Overview

URLgoodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb
IP 74.208.236.35 (United States)
ASN#8560 IONOS SE
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2023-01-24 18:51:15 UTC
StatusLoading report..
IDS alerts0
Blocklist alert10
urlquery alerts
10
Phishing - Capital One
Tags capitalone financial phishing

Domain Summary (10)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
ecm.capitalone.com (3) 13649 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1441 86748 104.110.12.190
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5844 34.160.144.191
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 391 34.117.237.239
ocsp.digicert.com (4) 86 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1364 3128 93.184.220.29
goodkarmapay.com (12) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 7938 278364 74.208.236.35
cdnjs.cloudflare.com (1) 235 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 391 11936 104.17.25.14
r3.o.lencr.org (6) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2028 5321 23.36.77.32
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2373 35.241.9.150
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 52.34.4.233
img-getpocket.cdn.mozilla.net (6) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3246 61339 34.120.237.76

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Capital One Financial Corporation

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing
2023-01-24 medium goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF (...) Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 74.208.236.35
Date UQ / IDS / BL URL IP
2023-01-28 02:25:03 UTC 0 - 0 - 10 goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346D (...) 74.208.236.35
2023-01-24 18:52:21 UTC 10 - 0 - 12 goodkarmapay.com/ct.d/28448cbea1ecdaebe67346d (...) 74.208.236.35
2023-01-24 18:51:53 UTC 10 - 0 - 14 goodkarmapay.com/ct.d/28448cbea1ecdaebe67346d (...) 74.208.236.35
2023-01-24 18:51:38 UTC 10 - 0 - 10 goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346D (...) 74.208.236.35
2023-01-24 18:51:15 UTC 10 - 0 - 10 goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346D (...) 74.208.236.35


Last 5 reports on ASN: IONOS SE
Date UQ / IDS / BL URL IP
2023-06-04 14:35:47 UTC 0 - 4 - 0 abcfotografia.com/ 217.160.0.254
2023-06-04 12:21:02 UTC 0 - 1 - 0 downloads.mybuks.de/setup_mybuks.exe 82.165.100.91
2023-06-04 11:38:36 UTC 0 - 0 - 26 sunrisen-salesportal.net/ 217.160.0.67
2023-06-04 10:50:23 UTC 0 - 1 - 0 www.softwareok.com/Download/StressMyPC.zip 66.175.232.167
2023-06-04 10:35:03 UTC 0 - 1 - 0 pc-cleaners.com/app3-Spanish.exe 74.208.10.122


Last 5 reports on domain: goodkarmapay.com
Date UQ / IDS / BL URL IP
2023-01-28 02:25:03 UTC 0 - 0 - 10 goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346D (...) 74.208.236.35
2023-01-24 18:52:21 UTC 10 - 0 - 12 goodkarmapay.com/ct.d/28448cbea1ecdaebe67346d (...) 74.208.236.35
2023-01-24 18:51:53 UTC 10 - 0 - 14 goodkarmapay.com/ct.d/28448cbea1ecdaebe67346d (...) 74.208.236.35
2023-01-24 18:51:38 UTC 10 - 0 - 10 goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346D (...) 74.208.236.35
2023-01-24 18:51:15 UTC 10 - 0 - 10 goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346D (...) 74.208.236.35


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-03-03 06:18:56 UTC 10 - 0 - 5 secure02-capital1verification-ecm.com/gc/acco (...) 74.208.236.173
2023-02-24 07:08:13 UTC 10 - 0 - 10 webtrack.transcaribe.com/un_c/RUn9nvS4vSZCYpv (...) 74.208.236.39
2023-02-23 19:04:31 UTC 10 - 0 - 11 webtrack.transcaribe.com/ier_d/re/ 74.208.236.39
2023-01-29 07:04:34 UTC 10 - 0 - 10 www.bluekapwa.ca/cfg/2DB17B39BD22D4D7856D26F2 (...) 74.208.236.111
2023-01-28 06:07:33 UTC 10 - 0 - 12 agency.crostracker.com/un_c/RUn9nvS4vSZCYpvud (...) 74.208.236.39

JavaScript

Executed Scripts (4)

Executed Evals (1)
#1 JavaScript::Eval (size: 5760) - SHA256: c434981231757e151338d82440787196d61aff8e65c9cd890ada8ffcfba2c2e0
function collectDFP() {
    var a, d, i, f, c;
    a = {};
    d = [];
    i = fnGetTime();
    f = fnGetTime();
    var b = fnBrowserCurrentTimeStamp();
    a.userAgent = fnBrowserUserAgent();
    c = fnGetTime();
    d.push((c - f) + "");
    a.timezone = fnBrowserTimeZone();
    f = fnGetTime();
    d.push((f - c) + "");
    a.screen = fnBrowserScreen();
    c = fnGetTime();
    d.push((c - f) + "");
    a.language = fnBrowserLanguage();
    f = fnGetTime();
    d.push((f - c) + "");
    a.fonts = fnBrowserFontsOld();
    c = fnGetTime();
    d.push((c - f) + "");
    a.plugins = fnBrowserPluginsOld();
    f = fnGetTime();
    d.push((f - c) + "");
    a.cookieEnabled = fnBrowserCookieEnabled();
    c = fnGetTime();
    d.push((c - f) + "");
    a.javaEnabled = fnBrowserJavaEnabled();
    f = fnGetTime();
    d.push((f - c) + "");
    a.touchEnabled = fnBrowserTouchEnabled();
    c = fnGetTime();
    d.push((c - f) + "");
    a.silverLight = fnBrowserSilverLightDetails();
    f = fnGetTime();
    d.push((f - c) + "");
    a.flash = fnBrowserFlashDetails();
    c = fnGetTime();
    d.push((c - f) + "");
    a.canvas = fnBrowserCanvasHash();
    f = fnGetTime();
    d.push((f - c) + "");
    a.trueBrowser = fnBrowserTrueAgent();
    c = fnGetTime();
    d.push((c - f) + "");
    var h = JSON.stringify(a);
    a.tcn = fnTCN(b) + "";
    f = fnGetTime();
    d.push((f - c) + "");
    a.browser = fnBrowserInfo();
    c = fnGetTime();
    d.push((c - f) + "");
    a.system = fnBrowserSystemInfo();
    f = fnGetTime();
    d.push((f - c) + "");
    a.connectionInfo = fnBrowserConnectionInfo();
    c = fnGetTime();
    d.push((c - f) + "");
    a.latency = fnBrowserLatency();
    f = fnGetTime();
    d.push((f - c) + "");
    a.formFields = fnBrowserFormFields();
    c = fnGetTime();
    d.push((c - f) + "");
    a.version = fnBrowserDevicePrintVersion();
    f = fnGetTime();
    d.push((f - c) + "");
    a.timestamp = b;
    c = fnGetTime();
    d.push((c - f) + "");
    a.checksum = fnCSM(h);
    f = fnGetTime();
    d.push((f - c) + "");
    d.push((f - i) + "");
    a.rt = d;
    var g = fnB64Enc(JSON.stringify(a));
    var e = encodeURIComponent(g).replace(/\~/g, "%7E").replace(/\!/g, "%21").replace(/\*/g, "%2A").replace(/\(/g, "%28").replace(/\)/g, "%29").replace(/\'/g, "%27").replace(/\-/g, "%2D").replace(/\_/g, "%5F").replace(/\./g, "%2E");
    return e
}

function fnGetTime() {
    return (new Date()).getTime()
}

function fnCSM(a) {
    var c;
    try {
        c = Sha256.hash(a)
    } catch (b) {}
    return c
}

function mathEval(b, g) {
    var a, c, e = 0,
        f = 0;
    try {
        if (b === undefined || b === null) {
            return 1
        }
        a = b.split(g);
        if (a === undefined || a === null || a.length < 1) {
            return 1
        }
        try {
            e = parseInt(a[0]);
            if (isNaN(e)) {
                e = 0
            }
        } catch (d) {
            e = 0
        }
        for (c = 1; c < a.length; c++) {
            try {
                f = parseInt(a[c]);
                if (isNaN(f)) {
                    f = 0
                }
            } catch (d) {
                f = 0
            }
            if (g == "+") {
                e = e + f
            } else {
                if (g == "-") {
                    e = e - f
                }
            }
        }
        return e
    } catch (d) {
        return 1
    }
}

function fnTCN(a) {
    var e, d, b = 1;
    try {
        if (a === undefined || a === null) {
            a = ""
        }
        e = mathEval(a.replace(/[\t\r\n\v\f!"\#$%&'()*+,\-./:;<=>?@\[\\\]^_`{|}~ 0a-zA-Z]|^(?![\s\S])/gi, "+9").replace(/\+{2,}/gi, "+").replace(/^\+*|\+*$|[^\d+]/gi, ""), "+");
        if (e % 3 == 1) {
            d = e + "+" + (e + "").split("").join("+");
            b = mathEval(d, "+")
        } else {
            if (e % 3 == 2) {
                d = e + "-" + (e + "").split("").join("-");
                b = mathEval(d, "-")
            } else {
                b = e
            }
        }
    } catch (c) {
        b = -1
    }
    return b + ""
}
if (typeof Object.assign != "function") {
    Object.assign = function(d) {
        if (d == null) {
            throw new TypeError("Cannot convert undefined or null to object")
        }
        d = Object(d);
        for (var a = 1; a < arguments.length; a++) {
            var c = arguments[a];
            if (c != null) {
                for (var b in c) {
                    if (Object.prototype.hasOwnProperty.call(c, b)) {
                        d[b] = c[b]
                    }
                }
            }
        }
        return d
    }
}
var Sha256 = {};
Sha256.hash = function(q, p) {
    var v = {
        msgFormat: "string",
        outFormat: "hex"
    };
    var m = Object.assign(v, p);
    switch (m.msgFormat) {
        default:
            case "string":
            q = Sha256.utf8Encode(q);
        break;
        case "hex-bytes":
                q = Sha256.hexBytesToString(q);
            break
    }
    var u = [1116352408, 1899447441, 3049323471, 3921009573, 961987163, 1508970993, 2453635748, 2870763221, 3624381080, 310598401, 607225278, 1426881987, 1925078388, 2162078206, 2614888103, 3248222580, 3835390401, 4022224774, 264347078, 604807628, 770255983, 1249150122, 1555081692, 1996064986, 2554220882, 2821834349, 2952996808, 3210313671, 3336571891, 3584528711, 113926993, 338241895, 666307205, 773529912, 1294757372, 1396182291, 1695183700, 1986661051, 2177026350, 2456956037, 2730485921, 2820302411, 3259730800, 3345764771, 3516065817, 3600352804, 4094571909, 275423344, 430227734, 506948616, 659060556, 883997877, 958139571, 1322822218, 1537002063, 1747873779, 1955562222, 2024104815, 2227730452, 2361852424, 2428436474, 2756734187, 3204031479, 3329325298];
    var w = [1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225];
    q += String.fromCharCode(128);
    var A = q.length / 4 + 2;
    var r = Math.ceil(A / 16);
    var s = new Array(r);
    for (var C = 0; C < r; C++) {
        s[C] = new Array(16);
        for (var B = 0; B < 16; B++) {
            s[C][B] = (q.charCodeAt(C * 64 + B * 4) << 24) | (q.charCodeAt(C * 64 + B * 4 + 1) << 16) | (q.charCodeAt(C * 64 + B * 4 + 2) << 8) | (q.charCodeAt(C * 64 + B * 4 + 3))
        }
    }
    var F = ((q.length - 1) * 8) / Math.pow(2, 32);
    var k = ((q.length - 1) * 8) >>> 0;
    s[r - 1][14] = Math.floor(F);
    s[r - 1][15] = k;
    for (var C = 0; C < r; C++) {
        var n = new Array(64);
        for (var y = 0; y < 16; y++) {
            n[y] = s[C][y]
        }
        for (var y = 16; y < 64; y++) {
            n[y] = (Sha256.g1(n[y - 2]) + n[y - 7] + Sha256.g0(n[y - 15]) + n[y - 16]) >>> 0
        }
        var P = w[0],
            O = w[1],
            L = w[2],
            J = w[3],
            I = w[4],
            G = w[5],
            E = w[6],
            D = w[7];
        for (var y = 0; y < 64; y++) {
            var z = D + Sha256.e1(I) + Sha256.Ch(I, G, E) + u[y] + n[y];
            var x = Sha256.e0(P) + Sha256.Maj(P, O, L);
            D = E;
            E = G;
            G = I;
            I = (J + z) >>> 0;
            J = L;
            L = O;
            O = P;
            P = (z + x) >>> 0
        }
        w[0] = (w[0] + P) >>> 0;
        w[1] = (w[1] + O) >>> 0;
        w[2] = (w[2] + L) >>> 0;
        w[3] = (w[3] + J) >>> 0;
        w[4] = (w[4] + I) >>> 0;
        w[5] = (w[5] + G) >>> 0;
        w[6] = (w[6] + E) >>> 0;
        w[7] = (w[7] + D) >>> 0
    }
    for (var D = 0; D < w.length; D++) {
        w[D] = ("00000000" + w[D].toString(16)).slice(-8)
    }
    var o = m.outFormat == "hex-w" ? " " : "";
    return w.join(o)
};
Sha256.ROTR = function(b, a) {
    return (a >>> b) | (a << (32 - b))
};
Sha256.e0 = function(a) {
    return Sha256.ROTR(2, a) ^ Sha256.ROTR(13, a) ^ Sha256.ROTR(22, a)
};
Sha256.e1 = function(a) {
    return Sha256.ROTR(6, a) ^ Sha256.ROTR(11, a) ^ Sha256.ROTR(25, a)
};
Sha256.g0 = function(a) {
    return Sha256.ROTR(7, a) ^ Sha256.ROTR(18, a) ^ (a >>> 3)
};
Sha256.g1 = function(a) {
    return Sha256.ROTR(17, a) ^ Sha256.ROTR(19, a) ^ (a >>> 10)
};
Sha256.Ch = function(a, c, b) {
    return (a & c) ^ (~a & b)
};
Sha256.Maj = function(a, c, b) {
    return (a & c) ^ (a & b) ^ (c & b)
};
Sha256.utf8Encode = function(a) {
    return unescape(encodeURIComponent(a))
};
Sha256.hexBytesToString = function(b) {
    b = b.replace(" ", "");
    var c = "";
    for (var a = 0; a < b.length; a += 2) {
        c += String.fromCharCode(parseInt(b.slice(a, a + 2), 16))
    }
    return c
};
if (typeof module != "undefined" && module.exports) {
    module.exports = Sha256
};

Executed Writes (0)


HTTP Transactions (37)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "CB028034340B709ECE65E45E8FC1A26A64DD85926BEAA542F308D3F1D5EE2C84"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10553
Expires: Tue, 24 Jan 2023 21:46:58 GMT
Date: Tue, 24 Jan 2023 18:51:05 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "0582B6180687DD95C7FD728F1B9DB4495B807151E309B608AD203D69708F9DA6"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16057
Expires: Tue, 24 Jan 2023 23:18:42 GMT
Date: Tue, 24 Jan 2023 18:51:05 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 24 Jan 2023 18:42:45 GMT
age: 500
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    dcd75ca6daca51c5e39d431468511793
Sha1:   07f76d3bf23d65c9110d810fa71a994e39e085d3
Sha256: 73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "9750518EFD869DA5FF74BA65A196445BD4340C909157CC1A420F62C1D07224A0"
Last-Modified: Mon, 23 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2823
Expires: Tue, 24 Jan 2023 19:38:08 GMT
Date: Tue, 24 Jan 2023 18:51:05 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: VSMZ8Nz+ZsI10i6ZwCP8/oz87xL2/Bij3/NywjQErzUsQ1eJkEynsFyLwNVgK6FYGpWG6rxK/oM=
x-amz-request-id: 5KJQV1RSXA2XF66C
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 24 Jan 2023 18:19:22 GMT
age: 1903
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    7b922915ebf1fa3639b333f994c74f24
Sha1:   144a3f80b98fd0652d4614f24cf6cbbee40f8938
Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Tue, 24 Jan 2023 18:51:05 GMT
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 24 Jan 2023 18:17:31 GMT
age: 2014
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5761
Cache-Control: 'max-age=158059'
Date: Tue, 24 Jan 2023 18:51:05 GMT
Last-Modified: Tue, 24 Jan 2023 17:15:04 GMT
Server: ECS (ska/F70A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: KQu98Lsfer5mKC+ZeZgjnQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             52.34.4.233
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: g0yeFVGIbH/Srwgz6Uxz/JS8M1g=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19895
Expires: Wed, 25 Jan 2023 00:22:42 GMT
Date: Tue, 24 Jan 2023 18:51:07 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19895
Expires: Wed, 25 Jan 2023 00:22:42 GMT
Date: Tue, 24 Jan 2023 18:51:07 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "989830D93A90C30051B948A26CE403FB4370587ED3407D8D77AD0AD9CC28EB7A"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19895
Expires: Wed, 25 Jan 2023 00:22:42 GMT
Date: Tue, 24 Jan 2023 18:51:07 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F67efee66-d227-4c28-89a3-8fd7f382049b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 8308
x-amzn-requestid: 1988d3b3-5e1a-41fd-83f5-092eddb9185f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNys5GDKoAMFdbA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefe52-2349fde60b7db8a34c996717;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:38:26 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: WZE7yDAT_YRseW7m410pGAwkWAwJ2HmuTlg2IbSvCbN20SJbmQ4Odg==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 22:06:36 GMT
age: 74671
etag: "42d5b4b4a091778d98c351f0002d8656449d0243"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8308
Md5:    91b2e12a39dc4f63b9d52e8800cce1f2
Sha1:   42d5b4b4a091778d98c351f0002d8656449d0243
Sha256: d4dbc79e3383e83f861ccf8cde3e78ba427a66cd3fa99c17e23ec935867de4ad
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b12041d-fdaa-483d-b290-d584ffb6ea13.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7642
x-amzn-requestid: 3f4482cf-98a5-420e-abe7-17fd2d214da0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNyxIF3aIAMFWoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefe6d-0c1838dc7b4ab4650d54ee56;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:38:53 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: OD1DSocM7Q1FhRQ4oMhGjU8GN-sv978YqNpLMiKjeWupfFbK-WDXxQ==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 22:04:05 GMT
age: 74822
etag: "eb96120190e3a5c286ac5ec51ee8b163540377fd"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7642
Md5:    deb690b8f5503bf4bcf424e58ddb6b8c
Sha1:   eb96120190e3a5c286ac5ec51ee8b163540377fd
Sha256: c762b17d3e43d773966490d1186ebc352a78d47781c77a4f048e32fee9732b7d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F67794d4b-c63e-47af-b530-92b195f8e718.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 12907
x-amzn-requestid: c9f9a619-f0e1-4bc4-af2a-796b16aa1250
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNzFqF-lIAMFXIg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefef0-625e4bab03baa979605f13f8;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:41:04 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: riKsmnzvLP5xapNSozaa5W4P6--p4xU5bkS4Ir7jln-P_o_QhMBBxQ==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 22:04:30 GMT
age: 74797
etag: "7208e2e4beb739ae9aded4a207d48cb3572fad5f"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12907
Md5:    16d9c0855b43a6c2351cb450187948e2
Sha1:   7208e2e4beb739ae9aded4a207d48cb3572fad5f
Sha256: 92b0423b09aa653ec7326d0aa05dbe137ba452ef21f118c7eb6499a8ccecc8fd
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F987410c8-c934-4399-b586-efb1a5111e3b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 12102
x-amzn-requestid: 54ba881d-c54b-49fa-a5b3-20b8d80f2a35
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNyrNG1AIAMFxTg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefe47-1acbf1c34a4dbfdd506d3383;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:38:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: CHA4jmrQvf2RWyPB4RRjQNr_zvaDR07EMo2oHUT12GAE9QbTP3umnA==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 22:04:53 GMT
age: 74774
etag: "6aae9d763dec58740cdfbfe46f6c69986b81414d"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12102
Md5:    c29ea116f715297b757c81dab8d1b5f3
Sha1:   6aae9d763dec58740cdfbfe46f6c69986b81414d
Sha256: 09afde8ec60dd1471e0ce33ed11ae4542b6813ad02e2abf037629a8ae5cfe240
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febfe8cd9-8a38-4bff-80c1-8c58b3618c4d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 10594
x-amzn-requestid: 25119c89-8b57-4f78-ba4d-6181a565fc55
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNyrOG_VIAMF15w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefe47-5f7fde965860cba74a51ddbf;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:38:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: ZM3fGgrP1P7ju8-1AFIahWbbTgZaAu3mCZyN9m_g_rw6rWHeldJhmQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 21:57:44 GMT
etag: "1a45d9e39cb8a2fcf5cb06bbfcf0194f1eaff2ad"
age: 75203
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10594
Md5:    3172dcbfc344029f09fec71cfa869af7
Sha1:   1a45d9e39cb8a2fcf5cb06bbfcf0194f1eaff2ad
Sha256: e818325e9a7a516912bba892f0ff7377ee0a60d0a38afbbc7f41f8f5d7857a07
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F602ef184-7161-4092-91b7-61e14eef28a5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 3411
x-amzn-requestid: 62afd364-e94f-45ff-ba6c-9b589fc53e5f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e-EyCEzrIAMFb8A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c8b4d9-203f51040f82f12d535446c4;Sampled=0
x-amzn-remapped-date: Thu, 19 Jan 2023 03:11:21 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 3Ke5d5WguVrF_Phnhu9ojzN5Md0VkYnFfxKNoh5HHrmHwPI90IAIdA==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 04:49:41 GMT
age: 50486
etag: "2bd02a45c8b407e36a41a482b121ea3e14f7c722"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3411
Md5:    805711aaab303931f8966bbf73aeda52
Sha1:   2bd02a45c8b407e36a41a482b121ea3e14f7c722
Sha256: 66268668c1a970268d75beb1b57f66a759bedac76958a3359cb23104de40fbeb
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             74.208.236.35
HTTP/2 301 Moved Permanently
content-type: text/html; charset=iso-8859-1
                                            
content-length: 370
location: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
date: Tue, 24 Jan 2023 18:51:05 GMT
server: Apache
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   370
Md5:    364d1a08401c5b8854aca2e422542f89
Sha1:   a3ee951cd93345f7dc7ac92c5bc7de915c59bf32
Sha256: 70e54ae1e96db12d80e90708eabf0609dbdcb3d784155e80a5146efe3e1ccff9

Blocklists:
  - openphish: Capital One Financial Corporation
  - fortinet: Phishing
                                        
                                            GET /ajax/libs/imask/3.4.0/imask.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.17.25.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                            
date: Tue, 24 Jan 2023 18:51:08 GMT
content-length: 10899
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e9f-b217"
last-modified: Mon, 04 May 2020 16:11:11 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 431469
expires: Sun, 14 Jan 2024 18:51:08 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kCpoyhYtoxiGNLCjzUmpoe8kOYOkDdwQ7JiZVQYzyz1YbFAgqDLrJFPammHPig9lK7zlkUKdb%2F3spDKTfWvlHihkzxZ3n7ZzrTYhhhVxC6PKXetYyDHm%2F9uZe2QG4Ov6T1zZ2M1H"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 78eaf5723e3bb4f7-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (45552)
Size:   10899
Md5:    6dd93e13c5bb3b67dadd0de250ffea2f
Sha1:   961bf5bb7cc4aa32bcd66b9ac34461f7e02d96d3
Sha256: 1238c95de9a6c90c1992853fd140b31d2ec8854a09deaa0d4a2d3136281af5e9
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/css/style.css HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: text/css
                                            
content-length: 4248
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "1098-5f2f728940fa6"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   4248
Md5:    4572542ac353167e7fcd4b37c42cc452
Sha1:   c3072ef8fddc1f11e80afe2de5c72867628d42a7
Sha256: 724701ba0869c2848b479b01f166f66c868e5e6b4405b3fe9ab147c16a6068e9

urlquery:
  - Phishing - Capital One
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/files/browserFingerPrintv1.min.js.download HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: application/javascript
                                            
content-length: 28442
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "6f1a-5f2f728941f46"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (28442), with no line terminators
Size:   28442
Md5:    0f537e63c621f88c0c4bf4257394b2c2
Sha1:   7f28eaf9bbf93c3a2d4e012aaca4f34c3cbc3c97
Sha256: 559d96c9ff8af5055471707c21b22ac1a7bca706d199dc9f5659a65c02d7e944

urlquery:
  - Phishing - Capital One
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/files/examine.svg HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: image/svg+xml
                                            
content-length: 2092
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "82c-5f2f728942ee6"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2092), with no line terminators
Size:   2092
Md5:    5791de769b621b54ec564801ab823f10
Sha1:   f9cb957eb9d2ef18c32c71af001e2e7bb0380f5d
Sha256: a9e240fa54e4bd317fb06ce0920687e1f1a577d70c9593db633891126e8fbd29

urlquery:
  - Phishing - Capital One
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/files/equal_housing_lender.svg HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: image/svg+xml
                                            
content-length: 3739
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "e9b-5f2f728942ee6"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3739), with no line terminators
Size:   3739
Md5:    0a9caf42835ab4b61876bddec69ce0de
Sha1:   d30fd829250e6439b36ddd5e1b2354a52f309a4e
Sha256: 6043dfa194d29e8e22dc4aeed56d87b6a9a7623b97c3334592031570f4281d89

urlquery:
  - Phishing - Capital One
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/files/capital-one-logo.svg HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: image/svg+xml
                                            
content-length: 3971
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "f83-5f2f728941f46"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (3967), with CRLF line terminators
Size:   3971
Md5:    f0b7ad81821effc52540e39cafda48f9
Sha1:   33d64bc7001f414f12bd92e740a45e5ced239add
Sha256: 57dfca5b95599a613da940f4a49ab6378fcf0586366a47cae679796930bf0eed

urlquery:
  - Phishing - Capital One
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/files/styles.475f87ef7e34e703d941.css HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: text/css
                                            
content-length: 116197
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "1c5e5-5f2f72894bb88"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   116197
Md5:    6268f898e79f113dced13dcebe38b10f
Sha1:   7ecc82d74dda1ef9ad06700d4edcbafbc6de261a
Sha256: c1470f7e138a7522526d75fdb5b1597f9adafb7bdbec38b11b89c46e931f450c

urlquery:
  - Phishing - Capital One
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/files/fdic.svg HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: image/svg+xml
                                            
content-length: 2063
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "80f-5f2f728942ee6"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (2063), with no line terminators
Size:   2063
Md5:    508681d436b6b42ca2fe4f037d575129
Sha1:   78a4d0e58d49cfce4ed992dcd7265548c1fa7814
Sha256: 628de643d113e225cf4347ed2571ee813cb0919a3895d1902ee18e6f63d539f1

urlquery:
  - Phishing - Capital One
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/js/script.js HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: application/javascript
                                            
content-length: 99372
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "1842c-5f2f7289528e9"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (18129)
Size:   99372
Md5:    1501b528220baca92f7d189b7f00136b
Sha1:   60b48644dc907af63a10411190e9e085857a7078
Sha256: 9b11ce0ce39ad24aa3c869cbde323c1605bbafdfd45ab8f013aa48731d5a4969

urlquery:
  - Phishing - Capital One
Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3582
Cache-Control: max-age=113277
Date: Tue, 24 Jan 2023 18:51:09 GMT
Etag: "63cf321c-1d7"
Expires: Thu, 26 Jan 2023 02:19:06 GMT
Last-Modified: Tue, 24 Jan 2023 01:19:24 GMT
Server: ECS (ska/F70A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /CI_Common/assets/fonts/Optimist_W_Lt.woff2 HTTP/1.1 
Host: ecm.capitalone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goodkarmapay.com
Connection: keep-alive
Referer: https://goodkarmapay.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             104.110.12.190
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
content-length: 27852
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "cb37fa55f3dfdd26d61901032a53644f"
x-amz-server-side-encryption: AES256
x-amz-version-id: Q75rYxmglrbgkwTTGgaHL71RQB9n5YCD
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: WZLHu-KyMHr9Oi38M7o8z4XXwUqHnVG-f6Rg-E6l9knxWl69APaosA==
x-datastream-cache-status: 1
cache-control: max-age=864728
expires: Fri, 03 Feb 2023 19:03:17 GMT
date: Tue, 24 Jan 2023 18:51:09 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 27852, version 1.0\012- data
Size:   27852
Md5:    cb37fa55f3dfdd26d61901032a53644f
Sha1:   1115e8d43a08c1f74ec1f6a886d1cb530bb9da97
Sha256: 902c5a9d8ad932630fb2021fe1a1a7f4f06513b19e8d073866178ee65ff33fe9
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3582
Cache-Control: max-age=113277
Date: Tue, 24 Jan 2023 18:51:09 GMT
Etag: "63cf321c-1d7"
Expires: Thu, 26 Jan 2023 02:19:06 GMT
Last-Modified: Tue, 24 Jan 2023 01:19:24 GMT
Server: ECS (ska/F70A)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3582
Cache-Control: max-age=113277
Date: Tue, 24 Jan 2023 18:51:09 GMT
Etag: "63cf321c-1d7"
Expires: Thu, 26 Jan 2023 02:19:06 GMT
Last-Modified: Tue, 24 Jan 2023 01:19:24 GMT
Server: ECS (ska/F70A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /CI_Common/assets/fonts/Optimist_W_SBd.woff2 HTTP/1.1 
Host: ecm.capitalone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goodkarmapay.com
Connection: keep-alive
Referer: https://goodkarmapay.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             104.110.12.190
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
content-length: 28188
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "d647937062406e5cc182de0cc77947d8"
x-amz-server-side-encryption: AES256
x-amz-version-id: QmX7yv6RJT4hT4UTSJmqyU0reaonF3KP
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: SxgW2j2Ku0ctcy9uifxoUSuEGDe6rOxpREUwMoFk23y-XvIAp5y9VA==
x-datastream-cache-status: 1
cache-control: max-age=2073915
expires: Fri, 17 Feb 2023 18:56:24 GMT
date: Tue, 24 Jan 2023 18:51:09 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 28188, version 1.0\012- data
Size:   28188
Md5:    d647937062406e5cc182de0cc77947d8
Sha1:   9d4c283a4fca43ae95019091bbd0a9e1b77b97bc
Sha256: 48b4ed4ba8ee0eaeddfba861e6772c61f818931816102636a888ec0b49bce056
                                        
                                            GET /CI_Common/assets/fonts/Optimist_W_Rg.woff2 HTTP/1.1 
Host: ecm.capitalone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goodkarmapay.com
Connection: keep-alive
Referer: https://goodkarmapay.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             104.110.12.190
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
content-length: 28388
last-modified: Fri, 28 Jun 2019 00:26:02 GMT
etag: "f4e1fbca28c954a486a90828b2ee7543"
x-amz-server-side-encryption: AES256
x-amz-version-id: 1GgM.ruzxSoQhqV._aklwOsuyVwoqFBE
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: LHR62-C4
x-amz-cf-id: BGWuX4caZ0kfZbeEU9EBXkYNIfAXAQn7qhOobVDMcBZpZGYT9HOYpw==
x-datastream-cache-status: 1
cache-control: max-age=837929
expires: Fri, 03 Feb 2023 11:36:38 GMT
date: Tue, 24 Jan 2023 18:51:09 GMT
access-control-request-method: POST,GET,PUT,DELETE
access-control-max-age: 86400
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 28388, version 1.0\012- data
Size:   28388
Md5:    f4e1fbca28c954a486a90828b2ee7543
Sha1:   7750f00fe0337120e16632ea7fff2a78b11c874a
Sha256: 9b98e19f831844b3dae8e1fd65b6802bc778446fbdacac8203e34bbc02eacbcd
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/img/favicon.ico HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
                                            
content-length: 15086
date: Tue, 24 Jan 2023 18:51:09 GMT
server: Apache
last-modified: Mon, 23 Jan 2023 23:57:15 GMT
etag: "3aee-5f2f7289528e9"
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size:   15086
Md5:    d27e1739c7477b10ec6917546ae61f1d
Sha1:   bb36ab8bce726ce72a2d74a8529526bca0fa515d
Sha256: 5f2123af80970c0478de7f373c9d861d886e070592ebcd55fa372d8dfc9752ec

urlquery:
  - Phishing - Capital One
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/ HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/ HTTP/1.1 
Host: goodkarmapay.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goodkarmapay.com/ct.d/28448CBEA1ECDAEBE67346DCBF5EA32A1ECDAEBE6077F10EVDCBF5EA32A1ECDAEBE67346DCBF5EA32A1ECDAEBE673464CDCBF5EA32A1ECDAEBE67346/account/kb/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             74.208.236.35
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
date: Tue, 24 Jan 2023 18:51:08 GMT
server: Apache
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

Blocklists:
  - fortinet: Phishing