r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 9fbe85f42e8ae8ae41cc12df5f98b141
949fa36ff0f22f72565fd584bef094dd4de23037
184d3e4df4bce559b4d7c4836372f5fd2de9782a96b04d364230b7d695d737d8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "184D3E4DF4BCE559B4D7C4836372F5FD2DE9782A96B04D364230B7D695D737D8"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3275
Expires: Sun, 29 Jan 2023 03:39:05 GMT
Date: Sun, 29 Jan 2023 02:44:30 GMT
Connection: keep-alive
kmcthospital.com/standard2land/3mjjjyte=/
103.195.186.173301 Moved Permanently 176 B URL HTTP/1.1 kmcthospital.com/standard2land/3mjjjyte=/
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 532ec523b8cea453959c82d1950185b0
9376dd5715f5c2250685168f3612844b95b24147
6162635d97e4b10d6f2abd4f51df73f9a66f5901339d134b1bfcc1dd52c19f1e
Analyzer Verdict Alert fortinet Phishing
GET /standard2land/3mjjjyte=/ HTTP/1.1
Host: kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Sun, 29 Jan 2023 02:44:35 GMT
Content-Length: 176
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 3eb88dea4fe00db1182370e72683c3ab
ca520abf1e91bfd2aef40c6a1270a911071e8922
d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5544
Expires: Sun, 29 Jan 2023 04:16:54 GMT
Date: Sun, 29 Jan 2023 02:44:30 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 29 Jan 2023 02:35:33 GMT
content-type: application/json
age: 537
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 302c7548412192add063ad6c8b99cf3b
e5d178931a27db036ce8daae302594d3ff7050b8
fc2bd9091006189e67e8074093805ee5492ce16e1dbfba32e083abeeae34969d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FC2BD9091006189E67E8074093805EE5492CE16E1DBFBA32E083ABEEAE34969D"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17903
Expires: Sun, 29 Jan 2023 07:42:53 GMT
Date: Sun, 29 Jan 2023 02:44:30 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: +KS8NbeWHh8NfDeqEZzmQvcSH+FuPhvgHftOkU9KEjcYkNDLH9KJNTv/D958yFB1DQM1kymBFGU=
x-amz-request-id: 6SCVFBRWQX7S4DS5
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 29 Jan 2023 01:50:08 GMT
age: 3263
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 29 Jan 2023 02:44:31 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Last-Modified, Pragma, ETag, Retry-After, Content-Type, Content-Length, Expires, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 29 Jan 2023 01:49:03 GMT
age: 3328
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
www.kmcthospital.com/standard2land/3mjjjyte=/
103.195.186.173200 OK 5.1 kB URL HTTP/2 www.kmcthospital.com/standard2land/3mjjjyte=/
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (446), with CRLF line terminators
Hash fd06706322c456dae0dc8756fd7e7cc8
cc0b5a2074318f6dc23f67c9b0682c7c9da3eef0
bd6f0c13498ce326e88fe014e06a22dbcca3084b062e4ba6172ba8b8cd50f1ce
Analyzer Verdict Alert fortinet Phishing
GET /standard2land/3mjjjyte=/ HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
cache-control: private
content-type: text/html; charset=utf-8
content-encoding: br
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
set-cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi; path=/; HttpOnly; SameSite=Lax
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:35 GMT
content-length: 5102
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 16a7b6a7128312e2f985d30df18c4487
6017bff79ffb525d9c7f9f32b999b74b5dc69602
663fd12209627f08e759c2ed1c76278a5da79dae1e0b46082dd1bb44775f7a16
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "663FD12209627F08E759C2ED1C76278A5DA79DAE1E0B46082DD1BB44775F7A16"
Last-Modified: Fri, 27 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4281
Expires: Sun, 29 Jan 2023 03:55:52 GMT
Date: Sun, 29 Jan 2023 02:44:31 GMT
Connection: keep-alive
www.kmcthospital.com/css/CustomStyle.css
103.195.186.173502 Bad Gateway 0 B URL HTTP/2 www.kmcthospital.com/css/CustomStyle.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /css/CustomStyle.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 502 Bad Gateway
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:35 GMT
content-length: 0
X-Firefox-Spdy: h2
www.kmcthospital.com/css/owl.carousel.min.css
103.195.186.173200 OK 1.3 kB URL HTTP/2 www.kmcthospital.com/css/owl.carousel.min.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (3174), with CRLF line terminators
Hash 120567a55423f183f40187d2d63e2adc
05e6073efd3be3e70adb10bc0196f677ea09fa5d
5a51034a56cc5e9db3d2e3dcb52f733caf703f6b780b88af4514575c62ccd71f
GET /css/owl.carousel.min.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "c090c2781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:35 GMT
content-length: 1270
X-Firefox-Spdy: h2
www.kmcthospital.com/WebResource.axd?d=XLbUQuO-hrASu_LVFhjxApC7qD9oz4gIY-BBn21QWtUmoVMgESLCj9FaQihrZQW_MUd3OntyaK1krMi7aOyOh5hKOD41&t=637811927229275428
103.195.186.173200 OK 6.2 kB URL HTTP/2 www.kmcthospital.com/WebResource.axd?d=XLbUQuO-hrASu_LVFhjxApC7qD9oz4gIY-BBn21QWtUmoVMgESLCj9FaQihrZQW_MUd3OntyaK1krMi7aOyOh5hKOD41&t=637811927229275428
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash 19de2925b4ef32421ee614034d32b74c
edf05a2a319f61a3b7ae9872dc0da276b050f2a7
91aca35fd9ce371718ff9dc1c13a7d2b15aeae531d418b5c9b18854c611bdde3
GET /WebResource.axd?d=XLbUQuO-hrASu_LVFhjxApC7qD9oz4gIY-BBn21QWtUmoVMgESLCj9FaQihrZQW_MUd3OntyaK1krMi7aOyOh5hKOD41&t=637811927229275428 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: public
content-type: application/x-javascript
content-encoding: br
expires: Sun, 28 Jan 2024 18:13:08 GMT
last-modified: Wed, 23 Feb 2022 00:28:42 GMT
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:35 GMT
content-length: 6194
X-Firefox-Spdy: h2
www.kmcthospital.com/css/popup-style.css
103.195.186.173200 OK 818 B URL HTTP/2 www.kmcthospital.com/css/popup-style.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash ee224eeea9259915a4010bf65cca3513
948f5039cfc08ce8663b203e7930e5a7604216f7
00116be72295efebbb4b966fa8ddd7c07c5501efad4ea5040f6b50744f4e1ead
GET /css/popup-style.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "fd9ca781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:35 GMT
content-length: 818
X-Firefox-Spdy: h2
push.services.mozilla.com/
35.164.186.39101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.164.186.39:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Noo+PEWkcSqUKvOFPc0+nA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: h9H3w/VBV4EqwVwHjTcDKevB5+A=
www.kmcthospital.com/css/animate.css
103.195.186.173200 OK 12 kB URL HTTP/2 www.kmcthospital.com/css/animate.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash c493d2bd26b85da025d3b94b5dc9ae01
da621c86b4d1219a652459844b67fce1170750e8
f446082f0b300172af7720b5782014dc7a9e817dfdb093a6d835973947740047
GET /css/animate.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:30 GMT
accept-ranges: bytes
etag: "93336781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 11641
X-Firefox-Spdy: h2
www.kmcthospital.com/css/demo.css
103.195.186.173200 OK 7.0 kB URL HTTP/2 www.kmcthospital.com/css/demo.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash a8d93756fce365d4731f8a1803adbe4e
f122f5e617bd3012259699e9205b8aefccf52423
90554596ccef46775b6722f2239ababde5a0c61f854c7fa7f678a44d72392a36
GET /css/demo.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "fa4af781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 7022
X-Firefox-Spdy: h2
www.kmcthospital.com/css/font-awesome.min.css
103.195.186.173200 OK 6.5 kB URL HTTP/2 www.kmcthospital.com/css/font-awesome.min.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (21822), with CRLF line terminators
Hash b46f6c54e98af7ff25bdc731dd41afa0
0c7a425cd217f4fc0b35eecd93141dec9189caf2
eab97c1f6d3107013555d19ae0237fce676bffa9bfb82386ab350d7832611f2d
GET /css/font-awesome.min.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "4cb3a7781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 6518
X-Firefox-Spdy: h2
www.kmcthospital.com/WebResource.axd?d=KndHT_7njKxeWmkPOi3DzGZ6BSKvEgLwvo_BEg0G7Z-T-eYqMPuPgLTyYOkwf_NaS4I0hPZlH8N-5CBL0AB4kHbA-E01&t=637811927229275428
103.195.186.173200 OK 7.3 kB URL HTTP/2 www.kmcthospital.com/WebResource.axd?d=KndHT_7njKxeWmkPOi3DzGZ6BSKvEgLwvo_BEg0G7Z-T-eYqMPuPgLTyYOkwf_NaS4I0hPZlH8N-5CBL0AB4kHbA-E01&t=637811927229275428
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash e4a4de866ff1d5d0e43080d6b2956584
a888e41d318b338c97ff0646609821b9cea9825b
bc1f6ccca8de5ae7e40892b0989e5fe389a38d4289546bf311ad469cc0f0906a
GET /WebResource.axd?d=KndHT_7njKxeWmkPOi3DzGZ6BSKvEgLwvo_BEg0G7Z-T-eYqMPuPgLTyYOkwf_NaS4I0hPZlH8N-5CBL0AB4kHbA-E01&t=637811927229275428 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: public
content-type: application/x-javascript
content-encoding: br
expires: Sun, 28 Jan 2024 18:13:08 GMT
last-modified: Wed, 23 Feb 2022 00:28:42 GMT
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 7318
X-Firefox-Spdy: h2
www.kmcthospital.com/images/mail.png
103.195.186.173200 OK 351 B URL HTTP/2 www.kmcthospital.com/images/mail.png
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 19 x 15, 8-bit/color RGBA, non-interlaced\012- data
Hash 7432896ef28194e8b8ffb6a772175e66
67be386731283acd37904b63cca47c426c202fdc
c9c7631f76d4831cb7e3d16141c7c506489f7a7074f2866b9b28d0e73a61921c
GET /images/mail.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:57 GMT
accept-ranges: bytes
etag: "3558015f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 351
X-Firefox-Spdy: h2
www.kmcthospital.com/css/style.css
103.195.186.173200 OK 21 kB URL HTTP/2 www.kmcthospital.com/css/style.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 412c3adcf42c82bebfe5864f0580e747
e76eb9a6a0f4a31dd0fc224b4d423121b7f1ac9c
9cc648365f9914cb7c2274d4cbd8762e7b8d7d1442f1e733cd26e63a7abfcd1c
GET /css/style.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:32 GMT
accept-ranges: bytes
etag: "904df2781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 21253
X-Firefox-Spdy: h2
www.kmcthospital.com/images/location.png
103.195.186.173200 OK 392 B URL HTTP/2 www.kmcthospital.com/images/location.png
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 12 x 17, 8-bit/color RGBA, non-interlaced\012- data
Hash 040c868d17ee8d8c61f65a4753c9bb19
16ff7906f779f45793f43558506d06070636a8c8
8ef1e0aaac23892439507ee12bac72fbc4219126f954f86f80e32d45891d87b2
GET /images/location.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:57 GMT
accept-ranges: bytes
etag: "81f44515f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 392
X-Firefox-Spdy: h2
www.kmcthospital.com/images/cancel.png
103.195.186.173200 OK 474 B URL HTTP/2 www.kmcthospital.com/images/cancel.png
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 24 x 24, 16-bit gray+alpha, non-interlaced\012- data
Hash c3a1cfd006f2d11d043e4f8a4ebda920
f850d0911131e74cea93d773ac8c95f6e5fbf99a
8ed4396ed14f281fc8acf5a39e5c6f4fdf23d6139cae3f25e5f2de73ad1f935e
GET /images/cancel.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:54 GMT
accept-ranges: bytes
etag: "a1ea7213f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 474
X-Firefox-Spdy: h2
www.kmcthospital.com/images/call.png
103.195.186.173200 OK 356 B URL HTTP/2 www.kmcthospital.com/images/call.png
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced\012- data
Hash e83b884a4932bd7ee72b277534e76a53
3d5b356a73fa517961cee1eeafac3f3c1c30e365
62be2b564019d21ec1f83c038b8b8f9e5f8027128d9e472d4259496412719bc4
GET /images/call.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:54 GMT
accept-ranges: bytes
etag: "ecba6d13f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 356
X-Firefox-Spdy: h2
www.kmcthospital.com/css/all.css
103.195.186.173200 OK 18 kB URL HTTP/2 www.kmcthospital.com/css/all.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash 6ccc32017fb1ee08c3af765de9e0aadb
7ad3c7e328986c9f749306600c854b90abd4aec6
7d143ba33151ccaa229060ff703c65e7f1699df2cd5980661c1786009bd13eef
GET /css/all.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:30 GMT
accept-ranges: bytes
etag: "6d493a781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 18404
X-Firefox-Spdy: h2
www.kmcthospital.com/images/logo.png
103.195.186.173200 OK 6.0 kB URL HTTP/2 www.kmcthospital.com/images/logo.png
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 163 x 63, 8-bit/color RGBA, non-interlaced\012- data
Hash 51f7165a9c6f000112e33ed40ac6e656
f7f08caef5732ac66966a1ad9b7888113f17b492
1ba89830a18a989169b0bfeedcf4b368d25fb5118d5388d214e63d46c948117b
GET /images/logo.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:57 GMT
accept-ranges: bytes
etag: "60e45f15f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 5960
X-Firefox-Spdy: h2
www.kmcthospital.com/js/main.js
103.195.186.173200 OK 1.0 kB URL HTTP/2 www.kmcthospital.com/js/main.js
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash 2d94e47864bf8d81038e5294b3466849
b3f04d6d1bb8356bce3aa6811a717fb2ddbc076d
ba08cd1ac357978939cb76b5c41594e2c4b4b9618f48eb94ecde43fb602e5a53
Analyzer Verdict Alert fortinet Malware
GET /js/main.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "5268251dd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 1022
X-Firefox-Spdy: h2
www.kmcthospital.com/js/popup.js
103.195.186.173200 OK 490 B URL HTTP/2 www.kmcthospital.com/js/popup.js
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash 4a65d5c6d3823fa475ea51c74d43d374
964c401c5a17aa3a4d610d272f3bcb7b550a80e6
20f67bf4bd2ef8becc96712124ce91950cda78ee19feab927068557a266f6027
Analyzer Verdict Alert fortinet Malware
GET /js/popup.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "63d8401dd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 490
X-Firefox-Spdy: h2
www.kmcthospital.com/css/bootstrap.css
103.195.186.173200 OK 45 kB URL HTTP/2 www.kmcthospital.com/css/bootstrap.css
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash 298b1ccf7b6f24983cf5355e2fd1f174
63ca5ff41267c0b804617aebe25edee1b8a18637
c34b7c21be354ee10a53a4fa25017942598b2e7cdd878716341bf2bbb6a4ee53
GET /css/bootstrap.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "b4336a781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 44925
X-Firefox-Spdy: h2
www.kmcthospital.com/js/bootstrap.min.js
103.195.186.173200 OK 22 kB URL HTTP/2 www.kmcthospital.com/js/bootstrap.min.js
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (48664)
Hash 65f9e3d338fecf8590f5d4ca19ca57e2
7e5975f8ab4388b92e1803727c17fcc055ea5383
9b9f753cfbb684a0ad843fb53004c21e90373ef680c7ec5ebcdc1b8f388cc9a7
Analyzer Verdict Alert fortinet Malware
GET /js/bootstrap.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:50 GMT
accept-ranges: bytes
etag: "c056a81cd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 22103
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 86352d15c37831cf9bf1e41325029224
ac8b28bcc1e6dd026e1f62d1ef8b9f80a42eee21
154f5f5e116df41f5d3bd414c671138b2afc198071529a0f3573109277566cd8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 02:44:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 86352d15c37831cf9bf1e41325029224
ac8b28bcc1e6dd026e1f62d1ef8b9f80a42eee21
154f5f5e116df41f5d3bd414c671138b2afc198071529a0f3573109277566cd8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 02:44:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.kmcthospital.com/js/jquery-3.1.1.min.js
103.195.186.173200 OK 43 kB URL HTTP/2 www.kmcthospital.com/js/jquery-3.1.1.min.js
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (32030), with CRLF line terminators
Hash 188917525acd4cfa470e50e081b50c62
6033f5edc019f9be8d7a523772c5da33ceb32e1c
3105552fde44886e40e45575774970fdc556e1d269e769c1f76fefda030e5c13
Analyzer Verdict Alert fortinet Malware
GET /js/jquery-3.1.1.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "354c41dd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 43381
X-Firefox-Spdy: h2
www.kmcthospital.com/js/owl.carousel.min.js
103.195.186.173200 OK 18 kB URL HTTP/2 www.kmcthospital.com/js/owl.carousel.min.js
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (31997)
Hash b6654ca8af157f31e48dd29117cf25e7
387d1f09b243344d0d0bde1052c8e3208b52c56e
5708cc10063e395085df7d8e9d609859cfbb27e7382016c5bf52ee60399d592e
Analyzer Verdict Alert fortinet Malware
GET /js/owl.carousel.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "afa3341dd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 18177
X-Firefox-Spdy: h2
www.kmcthospital.com/js/jquery.min.js
103.195.186.173200 OK 52 kB URL HTTP/2 www.kmcthospital.com/js/jquery.min.js
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Unicode text, UTF-8 (with BOM) text, with very long lines (65479), with CRLF line terminators
Hash 33452a5c5d0ba9d172ff0d4bd4711037
0b71fab2fa3b9b3e431b0c2aa7898e1bb954bb13
5a3259252386a2a0c278145ebca97647ac4bab19140e33abb715f616b4a2be74
Analyzer Verdict Alert fortinet Malware
GET /js/jquery.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "c47241dd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 51984
X-Firefox-Spdy: h2
www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff2
103.195.186.173200 OK 13 kB URL HTTP/2 www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff2
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (446), with CRLF line terminators
Hash 5eee1365a1c5b3c4dceb613ae7cbd029
03675b50a50a28a6f019df6d511baf5ce42bf1e0
04996558f58cc35aac309e13953cfca2f4fb4b3845363d9125e8af3b738ad552
Analyzer Verdict Alert fortinet Malware
GET /fonts/FontsFreeNetNekstLight.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: private
content-type: text/html; charset=utf-8
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 13015
X-Firefox-Spdy: h2
www.kmcthospital.com/fonts/GTAmericaCondensedBold.woff2
103.195.186.173200 OK 6.8 kB URL HTTP/2 www.kmcthospital.com/fonts/GTAmericaCondensedBold.woff2
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format (Version 2), TrueType, length 6788, version 1.0\012- data
Hash 82bbd99d1fd2fdde2ac813ddd2eafa3a
d7fbb8bceb3129a1d13e3fba6472990b3f365019
49a6d9f893d552157eec675f0b5062b11d9477cb232c96e12cdfde9f728842c7
Analyzer Verdict Alert fortinet Malware
GET /fonts/GTAmericaCondensedBold.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff2
last-modified: Sat, 17 Dec 2022 04:34:46 GMT
accept-ranges: bytes
etag: "8d2a7e4d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 6788
X-Firefox-Spdy: h2
www.kmcthospital.com/fonts/FontsFreeNetNekstMedium.woff2
103.195.186.173200 OK 30 kB URL HTTP/2 www.kmcthospital.com/fonts/FontsFreeNetNekstMedium.woff2
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format (Version 2), TrueType, length 29872, version 1.0\012- data
Hash cbeb022216db9453ccb07100b5b144f8
71de96bd9c24a7a23234ffc60599a771be4d7f00
891125104f80f752502ee9d11220a0749cb61a0806eaf85d7901863a0961ccc4
Analyzer Verdict Alert fortinet Malware
GET /fonts/FontsFreeNetNekstMedium.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff2
last-modified: Sat, 17 Dec 2022 04:34:41 GMT
accept-ranges: bytes
etag: "18f491e1d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 29872
X-Firefox-Spdy: h2
www.kmcthospital.com/webfonts/fa-brands-400.woff2
103.195.186.173200 OK 77 kB URL HTTP/2 www.kmcthospital.com/webfonts/fa-brands-400.woff2
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format (Version 2), TrueType, length 76736, version 331.-31196\012- data
Hash ed311c7a0ade9a75bb3ebf5a7670f31d
0613c7ebba55ee47ef302c0f7766324692f899a7
8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef
Analyzer Verdict Alert fortinet Malware
GET /webfonts/fa-brands-400.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/all.css
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff2
last-modified: Sat, 17 Dec 2022 04:35:16 GMT
accept-ranges: bytes
etag: "6c42dff5d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 76736
X-Firefox-Spdy: h2
www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
142.250.74.132200 OK 1.6 kB URL HTTP/2 www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
IP 142.250.74.132:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3431)
Hash 1f759626387914b51a4d900c33d30d1c
c38c2ab4424ae6087b9d522546cf3232097c63b5
69f4afc84021c887870875c44a2582304763b38c9a04514004a08643d4b98bed
GET /maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: no-cache, must-revalidate
pragma: no-cache
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-GaO2Sh1jcAeWf0ls8biczQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/geo-maps-api/1
expires: Fri, 01 Jan 1990 00:00:00 GMT
content-type: text/html; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Sun, 29 Jan 2023 02:44:32 GMT
server: scaffolding on HTTPServer2
content-length: 1617
x-xss-protection: 0
x-content-type-options: nosniff
server-timing: gfet4t7; dur=148
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash ef589be52a3e55b643978f17949a73da
74545de6f144282252ff92c751f97cc835c80341
7bfa68c43e60a2627770163b5c1b96fbd7e4843984ad5ff6225c5490b8073b26
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 02:44:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 8c630e9bbc930d1c367efa81b67be3f7
ec536695531d40a813d99a06271c7c2d698d51d3
39ca0a60c3e2e85712757ead0830d0da82beac1e4f44b6e90243e5ca9326bf4b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 02:44:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
maps.googleapis.com/maps/api/js?client=google-maps-embed&paint_origin=&libraries=geometry,search&v=3.exp&language=en®ion=in&callback=onApiLoad
142.250.74.106200 OK 56 kB URL HTTP/2 maps.googleapis.com/maps/api/js?client=google-maps-embed&paint_origin=&libraries=geometry,search&v=3.exp&language=en®ion=in&callback=onApiLoad
IP 142.250.74.106:0
File type ASCII text, with very long lines (2546)
Hash 85bc607bc32c6bff0e3053293f83b3c2
3dfefdc15c17cef78a1708d3eedd08d785c968f6
85ddb27c1e3ddfeca5171d632bb208fbf24aa5bba2db1a1e80f4ef12676fa71c
GET /maps/api/js?client=google-maps-embed&paint_origin=&libraries=geometry,search&v=3.exp&language=en®ion=in&callback=onApiLoad HTTP/1.1
Host: maps.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
date: Sun, 29 Jan 2023 02:44:32 GMT
expires: Sun, 29 Jan 2023 03:14:32 GMT
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-encoding: gzip
server: mafe
content-length: 56008
x-xss-protection: 0
x-frame-options: SAMEORIGIN
server-timing: gfet4t7; dur=25
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff
103.195.186.173200 OK 46 kB URL HTTP/2 www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format, TrueType, length 45972, version 1.0\012- data
Hash 00dddaea66f1f48e2ea621d78a97ae07
2be85531008d854577126914c585d259bb7639db
66a797f5c1d644b3b8a9d783cb0e2c91cd03aaf1dce895a3a1fc9bc275d05f07
Analyzer Verdict Alert fortinet Malware
GET /fonts/FontsFreeNetNekstLight.woff HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff
last-modified: Sat, 17 Dec 2022 04:34:39 GMT
accept-ranges: bytes
etag: "a82733e0d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 45972
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 8c630e9bbc930d1c367efa81b67be3f7
ec536695531d40a813d99a06271c7c2d698d51d3
39ca0a60c3e2e85712757ead0830d0da82beac1e4f44b6e90243e5ca9326bf4b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 02:44:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
142.250.74.132200 OK 1.6 kB URL HTTP/2 www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
IP 142.250.74.132:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3473)
Hash af085b8d6c151bdcc6b9e8d13dd253a8
5c824e28ba66cba2146347268188ec8d250da83a
6f33e2c9d7a72104fd4fe4cc014fb73d00df22b13a7d3f8047fab33d00bb8bc5
GET /maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Sun, 29 Jan 2023 02:44:32 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
vary: Accept-Language
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-_AWMn2zb9GZXMUvsWKDKcg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/geo-maps-api/1
content-encoding: gzip
server: mafe
content-length: 1619
x-xss-protection: 0
server-timing: gfet4t7; dur=141
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 8cf65fcdafa84b63cf7005fe57927fcb
3f7d163a96e7f00eb2de9828624ec46e22b4b40a
dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 02:44:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.kmcthospital.com/images/Fav-icon.png
103.195.186.173200 OK 1.2 kB URL HTTP/2 www.kmcthospital.com/images/Fav-icon.png
IP 103.195.186.173:0
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 9743e95b98854912e4bfeefd3df0e74f
0564bc1c479c6f58cc31a9abc712871469494c93
2c22ba16d8f3af770b82a8e77e7e805c56be1769b185724e0a880a7e4679e45a
GET /images/Fav-icon.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/3mjjjyte=/
Cookie: ASP.NET_SessionId=0sorpu2gyiqbhqfbhkadmxdi
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:55 GMT
accept-ranges: bytes
etag: "5c17d313f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 02:44:36 GMT
content-length: 1201
X-Firefox-Spdy: h2
maps.gstatic.com/maps-api-v3/embed/js/51/7/init_embed.js
142.250.74.99200 OK 69 kB URL HTTP/2 maps.gstatic.com/maps-api-v3/embed/js/51/7/init_embed.js
IP 142.250.74.99:0
File type ASCII text, with very long lines (2599)
Hash fd4867728783671f13b38d1f073e7be9
ff5ba304ce5b2838e4b49b6cff833dede37e1098
52a398663110b5dc50e72094c287b049ec5ed33a2b639418e4e1a9c3d313b82c
GET /maps-api-v3/embed/js/51/7/init_embed.js HTTP/1.1
Host: maps.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-length: 69373
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 25 Jan 2023 18:33:57 GMT
expires: Thu, 25 Jan 2024 18:33:57 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 23 Jan 2023 21:48:16 GMT
content-type: text/javascript
age: 288635
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 8cf65fcdafa84b63cf7005fe57927fcb
3f7d163a96e7f00eb2de9828624ec46e22b4b40a
dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 02:44:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16061
Expires: Sun, 29 Jan 2023 07:12:14 GMT
Date: Sun, 29 Jan 2023 02:44:33 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16061
Expires: Sun, 29 Jan 2023 07:12:14 GMT
Date: Sun, 29 Jan 2023 02:44:33 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16061
Expires: Sun, 29 Jan 2023 07:12:14 GMT
Date: Sun, 29 Jan 2023 02:44:33 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16061
Expires: Sun, 29 Jan 2023 07:12:14 GMT
Date: Sun, 29 Jan 2023 02:44:33 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16061
Expires: Sun, 29 Jan 2023 07:12:14 GMT
Date: Sun, 29 Jan 2023 02:44:33 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg
34.120.237.76200 OK 5.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4c77437e3a7361861aed8bfecbfe6bd6
fefd238c13c0fdfb7d964c90fcc8a8cbbf953034
282d15c443cb6232ae0a30046a0dc24360617355a4651cdba59b11e6f7313d8a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5594
x-amzn-requestid: d56c9b84-dc1f-4d5c-91bf-7db55058bf67
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLyeEGOloAMFpzA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ce3126-5013a6b971d6800c5c85a4eb;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 07:03:02 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: D2ZAelkDgsd0wjoOSoPRwTzhozs84_aIcgwU-QmbDrTnHztVD0VL_A==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 14:57:16 GMT
age: 42437
etag: "fefd238c13c0fdfb7d964c90fcc8a8cbbf953034"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3dade28b-c683-4510-bc44-0207300ccc21.jpeg
34.120.237.76200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3dade28b-c683-4510-bc44-0207300ccc21.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6e46615b79ad2d230e98a2b9c54f4431
db55bd978e18e595d695637183862f8c5e7da5dd
f27875ef624f602be8d93b8bc7fae062bf877fc724473613242da4e493510673
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3dade28b-c683-4510-bc44-0207300ccc21.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6211
x-amzn-requestid: 529cce27-9ee1-4caf-b3ac-3db8216cb155
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fOdPSGFAIAMF2Eg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cf4261-1cbed26b6cf345de3046b6e8;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 02:28:49 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: KYA71q94uZX-mGN9EHC9Perjn0kOscXZCwgjAhYYnQYITBTeN4xmzQ==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 11:21:43 GMT
age: 55370
etag: "db55bd978e18e595d695637183862f8c5e7da5dd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcc7f65e9-ca75-4ecb-ba7c-ae70877eaf01.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcc7f65e9-ca75-4ecb-ba7c-ae70877eaf01.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2f73f114f8dc452fc0b16825570ad50c
6bb1b3db6c36e2c9d23b6cb7d1c8616eeec19575
23fd69e6ccdd2ce2b5d3d8b3f075a07cdb36efd663a4119b5dca22165e7b2090
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcc7f65e9-ca75-4ecb-ba7c-ae70877eaf01.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10030
x-amzn-requestid: 0c6c82b5-f91b-4468-bb25-d87d4d7dedd5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fVAbgERRIAMFdcw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1e116-7f17c79047447dff2de3ab67;Sampled=0
x-amzn-remapped-date: Thu, 26 Jan 2023 02:10:30 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 4C0fCJB3N9nw0xKQnlsRLx_VGA3shg394U3Tq4pxNMWgggZe93TLUA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 20:30:44 GMT
age: 22429
etag: "6bb1b3db6c36e2c9d23b6cb7d1c8616eeec19575"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg
34.120.237.76200 OK 9.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3be81f83687ddb6c93d3ff3c09a9dba2
50a48e737310d3f31840db4301b25927fbcc12c5
e78c909e2381898e7f546183784a05dff47c31734c95358aaada8c2777ad47be
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9167
x-amzn-requestid: e6e0789c-a4a9-4ffa-a0ae-691770d1035b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fPF9YEBmIAMF0kQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cf8388-01d2093432d3959903671a69;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 07:06:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: awfNeaKbFw2bjiTGwUrwUTxU-qbVS2eTjn948H8kn1hy7pi_DwLMlQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 17:35:56 GMT
age: 32917
etag: "50a48e737310d3f31840db4301b25927fbcc12c5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg
34.120.237.76200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6af6f32397882f56d14d22348e44a9f1
5a626376807e7507fa3a204c4e4e9e44aa074a37
478f32e98c0a1f0d62fa337795ca88b7927e14b684b681f7629b648bc2d709a5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7417
x-amzn-requestid: 53032353-8613-49b0-944d-3742236cf50c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fYcMmFeQIAMF3Yw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d340b6-7fe2226327d90db014527c08;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 03:10:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: zd8cTO2N1JO-OK3hCDwVO8naClCsg0raJLboRFle-DPSKhR_7k8-Yg==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 981753271eb5b6d11bc29d52f173a5da.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 03:34:31 GMT
age: 83402
etag: "5a626376807e7507fa3a204c4e4e9e44aa074a37"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg
34.120.237.76200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 43c4a8e963936a8064dbd2bd3c67b905
8508727c97127c98b886833af28b3470306216c2
070c29fe7c0a227029483d675eac863904ab6b291467acdf62167f4845699c21
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8652
x-amzn-requestid: 5a5a883e-d7d4-4fc5-925a-3a95830c504e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fVguyG7BIAMFm8g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d214c4-390b59a32060e41203533c58;Sampled=0
x-amzn-remapped-date: Thu, 26 Jan 2023 05:51:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ewSsCY4u9DwRtaj00U9JCim9tYeCgHRuIQFpdHm4ttI6L02-e44iDQ==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 23:11:24 GMT
age: 12789
etag: "8508727c97127c98b886833af28b3470306216c2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
142.250.74.35200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP 142.250.74.35:0
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 25 Jan 2023 19:33:54 GMT
expires: Thu, 25 Jan 2024 19:33:54 GMT
cache-control: public, max-age=31536000
age: 285039
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
142.250.74.35200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP 142.250.74.35:0
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 25 Jan 2023 07:51:59 GMT
expires: Thu, 25 Jan 2024 07:51:59 GMT
cache-control: public, max-age=31536000
age: 327154
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2