Report - s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967

Report Overview

Submitted URL
s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967
IP
94.237.84.54
ASN
#202053 UpCloud Ltd
Submitted
2023-01-27 05:10:44
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
16

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.4 kB	8.9 kB	23.36.76.226
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
s3ntry.net	310352	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	518 B	293 B	162.55.168.249
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.89.106.162
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	56 kB	34.120.237.76
s.naughtylotto.net	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	28 kB	192 kB	94.237.93.242

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-27	medium	s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33	Phishing
2023-01-27	medium	s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6	Phishing
2023-01-27	medium	s.naughtylotto.net/img/offers/win_gift/background.svg	Phishing
2023-01-27	medium	s.naughtylotto.net/img/offers/win_gift/giftbox-back.svg	Phishing
2023-01-27	medium	s.naughtylotto.net/img/offers/win_gift/giftbox-front.svg	Phishing
2023-01-27	medium	s.naughtylotto.net/img/offers/win_gift/giftbox-lid.svg	Phishing
2023-01-27	medium	s.naughtylotto.net/img/offers/prizewheel_chat/icon-send.svg	Phishing
2023-01-27	medium	s.naughtylotto.net/img/offers/prizewheel_chat/icon-emoji.svg	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967	553 B	2023-03-13	2023-03-13
Pretty URL s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967 IP 94.237.93.242 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 08:08:02 Last Seen2023-03-13 08:08:02 Times Seen1 Hash c699e8df1c076bb3eb3e043179f8506b ff0a275a522830d95a89e3c5c376094cd1fc7fcd df44ae88e8c589d59b91412384873c1d990a7894a9d52e9b488609e666dc0d9e Loading...

	s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967	654 B	2023-03-13	2023-03-13
Pretty URL s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967 IP 94.237.93.242 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 08:08:02 Last Seen2023-03-13 08:08:02 Times Seen1 Hash 392e3988b5e9c16d6835d2914ec6a483 809b2b6c746c046cf52e4e6163ca5f817d8a9b25 a0d5e098cbeaaac469213800a41b789474c9450b71a01f7dc353ce8436837430 Loading...

	unknown	0 B	2023-03-07	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-26 16:21:32 Times Seen37095629 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6	190 kB	2023-03-13	2023-03-13
Pretty URL s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6 IP 94.237.93.242 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 07:45:30 Last Seen2023-03-13 12:05:58 Times Seen1 Hash d837db9160e8db17ac7ed695d8d0bde6 961b8b6699089e130ac6dcd61062d227fc7fcdd7 42adf20b9944760e5d5c1bf059a073376bb06dfc45fd50f22e357d0576b0fd91 Loading...

HTTP Transactions (35)

URL IP Response Size

s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967

94.237.93.242

200 OK

4.0 kB

URL HTTP/1.1
s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5882)
Size
4.0 kB (4005 bytes)
Hash
a6054613328f90a8b7c4edc2df1783d8
2201257b4278842002741eb8c9e5375520c47a1f
29edbf5de13eb92d6bb46ba4f50dd7d29eaeca169c4d20818c7847d08b8d5abb

HTTP Headers

GET /win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967 HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Cache-Control: no-cache, private
Date: Fri, 27 Jan 2023 05:10:33 GMT
Log-Id: fbfd28f9-1bcd-4743-8497-8da9d938ed88
Set-Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; expires=Fri, 27-Jan-2023 07:10:33 GMT; Max-Age=7200; path=/
ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; expires=Fri, 27-Jan-2023 07:10:33 GMT; Max-Age=7200; path=/; httponly
SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; path=/; httponly
visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; expires=Sat, 28-Jan-2023 05:10:33 GMT; Max-Age=86400; path=/; httponly
KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9; expires=Fri, 27-Jan-2023 07:10:33 GMT; Max-Age=7200; path=/; httponly
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5fe582397f3003b225cb9058e02c2190
68174a54a8f6c4de9247ccea2dcae3c9b76bdb9f
238a2ef5b61d56353d0a5e97ec3092b8f2792cde7cecf40e1a858f8c129d3a9d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "238A2EF5B61D56353D0A5E97EC3092B8F2792CDE7CECF40E1A858F8C129D3A9D"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11733
Expires: Fri, 27 Jan 2023 08:26:06 GMT
Date: Fri, 27 Jan 2023 05:10:33 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2405562765b49b2782ebd2e2994851d5
be7ac8e558f7875bb1fb86ab5ec674424a5ff269
422cfa907461cb7b93b9089d600052f9e94951e5e0c93d97651905002e48ad3e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "422CFA907461CB7B93B9089D600052F9E94951E5E0C93D97651905002E48AD3E"
Last-Modified: Thu, 26 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13880
Expires: Fri, 27 Jan 2023 09:01:53 GMT
Date: Fri, 27 Jan 2023 05:10:33 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Backoff, Content-Length, Alert, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 27 Jan 2023 04:42:58 GMT
content-type: application/json
age: 1655
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
49049f3c92aad686cd7ff28ecd2a5a4f
9cc2bc9c055450dbc4fae93eabe4ef8509b3ff57
02cf421968192286bb174ff0e6c818a843c4eca61a02cd493e6f95bb58a37015

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "02CF421968192286BB174FF0E6C818A843C4ECA61A02CD493E6F95BB58A37015"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8261
Expires: Fri, 27 Jan 2023 07:28:14 GMT
Date: Fri, 27 Jan 2023 05:10:33 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: V9+b5FWXCVW7xXo+i4iWmFiPDaXkIvQGJ3iJOP6mYdPKjLAT5itEzmSofLCwesVP6cb1ndcS3iM=
x-amz-request-id: 9F8XNE6BK7QJ4VDR
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 27 Jan 2023 04:20:23 GMT
age: 3010
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 27 Jan 2023 05:10:33 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33

94.237.93.242

200 OK

1.3 kB

URL HTTP/1.1
s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
ASCII text, with very long lines (4365)
Size
1.3 kB (1345 bytes)
Hash
6e57861cd8455d3ae5645f268c9c8ec0
b628b639132ee93326e8f38b794b4dffa12cac48
552bfe378d3f4f5518ab65df2048ed7c669750a24fca58eca351e99b72cbfa48

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33 HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:33 GMT
Content-Type: text/css
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-1131"
Expires: Sat, 27 Jan 2024 05:10:33 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
30ab3600c4010d1c62c0c56c4d5e9987
3c20c1dd9990f0d6429f9228d1bba7cd8222534d
2bdc92291d207e6284bb04a9838c1ac1e5e804f2cdf706c5a2778c1188857893

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2BDC92291D207E6284BB04A9838C1AC1E5E804F2CDF706C5A2778C1188857893"
Last-Modified: Thu, 26 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17326
Expires: Fri, 27 Jan 2023 09:59:20 GMT
Date: Fri, 27 Jan 2023 05:10:34 GMT
Connection: keep-alive

s.naughtylotto.net/js/offers/win_gift/app.js?id=6706379132cc6d289c6faa60cec31b02

94.237.93.242

200 OK

84 kB

URL HTTP/1.1
s.naughtylotto.net/js/offers/win_gift/app.js?id=6706379132cc6d289c6faa60cec31b02
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
Unicode text, UTF-8 text, with very long lines (65443)
Size
84 kB (83482 bytes)
Hash
33161d213d9c3e17b971040994331868
5252aef8131e99989d4e0f117680f15744f08654
2576df8f42d3d1f927acb2ea707f4047f0b5376a6e4bf02c9eca43b99f2152e3

HTTP Headers

GET /js/offers/win_gift/app.js?id=6706379132cc6d289c6faa60cec31b02 HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-3ff1b"
Expires: Sat, 27 Jan 2024 05:10:34 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6

94.237.93.242

200 OK

64 kB

URL HTTP/1.1
s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
Unicode text, UTF-8 text, with very long lines (65474)
Size
64 kB (63554 bytes)
Hash
40f4ac2a307fd204e8474e9159a5eed1
098de131c72307928b6f2f3a4e9ef0ab7cda208d
d704547d50c71714a8c60c714f9eadb0b2e258e28aeb46fa460eb1a6246510bb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6 HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-2e42c"
Expires: Sat, 27 Jan 2024 05:10:34 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

s.naughtylotto.net/img/offers/win_gift/background.svg

94.237.93.242

200 OK

1.3 kB

URL HTTP/1.1
s.naughtylotto.net/img/offers/win_gift/background.svg
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2410), with no line terminators
Size
1.3 kB (1332 bytes)
Hash
ec68faffdc87ba4c1e7c794cd60742b4
aaed5a2a605cdd3aed30e59701d2612c1578d1cc
e268b37f5afb3342fd636fdfc69bb2815b37c2f88dddabf6204a84375f0b89fe

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /img/offers/win_gift/background.svg HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-96a"
Expires: Sat, 27 Jan 2024 05:10:34 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

s.naughtylotto.net/img/prizes/iphone-14/default@0.5x.png

94.237.93.242

200 OK

5.3 kB

URL HTTP/2
s.naughtylotto.net/img/prizes/iphone-14/default@0.5x.png
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
PNG image data, 200 x 200, 8-bit colormap, non-interlaced\012- data
Size
5.3 kB (5264 bytes)
Hash
690405dcbcd7e4230f747dc6ed50af82
725b37ab28b407cfa6f3c7bbb005ded1c8393477
e2d184b35e5bdc7916d85dca09ef2e4a292563a14cf9cda0eea65a3a9861ac5e

HTTP Headers

GET /img/prizes/iphone-14/default@0.5x.png HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://s.naughtylotto.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Fri, 27 Jan 2023 05:10:34 GMT
content-type: image/png
content-length: 5264
last-modified: Thu, 26 Jan 2023 10:57:04 GMT
etag: "63d25c80-1490"
expires: Sat, 27 Jan 2024 05:10:34 GMT
pragma: public
cache-control: max-age=31536000, public
accept-ranges: bytes
X-Firefox-Spdy: h2

s.naughtylotto.net/img/offers/win_gift/lightburst.png

94.237.93.242

200 OK

20 kB

URL HTTP/1.1
s.naughtylotto.net/img/offers/win_gift/lightburst.png
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
PNG image data, 500 x 500, 8-bit colormap, non-interlaced\012- data
Size
20 kB (19605 bytes)
Hash
a62dcec0bc0485ca2c254e27eeaa3b9f
94a7bf5150122a6acbf27c57d47d65dc7a1de04f
bd993a3438e817075745276a66be99e3171832ff7496e759b7065061b2a81a26

HTTP Headers

GET /img/offers/win_gift/lightburst.png HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: image/png
Content-Length: 19605
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
ETag: "63d25cd9-4c95"
Expires: Sat, 27 Jan 2024 05:10:34 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes

s.naughtylotto.net/img/offers/win_gift/giftbox-back.svg

94.237.93.242

200 OK

386 B

URL HTTP/1.1
s.naughtylotto.net/img/offers/win_gift/giftbox-back.svg
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (701), with no line terminators
Size
386 B (386 bytes)
Hash
66ff7ecb9258a98e85838792f74405c6
0580213668dc4b5e6e11dd10a9370dbfa1f455c9
28dbe1cbb4e0ccf7c3d420f42760aabdc0cc3d104a6e4e782df4db8f94706402

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /img/offers/win_gift/giftbox-back.svg HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-2bd"
Expires: Sat, 27 Jan 2024 05:10:34 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

s.naughtylotto.net/img/offers/win_gift/giftbox-front.svg

94.237.93.242

200 OK

475 B

URL HTTP/1.1
s.naughtylotto.net/img/offers/win_gift/giftbox-front.svg
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (880), with no line terminators
Size
475 B (475 bytes)
Hash
1fc6070edaf8400056c3c68f7f06c480
67d8d2b3a7fd115e1b13d586fadb096b4cd456f2
97a44e5b5e25f59150bff4d0594c30d6022f483198800874f354e598d9b63cde

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /img/offers/win_gift/giftbox-front.svg HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-370"
Expires: Sat, 27 Jan 2024 05:10:34 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

s.naughtylotto.net/img/offers/win_gift/giftbox-lid.svg

94.237.93.242

200 OK

2.1 kB

URL HTTP/1.1
s.naughtylotto.net/img/offers/win_gift/giftbox-lid.svg
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (4806), with no line terminators
Size
2.1 kB (2141 bytes)
Hash
a3ff924c41d7c6baa756124d6db6b4df
e87a833b59923216d716cd64448bb5ecda1ea9cf
29a9859d2fa1562386fb54e4cc357229474d032d830f04bc17512202092befd7

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /img/offers/win_gift/giftbox-lid.svg HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/css/offers/win_gift/app.css?id=e4e483488cb0925238eb7b0ee9b37a33
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-12c6"
Expires: Sat, 27 Jan 2024 05:10:34 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9bb7cc9c60c0b17212b9cfbb007f85ec
f24138bcc579dcd21016ede1996a5e3c19e0cf01
2d9062240da29b835b9736d4dff58ef98c2fb025d4b19259978cd17060936e9c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2D9062240DA29B835B9736D4DFF58EF98C2FB025D4B19259978CD17060936E9C"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14123
Expires: Fri, 27 Jan 2023 09:05:57 GMT
Date: Fri, 27 Jan 2023 05:10:34 GMT
Connection: keep-alive

s3ntry.net/api/18/envelope/?sentry_key=ccd7567c32f347d999f51c043b0ccde6&sentry_version=7

162.55.168.249

200 OK

2 B

URL HTTP/1.1
s3ntry.net/api/18/envelope/?sentry_key=ccd7567c32f347d999f51c043b0ccde6&sentry_version=7
IP
162.55.168.249:0
ASN
#24940 Hetzner Online GmbH

File type
JSON data\012- , ASCII text, with no line terminators
Size
2 B (2 bytes)
Hash
99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

HTTP Headers

POST /api/18/envelope/?sentry_key=ccd7567c32f347d999f51c043b0ccde6&sentry_version=7 HTTP/1.1
Host: s3ntry.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://s.naughtylotto.net/
Content-Type: text/plain;charset=UTF-8
Origin: http://s.naughtylotto.net
Content-Length: 434
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 27 Jan 2023 05:10:34 GMT
Content-Type: application/json
Content-Length: 2
Connection: close
access-control-allow-origin: http://s.naughtylotto.net
access-control-expose-headers: x-sentry-rate-limits, retry-after, x-sentry-error
vary: Origin

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Last-Modified, ETag, Content-Length, Expires, Cache-Control, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 27 Jan 2023 04:41:40 GMT
age: 1734
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c398b6b39d11d25b8ae9bc5cd94a1c98
640aa8c399ced71d0c2a9f5a90fbaf091b01d642
a6f07f7c6a4746acc25457c726701df33120628dfb578bc4982448d8efee5855

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A6F07F7C6A4746ACC25457C726701DF33120628DFB578BC4982448D8EFEE5855"
Last-Modified: Tue, 24 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12812
Expires: Fri, 27 Jan 2023 08:44:06 GMT
Date: Fri, 27 Jan 2023 05:10:34 GMT
Connection: keep-alive

push.services.mozilla.com/

52.89.106.162

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.89.106.162:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: MjpjVq5lkMnoGdt13uZA8g==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: ZGtIRzUt2f8Abt9REi5TOEc/7g4=

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4172
Expires: Fri, 27 Jan 2023 06:20:08 GMT
Date: Fri, 27 Jan 2023 05:10:36 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4172
Expires: Fri, 27 Jan 2023 06:20:08 GMT
Date: Fri, 27 Jan 2023 05:10:36 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4172
Expires: Fri, 27 Jan 2023 06:20:08 GMT
Date: Fri, 27 Jan 2023 05:10:36 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4172
Expires: Fri, 27 Jan 2023 06:20:08 GMT
Date: Fri, 27 Jan 2023 05:10:36 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53bbd20e-50aa-4ce8-8565-a97b3c8ee694.jpeg

34.120.237.76

200 OK

8.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53bbd20e-50aa-4ce8-8565-a97b3c8ee694.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.0 kB (7973 bytes)
Hash
02c8d9f27e0d17c38a55da6699dfb96e
6804d00e292afc0b7aadb08b11e7650488dacaa2
1ce3b93f1348649ddca495022525daf6d760823edd67bb9e506c7ee031a849b1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53bbd20e-50aa-4ce8-8565-a97b3c8ee694.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7973
x-amzn-requestid: acaa2abf-9789-4953-b3ab-98064a9a0137
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fXrXvHvBIAMFkQg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d2f297-2dc2c04e2a491b3f7f5e8370;Sampled=0
x-amzn-remapped-date: Thu, 26 Jan 2023 21:37:27 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Dw4ycOqAZkaeJgMvGEOlqphQjDZVO5umrvlSh_Gnx9i_6saWVl8dLw==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Thu, 26 Jan 2023 21:47:56 GMT
age: 26560
etag: "6804d00e292afc0b7aadb08b11e7650488dacaa2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fde58379f-114f-469a-b64a-4c60841b1a18.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.7 kB (5703 bytes)
Hash
f4b88ea6f29f683c4b46a7487fce35a5
fa64e1287967459f665d337865a2333b4fdc4c33
f0290a9132b343d91426385e31c61cad787b5e82878b5015c13d4c356e387787

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fde58379f-114f-469a-b64a-4c60841b1a18.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5703
x-amzn-requestid: 39b3ba3a-d049-4555-a04a-e3d55b90478f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fR1d1F8nIAMFTEw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d09c58-2dc0f52e71e822f71fed1456;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 03:04:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Llt0BnmCEL0H6v4DHYktatbn7H8KeQhNW0AXkP_EOxOmjx8aQuMdiA==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 04:45:35 GMT
age: 1501
etag: "fa64e1287967459f665d337865a2333b4fdc4c33"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5163812c-4389-44eb-b150-06b17c4ce709.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10320 bytes)
Hash
f819bef602c1582c03369ae192781a18
ceba3fe645526c11f53327a672cc8bee5a26d730
5084edafadd1835817389ba77457a6b19d909b7da4d16d5660a7c0749cab288e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5163812c-4389-44eb-b150-06b17c4ce709.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10320
x-amzn-requestid: 53838261-aa68-414f-a161-d2b8b64d69c6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fBYVuEr4oAMFQ8Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ca0757-135d8d6c3578bfb511e0df7d;Sampled=0
x-amzn-remapped-date: Fri, 20 Jan 2023 03:15:35 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: kGzVJN6CbU8kcEeg2f4KWcU1sk4qZbS73I6NVyFmg4DqXZ4bErkqzA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 3cd7af07832481c336aa1c93c9b4a6fe.cloudfront.net (CloudFront), 1.1 google
date: Thu, 26 Jan 2023 14:18:34 GMT
age: 53522
etag: "ceba3fe645526c11f53327a672cc8bee5a26d730"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F16430244-f45f-4aea-a8a8-2b1f37fa80ef.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.7 kB (5737 bytes)
Hash
5e7158416f60576804ccff03307319fe
a342f94625e913fa6b8d862a59979f1e3ad80dd1
5c525df7d169cc7e033d920c11f4a0163a781c025a22b70530882b56964a9a52

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F16430244-f45f-4aea-a8a8-2b1f37fa80ef.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5737
x-amzn-requestid: cc977ea9-c418-4a5a-a13b-c86e16bbe6ba
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fRGPFGL5oAMFiSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d050c6-2d540cac5ca7d4e64cfdb8bc;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 21:42:30 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: uZnA5gkRlZyqamh_n3992G9PlMJa4gJ-mjSOQEysII73dDKLXmeXsg==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 26 Jan 2023 12:26:22 GMT
age: 60254
etag: "a342f94625e913fa6b8d862a59979f1e3ad80dd1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfb887e5-87fa-4855-b0ee-712d39779fa0.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11568 bytes)
Hash
b7a0759c043594fbe85af422b59b8227
a05cfaad16078f42218dae233da38f6f5dff8487
e898d6ef1b3998fb9322a8fc190069ec5f7b3582bfe8397a2367497d84a27549

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfb887e5-87fa-4855-b0ee-712d39779fa0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11568
x-amzn-requestid: 79b70f1f-a157-4dd4-8743-825714195b3c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e9T3UGA3oAMFSlQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c86695-36e60aba09c152c73b8aefcb;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 21:37:25 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: zt4bgV2C6Wb_Ufa5mZ7-UDTfCvhXJggPJw9668v5DEmyBnWZ-aNrCg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Thu, 26 Jan 2023 23:01:22 GMT
age: 22154
etag: "a05cfaad16078f42218dae233da38f6f5dff8487"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59e67210-efa8-4704-9931-e876d7c8922b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.1 kB (8065 bytes)
Hash
262b43386e404cb3d320c47c4cf792c1
87f304f8583fe6b6e942a9dbcb5efb5ee94987f2
ca0f72005920b2b2f49c387314540f3cd2f3d7808f0365dfb1c491500e8a8714

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59e67210-efa8-4704-9931-e876d7c8922b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8065
x-amzn-requestid: 4a4a6d4c-9c4b-418d-be96-8a0d1de4828a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fBYVuHZsoAMFmWw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ca0757-74c21aa22d11c4240019a4b3;Sampled=0
x-amzn-remapped-date: Fri, 20 Jan 2023 03:15:35 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: TXXkkbJHyvwrly_-5FH0EIkRm4EwlDJxGWBHcbwax2H_ccfMfs-5PQ==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 26 Jan 2023 21:47:08 GMT
age: 26608
etag: "87f304f8583fe6b6e942a9dbcb5efb5ee94987f2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

s.naughtylotto.net/img/offers/win_gift/avatar.jpg

94.237.93.242

200 OK

3.6 kB

URL HTTP/2
s.naughtylotto.net/img/offers/win_gift/avatar.jpg
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3\012- data
Size
3.6 kB (3643 bytes)
Hash
7fa820fd27661cce2bdf1db6c6639d45
f47d78a8b6f959c939b091be576239189d006709
9394954ffd9694457ed5d5a129e0986f7fb01996b0b7a32157d6bee11b843a8a

HTTP Headers

GET /img/offers/win_gift/avatar.jpg HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://s.naughtylotto.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Fri, 27 Jan 2023 05:10:39 GMT
content-type: image/jpeg
content-length: 3643
last-modified: Thu, 26 Jan 2023 10:58:33 GMT
etag: "63d25cd9-e3b"
expires: Sat, 27 Jan 2024 05:10:39 GMT
pragma: public
cache-control: max-age=31536000, public
accept-ranges: bytes
X-Firefox-Spdy: h2

s.naughtylotto.net/img/offers/prizewheel_chat/icon-send.svg

94.237.93.242

200 OK

183 B

URL HTTP/1.1
s.naughtylotto.net/img/offers/prizewheel_chat/icon-send.svg
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Size
183 B (183 bytes)
Hash
6d6606986625a891ed37f0bdfd21cfd9
a593b74217e9f6d52b4b498d64f432188fb6652f
a4bb607f081511945c4202b312dd04999cb60b185f7f1228dd1140a09649e62a

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /img/offers/prizewheel_chat/icon-send.svg HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:39 GMT
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-d0"
Expires: Sat, 27 Jan 2024 05:10:39 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

s.naughtylotto.net/img/offers/prizewheel_chat/icon-emoji.svg

94.237.93.242

200 OK

313 B

URL HTTP/1.1
s.naughtylotto.net/img/offers/prizewheel_chat/icon-emoji.svg
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (564), with no line terminators
Size
313 B (313 bytes)
Hash
c8812c1f523a362d4bccbb44500f65ec
184c40a8e82eeef5ae7ec72489868fde8e9f0be9
e87db177ec4fd7038ce8a909dc63d533c7f8d621586830466e5e40fdbf03e958

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /img/offers/prizewheel_chat/icon-emoji.svg HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/win_gift?tid=5xpwo96lf6lxwid5hxd0kk48g,16441572,5,&ctrack=1674796216.2981973967
Cookie: XSRF-TOKEN=eyJpdiI6IlFyWVNZNGt2RWdsdnREMEtZaHdWUkE9PSIsInZhbHVlIjoidGlhdkpYemJpeWQzMDlPNWhwZEFmdEkvQWptVFRJY29pNXozVTdIM1h4aTNieXY5WWdvR0dFeFRnQysyTTE4R2k1VFVyS2owZjE5U3pTVUlxNmorcmdpMUxqOUlZMXBmVTRYKzlndVdWL2MwYkNGbG8yRGp1ek9zNTlyc2c0bmIiLCJtYWMiOiJkODgwOGIwMDFkOWE2YWY1YjkxNGM3MDVjNTE2ZTFiMzY4MzU1MzZmMGU3YmExODg1Y2U1OTIxZWJhMmVlNTY5IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6Img5ZUYvNVVMSDVzU081eUVZS2hJNXc9PSIsInZhbHVlIjoiVW8rSXgvdHg1cGFEcEpRVFZBd0FENW1PdmlYYnZuVWFxVGo2V1h4cUdBZWlLZ2lDdnZWN3RJZnZ4RXJ4WmdHeWpDYjlucVlmTHdvaUkyRjhhaU5FeVJXN1BIUE43WDYwSmtSdTlsYUxyblYzcUZtSGZrdUxTdGkwenNaL29ObWgiLCJtYWMiOiIzMDdkYjRiMTI5N2Y5OGY4Y2M5ZTY3MTJjOWMwYTk2NDgyOWJmZGQwZjg3ZGEyNTBmZDJhZDVmNWMzYWE4ZDUyIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6IlFpS1lJZHU3eFovZ0pvNmRjL0RQNmc9PSIsInZhbHVlIjoiQlV1MVJRbFN4ZHBUeHJlWEt1ck5pWnA1QU51WS9zVmVwNXhnNENCdXlBTGxiRVE2TXFJMTVwb3AvRHk0RER0a2hmYmZXY2hUSEdQRThFT04zNWxjS1pvY1ZzbmVFQ2dmN2c5TzhDdjRYMnJINlgzRVphZVZZeUd1ZWovQ01oL3F2M3IzVHg5am0zSXc1aGRZeisrT3FXbmNXMTVWSDdHUXg1VTRsMkJNb2xJPSIsIm1hYyI6IjJmOGI0M2ExYjQ2N2NlODExYjI4NTc5NWVjZmZhMzFmNzE1NzBiOTE1M2QzMmE4ZDFlYjFkN2FlYjQ1ODM1ZGMiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6InNSQ2xnRW1GZXFBMmQzMHpkc1VEalE9PSIsInZhbHVlIjoialJFSVUzTWFsenRob0dOZHRoY09jSWwxNngrOTkyZ2s5UFdqOVRJZzB2M0tGWXQzc1ZJQ2Jla1hTSlAvRDY5NiIsIm1hYyI6ImQwYmUxZWE3NjI0MmY2YTMzZTk5ZmJjMjc2ZTQ0ODk0OTY1ZTgyYzBmYmIxNjdkNzQ4NjA0YmVmODRmZWZmNmIiLCJ0YWciOiIifQ%3D%3D; KRBvsRLWlzFEstcjGcqLTEA6LYm9QxRkCBT7TDe2=eyJpdiI6ImJIQ3ZpZFVTQUg4cXAyeGVaUUpWU2c9PSIsInZhbHVlIjoiNEVCSE1VWlYrSVN0aHl0VzdFd1JNT0NJOFRTZjVmazVtc0s1ZFUxek85WWlFMXpPOSthUGhvYytRQTNVYnUxbDlOTG5zeHhUbFhrOWJLN2c4VDY3bkF5MjZpTWdWTloyM1JFZVE0Z2xPdkVyV0l5Y1Ftb3dESmlFQS9lUURlUnRYdkpmQURueUx2dnVmR1kvL2pDZVE3SzFoUFpFQk51OFprR3NvNDVrL25CSEl6WEZnOHBGRVBBeWpMUGdjbS9zYUNHUll5NVo0c1JBaWNIQ2tDdnpla0JPUE5qSnN5cTFZaHZRbmFhTWVGMDZ4M1BCYmo5YVRURWRyY01vaTRpc3VFVW1ya0tocWVEK1JWNnp3bmxpV09SSTRDeVhSaDJxN2J0R3ZkUkhJaXZoSk5WazlkVlE1d1N5b2c0Q1hLUjA3cFhuZkg5N3RFdHdRWEdBZVcvdUJqQytyU0NBdHF4T0FQMVJ1M0Vuekd2dGxKdm5oaXJ0TVptTlRrNmRkaTRvcU5zeWVxT3ZtT1VDUHAvQXExT0VtL3c5bVV6UkJYRGJsTFUxcm5vSW83WUg1T1N0djdGaXF5L0QxVVFHUTVHU204eWVBai9IR0VkMWpDeTNQTDczbGVhTlZIZG1CaVhvcmFoa2twTjExdkk9IiwibWFjIjoiZTkyMjFjNGIzMDQ5ZGJhZGI5N2U2ZjhiOWE5YTA4MjM1ZGJiMWZjNjkyMDY4OTZiMjE1YTljN2M5MTJkYTg4YSIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Fri, 27 Jan 2023 05:10:39 GMT
Content-Type: image/svg+xml
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-234"
Expires: Sat, 27 Jan 2024 05:10:39 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (35)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers