r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9fbe85f42e8ae8ae41cc12df5f98b141
949fa36ff0f22f72565fd584bef094dd4de23037
184d3e4df4bce559b4d7c4836372f5fd2de9782a96b04d364230b7d695d737d8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "184D3E4DF4BCE559B4D7C4836372F5FD2DE9782A96B04D364230B7D695D737D8"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2178
Expires: Sun, 29 Jan 2023 03:40:40 GMT
Date: Sun, 29 Jan 2023 03:04:22 GMT
Connection: keep-alive
www.kmcthospital.com/standard2land/5zmvlzda=/password.php
301 Moved Permanently 188 B URL HTTP/1.1 www.kmcthospital.com/standard2land/5zmvlzda=/password.php
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash c65122e7be0806f3a75292af833b6713
d156c849a1f81faa7228d90b0ea7a47a98500a64
7463caec9c2f985116c5bed03897c82bead84a2a80bdfcb31ab48e5cc7d7cd7f
Analyzer Verdict Alert fortinet Phishing
GET /standard2land/5zmvlzda=/password.php HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Sun, 29 Jan 2023 03:04:26 GMT
Content-Length: 188
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3eb88dea4fe00db1182370e72683c3ab
ca520abf1e91bfd2aef40c6a1270a911071e8922
d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4321
Expires: Sun, 29 Jan 2023 04:16:23 GMT
Date: Sun, 29 Jan 2023 03:04:22 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 302c7548412192add063ad6c8b99cf3b
e5d178931a27db036ce8daae302594d3ff7050b8
fc2bd9091006189e67e8074093805ee5492ce16e1dbfba32e083abeeae34969d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FC2BD9091006189E67E8074093805EE5492CE16E1DBFBA32E083ABEEAE34969D"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16779
Expires: Sun, 29 Jan 2023 07:44:01 GMT
Date: Sun, 29 Jan 2023 03:04:22 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 29 Jan 2023 02:35:33 GMT
content-type: application/json
age: 1729
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: vFBYlIXbSr9Dtj/v04koaNUySMcrFM6JwjLuNUS89rtM58GOTx/b1qpFrrYjlFFF3MNgQItjH/M=
x-amz-request-id: ZXCNSY34369ZDPYC
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 29 Jan 2023 02:50:09 GMT
age: 853
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 29 Jan 2023 03:04:22 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Last-Modified, ETag, Content-Length, Expires, Cache-Control, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 29 Jan 2023 02:49:03 GMT
age: 920
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
www.kmcthospital.com/standard2land/5zmvlzda=/password.php
200 OK 5.1 kB URL HTTP/2 www.kmcthospital.com/standard2land/5zmvlzda=/password.php
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (446), with CRLF line terminators
Hash 140cd2025a6722faa250c4f7cbe1536a
b00dbc4c488eca87d52f07a0aae7b56ba078df91
14299d3d6b43ca07af6b56310cf6c31fb5d9b003b450286fe16aace9d7bff501
Analyzer Verdict Alert fortinet Phishing
GET /standard2land/5zmvlzda=/password.php HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
cache-control: private
content-type: text/html; charset=utf-8
content-encoding: br
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
set-cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0; path=/; HttpOnly; SameSite=Lax
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 5111
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 16a7b6a7128312e2f985d30df18c4487
6017bff79ffb525d9c7f9f32b999b74b5dc69602
663fd12209627f08e759c2ed1c76278a5da79dae1e0b46082dd1bb44775f7a16
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "663FD12209627F08E759C2ED1C76278A5DA79DAE1E0B46082DD1BB44775F7A16"
Last-Modified: Fri, 27 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3091
Expires: Sun, 29 Jan 2023 03:55:54 GMT
Date: Sun, 29 Jan 2023 03:04:23 GMT
Connection: keep-alive
www.kmcthospital.com/css/CustomStyle.css
502 Bad Gateway 0 B URL HTTP/2 www.kmcthospital.com/css/CustomStyle.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /css/CustomStyle.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 502 Bad Gateway
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 0
X-Firefox-Spdy: h2
www.kmcthospital.com/WebResource.axd?d=XLbUQuO-hrASu_LVFhjxApC7qD9oz4gIY-BBn21QWtUmoVMgESLCj9FaQihrZQW_MUd3OntyaK1krMi7aOyOh5hKOD41&t=637811927229275428
200 OK 6.2 kB URL HTTP/2 www.kmcthospital.com/WebResource.axd?d=XLbUQuO-hrASu_LVFhjxApC7qD9oz4gIY-BBn21QWtUmoVMgESLCj9FaQihrZQW_MUd3OntyaK1krMi7aOyOh5hKOD41&t=637811927229275428
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash 19de2925b4ef32421ee614034d32b74c
edf05a2a319f61a3b7ae9872dc0da276b050f2a7
91aca35fd9ce371718ff9dc1c13a7d2b15aeae531d418b5c9b18854c611bdde3
GET /WebResource.axd?d=XLbUQuO-hrASu_LVFhjxApC7qD9oz4gIY-BBn21QWtUmoVMgESLCj9FaQihrZQW_MUd3OntyaK1krMi7aOyOh5hKOD41&t=637811927229275428 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: public
content-type: application/x-javascript
content-encoding: br
expires: Sun, 28 Jan 2024 18:13:08 GMT
last-modified: Wed, 23 Feb 2022 00:28:42 GMT
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 6194
X-Firefox-Spdy: h2
www.kmcthospital.com/css/style.css
200 OK 11 kB URL HTTP/2 www.kmcthospital.com/css/style.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 531a138424e4eb8c7a12bb4b8dee8132
9b6168c7ae7c058dc3470c7c72068eecb2597146
01bb535f4c630c7c2f550c176927abfe6e933bf13afe72ae62969affb448b8b6
GET /css/style.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:32 GMT
accept-ranges: bytes
etag: "0d4d4781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 10641
X-Firefox-Spdy: h2
www.kmcthospital.com/css/popup-style.css
200 OK 818 B URL HTTP/2 www.kmcthospital.com/css/popup-style.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash ee224eeea9259915a4010bf65cca3513
948f5039cfc08ce8663b203e7930e5a7604216f7
00116be72295efebbb4b966fa8ddd7c07c5501efad4ea5040f6b50744f4e1ead
GET /css/popup-style.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "fd9ca781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 818
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: zS/7uTynkhcafIOYFIRSMg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 8+S2ZUy50B6oYls/+XvqrvbeYqg=
www.kmcthospital.com/css/all.css
200 OK 13 kB URL HTTP/2 www.kmcthospital.com/css/all.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash dd17ca8280ce09ce347167adf2149b07
de0e571851f8f04506490457858ea46cde427117
19bdd5992e6a72e3790bde7fef4d34bb463a252dfe053d81b26940826bb091c6
GET /css/all.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:30 GMT
accept-ranges: bytes
etag: "0a7a3771412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 12672
X-Firefox-Spdy: h2
www.kmcthospital.com/css/animate.css
200 OK 4.3 kB URL HTTP/2 www.kmcthospital.com/css/animate.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash 2f50860912e08decbb7b5bf25fc37cef
c4aa66b70fb889271d5b38ddc6e9480b5fe0d6d9
bde5c6c183d058fe5a7cf29b9db56c3a0a923a7ac79e07a970014aa60baf1a67
GET /css/animate.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:30 GMT
accept-ranges: bytes
etag: "0a7a3771412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 4271
X-Firefox-Spdy: h2
www.kmcthospital.com/css/demo.css
200 OK 3.5 kB URL HTTP/2 www.kmcthospital.com/css/demo.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash 79a2b86a93bed5f2918d2241a54113d3
0c538139378a0b0d87c78e63143be685d332f582
8cbcd489df12cea819efecb4349d8cab2d1992f4f44b6a6da008184dd2674579
GET /css/demo.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "803d3c781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 3474
X-Firefox-Spdy: h2
www.kmcthospital.com/css/font-awesome.min.css
200 OK 4.7 kB URL HTTP/2 www.kmcthospital.com/css/font-awesome.min.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (21822), with CRLF line terminators
Hash 1fca9b05c4fbd1ae8d2bcb4cd4777207
8121336081068d3b49acf081ca70a2e6a3028d27
7f67cb847dca504c0f11e5d546249b84ece98dd185b6534f0c28d20cf91ea5e9
GET /css/font-awesome.min.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "803d3c781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 4707
X-Firefox-Spdy: h2
www.kmcthospital.com/css/bootstrap.css
200 OK 20 kB URL HTTP/2 www.kmcthospital.com/css/bootstrap.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash 01c22347803b6bcaed42333fe7aba495
06f8b074672f453f9e12fb36155bb1963013da7f
cd3279c285470ca57245f0b5bf5039c37b385ee7afb78bc044cc28a73c8c9448
GET /css/bootstrap.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "803d3c781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 19651
X-Firefox-Spdy: h2
www.kmcthospital.com/css/owl.carousel.min.css
200 OK 913 B URL HTTP/2 www.kmcthospital.com/css/owl.carousel.min.css
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (3174), with CRLF line terminators
Hash e266649ecbab50a833552c60c72ee369
877a0ede679d46bc7e22b0736727315b96c6cf4e
a4d67fce79ca4c12ec5a872acfab84dc28844ae8f60fdf0c1c26699835399a7b
GET /css/owl.carousel.min.css HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/css
content-encoding: br
last-modified: Sat, 17 Dec 2022 12:38:31 GMT
accept-ranges: bytes
etag: "803d3c781412d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 913
X-Firefox-Spdy: h2
www.kmcthospital.com/images/location.png
200 OK 392 B URL HTTP/2 www.kmcthospital.com/images/location.png
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 12 x 17, 8-bit/color RGBA, non-interlaced\012- data
Hash 040c868d17ee8d8c61f65a4753c9bb19
16ff7906f779f45793f43558506d06070636a8c8
8ef1e0aaac23892439507ee12bac72fbc4219126f954f86f80e32d45891d87b2
GET /images/location.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:57 GMT
accept-ranges: bytes
etag: "81f44515f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 392
X-Firefox-Spdy: h2
www.kmcthospital.com/images/call.png
200 OK 356 B URL HTTP/2 www.kmcthospital.com/images/call.png
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced\012- data
Hash e83b884a4932bd7ee72b277534e76a53
3d5b356a73fa517961cee1eeafac3f3c1c30e365
62be2b564019d21ec1f83c038b8b8f9e5f8027128d9e472d4259496412719bc4
GET /images/call.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:54 GMT
accept-ranges: bytes
etag: "ecba6d13f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 356
X-Firefox-Spdy: h2
www.kmcthospital.com/WebResource.axd?d=KndHT_7njKxeWmkPOi3DzGZ6BSKvEgLwvo_BEg0G7Z-T-eYqMPuPgLTyYOkwf_NaS4I0hPZlH8N-5CBL0AB4kHbA-E01&t=637811927229275428
200 OK 7.3 kB URL HTTP/2 www.kmcthospital.com/WebResource.axd?d=KndHT_7njKxeWmkPOi3DzGZ6BSKvEgLwvo_BEg0G7Z-T-eYqMPuPgLTyYOkwf_NaS4I0hPZlH8N-5CBL0AB4kHbA-E01&t=637811927229275428
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash e4a4de866ff1d5d0e43080d6b2956584
a888e41d318b338c97ff0646609821b9cea9825b
bc1f6ccca8de5ae7e40892b0989e5fe389a38d4289546bf311ad469cc0f0906a
GET /WebResource.axd?d=KndHT_7njKxeWmkPOi3DzGZ6BSKvEgLwvo_BEg0G7Z-T-eYqMPuPgLTyYOkwf_NaS4I0hPZlH8N-5CBL0AB4kHbA-E01&t=637811927229275428 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: public
content-type: application/x-javascript
content-encoding: br
expires: Sun, 28 Jan 2024 18:13:08 GMT
last-modified: Wed, 23 Feb 2022 00:28:42 GMT
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 7318
X-Firefox-Spdy: h2
www.kmcthospital.com/images/mail.png
200 OK 351 B URL HTTP/2 www.kmcthospital.com/images/mail.png
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 19 x 15, 8-bit/color RGBA, non-interlaced\012- data
Hash 7432896ef28194e8b8ffb6a772175e66
67be386731283acd37904b63cca47c426c202fdc
c9c7631f76d4831cb7e3d16141c7c506489f7a7074f2866b9b28d0e73a61921c
GET /images/mail.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:57 GMT
accept-ranges: bytes
etag: "3558015f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 351
X-Firefox-Spdy: h2
www.kmcthospital.com/images/cancel.png
200 OK 474 B URL HTTP/2 www.kmcthospital.com/images/cancel.png
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 24 x 24, 16-bit gray+alpha, non-interlaced\012- data
Hash c3a1cfd006f2d11d043e4f8a4ebda920
f850d0911131e74cea93d773ac8c95f6e5fbf99a
8ed4396ed14f281fc8acf5a39e5c6f4fdf23d6139cae3f25e5f2de73ad1f935e
GET /images/cancel.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:54 GMT
accept-ranges: bytes
etag: "a1ea7213f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 474
X-Firefox-Spdy: h2
www.kmcthospital.com/js/popup.js
200 OK 490 B URL HTTP/2 www.kmcthospital.com/js/popup.js
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with CRLF line terminators
Hash 4a65d5c6d3823fa475ea51c74d43d374
964c401c5a17aa3a4d610d272f3bcb7b550a80e6
20f67bf4bd2ef8becc96712124ce91950cda78ee19feab927068557a266f6027
Analyzer Verdict Alert fortinet Malware
GET /js/popup.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "63d8401dd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 490
X-Firefox-Spdy: h2
www.kmcthospital.com/js/main.js
200 OK 742 B URL HTTP/2 www.kmcthospital.com/js/main.js
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
Hash 517628fff1c0ec902728b8d66359e197
b31e2a71df96fac8d3bf215663fa0ab9248c0408
e6d16c465f4d7e6a61e27d6911d651267f126ac8f256af803765ab8ee31029af
Analyzer Verdict Alert fortinet Malware
GET /js/main.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "8081ba1cd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 742
X-Firefox-Spdy: h2
www.kmcthospital.com/images/logo.png
200 OK 6.0 kB URL HTTP/2 www.kmcthospital.com/images/logo.png
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 163 x 63, 8-bit/color RGBA, non-interlaced\012- data
Hash 51f7165a9c6f000112e33ed40ac6e656
f7f08caef5732ac66966a1ad9b7888113f17b492
1ba89830a18a989169b0bfeedcf4b368d25fb5118d5388d214e63d46c948117b
GET /images/logo.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:57 GMT
accept-ranges: bytes
etag: "60e45f15f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 5960
X-Firefox-Spdy: h2
www.kmcthospital.com/js/owl.carousel.min.js
200 OK 11 kB URL HTTP/2 www.kmcthospital.com/js/owl.carousel.min.js
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (31997)
Hash c5152780ecb150d1659cfcae81691588
755e83a2ac070034852480378bba3f795919d58a
5aa5823f32deb8e35df0d6468fa607a8555145dc6f4516b039c8217591d5b7d0
Analyzer Verdict Alert fortinet Malware
GET /js/owl.carousel.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "8081ba1cd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 10984
X-Firefox-Spdy: h2
www.kmcthospital.com/js/bootstrap.min.js
200 OK 12 kB URL HTTP/2 www.kmcthospital.com/js/bootstrap.min.js
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (48664)
Hash 1206e6fb336f4b937f1d0d83e2a79ea1
275a0352a904846e31e0f99be57bfc34ada88a11
573231a6724f70bc76b14b1f30d4d1f60689b13c7aa4109dbea9c310f3bd5510
Analyzer Verdict Alert fortinet Malware
GET /js/bootstrap.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:50 GMT
accept-ranges: bytes
etag: "0eb211cd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 12411
X-Firefox-Spdy: h2
www.kmcthospital.com/js/jquery-3.1.1.min.js
200 OK 29 kB URL HTTP/2 www.kmcthospital.com/js/jquery-3.1.1.min.js
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type ASCII text, with very long lines (32030), with CRLF line terminators
Hash f1c16a8fcaba171346ad47f7eb79ff97
0b3ecf5715d0a522326d5a220e9ed59b5a70508d
578a94fc08e5910b3f012ae18c143123373cbf4c3403056a43256c5da780d900
Analyzer Verdict Alert fortinet Malware
GET /js/jquery-3.1.1.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "8081ba1cd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 29265
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 86352d15c37831cf9bf1e41325029224
ac8b28bcc1e6dd026e1f62d1ef8b9f80a42eee21
154f5f5e116df41f5d3bd414c671138b2afc198071529a0f3573109277566cd8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 03:04:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 86352d15c37831cf9bf1e41325029224
ac8b28bcc1e6dd026e1f62d1ef8b9f80a42eee21
154f5f5e116df41f5d3bd414c671138b2afc198071529a0f3573109277566cd8
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 03:04:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.kmcthospital.com/js/jquery.min.js
200 OK 34 kB URL HTTP/2 www.kmcthospital.com/js/jquery.min.js
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Unicode text, UTF-8 (with BOM) text, with very long lines (65479), with CRLF line terminators
Hash 66f2f8139e01ac9e7800476946b19a96
096ec0c60a4c61ca324563bab870a8a6ed6266fa
b9f995452caf2e45385f4b290dd8ab56ad06563c72ca17363e9dda5e41af7910
Analyzer Verdict Alert fortinet Malware
GET /js/jquery.min.js HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: text/javascript
content-encoding: br
last-modified: Sat, 17 Dec 2022 11:45:51 GMT
accept-ranges: bytes
etag: "8081ba1cd12d91:0"
vary: Accept-Encoding
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:27 GMT
content-length: 33583
X-Firefox-Spdy: h2
www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff2
200 OK 13 kB URL HTTP/2 www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff2
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (446), with CRLF line terminators
Hash 5eee1365a1c5b3c4dceb613ae7cbd029
03675b50a50a28a6f019df6d511baf5ce42bf1e0
04996558f58cc35aac309e13953cfca2f4fb4b3845363d9125e8af3b738ad552
Analyzer Verdict Alert fortinet Malware
GET /fonts/FontsFreeNetNekstLight.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: private
content-type: text/html; charset=utf-8
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:28 GMT
content-length: 13015
X-Firefox-Spdy: h2
www.kmcthospital.com/fonts/GTAmericaCondensedBold.woff2
200 OK 6.8 kB URL HTTP/2 www.kmcthospital.com/fonts/GTAmericaCondensedBold.woff2
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format (Version 2), TrueType, length 6788, version 1.0\012- data
Hash 82bbd99d1fd2fdde2ac813ddd2eafa3a
d7fbb8bceb3129a1d13e3fba6472990b3f365019
49a6d9f893d552157eec675f0b5062b11d9477cb232c96e12cdfde9f728842c7
Analyzer Verdict Alert fortinet Malware
GET /fonts/GTAmericaCondensedBold.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff2
last-modified: Sat, 17 Dec 2022 04:34:46 GMT
accept-ranges: bytes
etag: "8d2a7e4d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:28 GMT
content-length: 6788
X-Firefox-Spdy: h2
www.kmcthospital.com/fonts/FontsFreeNetNekstMedium.woff2
200 OK 30 kB URL HTTP/2 www.kmcthospital.com/fonts/FontsFreeNetNekstMedium.woff2
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format (Version 2), TrueType, length 29872, version 1.0\012- data
Hash cbeb022216db9453ccb07100b5b144f8
71de96bd9c24a7a23234ffc60599a771be4d7f00
891125104f80f752502ee9d11220a0749cb61a0806eaf85d7901863a0961ccc4
Analyzer Verdict Alert fortinet Malware
GET /fonts/FontsFreeNetNekstMedium.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff2
last-modified: Sat, 17 Dec 2022 04:34:41 GMT
accept-ranges: bytes
etag: "18f491e1d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:28 GMT
content-length: 29872
X-Firefox-Spdy: h2
www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
200 OK 1.6 kB URL HTTP/2 www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3473)
Hash 7c7c7154053948b793266dee3a6ee9db
32eb06c9c7e584c7a639d6baf96d9dea7b6a2344
5e0ac3648cd3905ca45e894c1d642b100daaba0ff1b17e7d15507402e5940dab
GET /maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Sun, 29 Jan 2023 03:04:24 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
vary: Accept-Language
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-TQzL8ImYSwBgEygQNB3itA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/geo-maps-api/1
content-encoding: gzip
server: mafe
content-length: 1620
x-xss-protection: 0
server-timing: gfet4t7; dur=147
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.kmcthospital.com/webfonts/fa-brands-400.woff2
200 OK 77 kB URL HTTP/2 www.kmcthospital.com/webfonts/fa-brands-400.woff2
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format (Version 2), TrueType, length 76736, version 331.-31196\012- data
Hash ed311c7a0ade9a75bb3ebf5a7670f31d
0613c7ebba55ee47ef302c0f7766324692f899a7
8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef
Analyzer Verdict Alert fortinet Malware
GET /webfonts/fa-brands-400.woff2 HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/all.css
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff2
last-modified: Sat, 17 Dec 2022 04:35:16 GMT
accept-ranges: bytes
etag: "6c42dff5d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:28 GMT
content-length: 76736
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash ef589be52a3e55b643978f17949a73da
74545de6f144282252ff92c751f97cc835c80341
7bfa68c43e60a2627770163b5c1b96fbd7e4843984ad5ff6225c5490b8073b26
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 03:04:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 8c630e9bbc930d1c367efa81b67be3f7
ec536695531d40a813d99a06271c7c2d698d51d3
39ca0a60c3e2e85712757ead0830d0da82beac1e4f44b6e90243e5ca9326bf4b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 03:04:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
maps.googleapis.com/maps/api/js?client=google-maps-embed&paint_origin=&libraries=geometry,search&v=3.exp&language=en®ion=in&callback=onApiLoad
200 OK 56 kB URL HTTP/2 maps.googleapis.com/maps/api/js?client=google-maps-embed&paint_origin=&libraries=geometry,search&v=3.exp&language=en®ion=in&callback=onApiLoad
IP
File type ASCII text, with very long lines (2546)
Hash 85bc607bc32c6bff0e3053293f83b3c2
3dfefdc15c17cef78a1708d3eedd08d785c968f6
85ddb27c1e3ddfeca5171d632bb208fbf24aa5bba2db1a1e80f4ef12676fa71c
GET /maps/api/js?client=google-maps-embed&paint_origin=&libraries=geometry,search&v=3.exp&language=en®ion=in&callback=onApiLoad HTTP/1.1
Host: maps.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-encoding: gzip
server: mafe
content-length: 56008
x-xss-protection: 0
x-frame-options: SAMEORIGIN
date: Sun, 29 Jan 2023 02:44:32 GMT
expires: Sun, 29 Jan 2023 03:14:32 GMT
cache-control: public, max-age=1800
content-type: text/javascript; charset=UTF-8
age: 1192
server-timing: gfet4t7; dur=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 8c630e9bbc930d1c367efa81b67be3f7
ec536695531d40a813d99a06271c7c2d698d51d3
39ca0a60c3e2e85712757ead0830d0da82beac1e4f44b6e90243e5ca9326bf4b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 03:04:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff
200 OK 46 kB URL HTTP/2 www.kmcthospital.com/fonts/FontsFreeNetNekstLight.woff
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type Web Open Font Format, TrueType, length 45972, version 1.0\012- data
Hash 00dddaea66f1f48e2ea621d78a97ae07
2be85531008d854577126914c585d259bb7639db
66a797f5c1d644b3b8a9d783cb0e2c91cd03aaf1dce895a3a1fc9bc275d05f07
Analyzer Verdict Alert fortinet Malware
GET /fonts/FontsFreeNetNekstLight.woff HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.kmcthospital.com/css/style.css
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: font/x-woff
last-modified: Sat, 17 Dec 2022 04:34:39 GMT
accept-ranges: bytes
etag: "a82733e0d011d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:28 GMT
content-length: 45972
X-Firefox-Spdy: h2
www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
200 OK 1.6 kB URL HTTP/2 www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3428)
Hash bf17f46cda9e19e3d3042ad353dac315
6534a6a639de722581a2540e5701a048590f09a4
4ac36ed700c4e7c3058ee486cd3086b16af8b99fb963a48c8ea61b95e5077700
GET /maps/embed?pb=!1m18!1m12!1m3!1d3912.374651577319!2d75.96588431480555!3d11.307302891962633!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x3ba64235bd9926bd%3A0x73e8c8c7a0d0d080!2sKMCT%20Medical%20College%20Hospital!5e0!3m2!1sen!2sin!4v1671253143612!5m2!1sen!2sin HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
cache-control: no-cache, must-revalidate
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-m6g8iFDj3pmd3knj7G_zGQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/geo-maps-api/1
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
content-type: text/html; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Sun, 29 Jan 2023 03:04:24 GMT
server: scaffolding on HTTPServer2
content-length: 1615
x-xss-protection: 0
x-content-type-options: nosniff
server-timing: gfet4t7; dur=140
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 8cf65fcdafa84b63cf7005fe57927fcb
3f7d163a96e7f00eb2de9828624ec46e22b4b40a
dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 03:04:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
maps.gstatic.com/maps-api-v3/embed/js/51/7/init_embed.js
200 OK 69 kB URL HTTP/2 maps.gstatic.com/maps-api-v3/embed/js/51/7/init_embed.js
IP
File type ASCII text, with very long lines (2599)
Hash fd4867728783671f13b38d1f073e7be9
ff5ba304ce5b2838e4b49b6cff833dede37e1098
52a398663110b5dc50e72094c287b049ec5ed33a2b639418e4e1a9c3d313b82c
GET /maps-api-v3/embed/js/51/7/init_embed.js HTTP/1.1
Host: maps.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-length: 69373
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 28 Jan 2023 03:51:36 GMT
expires: Sun, 28 Jan 2024 03:51:36 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 23 Jan 2023 21:48:16 GMT
content-type: text/javascript
age: 83568
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 8cf65fcdafa84b63cf7005fe57927fcb
3f7d163a96e7f00eb2de9828624ec46e22b4b40a
dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 03:04:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.kmcthospital.com/images/Fav-icon.png
200 OK 1.2 kB URL HTTP/2 www.kmcthospital.com/images/Fav-icon.png
IP
ASN #394695 PUBLIC-DOMAIN-REGISTRY
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash 9743e95b98854912e4bfeefd3df0e74f
0564bc1c479c6f58cc31a9abc712871469494c93
2c22ba16d8f3af770b82a8e77e7e805c56be1769b185724e0a880a7e4679e45a
GET /images/Fav-icon.png HTTP/1.1
Host: www.kmcthospital.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.kmcthospital.com/standard2land/5zmvlzda=/password.php
Cookie: ASP.NET_SessionId=dtlqbo5ajfvbj4pifyynupg0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
cache-control: max-age=604800
content-type: image/png
last-modified: Sat, 17 Dec 2022 11:59:55 GMT
accept-ranges: bytes
etag: "5c17d313f12d91:0"
server: Microsoft-IIS/10.0
access-control-allow-origin: *
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Sun, 29 Jan 2023 03:04:28 GMT
content-length: 1201
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14863
Expires: Sun, 29 Jan 2023 07:12:07 GMT
Date: Sun, 29 Jan 2023 03:04:24 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14863
Expires: Sun, 29 Jan 2023 07:12:07 GMT
Date: Sun, 29 Jan 2023 03:04:24 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14863
Expires: Sun, 29 Jan 2023 07:12:07 GMT
Date: Sun, 29 Jan 2023 03:04:24 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8047
Expires: Sun, 29 Jan 2023 05:18:31 GMT
Date: Sun, 29 Jan 2023 03:04:24 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 43c4a8e963936a8064dbd2bd3c67b905
8508727c97127c98b886833af28b3470306216c2
070c29fe7c0a227029483d675eac863904ab6b291467acdf62167f4845699c21
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8652
x-amzn-requestid: 5a5a883e-d7d4-4fc5-925a-3a95830c504e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fVguyG7BIAMFm8g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d214c4-390b59a32060e41203533c58;Sampled=0
x-amzn-remapped-date: Thu, 26 Jan 2023 05:51:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ewSsCY4u9DwRtaj00U9JCim9tYeCgHRuIQFpdHm4ttI6L02-e44iDQ==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 23:11:24 GMT
age: 13980
etag: "8508727c97127c98b886833af28b3470306216c2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg
200 OK 5.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4c77437e3a7361861aed8bfecbfe6bd6
fefd238c13c0fdfb7d964c90fcc8a8cbbf953034
282d15c443cb6232ae0a30046a0dc24360617355a4651cdba59b11e6f7313d8a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d4cfe7c-2bbe-4efd-b73a-59ea603c332f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5594
x-amzn-requestid: d56c9b84-dc1f-4d5c-91bf-7db55058bf67
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLyeEGOloAMFpzA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ce3126-5013a6b971d6800c5c85a4eb;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 07:03:02 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: D2ZAelkDgsd0wjoOSoPRwTzhozs84_aIcgwU-QmbDrTnHztVD0VL_A==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 14:57:16 GMT
age: 43628
etag: "fefd238c13c0fdfb7d964c90fcc8a8cbbf953034"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3dade28b-c683-4510-bc44-0207300ccc21.jpeg
200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3dade28b-c683-4510-bc44-0207300ccc21.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6e46615b79ad2d230e98a2b9c54f4431
db55bd978e18e595d695637183862f8c5e7da5dd
f27875ef624f602be8d93b8bc7fae062bf877fc724473613242da4e493510673
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3dade28b-c683-4510-bc44-0207300ccc21.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6211
x-amzn-requestid: 529cce27-9ee1-4caf-b3ac-3db8216cb155
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fOdPSGFAIAMF2Eg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cf4261-1cbed26b6cf345de3046b6e8;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 02:28:49 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: KYA71q94uZX-mGN9EHC9Perjn0kOscXZCwgjAhYYnQYITBTeN4xmzQ==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 11:21:43 GMT
age: 56561
etag: "db55bd978e18e595d695637183862f8c5e7da5dd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8f2806c-ec5e-41a0-85d8-007f6d34d108.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8f2806c-ec5e-41a0-85d8-007f6d34d108.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6021d6a06bff2826eb341747e82484f7
a817ff1ba206234627706551820d0d9856b398de
f0ba6de8709fdb73e94dbdace635232c76b9d70dad73badaca0542d9ad49604d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8f2806c-ec5e-41a0-85d8-007f6d34d108.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11624
x-amzn-requestid: dff12902-8b83-4df1-a2c9-a2ee9565830f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fIhnjEmpIAMFdlA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cce2fc-0216188a3154167648f7d976;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 07:17:16 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: kxzVU1bNn09g_-73AY-mNvzhHo-dTyQinPkfPEqhDcKFfrTnbDpaZQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 23:15:07 GMT
age: 13757
etag: "a817ff1ba206234627706551820d0d9856b398de"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcc7f65e9-ca75-4ecb-ba7c-ae70877eaf01.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcc7f65e9-ca75-4ecb-ba7c-ae70877eaf01.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2f73f114f8dc452fc0b16825570ad50c
6bb1b3db6c36e2c9d23b6cb7d1c8616eeec19575
23fd69e6ccdd2ce2b5d3d8b3f075a07cdb36efd663a4119b5dca22165e7b2090
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcc7f65e9-ca75-4ecb-ba7c-ae70877eaf01.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10030
x-amzn-requestid: 0c6c82b5-f91b-4468-bb25-d87d4d7dedd5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fVAbgERRIAMFdcw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d1e116-7f17c79047447dff2de3ab67;Sampled=0
x-amzn-remapped-date: Thu, 26 Jan 2023 02:10:30 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 4C0fCJB3N9nw0xKQnlsRLx_VGA3shg394U3Tq4pxNMWgggZe93TLUA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 20:30:44 GMT
age: 23620
etag: "6bb1b3db6c36e2c9d23b6cb7d1c8616eeec19575"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg
200 OK 9.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3be81f83687ddb6c93d3ff3c09a9dba2
50a48e737310d3f31840db4301b25927fbcc12c5
e78c909e2381898e7f546183784a05dff47c31734c95358aaada8c2777ad47be
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9167
x-amzn-requestid: e6e0789c-a4a9-4ffa-a0ae-691770d1035b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fPF9YEBmIAMF0kQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cf8388-01d2093432d3959903671a69;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 07:06:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: awfNeaKbFw2bjiTGwUrwUTxU-qbVS2eTjn948H8kn1hy7pi_DwLMlQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 17:35:56 GMT
age: 34108
etag: "50a48e737310d3f31840db4301b25927fbcc12c5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 25 Jan 2023 19:33:54 GMT
expires: Thu, 25 Jan 2024 19:33:54 GMT
cache-control: public, max-age=31536000
age: 286231
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 25 Jan 2023 07:51:59 GMT
expires: Thu, 25 Jan 2024 07:51:59 GMT
cache-control: public, max-age=31536000
age: 328346
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
103.195.186.173
44.228.1.109
23.36.76.226
0.0.0.0