniff
x-served-by: cache-fra-eddf8230110-FRA
x-timer: S1707398508.633858,VS0,VS0,VE44
vary: Accept-Encoding
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
content-length: 26808
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
access-control-allow-headers: Content-Type
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/letters_to_editor.png | 104.21.56.131 | 530 No Reason Phrase | 147 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/letters_to_editor.png IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeXML 1.0 document, ASCII text Hash029ae44b379d08114259b850f45de150 95b397b22a1424917656337ad39f0264c9c22f75 1a17a5e27c658004e3900653663f22969eaf852fa54d89488fbf3cfee29774d1
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/letters_to_editor.png HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:46 GMT
content-type: text/html
cf-ray: 876e01a2bec056c0-OSL
cf-cache-status: BYPASS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y63sttdtKb08ofdp8%2F%2B0G%2BjdcQLWoO5%2B64M1tgEPVB5RTYEjgVrUeuRvLh%2Bdbda0MRBMjv9Ed4t5IBsfoU25TBJSsYtshRCBNvlSx0Kab3EcGDU5opVsJ9gUT7oH6nr9c5LRnivFDJy54GhtsxK2OA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true | 143.204.55.11 | 200 OK | 0 B |
URL GET HTTP/2cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true IP143.204.55.11:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
HEAD /d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://will76.g5gm64rpby.workers.dev/
Origin: https://will76.g5gm64rpby.workers.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/html
date: Fri, 19 Apr 2024 15:42:49 GMT
last-modified: Wed, 22 Nov 2023 10:34:39 GMT
etag: W/"4514f374d26e7dbf3f5b67dfa4eeb68f"
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: ssmerYOilXJ03Q-F_Gd_8ZbrYxO4FTyOhRfWmaCL6eBJ1sExojZCwA==
cache-control: max-age=60,must-revalidate
x-robots-tag: googlebot:noindex,indexifembedded
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/PortalPictures/april-2024/374506298_Sturgeon%20LS.jpg?imwidth=640 | 104.21.56.131 | 404 Not Found | 1.0 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/PortalPictures/april-2024/374506298_Sturgeon%20LS.jpg?imwidth=640 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash841102042dfedb8a9dcc0e6a9966307f 313ea8da3498deebf7f443093638df7501ce60c6 6ad407809dc8e6d079dfbd21823508dffb897b97a27eb8ae43acbea1b7c8df0d
GET /content/dam/PortalPictures/april-2024/374506298_Sturgeon%20LS.jpg?imwidth=640 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:47 GMT
content-type: text/html
cf-ray: 876e01a29e9b56c0-OSL
cf-cache-status: MISS
vary: Accept-Encoding
x-cache-lookup: Cache Miss, Hit From Inner Cluster, Cache Miss
x-nws-log-uuid: 6136744849823012065
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q9chmRm%2F1YILXnHUKQXkjbP%2BulRfxlphs9mocaJjWX4Me12iXnSB1Ma4GJnriXW0fv3Xjc0v3PXj%2FiM%2Fiq1Ybk3GZYSpZt7l4ae9e333cICp49sFvorS8zdmi8w17v%2F%2BMNDBFE4ZOeUqBQf8M%2F%2B5bA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| www.telegraph.co.uk/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/doric-news-uprights-vf-basic-web.woff2 | 2.18.174.13 | 200 OK | 27 kB |
URL GET HTTP/2www.telegraph.co.uk/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/doric-news-uprights-vf-basic-web.woff2 IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 26808, version 1.0 Hashd3638636961c30e60e4509fd34a8bfa3 24403bf7d5a2844947c3ff0814bb76fe9b1050e8 bef522b0c3369a5cf089cffb0ed13485558d8f67c49847765f87e44beb538856
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/doric-news-uprights-vf-basic-web.woff2 HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cf-particle-html.eip.telegraph.co.uk
DNT: 1
Connection: keep-alive
Referer: https://cf.eip.telegraph.co.uk/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 08 Feb 2024 13:21:47 GMT
etag: W/"68b8-610deb18a13ee-gzip"
content-security-policy: frame-ancestors 'self' *.telegraph.co.uk;
x-vhost: publish, ${SERVER_NAME}
content-type: font/woff2
x-content-type-options: nosniff
x-served-by: cache-fra-eddf8230110-FRA
x-timer: S1707398508.633858,VS0,VS0,VE44
vary: Accept-Encoding
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
content-length: 26808
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
access-control-allow-headers: Content-Type
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/6d749aad-ca31-487f-8483-f0f5e4ee5a4b.svg | 2.18.174.13 | 200 OK | 823 B |
URL GET HTTP/2www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/6d749aad-ca31-487f-8483-f0f5e4ee5a4b.svg IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeSVG Scalable Vector Graphics image Hasha07182baae55ff7ef6adab3a8bd65b68 9bc39eeca8fe8ef23065f7e4c552e3a7aad9ac28 720ecd17969275d17f0f98546da645ee4cf2cc98a8e17cbba853dd0091792f06
GET /content/dam/eip/particles/gen/2023/11/15/6d749aad-ca31-487f-8483-f0f5e4ee5a4b.svg HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Wed, 15 Nov 2023 12:23:54 GMT
etag: "0x8DBE5D5BC0EA9E6"
access-control-allow-origin: *
content-security-policy: frame-ancestors 'self' www.stumbleupon.com stumbleupon.com;
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-disposition: attachment; filename="6d749aad-ca31-487f-8483-f0f5e4ee5a4b.svg"
x-vhost: publish
accept-ranges: bytes
strict-transport-security: max-age=31557600
x-served-by: cache-fra-eddf8230040-FRA
x-timer: S1700051152.807484,VS0,VS0,VE105
mpulse_cdn_cache: HIT
mpulse_origin_time: 0
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
content-length: 823
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| www.telegraph.co.uk/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/austin-news-uprights-vf-basic-web.woff2 | 2.18.174.13 | 200 OK | 91 kB |
URL GET HTTP/2www.telegraph.co.uk/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/austin-news-uprights-vf-basic-web.woff2 IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 90584, version 1.0 Hashdedf7324bc95adb4cc761711518d4dee 83c4374d1d5f8caafe1a72627ab1bfb28b5948e5 abc99ab42d99b92fd5e8a3c55ad6408cddb6d3d080979a646364343b9dffb0a6
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/austin-news-uprights-vf-basic-web.woff2 HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cf-particle-html.eip.telegraph.co.uk
DNT: 1
Connection: keep-alive
Referer: https://cf.eip.telegraph.co.uk/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 08 Feb 2024 13:21:48 GMT
etag: W/"161d8-610deb1916a1c-gzip"
content-security-policy: frame-ancestors 'self' *.telegraph.co.uk;
x-vhost: publish, ${SERVER_NAME}
content-type: font/woff2
x-content-type-options: nosniff
x-served-by: cache-ams21063-AMS
x-timer: S1707398508.128122,VS0,VS0,VE38
vary: Accept-Encoding
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
access-control-allow-headers: Content-Type
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/football/2024/04/19/TELEMMGLPICT000374523800_17135377518440_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 42 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/football/2024/04/19/TELEMMGLPICT000374523800_17135377518440_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash043fb3a16422dabb8d626e772043809a 4436a3e907d06924bccd6a7d42f08b9da1ab47f4 87f2f673eceb7d9f420e2acda06beb155958f4600811940d0a269e94b3e733c0
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/football/2024/04/19/TELEMMGLPICT000374523800_17135377518440_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:48 GMT
content-type: text/plain;charset=UTF-8
content-length: 42
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2%2FrSxzJ3tob0gK8Em3yge4iUm64U9Js58SBoI1jaZsrMnZlvyWLUz9TBU8YTlxs3GRc2eUF5DbeE%2BE1n%2FkxRsTosVvAG7XgJR0bC4bTI8v3rBRmm4lJov0vEI%2Bf8xarT8vkCeAvIox1xRGtCWDs2Gg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01a2bebf56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/2cd63db6-e399-4a7a-8744-f3cf2d279cf5.svg | 2.18.174.13 | 200 OK | 498 B |
URL GET HTTP/2www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/2cd63db6-e399-4a7a-8744-f3cf2d279cf5.svg IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeSVG Scalable Vector Graphics image Hash88a16999f8d2f5a700ba5e310a293474 201090863b181ca9a7b77b1ed341a85cf631bb5d de6acacf5c4b5e2b9a5ebcff672f23967a7c69035deb69632a064e399b8ba061
GET /content/dam/eip/particles/gen/2023/11/15/2cd63db6-e399-4a7a-8744-f3cf2d279cf5.svg HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Wed, 15 Nov 2023 12:23:59 GMT
etag: "0x8DBE5D5BEB57407"
access-control-allow-origin: *
content-security-policy: frame-ancestors 'self' www.stumbleupon.com stumbleupon.com;
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-disposition: attachment; filename="2cd63db6-e399-4a7a-8744-f3cf2d279cf5.svg"
x-vhost: publish
accept-ranges: bytes
strict-transport-security: max-age=31557600
x-served-by: cache-fra-eddf8230052-FRA
x-timer: S1700051152.702542,VS0,VS0,VE117
mpulse_cdn_cache: HIT
mpulse_origin_time: 0
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
content-length: 498
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/92e4c964-795a-43aa-9809-5453a73ef85e.svg | 2.18.174.13 | 200 OK | 882 B |
URL GET HTTP/2www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/92e4c964-795a-43aa-9809-5453a73ef85e.svg IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeSVG Scalable Vector Graphics image Hashee0b0e499aed970b967bd95238b9d4b1 cc505d7b3a1698b729f8fed317c3016ca917a7f6 3e6676fa814ce6276c5a73786a19b65314bd45b1bc12405a849b0c441e928932
GET /content/dam/eip/particles/gen/2023/11/15/92e4c964-795a-43aa-9809-5453a73ef85e.svg HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Wed, 15 Nov 2023 12:24:35 GMT
etag: "0x8DBE5D5D450A58C"
access-control-allow-origin: *
content-security-policy: frame-ancestors 'self' www.stumbleupon.com stumbleupon.com;
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-disposition: attachment; filename="92e4c964-795a-43aa-9809-5453a73ef85e.svg"
x-vhost: publish
accept-ranges: bytes
strict-transport-security: max-age=31557600
x-served-by: cache-fra-eddf8230060-FRA
x-timer: S1700051152.711444,VS0,VS0,VE122
mpulse_cdn_cache: HIT
mpulse_origin_time: 0
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
content-length: 882
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/Austin-News-Headline-Cond-Roman.woff2 | 104.21.56.131 | 403 Forbidden | 41 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/Austin-News-Headline-Cond-Roman.woff2 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash0879cf9383cbc7fd6d36d038149757b6 8f444adaa06bd0e0d8da67d1bb9d58a72f717f41 edddb76c0ba37e273fa2ec0a91bc72c1efdb285e933f320fd475acf859350b8c
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/Austin-News-Headline-Cond-Roman.woff2 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://will76.g5gm64rpby.workers.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/plain;charset=UTF-8
content-length: 41
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pBUD7fUs3jyKD7Wixzph8zDgja9a65p21uYmLjlgtXTYbAq02mr5BJWDnGXPwB4e2iLtlFdfrBANl6s2NddlR%2B9%2F9IvoETWMJ0coxO0Fg5ERW3EYoh5T7ZsKBGktQVHDUtuAegpn21AxngfeQzFa3g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01a25e4e56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2024/02/02/TELEMMGLPICT000364924535_17068761282040_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=210 | 104.21.56.131 | 404 Not Found | 41 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2024/02/02/TELEMMGLPICT000364924535_17068761282040_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=210 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash0879cf9383cbc7fd6d36d038149757b6 8f444adaa06bd0e0d8da67d1bb9d58a72f717f41 edddb76c0ba37e273fa2ec0a91bc72c1efdb285e933f320fd475acf859350b8c
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/health-fitness/2024/02/02/TELEMMGLPICT000364924535_17068761282040_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=210 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/plain;charset=UTF-8
content-length: 41
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GDwPemnB2rGoCp1ItOOGe6VxD4KGTD0bzNW4r39sQddhESmLaiL%2FL02q6OTn67hTQjGpX3iQFuiDDc3EG819IjHoFDSuZDLx6ZEIvVTWfWrFVrz8tPSZTIDj1KUDWtQaWFLg67qR21Zigrin3RgWBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01b0cc9856c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/page-refresh.lc-534f41bd2b70976b5eb656da04d04020-lc.min..js | 104.21.56.131 | 403 Forbidden | 41 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/page-refresh.lc-534f41bd2b70976b5eb656da04d04020-lc.min..js IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash520927f408747156b94d42bff6355733 9bf57696bcee47eacb4a67f0ab005dfdcd1d4a6d fe96992ece274aa739ab85c4fcfdbf074f0876140274832291a3f673bec5dba4
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/page-refresh.lc-534f41bd2b70976b5eb656da04d04020-lc.min..js HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/plain;charset=UTF-8
content-length: 41
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eSpRKq%2FNcxyOnkD5Cc6qR11vymMjgpEGbzVfkflCS%2B1Zl9GD6X7NTYvhZuvr4IEb1eAWlIuzi44YAl0QwsZXcuTtV5qa8g3ZJduYiQxRM4W%2BTCHrfS%2FF7rf%2BqkX5IyuX2guk816NCi2%2B6V13aVxkWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01afcb7156c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/utility-bar/Travel%20-%20UTILITY%20BAR%201.png?impolicy=utilities-thumbnail | 104.21.56.131 | 403 Forbidden | 39 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/utility-bar/Travel%20-%20UTILITY%20BAR%201.png?impolicy=utilities-thumbnail IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash19d98b9151bae8ead0c9bcfeba7dcb72 c5a8bb503a5840dc4f0fff049916933e52695cb9 de2ca29130ea8988fed235954a00333a72c547f6fe8f8902338ebdeb62077f5c
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/utility-bar/Travel%20-%20UTILITY%20BAR%201.png?impolicy=utilities-thumbnail HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/plain;charset=UTF-8
content-length: 39
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M1HMx0EnCwH1h44q2MnQtNsCIYykXMMyfHyYfG0acE8jcLJOgEoUhEI1KUOMJCHDVdH7kR35UHZIvEmMDEoTK%2FkXH9HMT6y9E8Ch0uk2ZTP3o15y5MqoJg%2FqLs5jeyBgSMEtRaxZAAphV4MM3b%2BqHw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01b0bc9756c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/USA-SVG.svg | 104.21.56.131 | 403 Forbidden | 42 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/USA-SVG.svg IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash3481cb6553b34147bc62a14e7cc0fe5b 1a7ed1e5b83f42139f98b22cc334d4fb4b6ab1b4 002470b01ab7e76a7772209ae46a5950e14e2090653518759ede8e25ee4559af
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/USA-SVG.svg HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/plain;charset=UTF-8
content-length: 42
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W80lPSPRmWZW28dHWJkAb4RU5q%2B1Py%2FWxPcTg5riZvWE8nj6vjMETgXTGBAtjUiMBvWJWpb90ege2OvvMLoF%2FBylUXMFT%2FUf7qjbAD%2BeSxrlDRV9YWlDkOoT6xVMnbkHzC66YQlZw8ccSejJBTAuyA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01afdb8056c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/11/TELEMMGLPICT000373575372_17128571483010_trans_NvBQzQNjv4BqSaFSVAJuAAQ5qve96V-sy4Q-OfDahYLO2dxGujAhEX4.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 40 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/11/TELEMMGLPICT000373575372_17128571483010_trans_NvBQzQNjv4BqSaFSVAJuAAQ5qve96V-sy4Q-OfDahYLO2dxGujAhEX4.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hashf6dd7aa0e3e839e8e92565223070b02f c4ad562741c5a997283d3b742c4646399f52dffc f9a6560c83c4e93a3be6077b20afd753f267c2e2bd06c6d9ce116dd6b530f978
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/travel/2024/04/11/TELEMMGLPICT000373575372_17128571483010_trans_NvBQzQNjv4BqSaFSVAJuAAQ5qve96V-sy4Q-OfDahYLO2dxGujAhEX4.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/plain;charset=UTF-8
content-length: 40
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u5sPBVLxVW3FOaDtTv4q2YSNqM47qdgq30Lfux6aX4ZXE%2Fw9Rw7ev3KowCxBxfafAb2Di69cQI2yjDTqq%2BWw1xSSwAnc7HiMGETOeZZ9kHGGK7ZQ28CKjYtxe9XzWmwgqrvic260uPrgskMZn11dkg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01b0cca156c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/business/2024/04/19/TELEMMGLPICT000374495280_17135360663370_trans_NvBQzQNjv4Bqn4xRlpI8rQaTeEWFc06e5TsoP6K2mMXO8tELEPpzIJQ.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 44 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/business/2024/04/19/TELEMMGLPICT000374495280_17135360663370_trans_NvBQzQNjv4Bqn4xRlpI8rQaTeEWFc06e5TsoP6K2mMXO8tELEPpzIJQ.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hashdd9ffab5e53aa00264abb470cb91a829 82d83355c5f05a523f2da9e1cb12847c5851b398 c3c2b5398fd5c94a73e6a3436399defb0b9b74aa51b3e76ce7609f59bad4c295
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/business/2024/04/19/TELEMMGLPICT000374495280_17135360663370_trans_NvBQzQNjv4Bqn4xRlpI8rQaTeEWFc06e5TsoP6K2mMXO8tELEPpzIJQ.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/plain;charset=UTF-8
content-length: 44
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rwMDq3GDavQsCAgU0DOb4MFemDieH6vMNucNJC3c7JWn5%2B14TxHde1ZhG0628y8qa3%2BgHeL%2B1fyiXmQ1XuybiGKcKWwUZtG48GKS61JyAxF1LUTHEelEX58kvmEF2SKKmNECnKgupt8cuzG%2FsMukxg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01a2aeb456c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/19/TELEMMGLPICT000374512791_17135328638050_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 | 104.21.56.131 | 530 No Reason Phrase | 6.2 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/19/TELEMMGLPICT000374512791_17135328638050_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (501) Hashe9db856379ad31bd1fa6ad2d61b59abd ccc88c1199b3a6b8fdbb8b01cebeafbf7700f48e 8bdff10ddd3e29550cecb2f83253adfa15fd048c7e55ec333ef1aacbce8ba020
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/travel/2024/04/19/TELEMMGLPICT000374512791_17135328638050_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 530 No Reason Phrase
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/html; charset=UTF-8
content-length: 6202
cf-ray: 876e01a2bebd56c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KKPToTqexfQhrMX9FSbe08P64Db2SVX78IQ9pLwV%2Buv4y9h1q%2F75iFIR1ZTMBLL8v30Q6WIDr10QZoRGt8O7tkzKWw6rF7m7a8ZjMNKL8nTLqwQU9khtkXM%2Fz%2FOyurtvx3Gai8TJrN2EoJM0cXKGOw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/telegraph-view.png | 104.21.56.131 | 403 Forbidden | 40 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/telegraph-view.png IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash3e96a6ef0d3aa3dd10863221737f3e45 d556c272eaa17c0f3a5a35612ea1972f58cafcc7 f5039c17a692acd1adb99830af2f912ddb2a889ad456403a21894353e3bd91cd
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/telegraph-view.png HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/plain;charset=UTF-8
content-length: 40
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWj%2BvrugGxMlnz8AA8JpmDEBdNrVEnVY52vwDB%2FAA%2BhBp0V21ELHJjXNW702epBfYIr1SP%2BJJ4J3VYsSb%2BZppDpxoOB43Rnaq%2FWBo%2BO%2BfrQU4Tg5HHJRmpsd05E9MmjBfq1%2FvcKEQBofUqcNWo%2B86A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01afeb8d56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/news/2024/04/19/TELEMMGLPICT000374507559_17135357327780_trans_NvBQzQNjv4Bq900leoZVuq6ru6F43OqP_kikPYR0xYwuEBLwP9UFqPg.jpeg?imwidth=640 | 104.21.56.131 | 200 OK | 2.7 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/news/2024/04/19/TELEMMGLPICT000374507559_17135357327780_trans_NvBQzQNjv4Bq900leoZVuq6ru6F43OqP_kikPYR0xYwuEBLwP9UFqPg.jpeg?imwidth=640 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text Hashee45c44faedb07e3fd86a6fa59ebc15f cd9d3a003f819290bc9492e473c5cfc2971a108d 7a1c69ebcfbb00600d21354b26a70a61607e9ef672ee4d284668cdb1398deffe
GET /content/dam/news/2024/04/19/TELEMMGLPICT000374507559_17135357327780_trans_NvBQzQNjv4Bq900leoZVuq6ru6F43OqP_kikPYR0xYwuEBLwP9UFqPg.jpeg?imwidth=640 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/html
cf-ray: 876e01affbae56c0-OSL
cf-cache-status: MISS
last-modified: Wed, 27 Oct 2021 12:17:55 GMT
vary: Accept-Encoding
s-req-id: 5945846539689897527
s-req-type: 0
server-timing: cdn-cache;desc=miss, edge;dur=1, origin;dur=418
x-cache-lookup: Cache Miss, Cache Miss, Cache Miss, Cache Miss
x-nws-log-uuid: 5945846539689897527
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=53wTsiUqkJO%2ByLgDqN9%2BPE0ckTaVvHQbNn%2Bl5HlSe2NJXJ8cMuk%2BJB5wSooCDHM78pr0NA7I%2B%2FZOiYG390N%2Bkq6oj69ZMWBKVQnue%2BHLiLW9sIYxAkCEpmxjg9rAykV1cnFHq4jMfrxK9TQdNUGMzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/11/TELEMMGLPICT000373575372_17128571483010_trans_NvBQzQNjv4BqSaFSVAJuAAQ5qve96V-sy4Q-OfDahYLO2dxGujAhEX4.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 39 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/11/TELEMMGLPICT000373575372_17128571483010_trans_NvBQzQNjv4BqSaFSVAJuAAQ5qve96V-sy4Q-OfDahYLO2dxGujAhEX4.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash19d98b9151bae8ead0c9bcfeba7dcb72 c5a8bb503a5840dc4f0fff049916933e52695cb9 de2ca29130ea8988fed235954a00333a72c547f6fe8f8902338ebdeb62077f5c
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/travel/2024/04/11/TELEMMGLPICT000373575372_17128571483010_trans_NvBQzQNjv4BqSaFSVAJuAAQ5qve96V-sy4Q-OfDahYLO2dxGujAhEX4.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:51 GMT
content-type: text/plain;charset=UTF-8
content-length: 39
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i4eFHp16KN9Ir3J%2BvZOG2NLUK3qck1zbr7Oe4dBkfGBPY%2Fip%2FHHBBx5f5EvTiVkMajMhjiPqtHmkiWSYGlM3Gdy9c2KRM4zoPraUobnRCl6BsxWtQwy1sA5PtMqFUmyOSDzGJrna0uQ0UvE4i9aDzw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01bb9fcc56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/19/TELEMMGLPICT000136928748_17135283139400_trans_NvBQzQNjv4Bqx8Rkzl0zWjdvOH3PGOByseW2zJDeZ4Suazlpcy3wgw8.jpeg?imwidth=320 | 104.21.56.131 | | 43 B |
URL GET will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/19/TELEMMGLPICT000136928748_17135283139400_trans_NvBQzQNjv4Bqx8Rkzl0zWjdvOH3PGOByseW2zJDeZ4Suazlpcy3wgw8.jpeg?imwidth=320 IP104.21.56.131:0
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hasha4524bccc76ee709a8186c69db95a7f5 bac7f4473d8d712e7602be957658ec1ebca80b21 bd2c532cbd1841905d7ad072b28ca2af73d52bf0f1b39eec8b6d255d06f1a597
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/music/2024/04/19/TELEMMGLPICT000136928748_17135283139400_trans_NvBQzQNjv4Bqx8Rkzl0zWjdvOH3PGOByseW2zJDeZ4Suazlpcy3wgw8.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:51 GMT
content-type: text/plain;charset=UTF-8
content-length: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kPJw0VR1ySMJwiUepIzufd%2Bd9hYdHj5zvGsvF44kiRXPiieL00VdjMT%2FqNmeyA%2FsEa7%2B93xlOsAAei3Kqa9OoaTxWTCGB4Q7%2B574%2FZyMN6UUT3WVJA71ebcmut4bAllVSR%2FsyMj29ddZyAPzCru1FA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01b00bb356c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/PortalPictures/april-2024/374518296__212423542354-456456546.jpg?imwidth=1920 | 104.21.56.131 | 403 Forbidden | 43 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/PortalPictures/april-2024/374518296__212423542354-456456546.jpg?imwidth=1920 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hasha4524bccc76ee709a8186c69db95a7f5 bac7f4473d8d712e7602be957658ec1ebca80b21 bd2c532cbd1841905d7ad072b28ca2af73d52bf0f1b39eec8b6d255d06f1a597
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/PortalPictures/april-2024/374518296__212423542354-456456546.jpg?imwidth=1920 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:51 GMT
content-type: text/plain;charset=UTF-8
content-length: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sxa6PqRwYMXy35tQ4V4S%2Bu%2FhUB8ONe4HUXB4ckG0EEAKSfTTeyEDtSaoCfe60Atjzhew9mUvpGA34ww%2FPD3zSiGsQxkz8lr9qYM7NWygRb9AQnD7PvNx8G1ZidB1cTWySRe%2FQJV%2FNf4IH88Vz76E0w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01a28e9056c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/17/TELEMMGLPICT000374062356_17133658657630_trans_NvBQzQNjv4Bq44rdSC6sTNv0-awk2LQJvkR8YSybYNWDTYrGStsI8ko.jpeg?imwidth=960 | 104.21.56.131 | 404 Not Found | 6.8 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/17/TELEMMGLPICT000374062356_17133658657630_trans_NvBQzQNjv4Bq44rdSC6sTNv0-awk2LQJvkR8YSybYNWDTYrGStsI8ko.jpeg?imwidth=960 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (394) Hash05081dbeb1be3904dc36bd032220c905 85375c22c9f08ded99aa644ad20b6d86e0dd0065 24e911478352acbdcc88377d5c02ee4bcaaaf8c014a80637bdd3746c1372c664
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/travel/2024/04/17/TELEMMGLPICT000374062356_17133658657630_trans_NvBQzQNjv4Bq44rdSC6sTNv0-awk2LQJvkR8YSybYNWDTYrGStsI8ko.jpeg?imwidth=960 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 521 No Reason Phrase
date: Fri, 19 Apr 2024 15:42:55 GMT
content-type: text/html; charset=UTF-8
content-length: 6804
cf-ray: 876e01c3987156c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EJlhkVfDPlOQusFfXJMSliUirGpNchwNzMEHseClBbRsZ%2BC%2FkIDVHz4j33vZ7fHB6eTHwanOlrIpEAMwDVCXZ85EOnoICephJZNYMZGijCVVRUSBsC0x%2Fp%2FEPw2uN6vec52gNE956imG4E3g2zG0iQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/news/2024/04/19/TELEMMGLPICT000374373653_17135324518470_trans_NvBQzQNjv4BqlqnpGxFH1QWdCI6KqsKxnsydfw4MFWbU00kmtlhDef0.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 117 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/news/2024/04/19/TELEMMGLPICT000374373653_17135324518470_trans_NvBQzQNjv4BqlqnpGxFH1QWdCI6KqsKxnsydfw4MFWbU00kmtlhDef0.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typegzip compressed data, from Unix Hash4400dbcaa49293041585e6932e289d03 e01330bdb176a6ad18a03a514f885f2837e4f6ab fcc9e74596d6c4c033bded4744908d3f185ac4352c823f3e922eb251c2e1958d
GET /content/dam/news/2024/04/19/TELEMMGLPICT000374373653_17135324518470_trans_NvBQzQNjv4BqlqnpGxFH1QWdCI6KqsKxnsydfw4MFWbU00kmtlhDef0.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/plain;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=42MguksbIQWr1VAtRsgw0jg0YR4ehsiBnOPV5GStzVONHVCTZRVA8J7I%2BrRvvbqqiu60wr3cmE7Q7KvUUOtt8mz7dXHbO1JHDVbpg6DqYhJdMsKeL5c86gtRV%2Flcb0J3jWoQND9ZIOm%2F4epqsHU3jw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01a29e9d56c0-OSL
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/18/TELEMMGLPICT000374358738_17134307200730_trans_NvBQzQNjv4Bqm2gOvejiZNWnKEdp-xGW5FHwtdpQwyNje2OyIL7x97s.jpeg?imwidth=210 | 104.21.56.131 | 404 Not Found | 18 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/18/TELEMMGLPICT000374358738_17134307200730_trans_NvBQzQNjv4Bqm2gOvejiZNWnKEdp-xGW5FHwtdpQwyNje2OyIL7x97s.jpeg?imwidth=210 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (6409) Hash506e9a2e6a06a5a3265b814e06a20676 d39835b117886143af156dd2c7d5a98a7c988c9c ca0a3414f7864d527c1a874ff104d27f568bbe9f74e0cb3fa95d18f6a422295e
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/music/2024/04/18/TELEMMGLPICT000374358738_17134307200730_trans_NvBQzQNjv4Bqm2gOvejiZNWnKEdp-xGW5FHwtdpQwyNje2OyIL7x97s.jpeg?imwidth=210 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:55 GMT
content-type: text/html
cf-ray: 876e01d1ff5956c0-OSL
cf-cache-status: BYPASS
set-cookie: QiHooGUID=CC742ABB2B84E6A9F419211A815C7676.1713541375369; Max-Age=63072000; Domain=so.com; Path=/
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iihn0cDD3%2BwdPK9F%2Fvk%2FcUMpplIg8OBzQtrU9AAkLlyduIFHulkpX1H0PaJBv0BHhftL11kbdjLbj8hZ6Qo9cdh9sRpDCy6t14SMvBaptbPnB%2Bxj4n7%2B2tYYAnHoccghUDdAeHhRfb3DQwhXW0420g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/family/2024/04/18/TELEMMGLPICT000361858515_17134351634250_trans_NvBQzQNjv4Bq4U72PvVlAMIniqBdHHa0YfBB9gV9jTnXm-qxc_-b9g0.jpeg?imwidth=320 | 104.21.56.131 | 404 Not Found | 0 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/family/2024/04/18/TELEMMGLPICT000361858515_17134351634250_trans_NvBQzQNjv4Bq4U72PvVlAMIniqBdHHa0YfBB9gV9jTnXm-qxc_-b9g0.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/family/2024/04/18/TELEMMGLPICT000361858515_17134351634250_trans_NvBQzQNjv4Bq4U72PvVlAMIniqBdHHa0YfBB9gV9jTnXm-qxc_-b9g0.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:58 GMT
content-length: 0
cf-ray: 876e01e8fe9456c0-OSL
cf-cache-status: MISS
access-control-allow-origin: *
strict-transport-security: max-age=15768000
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Vt26WFlq1zWSRqtEz8Umse26wpN6JtKGFfP2ZB%2BgUWrOWklbZtammqp%2FzQ9TG9WX0L3lIi5FbYphUNrWv2144EbNhzrNeUOkODZ57QxW4XW6fChTqZU2QTBSbnqzSuE8IiA8sWg4CL7IYmBzMZSNA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/art/2024/04/18/TELEMMGLPICT000374335885_17134469245750_trans_NvBQzQNjv4Bq_Q1ILu06sxsA6j_eQJ7bcR8WzKyQDtZdoPByVJvBwnA.jpeg?imwidth=210 | 104.21.56.131 | 403 Forbidden | 40 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/art/2024/04/18/TELEMMGLPICT000374335885_17134469245750_trans_NvBQzQNjv4Bq_Q1ILu06sxsA6j_eQJ7bcR8WzKyQDtZdoPByVJvBwnA.jpeg?imwidth=210 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash3e96a6ef0d3aa3dd10863221737f3e45 d556c272eaa17c0f3a5a35612ea1972f58cafcc7 f5039c17a692acd1adb99830af2f912ddb2a889ad456403a21894353e3bd91cd
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/art/2024/04/18/TELEMMGLPICT000374335885_17134469245750_trans_NvBQzQNjv4Bq_Q1ILu06sxsA6j_eQJ7bcR8WzKyQDtZdoPByVJvBwnA.jpeg?imwidth=210 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:58 GMT
content-type: text/plain;charset=UTF-8
content-length: 40
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FbagzqA3CcCGwPC3P2K9jG4X3IXupBEpEPXaUfonAoTTCvff%2B2RykWTBuDOlVFkL5GmdjYI9os8v9hdrN2oJeKO4JqZKeMWP3g%2BwXuA%2FlzVkNSrQSmVYXdOAYBHUItgf%2Fdt5YgRqsuRIJ8BBXlcIRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01e70c8d56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/PortalPictures/april-2024/374506298_Sturgeon%20LS.jpg?imwidth=640 | 104.21.56.131 | 404 Not Found | 2.2 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/PortalPictures/april-2024/374506298_Sturgeon%20LS.jpg?imwidth=640 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (448) Hash4d4b45b1448344d0eabe6536f5861663 799853923873e6cc5bd769f314a86174c0524d97 b4a5054b74e35210b7bbb4748563573bf54f5dd535d7631ac84a7bd20a62af3d
GET /content/dam/PortalPictures/april-2024/374506298_Sturgeon%20LS.jpg?imwidth=640 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/html
cf-ray: 876e01affba456c0-OSL
cf-cache-status: BYPASS
vary: Accept-Encoding
x-ws-request-id: 662290f9_PSrdsdgemSTO1sw92_34579-44528
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NxQuwcHjWvequuPqQ2X4txS9PuPByhLuKDHAKgZ1Yx96uMDbni8p4mrj1gYgu2%2B6XfaCe1UWt0ZB%2FNZe5t0X13ojXKQAM%2FvswuHYVSDRjZbTEjUlXpR%2FMtHtn5t7TLOzGiA0gTR3dnbYYJofzu38%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/18/TELEMMGLPICT000374358738_17134307200730_trans_NvBQzQNjv4Bqm2gOvejiZNWnKEdp-xGW5FHwtdpQwyNje2OyIL7x97s.jpeg?imwidth=210 | 104.21.56.131 | 404 Not Found | 7.6 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/music/2024/04/18/TELEMMGLPICT000374358738_17134307200730_trans_NvBQzQNjv4Bqm2gOvejiZNWnKEdp-xGW5FHwtdpQwyNje2OyIL7x97s.jpeg?imwidth=210 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text Hashe5d60dcdad962bcdda2f09034cbcc2bd 37e9a1b33e5852337ee422d30896c1f586df7dae 2a1c1fb221816cea456cf003e8fd4e2c5f083895941cc6ebcf7cb478b207c20d
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/music/2024/04/18/TELEMMGLPICT000374358738_17134307200730_trans_NvBQzQNjv4Bqm2gOvejiZNWnKEdp-xGW5FHwtdpQwyNje2OyIL7x97s.jpeg?imwidth=210 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:53 GMT
content-type: text/html
cf-ray: 876e01c79ca356c0-OSL
cf-cache-status: BYPASS
set-cookie: bid=BX1ujh4iuRg; Expires=Sat, 19-Apr-25 15:42:53 GMT; Domain=.douban.com; Path=/
vary: Accept-Encoding
x-douban-newbid: BX1ujh4iuRg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yO0TsEOjkF5ufT0WvyczUKNPjnCTcRvBjGFJqixKJs1YCuP22JfgSKGUU%2FlpdlZnJsNFBsY0IWu9xYlEcr9%2BPcu34ZCrzH9Oz1POAzAX5NrzePvuJ4xvqxuhP%2FqHIsLKZSE3lZiXZybrN6gSWw4yFA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/news/2024/04/19/TELEMMGLPICT000374491307_17135234296700.jpeg?imwidth=640 | 104.21.56.131 | 522 No Reason Phrase | 7.1 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/news/2024/04/19/TELEMMGLPICT000374491307_17135234296700.jpeg?imwidth=640 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (460) Hash0bf6aaf76301481463042f739382cd7f a20306f4f4d26b6ded9cba0df50477da2bf9061c 997c3aa92e55e244cd70589cc10d02879e6660428544bcb668d6b68dc9863f8f
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/news/2024/04/19/TELEMMGLPICT000374491307_17135234296700.jpeg?imwidth=640 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 522 No Reason Phrase
date: Fri, 19 Apr 2024 15:43:02 GMT
content-type: text/html; charset=UTF-8
content-length: 7067
cf-ray: 876e01a29e9256c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L3WTCNezRA4CHR44OkG6%2FveLkpbh%2FIaR%2BzPGSdGBGCIVPVb2KdW8MNzYqHPh%2FsLJxrJRkGgB2v1qY%2BuIy9bGhNzvJ3QolIx%2FAaxEoiaPcPAzhagvKXy5B0Mmp71tpjARvHw2Qzm1EH%2FT5Nwx0al81g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/19/TELEMMGLPICT000374489242_17135277646070_trans_NvBQzQNjv4BqpVlberWd9EgFPZtcLiMQf0Rf_Wk3V23H2268P_XkPxc.jpeg?imwidth=320 | 104.21.56.131 | 520 No Reason Phrase | 40 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/19/TELEMMGLPICT000374489242_17135277646070_trans_NvBQzQNjv4BqpVlberWd9EgFPZtcLiMQf0Rf_Wk3V23H2268P_XkPxc.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash87d0d3084714f50c9fd3698577418b81 ffa9529505f0e566282ee0ba22225f5af5a1025e 9c037511f57888d5db5414d29521d419aa31f055e3fc9bf24b13905816e7316d
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/travel/2024/04/19/TELEMMGLPICT000374489242_17135277646070_trans_NvBQzQNjv4BqpVlberWd9EgFPZtcLiMQf0Rf_Wk3V23H2268P_XkPxc.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:43:02 GMT
content-type: text/plain;charset=UTF-8
content-length: 40
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8WW3hx1YagnMMniyD%2FlYyXOX93aUtXOm%2Bm9AbzEGWgLfu5OXbgbgRB9Oy%2F5u7VdxKyuYOx6o59%2BzLdkn0P9%2F261Uf3n3JS0QBoREOvErKn4bxzGqApKGXGeoYdGCtTy8g18IKbNHWfgJUX9G%2B1Vb2g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e0200ce6656c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2024/04/19/TELEMMGLPICT000332615754_17135310540660_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 43 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2024/04/19/TELEMMGLPICT000332615754_17135310540660_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hasha68af2301bc73ce47355aec64dbebca5 d96855d7c1fe8420b47a7eda6341e59ff4f001ce 9d55b37c646e6bb26e27154aeb5fd15edc1601465a033973b9d1ca107a49e120
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/health-fitness/2024/04/19/TELEMMGLPICT000332615754_17135310540660_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:43:03 GMT
content-type: text/plain;charset=UTF-8
content-length: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mW0P3jARBEyIitpBcQwbyoJgCc9UE9tREyzFg0wj92wNePhWBl0AIFrjy5uwkbllDfYz5dQgkNmm9vpty8LOvwHkklIfugEBsDgXuiWUDzI5DPf1liQPkxYki2IyjmqKgKoaXvmbRWgMkTIntGwqtA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e020acfca56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-b719fdf665c61f9440830226ea36eac9-lc.min..js | 104.21.56.131 | 405 Method Not Allowed | 7.1 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-b719fdf665c61f9440830226ea36eac9-lc.min..js IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (460) Hashd36fa21b15e73641d01b2770ffb7ebef 3fce88f61fdbd26b7f9fb87ec3f3d49d345ecc90 8d8fa38780a8f9c5caa09ca538b65ec04061d7266475bcc99e77c086a3adce17
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui.lc-b719fdf665c61f9440830226ea36eac9-lc.min..js HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 522 No Reason Phrase
date: Fri, 19 Apr 2024 15:43:04 GMT
content-type: text/html; charset=UTF-8
content-length: 7073
cf-ray: 876e01afcb6f56c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NxZjCbZmAj8bc06HahYbSOvr8tjC81XC8eB1n6LWwMPfirKB0CR5owbmQrSxW3aTrXFxgVLE6oLZA3AL0G4rNKkRv6e67VTiepOKYXulEXyFmEF8fmSLmAV96D%2BaII4IpliEAHj1kMVkA89BeX25oQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/tv/2024/04/17/TELEMMGLPICT000374155413_17133442440820_trans_NvBQzQNjv4BqaHd6X3lW3lGv45Ug3tlONZ3XVdg1rRzimPdm_Jg3Voo.jpeg?imwidth=210 | 104.21.56.131 | 404 Not Found | 34 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/tv/2024/04/17/TELEMMGLPICT000374155413_17133442440820_trans_NvBQzQNjv4BqaHd6X3lW3lGv45Ug3tlONZ3XVdg1rRzimPdm_Jg3Voo.jpeg?imwidth=210 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (57314) Hashdb90f37b3e4016c934d73cea779302ce 1586446248287fa98e05fa7f8346df6f31af4ff3 be51809cba2ce8fd46df097a78267969bef748efed0dc986c71da462a6c2f881
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/tv/2024/04/17/TELEMMGLPICT000374155413_17133442440820_trans_NvBQzQNjv4BqaHd6X3lW3lGv45Ug3tlONZ3XVdg1rRzimPdm_Jg3Voo.jpeg?imwidth=210 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:59 GMT
content-type: text/html; charset=utf-8
cf-ray: 876e01ed3b0656c0-OSL
cf-cache-status: MISS
vary: Accept-Encoding
access-control-expose-headers: x-a1-front-switch
p2sp_switch: on
p2spios_switch: on
pcdn_switch: on
x-a1-front-switch: on
x-a1-xdcs-collector-switch: on
x-award-error: eyJzdGF0dXMiOjQwNCwicm91dGVyRXJyb3IiOnRydWUsIl9fYXdhcmRfXyI6dHJ1ZSwiTm90Rm91bmQiOiIvY29udGVudC9kYW0vdHYvMjAyNC8wNC8xNy9URUxFTU1HTFBJQ1QwMDAzNzQxNTU0MTNfMTcxMzM0NDI0NDA4MjBfdHJhbnNfTnZCUXpRTmp2NEJxYUhkNlgzbFczbEd2NDVVZzN0bE9OWjNYVmRnMXJSemltUGRtX0pnM1Zvby5qcGVnIn0=
x-cache-lookup: Cache Miss, Cache Miss, Cache Miss, Cache Miss
x-cache-status: MISS
x-idc-gw: sh-bs@adse$1#xdcs-collector$1#mobile$10#mermaid$1
x-nws-log-uuid: 805649625994967949
x-powered-by: award 1.1.27
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jKWk92%2BN99k8hhtofWSW8qPjkPbKBAb1oDlsv2QtEv0JNR3SIMPQeS34w6edFSxAS13QZz%2BGNcpToem66BHG%2FiuHl2lWUddbMP7h%2F6cHR6hMG6ofM2vsDtSzozE%2FCd1n9LATM1e%2FBQi3%2F%2F5gzOkY%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| www.telegraph.co.uk/martech/js/TGT-2146--bonus-sub-homepage-puff/index.js | 2.18.174.13 | 200 OK | 6.9 kB |
URL GET HTTP/2www.telegraph.co.uk/martech/js/TGT-2146--bonus-sub-homepage-puff/index.js IP2.18.174.13:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (14994) Hashabbcb45e3ca95379dedb9f978c1f4111 2095cb4b7f7fb7a1e6edc364cf04e5eaed6e024b 35b57b3f1ac841f0766418097311fac1188b78135466911e363b93c316ea5318
GET /martech/js/TGT-2146--bonus-sub-homepage-puff/index.js HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 19 Apr 2024 12:16:59 GMT
etag: "abbcb45e3ca95379dedb9f978c1f4111"
x-goog-generation: 1713529019163254
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 20871
x-goog-meta-goog-reserved-file-mtime: 1713528957
content-type: text/javascript
x-goog-hash: crc32c=VEo7YQ==, md5=q7y0XjypU3ne25+XjB9BEQ==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-guploader-uploadid: ABPtcPovXTSL9ZZHkC59bNhM9ZReYgsEbRkFvyTKTjqiw-7yT-5M0hW6NmsQrdkK1BSEJ-DTevU
server: UploadServer
content-encoding: gzip
content-length: 6876
cache-control: public, max-age=37
expires: Fri, 19 Apr 2024 15:43:41 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
vary: Accept-Encoding
akamai-x-true-cache-ttl: 300
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| www.telegraph.co.uk/martech/js/TGT-1002--paywall-meters-profile/index.js | 2.18.174.13 | 200 OK | 1.2 kB |
URL GET HTTP/2www.telegraph.co.uk/martech/js/TGT-1002--paywall-meters-profile/index.js IP2.18.174.13:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (2831), with no line terminators Hash72256b347397812418a0f27b4500d446 e7bf738208a2dd1f3e4e3e2e526051c1c290be7b d8c2831972faeeed68ebffdafea25fb2d9f78dca0238dfa9b37b41e9286d70ad
GET /martech/js/TGT-1002--paywall-meters-profile/index.js HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
x-guploader-uploadid: ABPtcPqfX3ZhiofbWoC-0vD6eoLwxS4xMOkKdtQNjisJx18re5ub8shVsdNnYgUIrz6MgrMQvEN5PVPsGw
last-modified: Fri, 19 Apr 2024 12:16:59 GMT
etag: "72256b347397812418a0f27b4500d446"
x-goog-generation: 1713529019066182
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2831
x-goog-meta-goog-reserved-file-mtime: 1713528948
content-type: text/javascript
x-goog-hash: crc32c=710pHw==, md5=ciVrNHOXgSQYoPJ7RQDURg==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
server: UploadServer
content-encoding: gzip
content-length: 1214
cache-control: public, max-age=228
expires: Fri, 19 Apr 2024 15:46:52 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
vary: Accept-Encoding
akamai-x-true-cache-ttl: 300
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC5b23bcae5fb9431883474a5f2d31a825-source.min.js | 2.18.172.233 | 200 OK | 674 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC5b23bcae5fb9431883474a5f2d31a825-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeASCII text, with very long lines (1098) Hash96138c3af4dd04841dd37da647d40a4d 9d6596d287fc04e73ce4c8b24b87cb129a71a7ab 20e04a8386d6b6a6bace45b01a38e0633aef9be371b36cf4fc431a70992acfcf
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC5b23bcae5fb9431883474a5f2d31a825-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 674
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCf4201ec5a2fc4601bbebbe453fcead32-source.min.js | 2.18.172.233 | 200 OK | 1.5 kB |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCf4201ec5a2fc4601bbebbe453fcead32-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (4089) Hashc633f3ff4e71135ad4ce30266eb45f26 e586afe3ea9a829e4c349127337c944eee6bfe8d 4f22897c800e27f4a0ac0336c805d4141fb9cf560d6b5603516f3f4b1f52b7c8
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCf4201ec5a2fc4601bbebbe453fcead32-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1481
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC0392241e4a1a46c2a1c36fb86deca2dd-source.min.js | 2.18.172.233 | 200 OK | 858 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC0392241e4a1a46c2a1c36fb86deca2dd-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (1455) Hash7696a5d1123b2bc3e3fb580bc47da898 1459617703fd523a1ac76e4b067c520840ffcbb2 cee339f58ada6571399dc6e95d811fb362b8541b182d9f2ad10d96851fcec64c
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC0392241e4a1a46c2a1c36fb86deca2dd-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 858
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCc138c3393f56415ebf739ba7b8ecca91-source.min.js | 2.18.172.233 | 200 OK | 319 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCc138c3393f56415ebf739ba7b8ecca91-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeASCII text, with very long lines (362) Hash7e8b72893a3a82bbbe528f63e52c6340 59d5933aff7119640f0dba5c5a4259760ce20e27 2064da321acdc00930b230d86435aac0b9c5d32953ff170bb783280ecd4c1b1f
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCc138c3393f56415ebf739ba7b8ecca91-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 319
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| secure.telegraph.co.uk/customer/lib/tmgrefresh@v1.0.0/tmgrefresh.js | 184.86.2.245 | 200 OK | 2.3 kB |
URL GET HTTP/1.1secure.telegraph.co.uk/customer/lib/tmgrefresh@v1.0.0/tmgrefresh.js IP184.86.2.245:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectsecure.telegraph.co.uk Fingerprint23:AC:E5:52:2D:CA:5F:27:B0:E9:34:9F:35:0A:8D:9D:15:6C:32:8A ValidityWed, 07 Feb 2024 00:00:00 GMT - Thu, 06 Feb 2025 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (5577) Hash1412a9e95dd43669d8991b22467d954c 33adbed61994e43a502ae39b7425cdfc7cdcbfd4 bfe42c6dabf1af056e6e7945700398461896e3d89d69fbccdbeb45d78d49646e
GET /customer/lib/tmgrefresh@v1.0.0/tmgrefresh.js HTTP/1.1
Host: secure.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Last-Modified: Thu, 11 Apr 2024 05:33:31 GMT
ETag: "455b20998e6b19be768e78cd1eb4b6d1"
X-GUploader-UploadID: ABPtcPr3cp7YBK-H4nvt2KkZqiRgV-SQGk-SjSqpnM5NwxwyMjFRAApA5loIeZQTwPZweNx9H3iDz0A8fg
Vary: Accept-Encoding
x-goog-generation: 1712813611453139
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 2337
Content-Type: text/javascript
Content-Encoding: gzip
x-goog-hash: crc32c=Yj84sw==
x-goog-storage-class: MULTI_REGIONAL
Accept-Ranges: bytes
Content-Length: 2337
Server: UploadServer
Cache-Control: public, max-age=600
Expires: Fri, 19 Apr 2024 15:53:04 GMT
Date: Fri, 19 Apr 2024 15:43:04 GMT
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1713541384486_386095662_260687486_22_9413_8_0_-";dur=1
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC5e2dbb35c68847ddb3cb91be35b316bf-source.min.js | 2.18.172.233 | 200 OK | 814 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC5e2dbb35c68847ddb3cb91be35b316bf-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (2520) Hashe3cd9b574ddf90a99f78b57d9645b261 7b73ef30ab0ad1826be0e6b70a6bc7caffbb9daa 215b6fe719e351c41aa62d91d4cc79a5eb05e8c6b0f9709474e32be2180a086d
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC5e2dbb35c68847ddb3cb91be35b316bf-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 814
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC575f15ce13af4933b805b4f732675d4b-source.min.js | 2.18.172.233 | 200 OK | 410 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC575f15ce13af4933b805b4f732675d4b-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeASCII text, with very long lines (517) Hashd6938bb8bcae356023f62753aef02e3b 9b6b63cf6dbd73b72c51cc1a095f1ed03a7843da b507108af621d5e9256c9beead150c4faa61257a005e884442847af79396fb4a
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC575f15ce13af4933b805b4f732675d4b-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 410
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC0e837c2e8e5744eba1be15ebe9c787b5-source.min.js | 2.18.172.233 | 200 OK | 625 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC0e837c2e8e5744eba1be15ebe9c787b5-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (943) Hash428ed34908e4761776069240aa6c68a4 ef383d58e471ff080312458a5f860652c39702a9 8a79d2513a81cf5ca5b909ef1b4751fd2d205d4482c1c9b7af6e521afb9217ef
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC0e837c2e8e5744eba1be15ebe9c787b5-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 625
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC9b17c8d4d94f46beb2a10aabcdc02174-source.min.js | 2.18.172.233 | 200 OK | 469 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC9b17c8d4d94f46beb2a10aabcdc02174-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (585) Hashae0f1150a54bcdfa7a80409539e94c72 bfdf91cf192f6fba95ef6fc5d98518b1de5796f4 53a36a45d91d8cd70d773aa29de1e8108e4d1fb20d596e53f0d441ba4a7ce107
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC9b17c8d4d94f46beb2a10aabcdc02174-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 469
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCd54e9c42e0624ea0ad5b96782ea44321-source.min.js | 2.18.172.233 | 200 OK | 237 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCd54e9c42e0624ea0ad5b96782ea44321-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
Hash19110ff24787078f5d99e421fc2b6a51 e405a0b71d08146cd1ac1993358ed2062dce7052 103413a075ec613bcb8112c80bded23c1c116e06557a6841a5dfd745b4c1dd78
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RCd54e9c42e0624ea0ad5b96782ea44321-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 237
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC22e1dd49b68a467cb5e2673ac8ce95d8-source.min.js | 2.18.172.233 | 200 OK | 1.1 kB |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC22e1dd49b68a467cb5e2673ac8ce95d8-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeASCII text, with very long lines (2062) Hash48c7baf10233d95f5a01e56a39dafb04 5557d1a2a0adebda261a9f15078b0c5a8483b8b7 e53d9ca603d0ef8368f3a93917e9e04de9d5098d34d394601a14c671d195ccd0
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC22e1dd49b68a467cb5e2673ac8ce95d8-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1063
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC6ef3d60d6d364f88af53c8375835091a-source.min.js | 2.18.172.233 | 200 OK | 874 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC6ef3d60d6d364f88af53c8375835091a-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (1591) Hashd7ae24145743855310fc44cd4b4265e4 d84febb51a15683cc083907a1b66a771292da3c5 79e2d3974d963b35ae71c216fc417ffde6b94a72d6df01a92d62fb6ead201b14
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC6ef3d60d6d364f88af53c8375835091a-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 874
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC27ef2087a2bc41cb8883677d330507ff-source.min.js | 2.18.172.233 | 200 OK | 957 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC27ef2087a2bc41cb8883677d330507ff-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (1911) Hash1543c6f0a889b2296c0d941025bac615 5dbd91dc930adcde146c3abe079f9e0edea0795a a4f363e454caf0eb7ed8ce8bb2bdc060a6add620251933de37e75bbd23085d1e
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC27ef2087a2bc41cb8883677d330507ff-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 957
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC63265de272154d8fb98272bdb1827b13-source.min.js | 2.18.172.233 | 200 OK | 183 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC63265de272154d8fb98272bdb1827b13-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
Hash87405c198d7887898cb6a669d7294a7a 0c1087a9b7f3cf5d008ca45473241fb4466d4685 eff5dd043ba8494c8483cb2ceb81e3c0c2e80ffe570988d15bf57002aab8dbfb
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC63265de272154d8fb98272bdb1827b13-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 183
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC196522a11d1a4e678ce58e6416ecddf5-source.min.js | 2.18.172.233 | 200 OK | 912 B |
URL GET HTTP/2assets.adobedtm.com/bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC196522a11d1a4e678ce58e6416ecddf5-source.min.js IP2.18.172.233:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectassets.adobedtm.com Fingerprint8E:2F:9F:94:55:93:C2:B5:58:37:E8:D3:02:3C:23:AF:BA:E7:1D:EA ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (2020) Hash5befabcdd04d24f2529bdb92202629f3 3f6bfdb6aae985b7168559d59570a16185f30909 3bc6a2ada9c9085b67118c5bfc6572f2e1c17afb9f0d7f3d85653a774b427361
GET /bb77750356fd/42bfe6bcc850/3cc7ea0964b7/RC196522a11d1a4e678ce58e6416ecddf5-source.min.js HTTP/1.1
Host: assets.adobedtm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "4bbd5fda096628da958f3496cc16c8b6:1713182444.246905"
last-modified: Mon, 15 Apr 2024 12:00:44 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 912
cache-control: max-age=3600
expires: Fri, 19 Apr 2024 16:43:04 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
timing-allow-origin: *
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/UK-SVG.svg | 104.21.56.131 | 521 No Reason Phrase | 7.1 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/UK-SVG.svg IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (460) Hash5b70f3a1878b9a3c4ec9e37050c94e4b c173b195b749f5c64fff8f5baf3f638eddfd5d0b e47a810899a55d2077016ad8bba2fef79a78fd2b1311c389b7e87e887d5a7af4
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/images/flags/UK-SVG.svg HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 522 No Reason Phrase
date: Fri, 19 Apr 2024 15:43:04 GMT
content-type: text/html; charset=UTF-8
content-length: 7055
cf-ray: 876e01afdb7e56c0-OSL
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
vary: Accept-Encoding
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QIYqVtry6Z9rZXXaCUKceCbZ4oUqqLcKEy%2FzgIQF4qQ18QvE1VhYNWZw%2FJEfsTIWYfKumj8eOj96lnuDQbk2ZfMO4bpSbFnYpaE65ZIjWbFWoq78n3DTIGHe0dp0pkjLTGy4ZEt5G7Qi8AmaDCnlNw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| www.telegraph.co.uk/content/dam/generic/Matt-cartoon-255x206px-small.png?adCount=1 | 2.18.174.13 | 200 OK | 5.3 kB |
URL GET HTTP/2www.telegraph.co.uk/content/dam/generic/Matt-cartoon-255x206px-small.png?adCount=1 IP2.18.174.13:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 255x206, Scaling: [none]x[none], YUV color, decoders should clamp Hash0eebd89e2a9ee67d2d3506412c0aff1d 3acf1ad43024907e03fbf8b0fdbc41093b6fd615 c651e10b8f905e2fcf5d4969b88ae86cc2a5c247a67ddc36bd1ae3efc6e47067
GET /content/dam/generic/Matt-cartoon-255x206px-small.png?adCount=1 HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: no-transform, max-age=31536000
etag: "58b1-55ac2236c2b00"
last-modified: Wed, 12 Feb 2020 19:04:14 GMT
server: Akamai Image Manager
x-serial: 1944
x-check-cacheable: YES
content-length: 5286
content-type: image/webp
mpulse_cdn_cache: HIT
mpulse_origin_time: 0
date: Fri, 19 Apr 2024 15:43:04 GMT
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| utt.impactcdn.com/A2955910-0794-472c-9dd6-26997e004e2e1.js | 35.186.249.72 | 200 OK | 16 kB |
URL GET HTTP/2utt.impactcdn.com/A2955910-0794-472c-9dd6-26997e004e2e1.js IP35.186.249.72:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectutt.impactcdn.com Fingerprint76:28:91:59:28:AB:FD:C7:8E:C4:F0:C5:E1:E3:BF:DA:D3:97:6C:2B ValidityWed, 28 Feb 2024 17:49:44 GMT - Tue, 28 May 2024 18:43:17 GMT
File typeJavaScript source, ASCII text, with very long lines (37506) Hash86fdbcbbbdfa81aeb5bc69f783eb99f5 ee463475b02d58bea1d2494a0acadb5e3ec3e5b5 1b5d01ba587ae93120c68e690a59ce7ca5ca6c1bb334fe45ac9a70177bcdb9ce
GET /A2955910-0794-472c-9dd6-26997e004e2e1.js HTTP/1.1
Host: utt.impactcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-guploader-uploadid: ABPtcPoxxRoelQsTuOsGwd2bUMQt41TYrDcLUfovRJqPuko9dgYSBYShHMXj5oafip7GH5g0fA
x-goog-generation: 1711128558917649
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 15767
content-encoding: gzip
x-goog-hash: crc32c=7zeN7A==, md5=QZnzAhdsHPEDwfzeUixDpg==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
content-length: 15767
access-control-allow-origin: *
server: UploadServer
date: Fri, 19 Apr 2024 15:39:41 GMT
expires: Fri, 19 Apr 2024 15:44:41 GMT
cache-control: public,max-age=900,s-maxage=300
age: 203
last-modified: Fri, 22 Mar 2024 17:29:19 GMT
etag: "4199f302176c1cf103c1fcde522c43a6"
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| smetrics.telegraph.co.uk/id?d_visid_ver=4.5.2&d_fieldgroup=A&mcorgid=2C7336C753C676BA0A490D4B%40AdobeOrg&mid=54157590449425210053891010724880296810&ts=1713541384488 | 63.140.62.17 | 200 OK | 48 B |
URL GET HTTP/2smetrics.telegraph.co.uk/id?d_visid_ver=4.5.2&d_fieldgroup=A&mcorgid=2C7336C753C676BA0A490D4B%40AdobeOrg&mid=54157590449425210053891010724880296810&ts=1713541384488 IP63.140.62.17:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectsmetrics.telegraph.co.uk Fingerprint96:37:CA:27:58:A7:6B:0C:93:54:CD:8B:55:BC:D3:A4:5B:C6:57:24 ValidityMon, 17 Jul 2023 00:00:00 GMT - Fri, 16 Aug 2024 23:59:59 GMT
Hash4a86b96209313c5f0376c64d19192fd2 e78f1a587b21f6597ae90ae10121086c7cdc8b4b 6bf77ef190d44c55bbe90b5f65cee2cbab3a106bc4d362d54835d3fc69af75dc
GET /id?d_visid_ver=4.5.2&d_fieldgroup=A&mcorgid=2C7336C753C676BA0A490D4B%40AdobeOrg&mid=54157590449425210053891010724880296810&ts=1713541384488 HTTP/1.1
Host: smetrics.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: https://will76.g5gm64rpby.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
access-control-allow-credentials: true
date: Fri, 19 Apr 2024 15:43:04 GMT
p3p: CP="This is not a P3P policy"
server: jag
set-cookie: s_ecid=MCMID%7C54157590449425210053891010724880296810; Path=/; Domain=telegraph.co.uk; Max-Age=63072000; Expires=Sun, 19 Apr 2026 15:43:43 GMT; SameSite=Lax;
vary: Origin
content-type: application/x-javascript;charset=utf-8
content-length: 48
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
|
|
| cdn.privacy-mgmt.com/unified/wrapperMessagingWithoutDetection.js | 143.204.55.105 | 200 OK | 63 kB |
URL GET HTTP/2cdn.privacy-mgmt.com/unified/wrapperMessagingWithoutDetection.js IP143.204.55.105:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.privacy-mgmt.com Fingerprint83:29:3B:F8:B4:1D:36:97:DF:3A:13:FE:0A:B4:20:94:33:1E:FC:B3 ValiditySun, 08 Oct 2023 00:00:00 GMT - Tue, 05 Nov 2024 23:59:59 GMT
File typegzip compressed data, from Unix Hash7fbd883a6ff0001b61882bd467696f31 a1eefe1502bdd348ce3d66d4667e8a94f349face 8ed5d97bf646061727cf0f4d2cc3da24dee1de00947d9e54297d05f382be809d
GET /unified/wrapperMessagingWithoutDetection.js HTTP/1.1
Host: cdn.privacy-mgmt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript
last-modified: Thu, 18 Apr 2024 15:24:16 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 19 Apr 2024 15:24:57 GMT
cache-control: max-age=3600
etag: W/"0ec630abc0613ef647eb0f3fbaf57d34"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: HaJ5e0HlklTZuTwL5Imy9YOrNlnYj_bsNxes7U7g6pMbMCU-o-dbdQ==
age: 1088
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2024/04/19/TELEMMGLPICT000332615754_17135310540660_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 43 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2024/04/19/TELEMMGLPICT000332615754_17135310540660_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash191da67531bd94f34f70b22c7af60817 7b7a8d94c6021684f8d365ad58b56c2c3b5fb479 4cf4a95247a8229a15a7cabd62837431d81a1079eb77e6aaf4d3d3df5eb5e098
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/health-fitness/2024/04/19/TELEMMGLPICT000332615754_17135310540660_trans_NvBQzQNjv4BqRo0U4xU-30oDveS4pXV-Vv4Xpit_DMGvdp2n7FDd82k.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:43:05 GMT
content-type: text/plain;charset=UTF-8
content-length: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TZV0MBgVn%2BElHI2l5MpUOAxoznR2n8PN6naFbAtzfS3tLnZq%2FoJBOXsy4jzLSHBkCkRfmT8SZPrIoSBA32srkn5zu6JZ07Ibc9JTiv8h3LoZ3rgp06KAVu%2BK9xbDePmyK1UZYY%2BSGAArXn3HTfu5lA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e02110da156c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| cdn.privacy-mgmt.com/mms/v2/get_site_data?hasCsp=true&href=https%3A%2F%2Fwill76.g5gm64rpby.workers.dev%2F&account_id=191 | 143.204.55.105 | 400 Bad Request | 52 B |
URL GET HTTP/2cdn.privacy-mgmt.com/mms/v2/get_site_data?hasCsp=true&href=https%3A%2F%2Fwill76.g5gm64rpby.workers.dev%2F&account_id=191 IP143.204.55.105:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.privacy-mgmt.com Fingerprint83:29:3B:F8:B4:1D:36:97:DF:3A:13:FE:0A:B4:20:94:33:1E:FC:B3 ValiditySun, 08 Oct 2023 00:00:00 GMT - Tue, 05 Nov 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hashe38ad10f9081d41ecaef5dc7df025500 6d9a82f7c4a5e2cb58ca8158d52a968f43d715a6 0131e810d5b572b773120755aea52283b226173925308853aabc8e9107f6e273
GET /mms/v2/get_site_data?hasCsp=true&href=https%3A%2F%2Fwill76.g5gm64rpby.workers.dev%2F&account_id=191 HTTP/1.1
Host: cdn.privacy-mgmt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://will76.g5gm64rpby.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 400 Bad Request
content-type: application/javascript
date: Fri, 19 Apr 2024 15:43:04 GMT
access-control-allow-origin: *
access-control-allow-methods: GET
x-cache: Error from cloudfront
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: XBE06t3jFjq57Xj5-uuamLz3QYBe5chOH_UWCgTrPbNfWWqwqhcu1A==
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/food-and-drink/2022/05/06/TELEMMGLPICT000095893679_trans_NvBQzQNjv4Bqek9vKm18v_rkIPH9w2GMNpPHkRvugymKLtqq96r_VP8.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 1.2 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/food-and-drink/2022/05/06/TELEMMGLPICT000095893679_trans_NvBQzQNjv4Bqek9vKm18v_rkIPH9w2GMNpPHkRvugymKLtqq96r_VP8.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text Hashb88aab027111f9687cdcbedd26f7935a 67b78936db579145a6d42488d3f6003091bb79bb a89431cf6924e9e59c5844df55c0acbba787ad37e7d582d3bb18c37e9e789592
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/food-and-drink/2022/05/06/TELEMMGLPICT000095893679_trans_NvBQzQNjv4Bqek9vKm18v_rkIPH9w2GMNpPHkRvugymKLtqq96r_VP8.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:43:03 GMT
content-type: text/html
cf-ray: 876e020dca7856c0-OSL
cf-cache-status: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E16AhksnZ7t5A4bRUxoFUlZKGRzx82bFTrbXVUEMgBL5Tvj60hs%2FHABkuUgCfDnEpooTFzpQnM4%2FEexU5x7fhhf6IiEiCZDFTe3jko39R4UNU9cK7rs0A9yEQL%2BNBufY0m%2BDfk7HwNbrxM6gAE5tGw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| www.telegraph.co.uk/customer/lib/onetap.js | 2.18.174.13 | 200 OK | 2.2 kB |
URL GET HTTP/2www.telegraph.co.uk/customer/lib/onetap.js IP2.18.174.13:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeJavaScript source, ASCII text Hash199640824cf0ce6ed7b9109569b873a3 4a49a564c2b7204d77921ae1da0383a511dc013d edcce62f8db94151a484de491c6edfa250d314c19942d01bd36967084bb3c895
GET /customer/lib/onetap.js HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
x-guploader-uploadid: ABPtcPrZ_l1Xwwjgbzs70dkXA1zEZbz3aTR2yhfzmHLAfvJ2kLLYRt-OHjv7TcwijrgDD7YAvw
last-modified: Thu, 11 Apr 2024 05:33:31 GMT
etag: "5d0650b06f1f92ad5f9587060f50589b"
x-goog-generation: 1712813611390551
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 2236
content-type: text/javascript
content-encoding: gzip
x-goog-hash: crc32c=o2xQmA==, md5=XQZQsG8fkq1flYcGD1BYmw==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
content-length: 2236
server: UploadServer
cache-control: public, max-age=80
expires: Fri, 19 Apr 2024 15:44:27 GMT
date: Fri, 19 Apr 2024 15:43:07 GMT
vary: Accept-Encoding
akamai-x-true-cache-ttl: 900
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| www.telegraph.co.uk/customer/lib/tmguser@v1.0.0/tmguser.js | 2.18.174.13 | 200 OK | 8.5 kB |
URL GET HTTP/2www.telegraph.co.uk/customer/lib/tmguser@v1.0.0/tmguser.js IP2.18.174.13:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (27579) Hash2e5e8c4f31269eff50e187c547a6745c efcbe21d8d11d1e6627ef98e7b7f3fdfb77a2b42 26d1c3e28926b78964c3fb5ad0a8b334dea27e9683eb5c8950eab504c63d7ff1
GET /customer/lib/tmguser@v1.0.0/tmguser.js HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
x-guploader-uploadid: ABPtcPrbIBdfUKza_sGVO_n1relF2ZwLdAdhCFk9m9TmpewtsGgIq_swnc8SmLqFBrbxe4pfATo
last-modified: Thu, 11 Apr 2024 05:33:31 GMT
etag: "a8371588dd1f7be9c2639013782b2a1b"
x-goog-generation: 1712813611501375
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 8450
content-type: text/javascript
content-encoding: gzip
x-goog-hash: crc32c=//i2cA==, md5=qDcViN0fe+nCY5ATeCsqGw==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
content-length: 8450
server: UploadServer
cache-control: public, max-age=672
expires: Fri, 19 Apr 2024 15:54:19 GMT
date: Fri, 19 Apr 2024 15:43:07 GMT
vary: Accept-Encoding
akamai-x-true-cache-ttl: 900
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/core/resources/icons/favicon.svg | 104.21.56.131 | 403 Forbidden | 44 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/core/resources/icons/favicon.svg IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash2386017cab459c7f7658524d8a4747cd 60b59df562b3bc393c2f282421f20c44e4f038a7 0d12a27253dfda80192317f0e509a6deadcdd7d21fd3c139fabb7b8b9cfce39a
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/core/resources/icons/favicon.svg HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2; AMCV_2C7336C753C676BA0A490D4B%40AdobeOrg=-432600572%7CMCIDTS%7C19833%7CMCMID%7C54157590449425210053891010724880296810%7CMCAID%7CNONE%7CMCOPTOUT-1713548584s%7CNONE%7CvVersion%7C4.5.2; _topp=1713541384373; AMCVS_2C7336C753C676BA0A490D4B%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:43:07 GMT
content-type: text/plain;charset=UTF-8
content-length: 44
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YkfQqXVEI3cJXMOt9C%2B1VhAI6yo4y2yqJAf784bammXPyk2LS3kt11xJPWLCr2v6Tv6SYS85Teo%2FQj%2BCQfK9d1aLXKUMxfJstOF8fIr6HPyFh%2FM3SdGRmCodTZBZtJ0LpZU3WIEQ9X3iBgQQwXLYEA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e0220af8956c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/utility-bar/Money%20-%20UTILITY%20BAR%201.png?impolicy=utilities-thumbnail | 104.21.56.131 | 404 Not Found | 2.3 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/utility-bar/Money%20-%20UTILITY%20BAR%201.png?impolicy=utilities-thumbnail IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text Hashb88aab027111f9687cdcbedd26f7935a 67b78936db579145a6d42488d3f6003091bb79bb a89431cf6924e9e59c5844df55c0acbba787ad37e7d582d3bb18c37e9e789592
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/utility-bar/Money%20-%20UTILITY%20BAR%201.png?impolicy=utilities-thumbnail HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/html
cf-ray: 876e01b0bc8e56c0-OSL
cf-cache-status: MISS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2BJ%2BmPvyyZWQle8QBlqAMvWe5jIfiu0QCtdD6%2FM3ozWsOunAFcqD3veNeiOl8mXlo5k0Ygkcm%2F94EJcaPnbgI96LSOlrH3x1nl8bpCC1ndUcs3Thb80n7tZAEqO108RzeglAVzKwO%2Buc7pAgjuUJMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/food-and-drink/2024/04/11/TELEMMGLPICT000373559587_17128480121930_trans_NvBQzQNjv4BqALc_t5KjuK6SvfNY518gx-S6A9DCI5UtlOIUnS59YHo.jpeg?imwidth=320 | 104.21.56.131 | | 43 B |
URL GET will76.g5gm64rpby.workers.dev/content/dam/food-and-drink/2024/04/11/TELEMMGLPICT000373559587_17128480121930_trans_NvBQzQNjv4BqALc_t5KjuK6SvfNY518gx-S6A9DCI5UtlOIUnS59YHo.jpeg?imwidth=320 IP104.21.56.131:0
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash191da67531bd94f34f70b22c7af60817 7b7a8d94c6021684f8d365ad58b56c2c3b5fb479 4cf4a95247a8229a15a7cabd62837431d81a1079eb77e6aaf4d3d3df5eb5e098
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/food-and-drink/2024/04/11/TELEMMGLPICT000373559587_17128480121930_trans_NvBQzQNjv4BqALc_t5KjuK6SvfNY518gx-S6A9DCI5UtlOIUnS59YHo.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2; AMCV_2C7336C753C676BA0A490D4B%40AdobeOrg=-432600572%7CMCIDTS%7C19833%7CMCMID%7C54157590449425210053891010724880296810%7CMCAID%7CNONE%7CMCOPTOUT-1713548584s%7CNONE%7CvVersion%7C4.5.2; _topp=1713541384373; AMCVS_2C7336C753C676BA0A490D4B%40AdobeOrg=1; x-waf-captcha-referer=https%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dedtunnel; eng_k55_id=015103
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:43:09 GMT
content-type: text/plain;charset=UTF-8
content-length: 43
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZV%2FeM7W2x3vbxJ3UAMCjIZBneY8Msq8dYlAJXP1IhCT1wP023GuExkuWI%2FL8SKFhRKzosWGzFAAXaXvK7v2ptCKs5gsFsFpM%2BJRaxjHp5dT07ycRNjAeAuJdbde4%2FCEp0L8qdpblRwCwpZuuw6CDA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e022d2bec56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 2.3 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with very long lines (2513), with no line terminators Hash9985a0059bd1b765bfd4a0891ec16fe6 ae5b7639635ec706807d0307359e5b7c14f9f15a 8ed095c733f0b55dfd8dd2b8d8432472de559750530d2a493cf455d4c4df0629
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:43:03 GMT
content-type: text/html
cf-ray: 876e020d5a1656c0-OSL
cf-cache-status: BYPASS
vary: Accept-Encoding
x-ws-request-id: 66229107_PSrdsdgemSTO1sw92_34310-33272
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kna1hR23zBtRO8gjD7%2FXFsmkkdSOXoZiRrn2rNodYFKxU6CpLFlul9zksCN4PsMKcAcoiQcmYp6vfwmdr4vsJAtyKvtX1%2B4T7TwxcMHcqWAriG4khBE5an2gkBTP%2F%2BayFGCXNmUhE6hDNN0gDGU%2BbA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cf.eip.telegraph.co.uk/visuals-cms/particles/embed/public-assets/css/0.0.2.css | 35.190.33.26 | 200 OK | 44 B |
URL GET HTTP/3cf.eip.telegraph.co.uk/visuals-cms/particles/embed/public-assets/css/0.0.2.css IP35.190.33.26:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeASCII text, with no line terminators Hash28931179ff38f4245b0320f271e9308b 223806ba5ca7aab980f97297d621a8ff7d10215e 2810d41924b9881a5892a6d85f0f1393b9a0cc817c7f4ef0fcc08ae293bc865f
GET /visuals-cms/particles/embed/public-assets/css/0.0.2.css HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
x-amz-id-2: G0Zx1TXNjiphVYq2aj++yYBj9WMTNq/CsO0p0i/xiXIozmmzJpOq7JCYcuUVt8EpnRNCPvGx+UU=
x-amz-request-id: P44KKK4M68XE89X9
server: AmazonS3
content-length: 44
via: 1.1 google
date: Fri, 19 Apr 2024 15:39:24 GMT
age: 204
last-modified: Tue, 16 Apr 2024 13:29:04 GMT
etag: "7d08b58878004ea1dfd0ef3cea3498b8"
content-type: text/css
cache-control: public,max-age=25,s-maxage=300,must-revalidate,proxy-revalidate
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.telegraph.co.uk/martech/js/TGT-256--google-one-tap-library/index.js | 2.18.174.13 | 200 OK | 78 kB |
URL GET HTTP/2www.telegraph.co.uk/martech/js/TGT-256--google-one-tap-library/index.js IP2.18.174.13:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /martech/js/TGT-256--google-one-tap-library/index.js HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-guploader-uploadid: ABPtcPqdE-4QkX-yezQYOLHj0kXoPwXdveZgHi6tCx0AU3eZVnbL-1ylZQJ_DNwDb6C00dQrgFgx5VAU8w
last-modified: Fri, 19 Apr 2024 12:16:58 GMT
etag: "c675b0a4926ed4bc6f0ec5120aaf991a"
x-goog-generation: 1713529018286384
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 78362
x-goog-meta-goog-reserved-file-mtime: 1713528961
content-type: text/javascript
x-goog-hash: crc32c=R8ieUw==, md5=xnWwpJJu1LxvDsUSCq+ZGg==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
server: UploadServer
content-encoding: gzip
content-length: 20646
cache-control: public, max-age=190
expires: Fri, 19 Apr 2024 15:46:14 GMT
date: Fri, 19 Apr 2024 15:43:04 GMT
vary: Accept-Encoding
akamai-x-true-cache-ttl: 300
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| cdn.privacy-mgmt.com/wrapper/metrics/v1/custom-metrics | 143.204.55.105 | 200 OK | 2 B |
URL POST HTTP/2cdn.privacy-mgmt.com/wrapper/metrics/v1/custom-metrics IP143.204.55.105:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.privacy-mgmt.com Fingerprint83:29:3B:F8:B4:1D:36:97:DF:3A:13:FE:0A:B4:20:94:33:1E:FC:B3 ValiditySun, 08 Oct 2023 00:00:00 GMT - Tue, 05 Nov 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hashe0aa021e21dddbd6d8cecec71e9cf564 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
POST /wrapper/metrics/v1/custom-metrics HTTP/1.1
Host: cdn.privacy-mgmt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://will76.g5gm64rpby.workers.dev/
Content-Type: application/json
Content-Length: 149
Origin: https://will76.g5gm64rpby.workers.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/plain; charset=utf-8
content-length: 2
date: Fri, 19 Apr 2024 15:43:05 GMT
x-powered-by: Express
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, SP_SCRIPT_VERSION
access-control-allow-methods: GET, PUT, POST, DELETE
cache-control: no-cache, no-store
strict-transport-security: max-age=15552000; includeSubDomains
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: KLW52TPr9O0Ok9hXwRhm0BgFRg4-nT7UKhSxwg35q7HTqBdJAre0JQ==
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=640 | 104.21.56.131 | 404 Not Found | 4.9 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=640 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (5122), with no line terminators Hash752597750ffb3afccbf53aaee7e10236 0f3b1fddf0fe1413d4f54a1e366578ba374fdf5d b2a415f892b08e9a7da3fa98f4cc14698fae274639eee51622606eeb4d877b28
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=640 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/html
cf-ray: 876e01a2aead56c0-OSL
cf-cache-status: BYPASS
set-cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2;path=/;HttpOnly;Max-Age=1800
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FqmOSbvoDrs4DQ3PGgox8rO59LDqQ7QD3QREWwonIu95eON4vxZ7wMZVpiOTTjz5RdC3TKzGRUgQD7opQW2mNXEDyaIQwKAeZM89IFKYPE%2BX%2BbldmeaY0KzVgO9KrDBCsXRs5ZuKSsDCaMqR2pL3oQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/films/2024/04/18/TELEMMGLPICT000339190835_17134358845690_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwZ-noePaJta23NuHfKFFEj8.jpeg?imwidth=210 | 104.21.56.131 | 403 Forbidden | 345 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/films/2024/04/18/TELEMMGLPICT000339190835_17134358845690_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwZ-noePaJta23NuHfKFFEj8.jpeg?imwidth=210 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeXML document, ASCII text, with very long lines (370), with no line terminators Hashcd7dac750986bd02f32e960fef46390a ea7fdb13b6ca5c359e09761e46c9090126297fe4 e4a0573edb0e285d079127b2384ece71a1bca0b888b63b4568378724c4c71fb4
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/films/2024/04/18/TELEMMGLPICT000339190835_17134358845690_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwZ-noePaJta23NuHfKFFEj8.jpeg?imwidth=210 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:48 GMT
content-type: text/html
cf-ray: 876e01b0cc9956c0-OSL
cf-cache-status: BYPASS
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1KctJvkoTqq2JIXOwvv3RslSU8vcr%2F5qdhjo%2FbWE9WFKn5AV2N0J7MZxAk76IWqHnNBKECMYocgTCH7hbj7du7v9LEy15e5ROrU7%2B0HgGVQHWD6OS6M7ieqmIQUGN60skCJBVLUOvJBrSesrFCkDhw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 | 143.204.55.11 | 200 OK | 0 B |
URL HEAD HTTP/2cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 IP143.204.55.11:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
HEAD /14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://will76.g5gm64rpby.workers.dev/
Origin: https://will76.g5gm64rpby.workers.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
date: Fri, 19 Apr 2024 15:42:49 GMT
last-modified: Fri, 22 Dec 2023 16:30:41 GMT
etag: W/"2bacfa48a00de88a0e1566845c440e30"
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: mFKnr3TIDMl6dXheXxKlkiio0Mvv2Cllfyg3ZnP1zNh7QDIMSbp1Ag==
cache-control: max-age=60,must-revalidate
x-robots-tag: googlebot:noindex,indexifembedded
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/Telesans-Text-Web-Regular.woff2 | 104.21.56.131 | 404 Not Found | 49 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/Telesans-Text-Web-Regular.woff2 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/ui/dist/static/resources/fonts/Telesans-Text-Web-Regular.woff2 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://will76.g5gm64rpby.workers.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:50 GMT
content-type: text/html; charset=gbk
cf-ray: 876e01a26e5056c0-OSL
cf-cache-status: MISS
cache-control: max-age=60, must-revalidate
expires: Fri, 19 Apr 2024 15:43:50 GMT
last-modified: Fri, 19 Apr 2024 15:42:50 GMT
vary: Accept-Encoding
via: http/1.1 zats (zats3-2 [cSsSfU])
pragma: public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HUwDQeU3NpLzEgu5QWwA2W8Yl2SaHvqQlhfJBRVVR%2Bji6j7grmGvrxKS80Z2m04jy%2F23SMiA%2BdZLk8mheOcMVak2jtJxWFQpUmYYjW6BojvEn6Rv%2B0kbytkg%2BzFqA7Wugyqg1QcOCl%2F5UEnQYkMATg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| accounts.google.com/gsi/client | 173.194.222.84 | 200 OK | 224 kB |
URL GET HTTP/2accounts.google.com/gsi/client IP173.194.222.84:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectaccounts.google.com FingerprintCC:CB:DD:14:30:B0:75:6A:EE:1D:20:F1:9E:C5:DD:5F:DD:68:4F:7B ValidityMon, 18 Mar 2024 20:38:53 GMT - Mon, 10 Jun 2024 20:38:52 GMT
File typeJavaScript source, ASCII text, with very long lines (2899) Size224 kB (223694 bytes) Hash7db2f3e932b703808929cf6fe7ac6d96 6d8855f7f5b31dde4cc7739a2475afbf313b4121 10d875c270ce2f5b1eaedd4f4a51a7177d65df51cbfea927f27431baa31553e5
GET /gsi/client HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
expires: Fri, 19 Apr 2024 15:43:07 GMT
date: Fri, 19 Apr 2024 15:43:07 GMT
cache-control: private, max-age=1800
content-security-policy: script-src 'nonce-nBftlQ0sgaHlZpkUHrQ2Ng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/books/2024/04/12/TELEMMGLPICT000372793816_17129289193450_trans_NvBQzQNjv4Bq3zYIPTPO0g1eaGwuB2PsGvm7QWKCPdnz7LBnrDH2Qb4.jpeg?imwidth=320 | 104.21.56.131 | 404 Not Found | 1.7 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/books/2024/04/12/TELEMMGLPICT000372793816_17129289193450_trans_NvBQzQNjv4Bq3zYIPTPO0g1eaGwuB2PsGvm7QWKCPdnz7LBnrDH2Qb4.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1705), with no line terminators Hash3ee424b7ab93e5aac1abf9191a7ee83d 5cddb8cae234915592c342b127e2213a7abb516e d069cfd29f033bef91c6fb2bf1f53304bf548c28f3a0b209aaee5e1cb5402da9
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/books/2024/04/12/TELEMMGLPICT000372793816_17129289193450_trans_NvBQzQNjv4Bq3zYIPTPO0g1eaGwuB2PsGvm7QWKCPdnz7LBnrDH2Qb4.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2; AMCV_2C7336C753C676BA0A490D4B%40AdobeOrg=-432600572%7CMCIDTS%7C19833%7CMCMID%7C54157590449425210053891010724880296810%7CMCAID%7CNONE%7CMCOPTOUT-1713548584s%7CNONE%7CvVersion%7C4.5.2; _topp=1713541384373; AMCVS_2C7336C753C676BA0A490D4B%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:43:05 GMT
content-type: text/html; charset=UTF-8
cf-ray: 876e02185e7056c0-OSL
cf-cache-status: MISS
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
referrer-policy: no-referrer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YMw0OjADBAYp3hhEjUYq23y79L0cc%2BYUxxAgCBiNo7ClCCwSQQTtZqcOuN0P1i5DVoAchksK38XQyiW5DzKrDhT2VUbpFKtIj51oD2zEQmreMVUaz0fb56l501H8nbrzyAaIOfSV3Fe9FsRTCSPAvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
|
|
| cf-particle-html.eip.telegraph.co.uk/data-source/3875c873-ac7b-4bd6-a602-b997143086e4.json | 143.204.55.11 | 200 OK | 5.4 kB |
URL GET HTTP/2cf-particle-html.eip.telegraph.co.uk/data-source/3875c873-ac7b-4bd6-a602-b997143086e4.json IP143.204.55.11:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
File typeUnicode text, UTF-8 text, with very long lines (5973), with no line terminators Hash2679532d3ad48956f93b491c5ff99f56 b4fd21e8839b2536d06858d30a20078c80b240a2 4b181444d8e8078f2e404c7a6c9630960910159c66276993d6d90a6efc5be4df
GET /data-source/3875c873-ac7b-4bd6-a602-b997143086e4.json HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/json
last-modified: Fri, 17 Nov 2023 15:32:12 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 19 Apr 2024 15:37:47 GMT
cache-control: max-age=300,s-maxage=30,must-revalidate,proxy-revalidate
etag: W/"4dd175a6305a3335f487a7d307c3792e"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: UZuFyyLEyBLUCpFILqKS2-Z0Hx_oWx4aHWMbhWf2wR5BDmJ-_PSIwg==
age: 313
x-robots-tag: googlebot:noindex,indexifembedded
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
|
|
| cf.eip.telegraph.co.uk/store/img-media/501b545b-5d5a-4d15-bd1c-e6d14f67d75b/501b545b-5d5a-4d15-bd1c-e6d14f67d75b-original.svg | 0.0.0.0 | | 0 B |
URL GET cf.eip.telegraph.co.uk/store/img-media/501b545b-5d5a-4d15-bd1c-e6d14f67d75b/501b545b-5d5a-4d15-bd1c-e6d14f67d75b-original.svg IP0.0.0.0:0
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /store/img-media/501b545b-5d5a-4d15-bd1c-e6d14f67d75b/501b545b-5d5a-4d15-bd1c-e6d14f67d75b-original.svg HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| will76.g5gm64rpby.workers.dev/content/dam/fashion/2024/04/19/TELEMMGLPICT000374389715_17135349363340_trans_NvBQzQNjv4BqoypYBdBXGN-bZ0zyPjpGiDXaG_3FkRG2WH2SGzlVXbs.jpeg?imwidth=320 | 104.21.56.131 | 202 Accepted | 209 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/fashion/2024/04/19/TELEMMGLPICT000374389715_17135349363340_trans_NvBQzQNjv4BqoypYBdBXGN-bZ0zyPjpGiDXaG_3FkRG2WH2SGzlVXbs.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with no line terminators Hashd88faa19633c76a9f661b3d9bc878c76 27dff72196f73c059c873658f3436c6531f80693 f831a36e69d83f92800767957dd2f0bbb23ac1d0c8721cd98c82a44d0ec2372f
GET /content/dam/fashion/2024/04/19/TELEMMGLPICT000374389715_17135349363340_trans_NvBQzQNjv4BqoypYBdBXGN-bZ0zyPjpGiDXaG_3FkRG2WH2SGzlVXbs.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 202 Accepted
date: Fri, 19 Apr 2024 15:43:07 GMT
content-type: text/html; charset=utf-8
cf-ray: 876e01dfad5d56c0-OSL
cf-cache-status: BYPASS
cache-control: no-store
set-cookie: x-waf-captcha-referer=https%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dedtunnel; Path=/; Max-Age=60;
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
pragma: no-cache
x-cache-lookup: Cache Miss
x-nws-log-uuid: 6723705223665367979
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9DHeBt4PART5%2FW5cFqGySPwWUVLHoHs6uU9d0kNzULCnbpLujutlYdguMLMLSm24X56%2FgRNZ%2B%2F%2FxmyZRFugXPdjyeskCwmvFFQrXDmU60tw%2FDVgZvr1mCc0e0x80fAKwXMZ6AJ44J4Kxl%2BV0Wl3W4g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/fashion/2024/04/19/TELEMMGLPICT000374389715_17135349363340_trans_NvBQzQNjv4BqoypYBdBXGN-bZ0zyPjpGiDXaG_3FkRG2WH2SGzlVXbs.jpeg?imwidth=320 | 0.0.0.0 | | 0 B |
URL GET will76.g5gm64rpby.workers.dev/content/dam/fashion/2024/04/19/TELEMMGLPICT000374389715_17135349363340_trans_NvBQzQNjv4BqoypYBdBXGN-bZ0zyPjpGiDXaG_3FkRG2WH2SGzlVXbs.jpeg?imwidth=320 IP0.0.0.0:0
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /content/dam/fashion/2024/04/19/TELEMMGLPICT000374389715_17135349363340_trans_NvBQzQNjv4BqoypYBdBXGN-bZ0zyPjpGiDXaG_3FkRG2WH2SGzlVXbs.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2; AMCV_2C7336C753C676BA0A490D4B%40AdobeOrg=-432600572%7CMCIDTS%7C19833%7CMCMID%7C54157590449425210053891010724880296810%7CMCAID%7CNONE%7CMCOPTOUT-1713548584s%7CNONE%7CvVersion%7C4.5.2; _topp=1713541384373; AMCVS_2C7336C753C676BA0A490D4B%40AdobeOrg=1; x-waf-captcha-referer=https%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dedtunnel
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
|
|
| cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7/css/homePageRendererHTML.css | 143.204.55.11 | 200 OK | 3.3 kB |
URL GET HTTP/2cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7/css/homePageRendererHTML.css IP143.204.55.11:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
File typeASCII text, with very long lines (3287), with no line terminators Hash646c74a1f760a7627a521d7a41db611b 1633df6072203c374125f099b367a53458dcfbd2 ca7b2fe892a4fcbd831393c6c5f92c873a506cb38d3dec88be4d8dee0c84c161
GET /14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7/css/homePageRendererHTML.css HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
last-modified: Fri, 22 Dec 2023 16:31:01 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 19 Apr 2024 15:37:30 GMT
cache-control: max-age=30,s-maxage=30,must-revalidate
etag: W/"646c74a1f760a7627a521d7a41db611b"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: U2Weq8Od38s3Jf8m05MpVpOG6UFh9jo4K6AwycpCpUL3VQfdnG-lMQ==
age: 319
x-robots-tag: googlebot:noindex,indexifembedded
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
|
|
| cf.eip.telegraph.co.uk/store/img-media/7b02d03c-d69c-49e5-9c3e-5c98d6fc10f1/7b02d03c-d69c-49e5-9c3e-5c98d6fc10f1-original.svg | 0.0.0.0 | | 0 B |
URL GET cf.eip.telegraph.co.uk/store/img-media/7b02d03c-d69c-49e5-9c3e-5c98d6fc10f1/7b02d03c-d69c-49e5-9c3e-5c98d6fc10f1-original.svg IP0.0.0.0:0
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /store/img-media/7b02d03c-d69c-49e5-9c3e-5c98d6fc10f1/7b02d03c-d69c-49e5-9c3e-5c98d6fc10f1-original.svg HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2023/06/16/TELEMMGLPICT000339540092_16869168700310_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 | 0.0.0.0 | | 0 B |
URL GET will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2023/06/16/TELEMMGLPICT000339540092_16869168700310_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 IP0.0.0.0:0
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/health-fitness/2023/06/16/TELEMMGLPICT000339540092_16869168700310_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
|
|
| accounts.google.com/gsi/style | 173.194.222.84 | 200 OK | 530 B |
URL GET HTTP/2accounts.google.com/gsi/style IP173.194.222.84:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectaccounts.google.com FingerprintCC:CB:DD:14:30:B0:75:6A:EE:1D:20:F1:9E:C5:DD:5F:DD:68:4F:7B ValidityMon, 18 Mar 2024 20:38:53 GMT - Mon, 10 Jun 2024 20:38:52 GMT
File typeASCII text, with very long lines (530), with no line terminators Hash6ce3c682ce6b9e0b88670395a63345c8 8cbfc0856a52320e3567792dfe2487748ac07458 524f1ea2ac242c6fae3c1cc52c7ae7d05a8a7db466fe3c7b46e8efcfc2d95e53
GET /gsi/style HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
expires: Fri, 19 Apr 2024 15:43:07 GMT
date: Fri, 19 Apr 2024 15:43:07 GMT
cache-control: private, max-age=86400
content-security-policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'nonce-SMstBL6IxnDhsDKyxaSkNw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdn.polyfill.io/v3/polyfill.min.js?flags=gated&features=default,fetch,IntersectionObserver,NodeList.prototype.forEach,Array.prototype.@@iterator&Array.prototype.includes&Array.prototype.find&callback=tmg.polyfill.complete | 104.18.53.237 | 200 OK | 174 B |
URL GET HTTP/2cdn.polyfill.io/v3/polyfill.min.js?flags=gated&features=default,fetch,IntersectionObserver,NodeList.prototype.forEach,Array.prototype.@@iterator&Array.prototype.includes&Array.prototype.find&callback=tmg.polyfill.complete IP104.18.53.237:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerSectigo Limited Subject*.polyfill.io Fingerprint19:AA:59:2F:D9:8A:C1:48:99:20:3C:64:45:4E:E5:A6:1D:E4:92:0C ValidityTue, 20 Feb 2024 00:00:00 GMT - Wed, 19 Feb 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with no line terminators Hash159d8bc155d100ec420f1610d224d54e 95aa65840e95f9ad518b5501eca59f917cd5ddc7 d1d4dad95f6ae074bad9fb9e480b19692fa917b0870776d58d763b332a3de61d
GET /v3/polyfill.min.js?flags=gated&features=default,fetch,IntersectionObserver,NodeList.prototype.forEach,Array.prototype.@@iterator&Array.prototype.includes&Array.prototype.find&callback=tmg.polyfill.complete HTTP/1.1
Host: cdn.polyfill.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 19 Apr 2024 15:42:46 GMT
content-type: text/javascript; charset=utf-8
cf-ray: 876e01a28df60b59-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: public, max-age=14400
content-encoding: gzip
expires: Fri, 19 Apr 2024 19:42:46 GMT
last-modified: Fri, 19 Apr 2024 15:42:46 GMT
vary: Accept-Encoding, User-Agent
access-control-allow-methods: GET,HEAD,OPTIONS
server: cloudflare
X-Firefox-Spdy: h2
|
|
| cf.eip.telegraph.co.uk/store/bin-media/55f5d901-249d-4ccb-b59e-8f265243c9b1/55f5d901-249d-4ccb-b59e-8f265243c9b1-original.js | 35.190.33.26 | 200 OK | 10 kB |
URL GET HTTP/3cf.eip.telegraph.co.uk/store/bin-media/55f5d901-249d-4ccb-b59e-8f265243c9b1/55f5d901-249d-4ccb-b59e-8f265243c9b1-original.js IP35.190.33.26:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeJavaScript source, ASCII text, with very long lines (5911) Hash5e73ee56e1e3d3f19c93c763580aa159 2e8c8b93666972b567406757a087657ef06a8e5d 07aa0fc88ccd05c762755c8e40aebbf613344bf526ea378aef72fd1750410a55
GET /store/bin-media/55f5d901-249d-4ccb-b59e-8f265243c9b1/55f5d901-249d-4ccb-b59e-8f265243c9b1-original.js HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://cf-particle-html.eip.telegraph.co.uk
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
x-amz-id-2: SBeo4zmXA+JlJ6KWcQHH/m7t1W/iVDa1Uzv6F2ef78xgnpqxTBRY2TQkSK5DkE6ynOUSaFyK3aQ=
x-amz-request-id: G1X9E0P87RCDTW2D
date: Fri, 19 Apr 2024 15:42:49 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
access-control-expose-headers: x-amz-meta-tmg-crypt, x-amz-meta-tmg-crypt-vec
access-control-max-age: 31536000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method,Accept-Encoding
last-modified: Fri, 22 Sep 2023 09:54:27 GMT
etag: W/"5e73ee56e1e3d3f19c93c763580aa159"
content-type: application/x-javascript
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
gcp-cache: miss
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| cf.eip.telegraph.co.uk/assets/_css/doricv01.css | 35.190.33.26 | 200 OK | 4.8 kB |
URL GET HTTP/3cf.eip.telegraph.co.uk/assets/_css/doricv01.css IP35.190.33.26:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
File typeASCII text, with very long lines (5018), with no line terminators Hash70ded8d8a4e4f6e2d6f8f27f1377a65c d0c85a539b75f5f9bb2edbe04031ee669019c621 0a5bcfd4843f66fefd9a56227fbf8ed8020abb58f746da0160fa495fc74f0307
GET /assets/_css/doricv01.css HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
x-amz-id-2: FUtVYKsLk8pcghwKMnJrgd35DGkVpGXaimQZwkI5qIWuGKl6iC0foaknx1C4s4c1RgM14IYp9W8=
x-amz-request-id: 0QWMBPES6TX813FY
server: AmazonS3
via: 1.1 google
content-encoding: br
accept-ranges: none
content-length: 598
date: Sun, 31 Mar 2024 19:01:41 GMT
age: 1629667
last-modified: Mon, 22 Jan 2024 14:45:49 GMT
etag: W/"079a7d60052495adbccac39fcc99f0ce"
content-type: text/css
vary: Accept-Encoding
cache-control: public,max-age=86400,s-maxage=2592000
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
gcp-cache: hit
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.telegraph.co.uk/content/dam/eip/particles/gen/2023/04/27/37c8ad28-c483-4c6c-a452-1e8aac3af04c.svg | 2.18.174.13 | 200 OK | 2.7 kB |
URL GET HTTP/2www.telegraph.co.uk/content/dam/eip/particles/gen/2023/04/27/37c8ad28-c483-4c6c-a452-1e8aac3af04c.svg IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeSVG Scalable Vector Graphics image Hashfb1cfc0388534e51630598183e928934 3e7d4859e674275a536021a3fbff851237411c04 3c41424bec8125735ae33e38599f8a2f2ce58ef95959086c175dc98ed1854296
GET /content/dam/eip/particles/gen/2023/04/27/37c8ad28-c483-4c6c-a452-1e8aac3af04c.svg HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Thu, 27 Apr 2023 11:50:45 GMT
etag: "0x8DB4715A297CD9D"
access-control-allow-origin: *
content-security-policy: frame-ancestors 'self' www.stumbleupon.com stumbleupon.com;
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-disposition: attachment; filename="37c8ad28-c483-4c6c-a452-1e8aac3af04c.svg"
accept-ranges: bytes
strict-transport-security: max-age=31557600
x-served-by: cache-lcy-eglc8600052-LCY
x-timer: S1694714129.570773,VS0,VS0,VE2
content-encoding: gzip
content-length: 900
mpulse_cdn_cache: HIT
mpulse_origin_time: 0
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
vary: Accept-Encoding
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/books/2024/04/12/TELEMMGLPICT000372793816_17129289193450_trans_NvBQzQNjv4Bq3zYIPTPO0g1eaGwuB2PsGvm7QWKCPdnz7LBnrDH2Qb4.jpeg?imwidth=320 | 104.21.56.131 | 404 Not Found | 144 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/books/2024/04/12/TELEMMGLPICT000372793816_17129289193450_trans_NvBQzQNjv4Bq3zYIPTPO0g1eaGwuB2PsGvm7QWKCPdnz7LBnrDH2Qb4.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with no line terminators Hash5fe95fd7c3e6c966d910a847329e91ce 4a82d7d8e1dd1b228bcc5f34a3e9278ab8fc8155 f48738c89efeb105b86eefb13989e52f9270e0392daf360cbdae38ea4b67c969
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/books/2024/04/12/TELEMMGLPICT000372793816_17129289193450_trans_NvBQzQNjv4Bq3zYIPTPO0g1eaGwuB2PsGvm7QWKCPdnz7LBnrDH2Qb4.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2; AMCV_2C7336C753C676BA0A490D4B%40AdobeOrg=-432600572%7CMCIDTS%7C19833%7CMCMID%7C54157590449425210053891010724880296810%7CMCAID%7CNONE%7CMCOPTOUT-1713548584s%7CNONE%7CvVersion%7C4.5.2; _topp=1713541384373; AMCVS_2C7336C753C676BA0A490D4B%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:43:05 GMT
content-type: text/html
cf-ray: 876e02195f8b56c0-OSL
cf-cache-status: MISS
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
proxy-status: 0000201404060102
server-timing: cdn-cache; desc=MISS, edge; dur=686, origin; dur=20
x-origin-response-time: 20,60.221.220.100
x-parent-response-time: 706,95.101.11.69
x-tt-logid: 20240419234305539C9D351AADFE62CCAA
x-tt-trace-host: 01ae3485c412db67097a2fefa88ba0f972fad6c34c82268f0d09dfce0c0da7526fe3ec1cdbce3c8fd31473c8b94843050402c6cd46453f878d73cc2e5e80af3639cc55ac69db83011325aff4601a21888a175832c017a216365f5080b371144663
x-tt-trace-id: 00-240419234305539C9D351AADFE62CCAA-4CFE7CEA1A0ACA87-00
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HAtbgAPUupBPQpaummiQ8yJr%2BSWSpBxEpqu5beg8M6zrXxTDsgy5fx%2FP%2F2Xi9seZ0l%2F%2Be661zFDHlmrnIUkkBpKBz2Lbi3%2F2DyIqQXEw61t8sLcL3IhnqDaI47wd1YF1h%2FJ446uUJ5L0e62Qu1KnvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cf.eip.telegraph.co.uk/store/img-media/2014b41a-04a8-4329-8159-353fe516acca/2014b41a-04a8-4329-8159-353fe516acca-original.svg | 0.0.0.0 | | 0 B |
URL GET cf.eip.telegraph.co.uk/store/img-media/2014b41a-04a8-4329-8159-353fe516acca/2014b41a-04a8-4329-8159-353fe516acca-original.svg IP0.0.0.0:0
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerGoogle Trust Services LLC Subjectcf.eip.telegraph.co.uk Fingerprint80:72:F4:AA:6B:5F:E7:61:89:C8:9D:8F:89:72:31:6D:0E:71:56:10 ValidityMon, 04 Mar 2024 21:09:40 GMT - Sun, 02 Jun 2024 21:49:46 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /store/img-media/2014b41a-04a8-4329-8159-353fe516acca/2014b41a-04a8-4329-8159-353fe516acca-original.svg HTTP/1.1
Host: cf.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| will76.g5gm64rpby.workers.dev/content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=320 | 104.21.56.131 | 404 Not Found | 144 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with no line terminators Hash5fe95fd7c3e6c966d910a847329e91ce 4a82d7d8e1dd1b228bcc5f34a3e9278ab8fc8155 f48738c89efeb105b86eefb13989e52f9270e0392daf360cbdae38ea4b67c969
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/money/2024/04/16/TELEMMGLPICT000372660825_17132852364340_trans_NvBQzQNjv4BqtmWr_C1vPWl_nqc2YvM8bsxifyO7LEncGNnyej3wfOw.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:43:03 GMT
content-type: text/html
cf-ray: 876e01ffbd9656c0-OSL
cf-cache-status: MISS
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
proxy-status: 0000201404060102
server-timing: cdn-cache; desc=MISS, edge; dur=1, origin; dur=1785
x-origin-response-time: 1786,95.101.11.4
x-tt-logid: 20240419234303868C682DF77CFA32FE1F
x-tt-trace-host: 01ae3485c412db67097a2fefa88ba0f9727f447932683cadf7ddae7ca47e13542cc369f4d56cad432b9834a1a5640ed19a8acb51f2d9c2384c4f59bff9fc7194596d1cbaa3c0947acaf3c6e200bb67109d
x-tt-trace-id: 00-240419234303868C682DF77CFA32FE1F-4AEC5B0055CB4D56-00
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JLnEUMOKntJ%2FvcgdqDQMT15jbf8TUc8DNr5nxZXc%2BA4vTxKLH4M%2FDSUNyMNvlnaJJymZhqw%2FqIkHPVT%2FdiwbjRkfVphdV07scDmYXq2JiE%2FwiBIsNLxpUCKWcjZGe48%2FbW5AvQwYk3Znz%2F7yq2BQ2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cf-particle-html.eip.telegraph.co.uk/data-source/65172ecd-e97e-4c19-bbc2-8a43bdfdf0d9.json | 143.204.55.11 | 200 OK | 6.5 kB |
URL GET HTTP/2cf-particle-html.eip.telegraph.co.uk/data-source/65172ecd-e97e-4c19-bbc2-8a43bdfdf0d9.json IP143.204.55.11:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
File typeASCII text, with very long lines (7322), with no line terminators Hash900f96bc60bb99bbed83cfd16b39fa78 bce557635411e74094a741d0a74af0fac6c6b860 a2fbca65a910e217aacae949716ac9bc86d8d2c599e327eb9aa8e95797b08e08
GET /data-source/65172ecd-e97e-4c19-bbc2-8a43bdfdf0d9.json HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/json
last-modified: Wed, 07 Feb 2024 09:18:01 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 19 Apr 2024 15:39:40 GMT
cache-control: max-age=300,s-maxage=30,must-revalidate,proxy-revalidate
etag: W/"bf437a36b5b7c4b233acb0c84e72f7e4"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 2ASu4GoWmsFfFWKMou4vgZy2eMUAZ-oM30h7CjYlxo9d21gdHFpExw==
age: 193
x-robots-tag: googlebot:noindex,indexifembedded
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/films/2024/04/18/TELEMMGLPICT000339190835_17134358845690_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwZ-noePaJta23NuHfKFFEj8.jpeg?imwidth=210 | 104.21.56.131 | 404 Not Found | 1.0 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/films/2024/04/18/TELEMMGLPICT000339190835_17134358845690_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwZ-noePaJta23NuHfKFFEj8.jpeg?imwidth=210 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1058), with no line terminators Hashea47f19f98e2cda722b9be57e6c1f37a 2e9f8a86aea147bc8aa8feb5b7c5af2a2967c71d 6cb7f152914147507f198cc335044e0ebb9e3ba8a1935f9a1a4940157c645385
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/films/2024/04/18/TELEMMGLPICT000339190835_17134358845690_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwZ-noePaJta23NuHfKFFEj8.jpeg?imwidth=210 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:52 GMT
content-type: text/html
cf-ray: 876e01b4282356c0-OSL
cf-cache-status: MISS
cache-control: no-cache
vary: Accept-Encoding
via: http/1.1 ctc.guangzhou.union.188 (ApacheTrafficServer/6.2.1 [cMsSf ]), cache12.l2us1[739,739,404-1280,M], cache5.l2us1[740,0], cache2.ru7[868,868,404-0,M], cache2.ru7[871,0]
ali-swift-global-savetime: 1713541372
eagleid: 68a6b69617135413711956932e
edge-copy-time: 1713541371887
timing-allow-origin: *
x-cache: MISS TCP_MISS dirn:-2:-2
x-via-cdn: f=aliyun,s=cache2.ru7,c=162.158.222.251;f=sinaedge,s=ctc.guangzhou.union.188.nb.sinaedge.com,c=163.181.67.160;f=Edge,s=ctc.guangzhou.union.188,c=10.31.50.188;f=edge,s=ctc.yongfeng.bsd-storage.196.nb.sinaedge.com,c=172.16.92.63;
x-via-edge: 1713541371807a043b5a3bc321f0a0d43c63d
x-via-ssl: ssl.63.sinag1.shx.lb.sinanode.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZVYdXakGzZDjaw67KGHf4zT0NxHhs1NbN4D7C%2FlhtzfJ9w3JszXcKGgwpQFeJarDKcdP3z3yFKXeNK6b1VN4vSHSJN64udas7nTt1MmRs2dpveyj8B4p9tm%2Fb4RGqD6artBHAUg4vPU95ot4GJb8Nw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2023/06/16/TELEMMGLPICT000339540092_16869168700310_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 | 104.21.56.131 | 403 Forbidden | 45 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/health-fitness/2023/06/16/TELEMMGLPICT000339540092_16869168700310_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash43a341866de064c0d4de9084cdb572c3 8e4e539386ef4368b4b28d0a112eb127239d4117 832bb831bd6d00327f55e7ed5b8675abb6dee477fadd198e12cab40caf4db004
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/health-fitness/2023/06/16/TELEMMGLPICT000339540092_16869168700310_trans_NvBQzQNjv4BqqVzuuqpFlyLIwiB6NTmJwfSVWeZ_vEN7c6bHu2jJnT8.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:58 GMT
content-type: text/plain;charset=UTF-8
content-length: 45
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V7JoAzyAnes%2BipmCMn7536ynHKZZjDdCq%2FpxuWs90YWzyuA43KgiQLbgyt7I8VTS9TL5HAorBeClxdGLZOa25K1hS3PdwTwJMOcfHd63lL6UsMgbpQkn62JJYhpsNblndnezm8y2FRYqZOA%2FpkOgGg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01ed3b0a56c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/ | 104.21.56.131 | 200 OK | 601 kB |
URL User Request GET HTTP/2will76.g5gm64rpby.workers.dev/ IP104.21.56.131:443
CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
Size601 kB (600635 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET / HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 19 Apr 2024 15:42:45 GMT
content-type: text/html; charset=UTF-8
cf-ray: 876e019d28b71bfe-OSL
cf-cache-status: DYNAMIC
cache-control: max-age=0, no-cache
expires: Fri, 19 Apr 2024 15:42:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
akamai-x-true-cache-ttl: 60
content-security-policy: frame-ancestors 'self' *.telegraph.co.uk;
pragma: no-cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-served-by: cache-ams21070-AMS
x-timer: S1713541323.107000,VS0,VS0,VE3
x-tmg-geo-action: UK_ON_UK_HP
x-tmg-pref-exists: false
x-vhost: ${SERVER_NAME}, publish
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Re4TbJhwRU9%2BQphpqNQrqmScfLy9BX2ikodJrQAppDBIrys84uYyf%2F%2F9vNXDQ7zomVtp9XxAHs56RfxWrdjTfyWs3jl7TPENxQX73s71roNGy%2BW38yYKSz6XCLRDTRhzUjt5EvnlfjjCF16i1qInzw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/18/TELEMMGLPICT000374369675_17134465300090_trans_NvBQzQNjv4Bqxf0udJPckKC_3Kw9fqS3NZgojZYlP8f0i9h2tPqCNsM.jpeg?imwidth=960 | 104.21.56.131 | 403 Forbidden | 45 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/18/TELEMMGLPICT000374369675_17134465300090_trans_NvBQzQNjv4Bqxf0udJPckKC_3Kw9fqS3NZgojZYlP8f0i9h2tPqCNsM.jpeg?imwidth=960 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeASCII text, with no line terminators Hash43a341866de064c0d4de9084cdb572c3 8e4e539386ef4368b4b28d0a112eb127239d4117 832bb831bd6d00327f55e7ed5b8675abb6dee477fadd198e12cab40caf4db004
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/travel/2024/04/18/TELEMMGLPICT000374369675_17134465300090_trans_NvBQzQNjv4Bqxf0udJPckKC_3Kw9fqS3NZgojZYlP8f0i9h2tPqCNsM.jpeg?imwidth=960 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Fri, 19 Apr 2024 15:42:51 GMT
content-type: text/plain;charset=UTF-8
content-length: 45
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JZZXNXY7um5c%2FimgM18S7gYzTesNEbz0jP%2FjzgszQjkAoncqOT0Z7UQJVkTwpNdY9uEBXDSf%2FvHdusq0KS80j76%2FFJVydhvoLyqXNDIM6CPVbtVPPdFGBX4N6hnyAqAw2L5fdH%2FpAnGW33NUJzHpww%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 876e01ba8ed256c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/c28be6c7-6f53-42c1-834e-10dc3b4cfeb2.svg | 2.18.174.13 | 200 OK | 1.8 kB |
URL GET HTTP/2www.telegraph.co.uk/content/dam/eip/particles/gen/2023/11/15/c28be6c7-6f53-42c1-834e-10dc3b4cfeb2.svg IP2.18.174.13:443
Requested byhttps://cf-particle-html.eip.telegraph.co.uk/d36ccaa4-b656-42b1-ac86-aeecac880dc9.html?direct=true&id=d36ccaa4-b656-42b1-ac86-aeecac880dc9&noblackrule=true CertificateIssuerDigiCert Inc Subjectwww.telegraph.co.uk Fingerprint80:A1:C4:8A:00:78:30:B9:78:8B:A7:9F:C1:34:9B:4B:23:0D:E3:7E ValidityFri, 09 Feb 2024 00:00:00 GMT - Thu, 23 Jan 2025 23:59:59 GMT
File typeSVG Scalable Vector Graphics image Hash2a38e35ad1ac344a79e7d6c1a19cf5e7 e15b37ff88cf7214c1624186f1b12e874694b22b 2b7837063efdb26437c234e648da615c14e8e53678738a6f07efbcb39078fac3
GET /content/dam/eip/particles/gen/2023/11/15/c28be6c7-6f53-42c1-834e-10dc3b4cfeb2.svg HTTP/1.1
Host: www.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cf-particle-html.eip.telegraph.co.uk/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Wed, 15 Nov 2023 12:23:02 GMT
etag: "0x8DBE5D59CCC6478"
access-control-allow-origin: *
content-security-policy: frame-ancestors 'self' www.stumbleupon.com stumbleupon.com;
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-disposition: attachment; filename="c28be6c7-6f53-42c1-834e-10dc3b4cfeb2.svg"
x-vhost: publish
accept-ranges: bytes
strict-transport-security: max-age=31557600
x-served-by: cache-fra-eddf8230071-FRA
x-timer: S1700051152.655774,VS0,VS0,VE115
mpulse_cdn_cache: HIT
mpulse_origin_time: 0
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=300, s-maxage=300
date: Fri, 19 Apr 2024 15:42:48 GMT
content-length: 782
akamai-x-true-cache-ttl: 31536000
x-tmg-pref-exists: false
X-Firefox-Spdy: h2
|
|
| cdn.privacy-mgmt.com/unified/4.21.0/gdpr-tcf.326dc0fcac2e9cce1493.bundle.js | 143.204.55.105 | 200 OK | 160 kB |
URL GET HTTP/2cdn.privacy-mgmt.com/unified/4.21.0/gdpr-tcf.326dc0fcac2e9cce1493.bundle.js IP143.204.55.105:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.privacy-mgmt.com Fingerprint83:29:3B:F8:B4:1D:36:97:DF:3A:13:FE:0A:B4:20:94:33:1E:FC:B3 ValiditySun, 08 Oct 2023 00:00:00 GMT - Tue, 05 Nov 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size160 kB (160238 bytes) Hash2143d49524e48555b3f69e0590182adf 5a815c3e69acb93a49e95766960aecf3ec671479 1c43ac29d5219a8cbced1f40bcd12460785eda36a772bddb79a7448a0f3654a1
GET /unified/4.21.0/gdpr-tcf.326dc0fcac2e9cce1493.bundle.js HTTP/1.1
Host: cdn.privacy-mgmt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript
date: Thu, 18 Apr 2024 15:24:53 GMT
last-modified: Tue, 16 Apr 2024 19:41:57 GMT
etag: W/"2143d49524e48555b3f69e0590182adf"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000
server: AmazonS3
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: JOliTMX48WOESz-IGMMbXFhlEWMbmTLE4TcEdwd1ed4BG368Y8NxkQ==
age: 87492
X-Firefox-Spdy: h2
|
|
| geolocation-db.com/json/ |  159.89.102.253 | 200 OK | 157 B |
IP159.89.102.253:443 ASN#14061 DIGITALOCEAN-ASN
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerLet's Encrypt Subjectgeolocation-db.com Fingerprint34:F4:1F:5A:FD:B3:5D:D8:24:9F:E2:5C:00:54:2B:83:DA:5A:0A:1A ValidityThu, 11 Apr 2024 03:27:48 GMT - Wed, 10 Jul 2024 03:27:47 GMT
File typetroff or preprocessor input, ASCII text, with no line terminators Hash756577606efeb0ff376c1db7424bb0d7 576e9aea13474e4571cbe504c82f07d6e4a83e36 3d40cc0891d8f98712269fbb48f69185ce50697fdad8cf6fc76a8ffea1bcc017
GET /json/ HTTP/1.1
Host: geolocation-db.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://will76.g5gm64rpby.workers.dev/
Origin: https://will76.g5gm64rpby.workers.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.14.0 (Ubuntu)
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| cdn.privacy-mgmt.com/unified/4.21.0/ccpa-gpp.65d1b35ff487d360208c.bundle.js | 143.204.55.105 | 200 OK | 212 kB |
URL GET HTTP/2cdn.privacy-mgmt.com/unified/4.21.0/ccpa-gpp.65d1b35ff487d360208c.bundle.js IP143.204.55.105:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.privacy-mgmt.com Fingerprint83:29:3B:F8:B4:1D:36:97:DF:3A:13:FE:0A:B4:20:94:33:1E:FC:B3 ValiditySun, 08 Oct 2023 00:00:00 GMT - Tue, 05 Nov 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size212 kB (212242 bytes) Hashee3c78a1bfc6ffcf1b3498e22fb1aa00 fc874efa56bfe159589b6ed8e0466551174bc25b fabb42a3d96583aa631ff7b021b2fce6d0c9222cbb68e3400adb8c0720d8d308
GET /unified/4.21.0/ccpa-gpp.65d1b35ff487d360208c.bundle.js HTTP/1.1
Host: cdn.privacy-mgmt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript
date: Thu, 18 Apr 2024 15:24:53 GMT
last-modified: Tue, 16 Apr 2024 19:41:57 GMT
etag: W/"ee3c78a1bfc6ffcf1b3498e22fb1aa00"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000
server: AmazonS3
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: VQUEW1a1ZmrO4JKFpo8isdAy7w4yeuGQC2BEjo_Bm6FR1COGNo63EQ==
age: 87491
X-Firefox-Spdy: h2
|
|
| cdn.privacy-mgmt.com/wrapper/metrics/v1/custom-metrics | 143.204.55.105 | 200 OK | 4 B |
URL OPTIONS HTTP/2cdn.privacy-mgmt.com/wrapper/metrics/v1/custom-metrics IP143.204.55.105:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.privacy-mgmt.com Fingerprint83:29:3B:F8:B4:1D:36:97:DF:3A:13:FE:0A:B4:20:94:33:1E:FC:B3 ValiditySun, 08 Oct 2023 00:00:00 GMT - Tue, 05 Nov 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hasha02439ec229d8be0e74b0c1602392310 61ff81c30aa3c76e78afea62b2e3bd1dfa49e854 9aee6b1bcdf617d8e39bb1f2b624c68ea33deb9d48e0364aeaded836d3d00293
OPTIONS /wrapper/metrics/v1/custom-metrics HTTP/1.1
Host: cdn.privacy-mgmt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://will76.g5gm64rpby.workers.dev/
Origin: https://will76.g5gm64rpby.workers.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=utf-8
content-length: 4
date: Fri, 19 Apr 2024 15:43:04 GMT
x-powered-by: Express
access-control-allow-origin: https://will76.g5gm64rpby.workers.dev
access-control-allow-credentials: true
access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,SP_SCRIPT_VERSION
access-control-allow-methods: GET, PUT, POST, DELETE
cache-control: no-cache, no-store
strict-transport-security: max-age=15552000; includeSubDomains
allow: POST
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 5bZv8sQcwyBIxo7K5onBo7E7J37a-ydYw77n_earWkwQHxqOkBCA2A==
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/utility-bar/Health%20-%20UTILITY%20BAR%202.png?impolicy=utilities-thumbnail | 104.21.56.131 | 404 Not Found | 146 B |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/utility-bar/Health%20-%20UTILITY%20BAR%202.png?impolicy=utilities-thumbnail IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, ASCII text, with no line terminators Hash40b3fc14254227ec5012d996bf90c4e1 b0dd06eb5a779151151101337889ff09953f8ac0 740816c1b61e4a8443c26d30d3eecfea04815fca8cd605a142f9d8a35f86ceca
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/utility-bar/Health%20-%20UTILITY%20BAR%202.png?impolicy=utilities-thumbnail HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/html
cf-ray: 876e01b0bc9056c0-OSL
cf-cache-status: MISS
strict-transport-security: max-age=86400; preload;
vary: Accept-Encoding
via: 1.1 a6d89f7e2d55548b941f1ff5d5b3c8d4.cloudfront.net (CloudFront)
referrer-policy: no-referrer-when-downgrade
x-amz-cf-id: MmQSrBPOvtP25Aq4ChqvJmN4gMnApfY7E8vK6pH26bUHopvPIpggtA==
x-amz-cf-pop: OSL50-C1
x-cache: Error from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1;mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zB500A3oUgiZqsuKOG4F7t2u%2BCmNEY6wWWWi8Zjdd2xt8OTq8o0U6ZrvChzjGa3fBvmiuTlwk4UolAAdJDRC6mqoU4IbKT2q6H8oy3XAvFFECK1qJ3J%2F30RovDlQRKGac3nR%2FFOC52TsXqPUAfJ%2FJA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 | 143.204.55.11 | 200 OK | 1.2 kB |
URL GET HTTP/2cf-particle-html.eip.telegraph.co.uk/14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 IP143.204.55.11:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerAmazon Subject*.eip.telegraph.co.uk Fingerprint41:46:D9:43:63:E4:9A:E6:EF:27:B4:70:A5:54:36:E8:6C:65:1B:15 ValidityTue, 20 Jun 2023 00:00:00 GMT - Fri, 19 Jul 2024 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (1281), with no line terminators Hash3cff8f96b85c86d515e4de35b13a9466 134a070d53c18a8d0e592fe4e9ba306571936c37 68f6037b319e50c198e61ef41bcd95ece822803e06b56e5f59977313d5ed6d82
GET /14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7.html?direct=true&id=14ea5c78-fbf0-43ef-9a72-3facfdbfc6c7 HTTP/1.1
Host: cf-particle-html.eip.telegraph.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
last-modified: Fri, 22 Dec 2023 16:30:41 GMT
x-amz-server-side-encryption: AES256
server: AmazonS3
content-encoding: gzip
date: Fri, 19 Apr 2024 15:38:04 GMT
etag: W/"2bacfa48a00de88a0e1566845c440e30"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: ElIL-IBiG2nqvxng13lDBc5_WamYLs6vR_Qk9S43H2mzKzMzXgoEvg==
age: 287
cache-control: max-age=60,must-revalidate
x-robots-tag: googlebot:noindex,indexifembedded
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
|
|
| will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/18/TELEMMGLPICT000374369675_17134465300090_trans_NvBQzQNjv4Bqxf0udJPckKC_3Kw9fqS3NZgojZYlP8f0i9h2tPqCNsM.jpeg?imwidth=960 | 104.21.56.131 | 404 Not Found | 1.8 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/content/dam/travel/2024/04/18/TELEMMGLPICT000374369675_17134465300090_trans_NvBQzQNjv4Bqxf0udJPckKC_3Kw9fqS3NZgojZYlP8f0i9h2tPqCNsM.jpeg?imwidth=960 IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1707), with no line terminators Hash175f81987eae3c2ab0040d45d8df09d7 d25fa00859ba212f6f129f6b6f78a5e087d0cc80 1909b03d69a4a6b649ce866591234360f4981a6b8a90ed2df95fcfba056c80ff
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /content/dam/travel/2024/04/18/TELEMMGLPICT000374369675_17134465300090_trans_NvBQzQNjv4Bqxf0udJPckKC_3Kw9fqS3NZgojZYlP8f0i9h2tPqCNsM.jpeg?imwidth=960 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=2760828017135413676414740e6d7540dca17619c25c8bd3e8188c5dc8d56b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:42:49 GMT
content-type: text/html; charset=utf-8
cf-ray: 876e01b0cca056c0-OSL
cf-cache-status: MISS
strict-transport-security: max-age=2592000; includeSubDomains; preload
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u9Xwwj2fIecbubafKytlt8gMjqW83pWqS5D7aMTf9J1vdUjVzb6BN7msjWoXZ5tdrjrX6r7yGarFOJzMdX%2BueDIFKunlFM49fCDfGXS8n3jFwRBhV2F%2FifGuSJZ4YDhtum24rmIKJO1XnRLObUojnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| will76.g5gm64rpby.workers.dev/content/dam/cars/2024/04/17/TELEMMGLPICT000374270261_17133703686770_trans_NvBQzQNjv4BqKxMay4KI7w5ufZARtkg_PYcsXyysZQo_cGAhtM_hpuM.jpeg?imwidth=320 | 0.0.0.0 | | 0 B |
URL GET will76.g5gm64rpby.workers.dev/content/dam/cars/2024/04/17/TELEMMGLPICT000374270261_17133703686770_trans_NvBQzQNjv4BqKxMay4KI7w5ufZARtkg_PYcsXyysZQo_cGAhtM_hpuM.jpeg?imwidth=320 IP0.0.0.0:0
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /content/dam/cars/2024/04/17/TELEMMGLPICT000374270261_17133703686770_trans_NvBQzQNjv4BqKxMay4KI7w5ufZARtkg_PYcsXyysZQo_cGAhtM_hpuM.jpeg?imwidth=320 HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
|
|
| will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/core/resources/icons/favicon-196x196.png | 104.21.56.131 | 404 Not Found | 1.2 kB |
URL GET HTTP/3will76.g5gm64rpby.workers.dev/etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/core/resources/icons/favicon-196x196.png IP104.21.56.131:443
Requested byhttps://will76.g5gm64rpby.workers.dev/ CertificateIssuerGoogle Trust Services LLC Subjectg5gm64rpby.workers.dev FingerprintA2:AC:3F:04:C0:0A:EE:DB:7B:33:CC:33:11:93:F1:AC:55:6E:59:0E ValidityThu, 22 Feb 2024 12:10:00 GMT - Wed, 22 May 2024 12:09:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1241), with no line terminators Hash14fc8ed36d3358a2d4a9557d2b69f860 875918c5480201d7fd3a1c646600cc8e206d9afa a5a5957109aeeeb74db86456a631d1a1d6667ccf5cc5744901c2210f8efacdd6
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | WeChat |
GET /etc.clientlibs/settings/wcm/designs/telegraph/core/clientlibs/core/resources/icons/favicon-196x196.png HTTP/1.1
Host: will76.g5gm64rpby.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://will76.g5gm64rpby.workers.dev/
Cookie: acw_tc=276077dd17135413698638743e3371ff3b1fece6839431e94c954fb1eb8cc2; AMCV_2C7336C753C676BA0A490D4B%40AdobeOrg=-432600572%7CMCIDTS%7C19833%7CMCMID%7C54157590449425210053891010724880296810%7CMCAID%7CNONE%7CMCOPTOUT-1713548584s%7CNONE%7CvVersion%7C4.5.2; _topp=1713541384373; AMCVS_2C7336C753C676BA0A490D4B%40AdobeOrg=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 19 Apr 2024 15:43:07 GMT
content-type: text/html
cf-ray: 876e0220af8656c0-OSL
cf-cache-status: BYPASS
cache-control: private
set-cookie: eng_k55_id=015103; path=/
vary: Accept-Encoding
x-powered-by: ASP.NET
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0AD3I9pNIvkCbi%2FjqG9NPiTKmscBV7l1PXUOjqkfEscC2AaNSBKpTlUEMW0s43VfoIY0gPhC1D8gXBjATCXIM%2FFXcahRYWNNwY1txaiPXEzMtcKhiBE9YuB4OlQuGPOhiAYp17fVeb0WZlnPmnjxvA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
0.0.0.0