Report - cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

Report Overview

Submitted URL
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/
IP
192.169.219.127
ASN
#26496 AS-26496-GO-DADDY-COM-LLC
Submitted
2022-12-03 20:15:37
Access
Website Title
Final URL
Tags
None
urlquery detections
Phishing - Google
Phishing website detected

Detections

urlquery
14
Network Intrusion Detection
0
Threat Detection Systems
16

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.41.253.170
cgi.papersmiths.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	8.8 kB	167 kB	192.169.219.127
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	43 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.77.32
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.5 kB	93.184.220.29

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/	Google Inc.

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/	Phishing
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.js	Phishing
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.ddslick.min.js	Phishing
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.js	Phishing
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.min.js	Phishing
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff	Phishing
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.js	21 kB	2023-03-07	2024-04-22
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-22 10:37:56 Times Seen153 Hash d6be38fb42c2e9618c9d5f2664078c19 77f553236f588cece0fe2be4859e8f3220231a1f 3df1b7719a1aa90d70ae337b76b6253b01ede9afa038b290498c3abf4ab54027 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.ddslick.min.js	7.2 kB	2023-03-07	2024-04-19
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.ddslick.min.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-19 02:11:18 Times Seen122 Hash d04d05b0ff957ffe696a978c851adf14 b97757fa25c5e1762c5812e427e8c59e0bd9436f 970882d4a7e6a84819f31de8d238cb3ada20bf0a4ea307b45bf44988bbfc4602 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.js	78 kB	2023-03-07	2024-04-22
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-22 10:37:56 Times Seen159 Hash 7947cb5a92373e747f786adfe1d49356 51165a72a6437ea17dda2afc64dbd7624cf46a36 69e875128adeedbc8aa1221b7ebffb20b484685964f4ab9a9772ce2146e52d48 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.min.js	95 kB	2023-03-07	2024-04-22
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.min.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-22 10:37:56 Times Seen697 Hash a13f7f208ba534681deadb1ec7a2e54a 3f51e2eecfa88c61e1200a48ed14f2cdda98ed87 d72fcb8924d1e14dbd4b04aff994c1183ee86c620f0aaac034f75fc508548220 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/	384 B	2023-03-07	2024-01-14
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/ IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-01-14 14:11:28 Times Seen17 Hash 5e0c5d5fd20071b8dddddebec0750dd0 73acbd4b4f963934174c263cd92dd3059215969f 93ea414cf314b95062256726481dcf795bb566accd72c9d7fbf45bc7d6461150 Loading...

HTTP Transactions (38)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6011
Expires: Sat, 03 Dec 2022 21:55:37 GMT
Date: Sat, 03 Dec 2022 20:15:26 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
67e9370f1bf3e4946a01f346eeae8966
aaab391d1134302d718de7a0d5edbedf884633e6
27a8654fb14db88d4b2bb3b45c1b197fc498cd94143d4a68687742fa48a41358

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6211
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 03 Dec 2022 20:15:26 GMT
Last-Modified: Sat, 03 Dec 2022 18:31:56 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7250
Expires: Sat, 03 Dec 2022 22:16:16 GMT
Date: Sat, 03 Dec 2022 20:15:26 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 03 Dec 2022 19:18:16 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3430
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: RjgGDzoJGG0LO9auIApN2J9ONyOQvXXcAXE1wj0jHBBABBk97SMLNW03IKgDjknmGUH9CpW5DQM=
x-amz-request-id: QNRVM8C6B9GA8R57
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 03 Dec 2022 19:47:15 GMT
age: 1691
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 03 Dec 2022 20:15:26 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 03 Dec 2022 20:08:58 GMT
cache-control: public,max-age=3600
age: 389
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
a151c326c67e1abb747847c1427db76f
80885d30ef8ba867bf33c40b861976958a27493a
de2b573ee1c8af980e593352e0c331b2595f62bd4499300ace30821d20814760

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6235
Cache-Control: max-age=138919
Content-Type: application/ocsp-response
Date: Sat, 03 Dec 2022 20:15:27 GMT
Etag: "638b11ab-1d7"
Expires: Mon, 05 Dec 2022 10:50:46 GMT
Last-Modified: Sat, 03 Dec 2022 09:06:51 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

52.41.253.170

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.41.253.170:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: hk2KaxDjp59e3EyddY1GFw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: P3QcUeWU64HXQmHYbR63Ld9SpLw=

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

192.169.219.127

200 OK

7.0 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text
Size
7.0 kB (6966 bytes)
Hash
33788b1b5641e586c8292939dc6428e3
a20be88178f6c1fae021658ba6f23ff5ef531a68
3c71cf9e1ad90ffafac459f02356ba1302f44fb1a31cb01c5fcfad67827215fa

Detections

Analyzer	Verdict	Alert
urlquery		Phishing website detected
openphish	Google Inc.
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/ HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:27 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 6966
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.css

192.169.219.127

200 OK

878 B

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.css
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
ASCII text, with CRLF line terminators
Size
878 B (878 bytes)
Hash
76be30dfd9c602c42308f7f612670278
823757f63f91f30d4fb554e9c400491e85a44b22
6448513cf59ee1d69d3ac8ff3e7ab35ee930a1dd3e9ad53a791147d61d3cd947

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.css HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 878
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.css

192.169.219.127

200 OK

1.1 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.css
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
assembler source, ASCII text, with CRLF line terminators
Size
1.1 kB (1068 bytes)
Hash
9aece729e5c01e567ac1cd247580f6b5
055df5132f4e7099006472864f2c9c97b305ac50
23528c3a34e29cc89c18f30133e5ed0f8e9740338952e7396ee69455f0b35985

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.css HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1068
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.js

192.169.219.127

200 OK

4.9 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
ASCII text, with CRLF line terminators
Size
4.9 kB (4884 bytes)
Hash
297b1612482f97c42812bd4e247aae5e
e795e2cab0a344cdb9b4636c1d537ce82079229f
e00fc88789e5ff36b9b029b4f422c7f04f6a06eafe74c3664349920b86f7f7f5

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationPassword.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 4884
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.ddslick.min.js

192.169.219.127

200 OK

2.4 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.ddslick.min.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (7149), with no line terminators
Size
2.4 kB (2365 bytes)
Hash
f8f1048858f981b77d6301fe7d792e38
2dd7cd336d6f5c4bd9bb7b4ca8788dbc56cf3ecd
55e3fbee508044c3fb516a06f93e6b47325176844f3ea07d7d95d302dd15e1fe

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.ddslick.min.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 2365
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.js

192.169.219.127

200 OK

17 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
ASCII text, with very long lines (430), with CRLF line terminators
Size
17 kB (17183 bytes)
Hash
0045751a5ff88bc5481e1dc55155e45d
848b97e588420a0b3bd3f36914f160e612574a36
4061eb93e539cc7dd4a71be9a385b40c59f9c1be360cebca8d28cf32f3dba6eb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/SpryAssets/SpryValidationTextField.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 17183
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.min.js

192.169.219.127

200 OK

34 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.min.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (32769), with CRLF line terminators
Size
34 kB (33632 bytes)
Hash
646ccca432fef5e5234280ee44eb7c66
19162421a16d8165ea940f51a79c03553cc4637a
953c5bbaf62076a94a1f6c1ec1a0ee3a5363856ef9317dc4366c80b7318e0ee0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/jquery.min.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 33632
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/avatar_2x.png

192.169.219.127

200 OK

2.2 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/avatar_2x.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 192 x 192, 8-bit/color RGB, non-interlaced\012- data
Size
2.2 kB (2195 bytes)
Hash
17540f255f86c00bde81020fcc165989
33917cf0c146e88f8aca5b60c93437a4d31b84e8
8b2e5ba8089dccceb66536831349b5f34730da240c7a7331a68b2572865d8335

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/avatar_2x.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 2195
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/logo_strip_2x.png

192.169.219.127

200 OK

11 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/logo_strip_2x.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 420 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
11 kB (11156 bytes)
Hash
384a868cf5a995d033c4ac6e30c60355
33973ebe05a7bc3660a594c41d48a709e64a013d
a97200185f4992c536e4b269f2b8a727c65a25795b99805d80e61bf135f2d4ca

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/logo_strip_2x.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 11156
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/universal_language_settings-21.png

192.169.219.127

200 OK

199 B

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/universal_language_settings-21.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced\012- data
Size
199 B (199 bytes)
Hash
4a2d1168a691747daf4d22e0dc483958
e556fed18aff83a117f173960c66d42d57cbc4b4
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/universal_language_settings-21.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 199
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff

192.169.219.127

200 OK

23 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 22656, version 1.1\012- data
Size
23 kB (22656 bytes)
Hash
7c5d9f078bea8c1fc0b21a764b832138
2505fe5f361045be53fb71afb8b105e319393389
7e7fd69ff0a1671b508800f38f6ad3690650c27c0a1f3f505629ecbe6ba51942

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 22656
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/mail_gmail.png

192.169.219.127

200 OK

1.5 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/mail_gmail.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 26, 8-bit/color RGBA, non-interlaced\012- data
Size
1.5 kB (1528 bytes)
Hash
5d2f329d5813e9ad215d0117610a58c5
dc79b83740707c383ee1eff430223a9d5ea6ff2d
0e95cbf733f41b43a1e2716643ad7ea8cd5fdfcb2eee2d038f4618c579bcaff7

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/mail_gmail.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 1528
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/logo_strip.png

192.169.219.127

200 OK

27 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/logo_strip.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 405 x 72, 8-bit/color RGBA, non-interlaced\012- data
Size
27 kB (26647 bytes)
Hash
a6dd956e0a1b11991ac93335bbf4b4cc
0e470f11b69b0468b2d90366769891cace69f5d9
000da3616519f393f1d7450839c1dbda356053087d0191bd2d25a83e5fc63e8c

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/logo_strip.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 26647
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/yahoo.png

192.169.219.127

200 OK

2.8 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/yahoo.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
2.8 kB (2830 bytes)
Hash
fda2a0cac8b16568eed32edbc85b5db8
c5783560af0df9ff43f1320645c773a7b58b7795
0b6c1e1b33c085efad5bdc32654ec90b4ddc934eb1c1aca71a439ff89867f468

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/yahoo.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 2830
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/live_hotmail.png

192.169.219.127

200 OK

517 B

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/live_hotmail.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data
Size
517 B (517 bytes)
Hash
8dccdb0f930ec8ff6c62dd13474fa9f4
f8261ea396e36539b67a8a8ecb5290455f8f61af
c7b07a0440ecfbd1f32110a6a5c7e92ecfe0200a65ba5fdd5660a98cf2294c09

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/live_hotmail.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 517
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff

192.169.219.127

200 OK

22 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 21956, version 1.1\012- data
Size
22 kB (21956 bytes)
Hash
3eb14f3838ada50e10f062a895c3b9cf
f570b2fe0688332cf8c4a9127db25433d9a1ebaa
90556675373ea9ed1d0e9b5678426d69296b6801c906ca378bb426aa3d6acdc3

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 21956
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/aol.png

192.169.219.127

200 OK

1.2 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/aol.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
1.2 kB (1183 bytes)
Hash
1db15cc5ad50540b10cde2d733efd2a4
3526d7089c8e1bca74d31b827ecd91d26c04deb9
1b5fe12e21a9d8ff78e007ecf9fa5a819947dc3e6ba7a0ca4951760d1c006adf

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/aol.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 1183
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/email.png

192.169.219.127

200 OK

2.9 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/email.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data
Size
2.9 kB (2921 bytes)
Hash
f093ed003976ef8aa9d299051c06f26b
6072eb6be0da0dea159ce919c634e78fcefb7047
73b1ce58fa539aab1d6d1424607c5ff60fc5e2f2c0becd3a776f7f4f8f3664b0

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Google

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/email.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Content-Length: 2921
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2240
Expires: Sat, 03 Dec 2022 20:52:49 GMT
Date: Sat, 03 Dec 2022 20:15:29 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2240
Expires: Sat, 03 Dec 2022 20:52:49 GMT
Date: Sat, 03 Dec 2022 20:15:29 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2240
Expires: Sat, 03 Dec 2022 20:52:49 GMT
Date: Sat, 03 Dec 2022 20:15:29 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2240
Expires: Sat, 03 Dec 2022 20:52:49 GMT
Date: Sat, 03 Dec 2022 20:15:29 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg

34.120.237.76

200 OK

6.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.2 kB (6174 bytes)
Hash
b986f9fcbeca91ed5c8d58fbfaf47d19
6e6c8bd2bce144cc4da1cd7be375b046b60dca79
07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 00:57:24 GMT
age: 69485
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F864be807-d5f6-42e3-bd58-f7641a256b9a.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.7 kB (7732 bytes)
Hash
379a4a1b95d3aa3c5a4f8e7f9abb030f
d45dceb3dc58a07197aa5077582b5b1cd2ff791a
1b92dec5bf90beffbcd9060052b8788f08645dd4ba34219f7ddb2d40bbd2d151

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F864be807-d5f6-42e3-bd58-f7641a256b9a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7732
x-amzn-requestid: 3781c2b7-082a-468a-a186-f7483494e749
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoEq3IAMFnKg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-679fe9f905e07abf4e6a812c;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: V4Z3TZtTDMjnyxZx7VdJrKtZ-PbZkWnsQ0-1eFDem4TVyRGvk0dc7A==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:39:57 GMT
age: 81332
etag: "d45dceb3dc58a07197aa5077582b5b1cd2ff791a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73b53015-e415-4fff-9252-8a16bbe000f5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.7 kB (9715 bytes)
Hash
45182367fd4f8b6dd234eef1022acdb1
d4b3052021ff3ad1dc4134fa25eb12a98e7c17da
a57fadaf74db2fb457cfe761314d56f021d22146f5bdb6a8bf11b6519e8a558d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73b53015-e415-4fff-9252-8a16bbe000f5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9715
x-amzn-requestid: c8102cfa-78dc-4d81-ad6a-e16b9132e238
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZO2HQKIAMF8IA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f2b-350c586b568e6565763376bd;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:31 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0QkVKyYm9UwlF5FEeli9UsRAQwEi3-c3bMR-QSJxIKRQe7WWT76dGQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:51:06 GMT
age: 80663
etag: "d4b3052021ff3ad1dc4134fa25eb12a98e7c17da"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

2.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
2.9 kB (2942 bytes)
Hash
b47431190f34eccf0a6efb98e2a32b7d
9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XvG2dAUeB914GQ1qJwQRHovAtra8OSjG-CsXeR8UOBq5r8qVjEbPBQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 05:02:08 GMT
age: 54801
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7dc00fa-a8d3-44bf-ba84-1998d8dd7c5a.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.3 kB (4309 bytes)
Hash
fcb89ca25035b2bbb71ae5dd175fcd40
544428cdad754b1bb7be3cd46a79bf078fd5b450
36dcbbe6cd2710ee502776b4bcf32053e92b750a55e2bd4cdeadbc694c7c2699

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7dc00fa-a8d3-44bf-ba84-1998d8dd7c5a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4309
x-amzn-requestid: c824c317-e6e3-4006-9f9d-ea54e8170a4c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cf2_tGErIAMF8_A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63896b97-7fc523296afea4dd4b5d1de8;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 03:05:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: bd85z5A6C0nxpDjeSEPp1NHJxXFO5sy1OgTLz7KpdWz61TNrfyQ47Q==
via: 1.1 40b967aa4aa18637c4b91214147f3cb4.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 03:53:20 GMT
age: 58929
etag: "544428cdad754b1bb7be3cd46a79bf078fd5b450"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F627a3f86-b7fa-44c4-a119-2e3d23eb8b6a.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.4 kB (5354 bytes)
Hash
1e74254b3fdce7d6b84a71a7aff43789
65c8b4abf957f9b54d99d0f78559e639adb29efb
f278c3cc6734da7188862a8c651c803e7ac1fda82234e191761453cb1359d3ee

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F627a3f86-b7fa-44c4-a119-2e3d23eb8b6a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5354
x-amzn-requestid: 3d58ffea-3433-4c5c-a60b-17f6de3a33e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cSsnvG44oAMFfyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638427ca-63b375f04189b7ce7d84cd5d;Sampled=0
x-amzn-remapped-date: Mon, 28 Nov 2022 03:15:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: -AurmlKwF0QgfsWBsV3ZN9ZyDhw1Zo82zUqrpkBbvbCfh0j7evV2Tg==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 11:01:04 GMT
age: 33265
etag: "65c8b4abf957f9b54d99d0f78559e639adb29efb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/favicon.ico

192.169.219.127

200 OK

1.2 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/favicon.ico
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
1.2 kB (1220 bytes)
Hash
36d8bb1e0b38f25263661ae4ba5fb322
8b65c1a9d7ef974ed08f8b95758691e77d6b0979
ffd651558fb9cf7ac0c6b9c61298e48d6adc93be20bf5de27fceee8683c00597

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/Google_docs_files/favicon.ico HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/182005714c82d495787eb467e1a55e0a/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 20:15:28 GMT
Server: Apache
Last-Modified: Thu, 01 Dec 2022 07:53:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1220
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/x-icon

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (38)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size