Report - s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818

Report Overview

Submitted URL
s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818
IP
94.237.93.242
ASN
#202053 UpCloud Ltd
Submitted
2023-01-28 20:36:22
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.9 kB	34.160.144.191
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
s3ntry.net	310352	2021-10-26T17:41:29Z	2023-03-13T08:01:50Z	518 B	293 B	162.55.168.249
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	52.35.19.71
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	51 kB	34.120.237.76
s.naughtylotto.net	unknown	2023-01-26T12:07:28Z	2023-02-04T10:42:21Z	13 kB	164 kB	94.237.93.242
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	4.4 kB	12 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-28	medium	s.naughtylotto.net/css/offers/easygift/app.css?id=71a27d441492b80782e563847c6c0e53	Phishing
2023-01-28	medium	s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818	553 B	2023-03-13	2023-03-13
Pretty URL s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818 IP 94.237.93.242 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 10:14:29 Last Seen2023-03-13 10:14:29 Times Seen1 Hash ddb84815a9da258c0c38d1815766a1ed 7690759ff4a09cff028efd6eabc9d41e583e11b8 5af5d702d6ef62860bb561b10f2bb8da941a6ae6a131ec5a252a46196fc6d1bc Loading...

	s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818	654 B	2023-03-13	2023-03-13
Pretty URL s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818 IP 94.237.93.242 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 10:14:29 Last Seen2023-03-13 10:14:29 Times Seen1 Hash beeebca6194f167c2f963a046eb7f379 143b183bf2885bd7ff70bae4a7415621d775bcff 13267eaff400d6142f6f7571db327af5f94d9529b8e433ba1d02c911593ef626 Loading...

	unknown	0 B	2023-03-07	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-26 08:03:18 Times Seen37086884 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	s.naughtylotto.net/js/offers/easygift/app.js?id=27420e3552ae880740670d845b5d73ac	229 kB	2023-03-13	2023-03-13
Pretty URL s.naughtylotto.net/js/offers/easygift/app.js?id=27420e3552ae880740670d845b5d73ac IP 94.237.93.242 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 10:14:29 Last Seen2023-03-13 10:14:29 Times Seen1 Hash 27420e3552ae880740670d845b5d73ac ba573931e82c1911c3b9a5adf918d2030876d969 b3966f24f1d4ba5e2206f13347cedd38358e7a9d54d10269efecb3ef4baf7609 Loading...

HTTP Transactions (34)

URL IP Response Size

s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818

94.237.93.242

200 OK

3.9 kB

URL HTTP/1.1
s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5882)
Size
3.9 kB (3941 bytes)
Hash
1c43e3ebc3d62758fd4e13e10c24250f
7f3e9d7060ee5c38989c31b13d5d6ca10f43dd51
1f4a69a779e3ae628aaf6faf124d2a9694341df41a082645602f5e5b4d474087

HTTP Headers

GET /easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818 HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Cache-Control: no-cache, private
Date: Sat, 28 Jan 2023 20:36:11 GMT
Log-Id: 8ab91b40-4130-41ff-9cba-4a81f688df91
Set-Cookie: XSRF-TOKEN=eyJpdiI6IkprY3p4cUVYZERmOEhsbWNNaEpYZXc9PSIsInZhbHVlIjoiSDRtUUh4ZXdDalU0N2FRdWxBbStyK1Z1TmNqUUlyanNLTVgyRWtST01ySlVndjRsUTZYeXIraTEzTENXekZrcllKa3R3MjZDRjQ1bk9Nai9tVE5YckdLUk92RWVUS3loNkd5ZzVVTDh3RGppSnpIZktPRktPRUlVa0lGVE13UEYiLCJtYWMiOiIxYzY3NjhhY2Y2Mzg4MGQ1MmUzZTc1Zjg0Y2UzNjg2YjA0NzljM2M3MzNiNDdhZjlhOGMwZTdhZGU1MzBiMGQ3IiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 22:36:11 GMT; Max-Age=7200; path=/
ivr_offers_session=eyJpdiI6InZsKzNBMVBqZ1U1bGVHcHNwUERha2c9PSIsInZhbHVlIjoibm5OWkEvaDBXejJVU09pVFk4NGRscEpBRHBKU09ZUTRjTkxlZmF1V3lOSmtreThQNS9vK05MeFRDSnZPbXBScXBrWDZlRnIvKy9IbU9EcHl3NnJaSkkycmw3VE5mcnRFRGRrZWlYRU5weXdUUEVDYkZvcHY1cTVETVhZWTZQWUwiLCJtYWMiOiI0NWU4MzljYTU0NjZkYTM2YjJkMjE1MmVmYmUwMzI0NTMxNWE3ZTYyOWQ2YWUxNjE2NjExNGQ3NGRlM2YzMWJkIiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 22:36:11 GMT; Max-Age=7200; path=/; httponly
SESS_TRAF=eyJpdiI6ImIxVWkrVi96bHJTZHl1eGRWYkZuNUE9PSIsInZhbHVlIjoiZkRqL0wxaGU0ajMzZW5CTkV4MlJWY3UwNDhkWDg0K1ZDbDBSRWZiRG9Oa0Y1dFlkOERwSVFsTGp2MGJWUFhneWpORjNtUUpZQVIrUXFIdWw1VXE0UTJEVk5USkU1SHF6ZEVKcDRWdGJrd1hrQnM0bGdDUDUyVDFUNFJsZVEraWh2VXZSY2cxRmV5QnhWRGFsRXBGYWllcTcyWnZHMEhEbG1hV0hlc0JyQ2lzPSIsIm1hYyI6IjBhZGJmNzA0NWJmMzMwYjY4YjFlMzBhNTc5MzgxZTk3MGQ2OGNjOWU5ZDg4YTQzNDg1MDBiNTRiYWM3NDQwMjUiLCJ0YWciOiIifQ%3D%3D; path=/; httponly
visit=eyJpdiI6Iks0VGZ6azZndUFNbUYvYlZOMHFnS1E9PSIsInZhbHVlIjoiUEpueGdwYWNmdFFiQlh0MCtIaU4zVTVaOGpoTWFRM2dRSjRadEx3WUVreWE1aUJqNjZraEU5enZPcnFQVDJOTiIsIm1hYyI6IjAwYjFhNzkzMjc1MmY4YzY4Zjc4N2Q4ODQzYjM3MTJjZGJiZGI2NTRmZDlhYWM0YjdmY2ZiZTliZjNiZDAwNDgiLCJ0YWciOiIifQ%3D%3D; expires=Sun, 29-Jan-2023 20:36:11 GMT; Max-Age=86400; path=/; httponly
rcGX0M87amO7ePybNCF1adHvOcM6jxRVif3p9dAO=eyJpdiI6IkpSS092dVN1L2NHU2lDYWIyTWNIcGc9PSIsInZhbHVlIjoiVHNaUlc3TkNoTmcyeVRhR0F4aUFXWFcwcmhHbFFYQnZ1cVBXOThRQXQ0cjB6U0x1Zmh2eDZkaFRjN08yL01VSVpxVWNhRjVRLzcvSnlLRnZwT0tzb2NrdmZrcGVNN0hVcDhVN2F5azYrM2g2ZkZsRmxZczNSTmwzbWorcllpRytDcWx5dDVLWDZ1QU5QOEVDTG5Fc09JUnNjN2tQRWl1aTdOcWlNU1pXMDlUdlloVUNmQ1ZSbkpITWE3U2k2WERqT0RlbUp3VTZtTHFqL1FjZ3d2L2UybUFKa3p2ZzdQZFE1c0RLUFVPbFVCNXBML09Yb0c2ME81K1BvaU51cTk0UUxjeTNSakx2Y244NGViaEhDZU9tRUlUNU5VU1B2VGFJZ3VGZlBTNTJpVTk5cHgrZnNDelloczRmQ3QyWXRSQVBQYWpEd0ZIdWxzSWdranhxR3N5UjV0RWllQ2FVekVvZkVPemg1OVkwM0t5cXRwb0ZkOGZvRFQ0NXg2K3k2Y3dCdkVaVEg0aWJNTFp6c2ExQWtIQXJwOGxlUmZvZUFYN1dXb21MaXpLdU1raUQ2RjhGU1dXOUNtelNPWFBHNjlaNk8wdzZGU2pJcFI4cEdkRVlOYnZLM1VQU04vak1FczJkMmJGd2pLMkx0MDA9IiwibWFjIjoiYmRkNzhlNzlmNWZkMDg4MWNhYmNmMzYyYWMxNjQ4ODQ1ZGFkZDk3YWIyMTVhMGUxNDBhMjRhMzIxMzk0NjMwNCIsInRhZyI6IiJ9; expires=Sat, 28-Jan-2023 22:36:11 GMT; Max-Age=7200; path=/; httponly
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a2104f935c638b4767ca5ae0d738ef23
85c6af15af749be0ceeae6de17c36925b750f166
5d4789a3696bd7faa9916768cb627bbc89bf70a756d80e53860cbac13c2bc8b1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5D4789A3696BD7FAA9916768CB627BBC89BF70A756D80E53860CBAC13C2BC8B1"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7486
Expires: Sat, 28 Jan 2023 22:40:57 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3eb88dea4fe00db1182370e72683c3ab
ca520abf1e91bfd2aef40c6a1270a911071e8922
d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8270
Expires: Sat, 28 Jan 2023 22:54:01 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 28 Jan 2023 20:35:31 GMT
content-type: application/json
age: 40
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
03092d1a1bc7ac91ee342a1a7ab2a562
52db06ce1fd2c74ddd36b6a0a7aee1b5c891600a
03b8ff2629abac9fc30ebec059c2e2018fcbc41646ad5f71c965ff630fbf1ffd

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "03B8FF2629ABAC9FC30EBEC059C2E2018FCBC41646AD5F71C965FF630FBF1FFD"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2605
Expires: Sat, 28 Jan 2023 21:19:36 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: 2wv2hrQJfmGMbdfRlqDvqhF3Hm7wjDMxZz3HK9w3HPYqpDwThdQN8hcKlWlxynxgXOvA21SH8T5B+lNfxd19CA==
x-amz-request-id: J4R32BVHMPZ7E61S
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 28 Jan 2023 19:50:02 GMT
age: 2769
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 28 Jan 2023 20:36:11 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

s.naughtylotto.net/css/offers/easygift/app.css?id=71a27d441492b80782e563847c6c0e53

94.237.93.242

200 OK

853 B

URL HTTP/1.1
s.naughtylotto.net/css/offers/easygift/app.css?id=71a27d441492b80782e563847c6c0e53
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
ASCII text, with very long lines (2022)
Size
853 B (853 bytes)
Hash
9ca66b2c2a72c07cf32ff2cf7f829152
05493cbdaee0422b44954b5197507482a65ff044
86800dcfdee59173f68f442fc76076be44b2bd64af98edbae199459c55ab2a0b

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /css/offers/easygift/app.css?id=71a27d441492b80782e563847c6c0e53 HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818
Cookie: XSRF-TOKEN=eyJpdiI6IkprY3p4cUVYZERmOEhsbWNNaEpYZXc9PSIsInZhbHVlIjoiSDRtUUh4ZXdDalU0N2FRdWxBbStyK1Z1TmNqUUlyanNLTVgyRWtST01ySlVndjRsUTZYeXIraTEzTENXekZrcllKa3R3MjZDRjQ1bk9Nai9tVE5YckdLUk92RWVUS3loNkd5ZzVVTDh3RGppSnpIZktPRktPRUlVa0lGVE13UEYiLCJtYWMiOiIxYzY3NjhhY2Y2Mzg4MGQ1MmUzZTc1Zjg0Y2UzNjg2YjA0NzljM2M3MzNiNDdhZjlhOGMwZTdhZGU1MzBiMGQ3IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6InZsKzNBMVBqZ1U1bGVHcHNwUERha2c9PSIsInZhbHVlIjoibm5OWkEvaDBXejJVU09pVFk4NGRscEpBRHBKU09ZUTRjTkxlZmF1V3lOSmtreThQNS9vK05MeFRDSnZPbXBScXBrWDZlRnIvKy9IbU9EcHl3NnJaSkkycmw3VE5mcnRFRGRrZWlYRU5weXdUUEVDYkZvcHY1cTVETVhZWTZQWUwiLCJtYWMiOiI0NWU4MzljYTU0NjZkYTM2YjJkMjE1MmVmYmUwMzI0NTMxNWE3ZTYyOWQ2YWUxNjE2NjExNGQ3NGRlM2YzMWJkIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6ImIxVWkrVi96bHJTZHl1eGRWYkZuNUE9PSIsInZhbHVlIjoiZkRqL0wxaGU0ajMzZW5CTkV4MlJWY3UwNDhkWDg0K1ZDbDBSRWZiRG9Oa0Y1dFlkOERwSVFsTGp2MGJWUFhneWpORjNtUUpZQVIrUXFIdWw1VXE0UTJEVk5USkU1SHF6ZEVKcDRWdGJrd1hrQnM0bGdDUDUyVDFUNFJsZVEraWh2VXZSY2cxRmV5QnhWRGFsRXBGYWllcTcyWnZHMEhEbG1hV0hlc0JyQ2lzPSIsIm1hYyI6IjBhZGJmNzA0NWJmMzMwYjY4YjFlMzBhNTc5MzgxZTk3MGQ2OGNjOWU5ZDg4YTQzNDg1MDBiNTRiYWM3NDQwMjUiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6Iks0VGZ6azZndUFNbUYvYlZOMHFnS1E9PSIsInZhbHVlIjoiUEpueGdwYWNmdFFiQlh0MCtIaU4zVTVaOGpoTWFRM2dRSjRadEx3WUVreWE1aUJqNjZraEU5enZPcnFQVDJOTiIsIm1hYyI6IjAwYjFhNzkzMjc1MmY4YzY4Zjc4N2Q4ODQzYjM3MTJjZGJiZGI2NTRmZDlhYWM0YjdmY2ZiZTliZjNiZDAwNDgiLCJ0YWciOiIifQ%3D%3D; rcGX0M87amO7ePybNCF1adHvOcM6jxRVif3p9dAO=eyJpdiI6IkpSS092dVN1L2NHU2lDYWIyTWNIcGc9PSIsInZhbHVlIjoiVHNaUlc3TkNoTmcyeVRhR0F4aUFXWFcwcmhHbFFYQnZ1cVBXOThRQXQ0cjB6U0x1Zmh2eDZkaFRjN08yL01VSVpxVWNhRjVRLzcvSnlLRnZwT0tzb2NrdmZrcGVNN0hVcDhVN2F5azYrM2g2ZkZsRmxZczNSTmwzbWorcllpRytDcWx5dDVLWDZ1QU5QOEVDTG5Fc09JUnNjN2tQRWl1aTdOcWlNU1pXMDlUdlloVUNmQ1ZSbkpITWE3U2k2WERqT0RlbUp3VTZtTHFqL1FjZ3d2L2UybUFKa3p2ZzdQZFE1c0RLUFVPbFVCNXBML09Yb0c2ME81K1BvaU51cTk0UUxjeTNSakx2Y244NGViaEhDZU9tRUlUNU5VU1B2VGFJZ3VGZlBTNTJpVTk5cHgrZnNDelloczRmQ3QyWXRSQVBQYWpEd0ZIdWxzSWdranhxR3N5UjV0RWllQ2FVekVvZkVPemg1OVkwM0t5cXRwb0ZkOGZvRFQ0NXg2K3k2Y3dCdkVaVEg0aWJNTFp6c2ExQWtIQXJwOGxlUmZvZUFYN1dXb21MaXpLdU1raUQ2RjhGU1dXOUNtelNPWFBHNjlaNk8wdzZGU2pJcFI4cEdkRVlOYnZLM1VQU04vak1FczJkMmJGd2pLMkx0MDA9IiwibWFjIjoiYmRkNzhlNzlmNWZkMDg4MWNhYmNmMzYyYWMxNjQ4ODQ1ZGFkZDk3YWIyMTVhMGUxNDBhMjRhMzIxMzk0NjMwNCIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 20:36:11 GMT
Content-Type: text/css
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-80a"
Expires: Sun, 28 Jan 2024 20:36:11 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f1d630d06a1adfc08343ce6a2ebd0781
d11213a776f7ac2e49b739bcd215ca40691868c4
1ee254ef33da389113bc9e4336d5d21229f95a96533dda3ee8177376e2171f16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1EE254EF33DA389113BC9E4336D5D21229F95A96533DDA3EE8177376E2171F16"
Last-Modified: Thu, 26 Jan 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5593
Expires: Sat, 28 Jan 2023 22:09:24 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f1d630d06a1adfc08343ce6a2ebd0781
d11213a776f7ac2e49b739bcd215ca40691868c4
1ee254ef33da389113bc9e4336d5d21229f95a96533dda3ee8177376e2171f16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1EE254EF33DA389113BC9E4336D5D21229F95A96533DDA3EE8177376E2171F16"
Last-Modified: Thu, 26 Jan 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5593
Expires: Sat, 28 Jan 2023 22:09:24 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f1d630d06a1adfc08343ce6a2ebd0781
d11213a776f7ac2e49b739bcd215ca40691868c4
1ee254ef33da389113bc9e4336d5d21229f95a96533dda3ee8177376e2171f16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1EE254EF33DA389113BC9E4336D5D21229F95A96533DDA3EE8177376E2171F16"
Last-Modified: Thu, 26 Jan 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5593
Expires: Sat, 28 Jan 2023 22:09:24 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f1d630d06a1adfc08343ce6a2ebd0781
d11213a776f7ac2e49b739bcd215ca40691868c4
1ee254ef33da389113bc9e4336d5d21229f95a96533dda3ee8177376e2171f16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1EE254EF33DA389113BC9E4336D5D21229F95A96533DDA3EE8177376E2171F16"
Last-Modified: Thu, 26 Jan 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5593
Expires: Sat, 28 Jan 2023 22:09:24 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f1d630d06a1adfc08343ce6a2ebd0781
d11213a776f7ac2e49b739bcd215ca40691868c4
1ee254ef33da389113bc9e4336d5d21229f95a96533dda3ee8177376e2171f16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1EE254EF33DA389113BC9E4336D5D21229F95A96533DDA3EE8177376E2171F16"
Last-Modified: Thu, 26 Jan 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5593
Expires: Sat, 28 Jan 2023 22:09:24 GMT
Date: Sat, 28 Jan 2023 20:36:11 GMT
Connection: keep-alive

s.naughtylotto.net/img/prizes/iphone-14/default@0.5x.png

94.237.93.242

200 OK

5.3 kB

URL HTTP/2
s.naughtylotto.net/img/prizes/iphone-14/default@0.5x.png
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
PNG image data, 200 x 200, 8-bit colormap, non-interlaced\012- data
Size
5.3 kB (5264 bytes)
Hash
690405dcbcd7e4230f747dc6ed50af82
725b37ab28b407cfa6f3c7bbb005ded1c8393477
e2d184b35e5bdc7916d85dca09ef2e4a292563a14cf9cda0eea65a3a9861ac5e

HTTP Headers

GET /img/prizes/iphone-14/default@0.5x.png HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://s.naughtylotto.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 28 Jan 2023 20:36:11 GMT
content-type: image/png
content-length: 5264
last-modified: Thu, 26 Jan 2023 10:57:04 GMT
etag: "63d25c80-1490"
expires: Sun, 28 Jan 2024 20:36:11 GMT
pragma: public
cache-control: max-age=31536000, public
accept-ranges: bytes
X-Firefox-Spdy: h2

s.naughtylotto.net/img/offers/easygift/shipping.png

94.237.93.242

200 OK

640 B

URL HTTP/2
s.naughtylotto.net/img/offers/easygift/shipping.png
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
PNG image data, 74 x 55, 4-bit colormap, non-interlaced\012- data
Size
640 B (640 bytes)
Hash
60f406c9f573688244e1c212009673d6
8dfb016afb56d4c72ae59693731ce2f395d867e8
f9a28c875a78db3398fafeae2f1a56611408ba6d1e0267756aba95ff37a595dd

HTTP Headers

GET /img/offers/easygift/shipping.png HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://s.naughtylotto.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 28 Jan 2023 20:36:11 GMT
content-type: image/png
content-length: 640
last-modified: Thu, 26 Jan 2023 10:58:33 GMT
etag: "63d25cd9-280"
expires: Sun, 28 Jan 2024 20:36:11 GMT
pragma: public
cache-control: max-age=31536000, public
accept-ranges: bytes
X-Firefox-Spdy: h2

s.naughtylotto.net/img/offers/easygift/service.png

94.237.93.242

200 OK

780 B

URL HTTP/2
s.naughtylotto.net/img/offers/easygift/service.png
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
PNG image data, 82 x 55, 4-bit colormap, non-interlaced\012- data
Size
780 B (780 bytes)
Hash
0e7f76f6ed04c8dc26ca94ead2faf7b6
6e4b98b0cd8406ea90fe6720675d263d8daafe0d
462592572f4a139663f290b78dff2fa4e0ee65e814ccd3009a3c5cc6a938e43d

HTTP Headers

GET /img/offers/easygift/service.png HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://s.naughtylotto.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 28 Jan 2023 20:36:11 GMT
content-type: image/png
content-length: 780
last-modified: Thu, 26 Jan 2023 10:58:33 GMT
etag: "63d25cd9-30c"
expires: Sun, 28 Jan 2024 20:36:11 GMT
pragma: public
cache-control: max-age=31536000, public
accept-ranges: bytes
X-Firefox-Spdy: h2

s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6

94.237.93.242

200 OK

64 kB

URL HTTP/1.1
s.naughtylotto.net/js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
Unicode text, UTF-8 text, with very long lines (65474)
Size
64 kB (63554 bytes)
Hash
40f4ac2a307fd204e8474e9159a5eed1
098de131c72307928b6f2f3a4e9ef0ab7cda208d
d704547d50c71714a8c60c714f9eadb0b2e258e28aeb46fa460eb1a6246510bb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/app.js?id=d837db9160e8db17ac7ed695d8d0bde6 HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818
Cookie: XSRF-TOKEN=eyJpdiI6IkprY3p4cUVYZERmOEhsbWNNaEpYZXc9PSIsInZhbHVlIjoiSDRtUUh4ZXdDalU0N2FRdWxBbStyK1Z1TmNqUUlyanNLTVgyRWtST01ySlVndjRsUTZYeXIraTEzTENXekZrcllKa3R3MjZDRjQ1bk9Nai9tVE5YckdLUk92RWVUS3loNkd5ZzVVTDh3RGppSnpIZktPRktPRUlVa0lGVE13UEYiLCJtYWMiOiIxYzY3NjhhY2Y2Mzg4MGQ1MmUzZTc1Zjg0Y2UzNjg2YjA0NzljM2M3MzNiNDdhZjlhOGMwZTdhZGU1MzBiMGQ3IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6InZsKzNBMVBqZ1U1bGVHcHNwUERha2c9PSIsInZhbHVlIjoibm5OWkEvaDBXejJVU09pVFk4NGRscEpBRHBKU09ZUTRjTkxlZmF1V3lOSmtreThQNS9vK05MeFRDSnZPbXBScXBrWDZlRnIvKy9IbU9EcHl3NnJaSkkycmw3VE5mcnRFRGRrZWlYRU5weXdUUEVDYkZvcHY1cTVETVhZWTZQWUwiLCJtYWMiOiI0NWU4MzljYTU0NjZkYTM2YjJkMjE1MmVmYmUwMzI0NTMxNWE3ZTYyOWQ2YWUxNjE2NjExNGQ3NGRlM2YzMWJkIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6ImIxVWkrVi96bHJTZHl1eGRWYkZuNUE9PSIsInZhbHVlIjoiZkRqL0wxaGU0ajMzZW5CTkV4MlJWY3UwNDhkWDg0K1ZDbDBSRWZiRG9Oa0Y1dFlkOERwSVFsTGp2MGJWUFhneWpORjNtUUpZQVIrUXFIdWw1VXE0UTJEVk5USkU1SHF6ZEVKcDRWdGJrd1hrQnM0bGdDUDUyVDFUNFJsZVEraWh2VXZSY2cxRmV5QnhWRGFsRXBGYWllcTcyWnZHMEhEbG1hV0hlc0JyQ2lzPSIsIm1hYyI6IjBhZGJmNzA0NWJmMzMwYjY4YjFlMzBhNTc5MzgxZTk3MGQ2OGNjOWU5ZDg4YTQzNDg1MDBiNTRiYWM3NDQwMjUiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6Iks0VGZ6azZndUFNbUYvYlZOMHFnS1E9PSIsInZhbHVlIjoiUEpueGdwYWNmdFFiQlh0MCtIaU4zVTVaOGpoTWFRM2dRSjRadEx3WUVreWE1aUJqNjZraEU5enZPcnFQVDJOTiIsIm1hYyI6IjAwYjFhNzkzMjc1MmY4YzY4Zjc4N2Q4ODQzYjM3MTJjZGJiZGI2NTRmZDlhYWM0YjdmY2ZiZTliZjNiZDAwNDgiLCJ0YWciOiIifQ%3D%3D; rcGX0M87amO7ePybNCF1adHvOcM6jxRVif3p9dAO=eyJpdiI6IkpSS092dVN1L2NHU2lDYWIyTWNIcGc9PSIsInZhbHVlIjoiVHNaUlc3TkNoTmcyeVRhR0F4aUFXWFcwcmhHbFFYQnZ1cVBXOThRQXQ0cjB6U0x1Zmh2eDZkaFRjN08yL01VSVpxVWNhRjVRLzcvSnlLRnZwT0tzb2NrdmZrcGVNN0hVcDhVN2F5azYrM2g2ZkZsRmxZczNSTmwzbWorcllpRytDcWx5dDVLWDZ1QU5QOEVDTG5Fc09JUnNjN2tQRWl1aTdOcWlNU1pXMDlUdlloVUNmQ1ZSbkpITWE3U2k2WERqT0RlbUp3VTZtTHFqL1FjZ3d2L2UybUFKa3p2ZzdQZFE1c0RLUFVPbFVCNXBML09Yb0c2ME81K1BvaU51cTk0UUxjeTNSakx2Y244NGViaEhDZU9tRUlUNU5VU1B2VGFJZ3VGZlBTNTJpVTk5cHgrZnNDelloczRmQ3QyWXRSQVBQYWpEd0ZIdWxzSWdranhxR3N5UjV0RWllQ2FVekVvZkVPemg1OVkwM0t5cXRwb0ZkOGZvRFQ0NXg2K3k2Y3dCdkVaVEg0aWJNTFp6c2ExQWtIQXJwOGxlUmZvZUFYN1dXb21MaXpLdU1raUQ2RjhGU1dXOUNtelNPWFBHNjlaNk8wdzZGU2pJcFI4cEdkRVlOYnZLM1VQU04vak1FczJkMmJGd2pLMkx0MDA9IiwibWFjIjoiYmRkNzhlNzlmNWZkMDg4MWNhYmNmMzYyYWMxNjQ4ODQ1ZGFkZDk3YWIyMTVhMGUxNDBhMjRhMzIxMzk0NjMwNCIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 20:36:11 GMT
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-2e42c"
Expires: Sun, 28 Jan 2024 20:36:11 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

s.naughtylotto.net/img/offers/easygift/logo.png

94.237.93.242

200 OK

768 B

URL HTTP/2
s.naughtylotto.net/img/offers/easygift/logo.png
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
PNG image data, 132 x 34, 4-bit colormap, non-interlaced\012- data
Size
768 B (768 bytes)
Hash
57ea8aa224f0687d6c058d10b56949a5
21e37e07a4c24bd576999c323a0ec72b2c0f1e8f
22e11ac82d12c15639b06d088cc7651962b251a214f612738642ad7b1ab3cb4f

HTTP Headers

GET /img/offers/easygift/logo.png HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://s.naughtylotto.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 28 Jan 2023 20:36:11 GMT
content-type: image/png
content-length: 768
last-modified: Thu, 26 Jan 2023 10:58:33 GMT
etag: "63d25cd9-300"
expires: Sun, 28 Jan 2024 20:36:11 GMT
pragma: public
cache-control: max-age=31536000, public
accept-ranges: bytes
X-Firefox-Spdy: h2

s.naughtylotto.net/js/offers/easygift/app.js?id=27420e3552ae880740670d845b5d73ac

94.237.93.242

200 OK

75 kB

URL HTTP/1.1
s.naughtylotto.net/js/offers/easygift/app.js?id=27420e3552ae880740670d845b5d73ac
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
Unicode text, UTF-8 text, with very long lines (65443)
Size
75 kB (75368 bytes)
Hash
c9d9a4ac3ec098f0786978c4cfed348b
f5f5306f21da3cb76af8804152d23f1699b5b3b8
522d8b5b6aac960b7e78e778d5382c31e641096d2de4b832ef047067f477a165

HTTP Headers

GET /js/offers/easygift/app.js?id=27420e3552ae880740670d845b5d73ac HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/easygift?tid=5xqk5audb9sfx64sn0x0kw0cg,16669821,5,&ctrack=1674938152.1451712818
Cookie: XSRF-TOKEN=eyJpdiI6IkprY3p4cUVYZERmOEhsbWNNaEpYZXc9PSIsInZhbHVlIjoiSDRtUUh4ZXdDalU0N2FRdWxBbStyK1Z1TmNqUUlyanNLTVgyRWtST01ySlVndjRsUTZYeXIraTEzTENXekZrcllKa3R3MjZDRjQ1bk9Nai9tVE5YckdLUk92RWVUS3loNkd5ZzVVTDh3RGppSnpIZktPRktPRUlVa0lGVE13UEYiLCJtYWMiOiIxYzY3NjhhY2Y2Mzg4MGQ1MmUzZTc1Zjg0Y2UzNjg2YjA0NzljM2M3MzNiNDdhZjlhOGMwZTdhZGU1MzBiMGQ3IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6InZsKzNBMVBqZ1U1bGVHcHNwUERha2c9PSIsInZhbHVlIjoibm5OWkEvaDBXejJVU09pVFk4NGRscEpBRHBKU09ZUTRjTkxlZmF1V3lOSmtreThQNS9vK05MeFRDSnZPbXBScXBrWDZlRnIvKy9IbU9EcHl3NnJaSkkycmw3VE5mcnRFRGRrZWlYRU5weXdUUEVDYkZvcHY1cTVETVhZWTZQWUwiLCJtYWMiOiI0NWU4MzljYTU0NjZkYTM2YjJkMjE1MmVmYmUwMzI0NTMxNWE3ZTYyOWQ2YWUxNjE2NjExNGQ3NGRlM2YzMWJkIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6ImIxVWkrVi96bHJTZHl1eGRWYkZuNUE9PSIsInZhbHVlIjoiZkRqL0wxaGU0ajMzZW5CTkV4MlJWY3UwNDhkWDg0K1ZDbDBSRWZiRG9Oa0Y1dFlkOERwSVFsTGp2MGJWUFhneWpORjNtUUpZQVIrUXFIdWw1VXE0UTJEVk5USkU1SHF6ZEVKcDRWdGJrd1hrQnM0bGdDUDUyVDFUNFJsZVEraWh2VXZSY2cxRmV5QnhWRGFsRXBGYWllcTcyWnZHMEhEbG1hV0hlc0JyQ2lzPSIsIm1hYyI6IjBhZGJmNzA0NWJmMzMwYjY4YjFlMzBhNTc5MzgxZTk3MGQ2OGNjOWU5ZDg4YTQzNDg1MDBiNTRiYWM3NDQwMjUiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6Iks0VGZ6azZndUFNbUYvYlZOMHFnS1E9PSIsInZhbHVlIjoiUEpueGdwYWNmdFFiQlh0MCtIaU4zVTVaOGpoTWFRM2dRSjRadEx3WUVreWE1aUJqNjZraEU5enZPcnFQVDJOTiIsIm1hYyI6IjAwYjFhNzkzMjc1MmY4YzY4Zjc4N2Q4ODQzYjM3MTJjZGJiZGI2NTRmZDlhYWM0YjdmY2ZiZTliZjNiZDAwNDgiLCJ0YWciOiIifQ%3D%3D; rcGX0M87amO7ePybNCF1adHvOcM6jxRVif3p9dAO=eyJpdiI6IkpSS092dVN1L2NHU2lDYWIyTWNIcGc9PSIsInZhbHVlIjoiVHNaUlc3TkNoTmcyeVRhR0F4aUFXWFcwcmhHbFFYQnZ1cVBXOThRQXQ0cjB6U0x1Zmh2eDZkaFRjN08yL01VSVpxVWNhRjVRLzcvSnlLRnZwT0tzb2NrdmZrcGVNN0hVcDhVN2F5azYrM2g2ZkZsRmxZczNSTmwzbWorcllpRytDcWx5dDVLWDZ1QU5QOEVDTG5Fc09JUnNjN2tQRWl1aTdOcWlNU1pXMDlUdlloVUNmQ1ZSbkpITWE3U2k2WERqT0RlbUp3VTZtTHFqL1FjZ3d2L2UybUFKa3p2ZzdQZFE1c0RLUFVPbFVCNXBML09Yb0c2ME81K1BvaU51cTk0UUxjeTNSakx2Y244NGViaEhDZU9tRUlUNU5VU1B2VGFJZ3VGZlBTNTJpVTk5cHgrZnNDelloczRmQ3QyWXRSQVBQYWpEd0ZIdWxzSWdranhxR3N5UjV0RWllQ2FVekVvZkVPemg1OVkwM0t5cXRwb0ZkOGZvRFQ0NXg2K3k2Y3dCdkVaVEg0aWJNTFp6c2ExQWtIQXJwOGxlUmZvZUFYN1dXb21MaXpLdU1raUQ2RjhGU1dXOUNtelNPWFBHNjlaNk8wdzZGU2pJcFI4cEdkRVlOYnZLM1VQU04vak1FczJkMmJGd2pLMkx0MDA9IiwibWFjIjoiYmRkNzhlNzlmNWZkMDg4MWNhYmNmMzYyYWMxNjQ4ODQ1ZGFkZDk3YWIyMTVhMGUxNDBhMjRhMzIxMzk0NjMwNCIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 20:36:11 GMT
Content-Type: application/javascript; charset=utf-8
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"63d25cd9-37fbb"
Expires: Sun, 28 Jan 2024 20:36:11 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
06fdb0f07b48428e9a171a2b1c3c17ae
390626d1b08165b90539c6902032d47fb2e0f712
0083a5dc672e6760780a64fecd547b0ef7d5c35934e7a9ba75063a10af7e87be

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0083A5DC672E6760780A64FECD547B0EF7D5C35934E7A9BA75063A10AF7E87BE"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3276
Expires: Sat, 28 Jan 2023 21:30:48 GMT
Date: Sat, 28 Jan 2023 20:36:12 GMT
Connection: keep-alive

s.naughtylotto.net/img/offers/easygift/confetti.png

94.237.93.242

200 OK

7.1 kB

URL HTTP/1.1
s.naughtylotto.net/img/offers/easygift/confetti.png
IP
94.237.93.242:0
ASN
#202053 UpCloud Ltd

File type
PNG image data, 375 x 292, 8-bit colormap, non-interlaced\012- data
Size
7.1 kB (7128 bytes)
Hash
431734d981e4f07e49423a3d45da20a7
2e74722c0e2adb8faee9bfbc71d4f361ba8b29f7
f8d17882c44cc448f78c81b26daaa48ffc3e3cf9a52568ae769d37c6f0a1bd01

HTTP Headers

GET /img/offers/easygift/confetti.png HTTP/1.1
Host: s.naughtylotto.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://s.naughtylotto.net/css/offers/easygift/app.css?id=71a27d441492b80782e563847c6c0e53
Cookie: XSRF-TOKEN=eyJpdiI6IkprY3p4cUVYZERmOEhsbWNNaEpYZXc9PSIsInZhbHVlIjoiSDRtUUh4ZXdDalU0N2FRdWxBbStyK1Z1TmNqUUlyanNLTVgyRWtST01ySlVndjRsUTZYeXIraTEzTENXekZrcllKa3R3MjZDRjQ1bk9Nai9tVE5YckdLUk92RWVUS3loNkd5ZzVVTDh3RGppSnpIZktPRktPRUlVa0lGVE13UEYiLCJtYWMiOiIxYzY3NjhhY2Y2Mzg4MGQ1MmUzZTc1Zjg0Y2UzNjg2YjA0NzljM2M3MzNiNDdhZjlhOGMwZTdhZGU1MzBiMGQ3IiwidGFnIjoiIn0%3D; ivr_offers_session=eyJpdiI6InZsKzNBMVBqZ1U1bGVHcHNwUERha2c9PSIsInZhbHVlIjoibm5OWkEvaDBXejJVU09pVFk4NGRscEpBRHBKU09ZUTRjTkxlZmF1V3lOSmtreThQNS9vK05MeFRDSnZPbXBScXBrWDZlRnIvKy9IbU9EcHl3NnJaSkkycmw3VE5mcnRFRGRrZWlYRU5weXdUUEVDYkZvcHY1cTVETVhZWTZQWUwiLCJtYWMiOiI0NWU4MzljYTU0NjZkYTM2YjJkMjE1MmVmYmUwMzI0NTMxNWE3ZTYyOWQ2YWUxNjE2NjExNGQ3NGRlM2YzMWJkIiwidGFnIjoiIn0%3D; SESS_TRAF=eyJpdiI6ImIxVWkrVi96bHJTZHl1eGRWYkZuNUE9PSIsInZhbHVlIjoiZkRqL0wxaGU0ajMzZW5CTkV4MlJWY3UwNDhkWDg0K1ZDbDBSRWZiRG9Oa0Y1dFlkOERwSVFsTGp2MGJWUFhneWpORjNtUUpZQVIrUXFIdWw1VXE0UTJEVk5USkU1SHF6ZEVKcDRWdGJrd1hrQnM0bGdDUDUyVDFUNFJsZVEraWh2VXZSY2cxRmV5QnhWRGFsRXBGYWllcTcyWnZHMEhEbG1hV0hlc0JyQ2lzPSIsIm1hYyI6IjBhZGJmNzA0NWJmMzMwYjY4YjFlMzBhNTc5MzgxZTk3MGQ2OGNjOWU5ZDg4YTQzNDg1MDBiNTRiYWM3NDQwMjUiLCJ0YWciOiIifQ%3D%3D; visit=eyJpdiI6Iks0VGZ6azZndUFNbUYvYlZOMHFnS1E9PSIsInZhbHVlIjoiUEpueGdwYWNmdFFiQlh0MCtIaU4zVTVaOGpoTWFRM2dRSjRadEx3WUVreWE1aUJqNjZraEU5enZPcnFQVDJOTiIsIm1hYyI6IjAwYjFhNzkzMjc1MmY4YzY4Zjc4N2Q4ODQzYjM3MTJjZGJiZGI2NTRmZDlhYWM0YjdmY2ZiZTliZjNiZDAwNDgiLCJ0YWciOiIifQ%3D%3D; rcGX0M87amO7ePybNCF1adHvOcM6jxRVif3p9dAO=eyJpdiI6IkpSS092dVN1L2NHU2lDYWIyTWNIcGc9PSIsInZhbHVlIjoiVHNaUlc3TkNoTmcyeVRhR0F4aUFXWFcwcmhHbFFYQnZ1cVBXOThRQXQ0cjB6U0x1Zmh2eDZkaFRjN08yL01VSVpxVWNhRjVRLzcvSnlLRnZwT0tzb2NrdmZrcGVNN0hVcDhVN2F5azYrM2g2ZkZsRmxZczNSTmwzbWorcllpRytDcWx5dDVLWDZ1QU5QOEVDTG5Fc09JUnNjN2tQRWl1aTdOcWlNU1pXMDlUdlloVUNmQ1ZSbkpITWE3U2k2WERqT0RlbUp3VTZtTHFqL1FjZ3d2L2UybUFKa3p2ZzdQZFE1c0RLUFVPbFVCNXBML09Yb0c2ME81K1BvaU51cTk0UUxjeTNSakx2Y244NGViaEhDZU9tRUlUNU5VU1B2VGFJZ3VGZlBTNTJpVTk5cHgrZnNDelloczRmQ3QyWXRSQVBQYWpEd0ZIdWxzSWdranhxR3N5UjV0RWllQ2FVekVvZkVPemg1OVkwM0t5cXRwb0ZkOGZvRFQ0NXg2K3k2Y3dCdkVaVEg0aWJNTFp6c2ExQWtIQXJwOGxlUmZvZUFYN1dXb21MaXpLdU1raUQ2RjhGU1dXOUNtelNPWFBHNjlaNk8wdzZGU2pJcFI4cEdkRVlOYnZLM1VQU04vak1FczJkMmJGd2pLMkx0MDA9IiwibWFjIjoiYmRkNzhlNzlmNWZkMDg4MWNhYmNmMzYyYWMxNjQ4ODQ1ZGFkZDk3YWIyMTVhMGUxNDBhMjRhMzIxMzk0NjMwNCIsInRhZyI6IiJ9

HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 20:36:11 GMT
Content-Type: image/png
Content-Length: 7128
Last-Modified: Thu, 26 Jan 2023 10:58:33 GMT
ETag: "63d25cd9-1bd8"
Expires: Sun, 28 Jan 2024 20:36:11 GMT
Pragma: public
Cache-Control: max-age=31536000, public
Accept-Ranges: bytes

s3ntry.net/api/18/envelope/?sentry_key=ccd7567c32f347d999f51c043b0ccde6&sentry_version=7

162.55.168.249

200 OK

2 B

URL HTTP/1.1
s3ntry.net/api/18/envelope/?sentry_key=ccd7567c32f347d999f51c043b0ccde6&sentry_version=7
IP
162.55.168.249:0
ASN
#24940 Hetzner Online GmbH

File type
JSON data\012- , ASCII text, with no line terminators
Size
2 B (2 bytes)
Hash
99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

HTTP Headers

POST /api/18/envelope/?sentry_key=ccd7567c32f347d999f51c043b0ccde6&sentry_version=7 HTTP/1.1
Host: s3ntry.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://s.naughtylotto.net/
Content-Type: text/plain;charset=UTF-8
Origin: http://s.naughtylotto.net
Content-Length: 434
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 20:36:12 GMT
Content-Type: application/json
Content-Length: 2
Connection: close
access-control-allow-origin: http://s.naughtylotto.net
access-control-expose-headers: x-sentry-rate-limits, x-sentry-error, retry-after
vary: Origin

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Last-Modified, Pragma, ETag, Retry-After, Content-Type, Content-Length, Expires, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 28 Jan 2023 19:41:40 GMT
age: 3272
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
16a7b6a7128312e2f985d30df18c4487
6017bff79ffb525d9c7f9f32b999b74b5dc69602
663fd12209627f08e759c2ed1c76278a5da79dae1e0b46082dd1bb44775f7a16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "663FD12209627F08E759C2ED1C76278A5DA79DAE1E0B46082DD1BB44775F7A16"
Last-Modified: Fri, 27 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6970
Expires: Sat, 28 Jan 2023 22:32:22 GMT
Date: Sat, 28 Jan 2023 20:36:12 GMT
Connection: keep-alive

push.services.mozilla.com/

52.35.19.71

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.35.19.71:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 8Je/PN65xetuzVR0iE2hVw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: UjzwKB3Z1/05Bo/uO+IPzEnY4Ss=

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2684
Expires: Sat, 28 Jan 2023 21:20:57 GMT
Date: Sat, 28 Jan 2023 20:36:13 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2684
Expires: Sat, 28 Jan 2023 21:20:57 GMT
Date: Sat, 28 Jan 2023 20:36:13 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2684
Expires: Sat, 28 Jan 2023 21:20:57 GMT
Date: Sat, 28 Jan 2023 20:36:13 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg

34.120.237.76

200 OK

7.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.6 kB (7585 bytes)
Hash
ea24bcba583bd8bd139559448a343e68
b9d37c2b14f890d41983a59f352e8f7caa9c94bb
e5ef5975eec964ae1684deb424f00833f2d217bdc7e6c385320ed3adeb6bc1c4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7585
x-amzn-requestid: bfb52acb-e0d7-482d-8be9-be5db1c16cac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_vkE5roAMF0Hw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d44663-2d38d314177e0ac40d4c8240;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:47:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: K9YWM9eaEc1DQ6wtEEuADnG1U-ahRBXDaiHIAm20dkWMOxPWBlJidw==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 22:46:13 GMT
age: 78600
etag: "b9d37c2b14f890d41983a59f352e8f7caa9c94bb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.5 kB (4475 bytes)
Hash
4205d8106659e00fff1cbe9262918b8c
ab4f6528594a1725934727dc7d834c028a79c609
31f1a28602a194bd0856495d4d81d5c72cd7ff4e5bad6bdd1a31ec3041f4a2cc

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4475
x-amzn-requestid: b7b272d6-3089-4f33-89b5-5cb388640e10
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_e6HsaIAMF5Lg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445f8-1789f7f4264270916da323db;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:45:28 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hAzO-IMqc1CFpiBAlRl8seIYL9UonyrBMATibovyFq5kEuaweY_VyA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:56:46 GMT
age: 81567
etag: "ab4f6528594a1725934727dc7d834c028a79c609"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ed7c466-ac98-4e05-89cf-f0abf56e8d98.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.0 kB (4975 bytes)
Hash
c982569d070f24dba1259603091c22e3
0f93acb5bee53670cc4ef486922f7333d96a2f4e
9a5a2d8a181a763ee6f60c27b396a0e3d7b1527e5177b2aff8d511db250753ed

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ed7c466-ac98-4e05-89cf-f0abf56e8d98.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4975
x-amzn-requestid: 633350b7-4686-40d5-8c9d-3c097f8e2d34
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-EBGuaoAMFbSw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443b3-4201212c1a0eb2a65d3f494c;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: M4VR-I89SGD0-FLzHhZ88PJJJmdWTEi0UrBnAmCBCQAdjRsssqnSzw==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:49:06 GMT
age: 82027
etag: "0f93acb5bee53670cc4ef486922f7333d96a2f4e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0cadb8fa-5527-46cd-92dd-6316ac84a7d5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (7028 bytes)
Hash
57b73886cbbb719eda5f733c018eedfb
b84ed40973f8a0d3c10529e34f9466746cfdaf0c
4ba11c23e0bbd2aed53b04ad0b3d22161af1971ddcfb75ae55734de9a49af207

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0cadb8fa-5527-46cd-92dd-6316ac84a7d5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7028
x-amzn-requestid: c1743fed-205a-431b-8648-474facde6d09
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-CwFtboAMF9rg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443ab-5b94864c707c42fc36fbc63a;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 7LUa_R8g8Rlv7JJA0_okht-vGe-xBSyZ5TPJTFakAHlncQPZKEdULQ==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:48:58 GMT
age: 82035
etag: "b84ed40973f8a0d3c10529e34f9466746cfdaf0c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfb887e5-87fa-4855-b0ee-712d39779fa0.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11568 bytes)
Hash
b7a0759c043594fbe85af422b59b8227
a05cfaad16078f42218dae233da38f6f5dff8487
e898d6ef1b3998fb9322a8fc190069ec5f7b3582bfe8397a2367497d84a27549

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdfb887e5-87fa-4855-b0ee-712d39779fa0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11568
x-amzn-requestid: 79b70f1f-a157-4dd4-8743-825714195b3c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e9T3UGA3oAMFSlQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c86695-36e60aba09c152c73b8aefcb;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 21:37:25 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: zt4bgV2C6Wb_Ufa5mZ7-UDTfCvhXJggPJw9668v5DEmyBnWZ-aNrCg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 23:03:41 GMT
age: 77552
etag: "a05cfaad16078f42218dae233da38f6f5dff8487"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F238effff-cb43-479f-8853-06086fff1bd5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.4 kB (9364 bytes)
Hash
f185f0b4f90d06dbb397b44ed9c73dbe
a48e2c369a048447e0e25e4791eb603859391c1c
b466060fc132cc8d23fcb83001206606e2d5502118c65e9f55795b5adbff2fa6

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F238effff-cb43-479f-8853-06086fff1bd5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9364
x-amzn-requestid: e556be7b-567a-4c9a-931e-ff6fee42d3a7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_T8GbFoAMFySg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445b2-6f4476e9388c77a057153277;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:44:18 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: LPkLrx7l9Qf_GKdtJq_77RUkvgnKZlCaDN34xsB5bEO8c9VQEJPAew==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:56:38 GMT
etag: "a48e2c369a048447e0e25e4791eb603859391c1c"
content-type: image/jpeg
age: 81575
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (34)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers