Report - www.gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL

Report Overview

Submitted URL
www.gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
IP
198.187.31.85
ASN
#22612 NAMECHEAP-NET
Submitted
2022-11-23 20:26:35
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
12

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
www.gotravellbtg.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	477 B	560 B	198.187.31.85
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	46 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	4.4 kB	23.36.77.32
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.5 kB	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
gotravellbtg.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	4.1 kB	300 kB	198.187.31.85
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	35.164.56.167

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-23	medium	gotravellbtg.com/wp-includes/css/classic-themes.min.css?ver=1	Malware
2022-11-23	medium	gotravellbtg.com/wp-content/themes/twentytwenty/assets/js/index.js?ver=2.1	Malware
2022-11-23	medium	gotravellbtg.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1	Malware
2022-11-23	medium	gotravellbtg.com/wp-content/themes/twentytwenty/style.css?ver=2.1	Malware
2022-11-23	medium	gotravellbtg.com/wp-content/themes/twentytwenty/print.css?ver=2.1	Malware
2022-11-23	medium	gotravellbtg.com/wp-content/themes/twentytwenty/assets/fonts/inter/Inter-upright-var.woff2	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL	2.1 kB	2023-03-08	2023-03-11
Pretty URL gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL IP 198.187.31.85 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 16:06:06 Last Seen2023-03-11 19:19:44 Times Seen1 Hash 4336ea9f64b6acd9504a276195bdfbb5 fcdb078ac2a78946c3063e54810507df4fa3f45a 9420bc19d3d988b1af5c4bd66135c2df57cbb8f7bec7fda6d419ea244066b5b0 Loading...

	gotravellbtg.com/wp-content/themes/twentytwenty/assets/js/index.js?ver=2.1	26 kB	2023-03-07	2024-04-18
Pretty URL gotravellbtg.com/wp-content/themes/twentytwenty/assets/js/index.js?ver=2.1 IP 198.187.31.85 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:25:30 Last Seen2024-04-18 13:26:11 Times Seen906 Hash e8fde5fa3fac2c06011808f4b4fe4eff 9c792c9f7308e3d9f42781ed581d8c9a63f99135 6a9c7d809cf7886b0418e90771e5cb9b0d04c7fa4da523ca397698c3a4b4de86 Loading...

	gotravellbtg.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1	19 kB	2023-03-07	2024-04-26
Pretty URL gotravellbtg.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 IP 198.187.31.85 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:08 Last Seen2024-04-26 16:08:31 Times Seen38067 Hash 32beb68a374e3aeac00abdf9e12b84ea b5d18aa625e8696dd9d07cd0869337717b211ae0 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782 Loading...

	gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL	97 B	2023-03-07	2024-04-25
Pretty URL gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL IP 198.187.31.85 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-25 01:21:21 Times Seen1704 Hash 382baaa0b6a4b709817aa3d9a76cf798 790e0412f8e01e83192ce7117731d4e07be8890b d8dd9e4bee02cb49c521217c4f44067b3dfa7d425f698fa8e90056c535188877 Loading...

	gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL	329 B	2023-03-07	2024-04-25
Pretty URL gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL IP 198.187.31.85 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-25 22:19:47 Times Seen3720 Hash 03d6d38af8c34d50a7d4f77919f3f6c7 90e18129a2b50addce02c98c923534d242233216 9f7a87d73cf34cd5d76d600a5ce326ac1ce32a021067b1bb50587fa488b13444 Loading...

HTTP Transactions (28)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1456357aecbd23f21ad98da57e0127eb
7074815b39fa8da9013883971d665e4c1b0797ea
f3eba265ee64870b2f822f1511b36c747d763c382557789cdad8be1d3b52d1f5

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F3EBA265EE64870B2F822F1511B36C747D763C382557789CDAD8BE1D3B52D1F5"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16723
Expires: Thu, 24 Nov 2022 01:05:07 GMT
Date: Wed, 23 Nov 2022 20:26:24 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
770d09773b5f304acf141fd66a4862b4
5ddc46ab75de26c858a9a6f6d1beaaec9bb181f5
c7bcc6928fa1c0bb225ce8a2f6badd6cb1bd6ea002fb808ed34e8dafbd7b3b26

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5901
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 23 Nov 2022 20:26:24 GMT
Last-Modified: Wed, 23 Nov 2022 18:48:03 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
054ff0d1a0a43f7cb1d78dbd34e27f99
3caf54f3de1d6a8c6f6454083f8b8e7dec77db54
fcdcef8306ae31f20c366489e1f88aa40b08f154d25d45f4055c4f8cdef47634

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FCDCEF8306AE31F20C366489E1F88AA40B08F154D25D45F4055C4F8CDEF47634"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7135
Expires: Wed, 23 Nov 2022 22:25:19 GMT
Date: Wed, 23 Nov 2022 20:26:24 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
d130218d0e2841f39c99610fe1a2ab90
29fbe1e177ee55c7a61ae0a206afff271cf5f945
6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 23 Nov 2022 20:18:50 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 454
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: hYFRdI3lyDx592i0av6NL9DVYLKiMF6XeTVG+FGlrbk07RXBvgj8ck2NvNET/FUf8WWEP0gbkTg=
x-amz-request-id: M5FJPVBC2305B86H
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 23 Nov 2022 19:43:06 GMT
age: 2598
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

www.gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL

198.187.31.85

301 Moved Permanently

0 B

URL HTTP/1.1
www.gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL HTTP/1.1
Host: www.gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
keep-alive: timeout=5, max=100
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
x-redirect-by: WordPress
location: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
x-litespeed-cache: miss
content-length: 0
date: Wed, 23 Nov 2022 20:26:24 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 23 Nov 2022 20:26:24 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 23 Nov 2022 20:11:11 GMT
cache-control: public,max-age=3600
age: 914
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL

198.187.31.85

404 Not Found

9.4 kB

URL HTTP/1.1
gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (9664)
Size
9.4 kB (9396 bytes)
Hash
ef389235799d92053c8ebb420b3a497d
7997bd1266179e4ece79b18a440f517f2470a91e
ea08557d63a84e702621bb882c1cb29bf116d0bb0fa9b74c364da50f2d5a559d

HTTP Headers

GET /bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 404 Not Found
keep-alive: timeout=5, max=100
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <http://gotravellbtg.com/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: miss
content-length: 9396
content-encoding: gzip
vary: Accept-Encoding
date: Wed, 23 Nov 2022 20:26:25 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
eb52164d651f5f45416e873aec29eb04
405b29bb7e7cd4367cf82988f8603e53db65f139
ed885e05db822ff30fe951e10b6d4f21e574d053939afca792992a1549a15301

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3701
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 23 Nov 2022 20:26:25 GMT
Last-Modified: Wed, 23 Nov 2022 19:24:44 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

35.164.56.167

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.164.56.167:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: ixnXguywfjGfz85AyvgdDQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: A1UAhxF5dllvHpxlTrqNmk5qbwo=

gotravellbtg.com/wp-includes/css/classic-themes.min.css?ver=1

198.187.31.85

200 OK

217 B

URL HTTP/1.1
gotravellbtg.com/wp-includes/css/classic-themes.min.css?ver=1
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text
Size
217 B (217 bytes)
Hash
95e891f28e44a9b314c09545d86be2b7
f9b13a8bd47273b086a0a07df15f314e0af0bc3e
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /wp-includes/css/classic-themes.min.css?ver=1 HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
Connection: keep-alive

HTTP/1.1 200 OK
keep-alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Thu, 23 Nov 2023 20:26:25 GMT
content-type: text/css
last-modified: Wed, 02 Nov 2022 02:24:39 GMT
etag: "d9-6361d4e7-0;;;"
accept-ranges: bytes
content-length: 217
date: Wed, 23 Nov 2022 20:26:25 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

gotravellbtg.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1

198.187.31.85

200 OK

16 kB

URL HTTP/1.1
gotravellbtg.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (47826)
Size
16 kB (16113 bytes)
Hash
f900baa20a50cc986670a1acfed3c04a
ee2ca8a3fc0287cddf2a5546b747a68b60738950
ca674f5479ab55e973bea867cf11312f726bd00fee6669855bf404acd179e758

HTTP Headers

GET /wp-includes/css/dist/block-library/style.min.css?ver=6.1.1 HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
Connection: keep-alive

HTTP/1.1 200 OK
keep-alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Thu, 23 Nov 2023 20:26:25 GMT
content-type: text/css
last-modified: Wed, 16 Nov 2022 02:24:19 GMT
etag: "172a9-637449d3-0;gz"
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 16113
date: Wed, 23 Nov 2022 20:26:25 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

gotravellbtg.com/wp-content/themes/twentytwenty/assets/js/index.js?ver=2.1

198.187.31.85

200 OK

8.3 kB

URL HTTP/1.1
gotravellbtg.com/wp-content/themes/twentytwenty/assets/js/index.js?ver=2.1
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text
Size
8.3 kB (8260 bytes)
Hash
9129d046374419b117e5bb424770414c
31a9a381635d158b25aa974b2bc45b28972a5fe4
e909258c401756ba9784cf6d673a7a2b0805f90ce8c6e2b3a3402cd3071ab46c

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /wp-content/themes/twentytwenty/assets/js/index.js?ver=2.1 HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
Connection: keep-alive

HTTP/1.1 200 OK
keep-alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Thu, 23 Nov 2023 20:26:25 GMT
content-type: application/x-javascript
last-modified: Tue, 24 May 2022 23:22:48 GMT
etag: "65ff-628d68c8-0;gz"
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 8260
date: Wed, 23 Nov 2022 20:26:25 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

gotravellbtg.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1

198.187.31.85

200 OK

5.8 kB

URL HTTP/1.1
gotravellbtg.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (15660)
Size
5.8 kB (5806 bytes)
Hash
8d1ea9267894d63ba4c9ba45b845bf75
d42e28a1369c0c3e3d4eff65f21b8c72960cee0a
3be43ab5ea0a6131c8bc5b7a4207eff0516ac5c37fabddd5d879784bcbb299ba

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
Connection: keep-alive

HTTP/1.1 200 OK
keep-alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Thu, 23 Nov 2023 20:26:25 GMT
content-type: application/x-javascript
last-modified: Tue, 12 Apr 2022 15:26:24 GMT
etag: "48b9-62559a20-0;gz"
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 5806
date: Wed, 23 Nov 2022 20:26:25 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

gotravellbtg.com/wp-content/themes/twentytwenty/style.css?ver=2.1

198.187.31.85

200 OK

30 kB

URL HTTP/1.1
gotravellbtg.com/wp-content/themes/twentytwenty/style.css?ver=2.1
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
Unicode text, UTF-8 text, with very long lines (2955)
Size
30 kB (29979 bytes)
Hash
52b6718be97a1c75baa9a8db9eb71ddf
93d6ec8c9902cf879995a04605e11b6bae38c928
f4d0e5a0c73a730b32f3360470a184b64d860577095a7c50d7dd5473446f1aa2

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /wp-content/themes/twentytwenty/style.css?ver=2.1 HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
Connection: keep-alive

HTTP/1.1 200 OK
keep-alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Thu, 23 Nov 2023 20:26:25 GMT
content-type: text/css
last-modified: Wed, 02 Nov 2022 05:35:42 GMT
etag: "1da5d-636201ae-0;gz"
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 29979
date: Wed, 23 Nov 2022 20:26:25 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

gotravellbtg.com/wp-content/themes/twentytwenty/print.css?ver=2.1

198.187.31.85

200 OK

1.1 kB

URL HTTP/1.1
gotravellbtg.com/wp-content/themes/twentytwenty/print.css?ver=2.1
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text
Size
1.1 kB (1074 bytes)
Hash
3b05bf721944d748861fa86d11a5b53d
a40150e379b57a18fd44a3744139164f1bec09e8
148904c882bfb77a60e1a190a9b9ce9eb14ff252b9520581d22997c6bf229217

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /wp-content/themes/twentytwenty/print.css?ver=2.1 HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
Connection: keep-alive

HTTP/1.1 200 OK
keep-alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Thu, 23 Nov 2023 20:26:26 GMT
content-type: text/css
last-modified: Tue, 24 May 2022 23:22:48 GMT
etag: "a8e-628d68c8-0;gz"
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1074
date: Wed, 23 Nov 2022 20:26:26 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

gotravellbtg.com/favicon.ico

198.187.31.85

404 Not Found

1.2 kB

URL HTTP/1.1
gotravellbtg.com/favicon.ico
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Size
1.2 kB (1238 bytes)
Hash
0bde7d4b3da67537eaf9188e6f8049cf
64300fc482d01d38b40ab20e15960b6509665e5a
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gotravellbtg.com/bgq9/?KlLTdXp=UfMZcQ0lgwlNuLAos/niaHkfv1Ipe2/QQVM1e8t3hg5gBhS9pE0arWqQ+fiAhcWpJvAlokQ/0aqihEdv4Ol+pgCy/VUmtwN2cg==&SDKPv=3frL
Connection: keep-alive

HTTP/1.1 404 Not Found
keep-alive: timeout=5, max=100
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 1238
date: Wed, 23 Nov 2022 20:26:26 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
611d1eca860866489908506a26bd6a2a
5e8c401f098357cd12889a6e507baf7c8a87772a
e3216e5edd547bc8f6a43780da5a118842b96de96d5cf668af68d8706ceb32e4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E3216E5EDD547BC8F6A43780DA5A118842B96DE96D5CF668AF68D8706CEB32E4"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3261
Expires: Wed, 23 Nov 2022 21:20:47 GMT
Date: Wed, 23 Nov 2022 20:26:26 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
611d1eca860866489908506a26bd6a2a
5e8c401f098357cd12889a6e507baf7c8a87772a
e3216e5edd547bc8f6a43780da5a118842b96de96d5cf668af68d8706ceb32e4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E3216E5EDD547BC8F6A43780DA5A118842B96DE96D5CF668AF68D8706CEB32E4"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3261
Expires: Wed, 23 Nov 2022 21:20:47 GMT
Date: Wed, 23 Nov 2022 20:26:26 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
611d1eca860866489908506a26bd6a2a
5e8c401f098357cd12889a6e507baf7c8a87772a
e3216e5edd547bc8f6a43780da5a118842b96de96d5cf668af68d8706ceb32e4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E3216E5EDD547BC8F6A43780DA5A118842B96DE96D5CF668AF68D8706CEB32E4"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3261
Expires: Wed, 23 Nov 2022 21:20:47 GMT
Date: Wed, 23 Nov 2022 20:26:26 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d582ed2-f829-4647-9113-832d4500a207.jpeg

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d582ed2-f829-4647-9113-832d4500a207.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9138 bytes)
Hash
6d2c986e076309d51d199332caebb07a
343a5bfba0f8fec28f9345f276b44f44c6eaf6a6
64e6fba6a45c70c1db6040a2273472774c00257bef373cc45b6ca00cb819681a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d582ed2-f829-4647-9113-832d4500a207.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9138
x-amzn-requestid: 524e565e-a9fb-45f9-b786-d64cf26a3cdf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cBcAAHG8IAMFhwQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637d4066-3689e70e6212e9e77dc134f4;Sampled=0
x-amzn-remapped-date: Tue, 22 Nov 2022 21:34:30 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: cwu__NPGaU0zyAG0H1yZhmjGsFzvNmzsGv6Zt9hrF5gwSysEio2MjA==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 22 Nov 2022 21:45:52 GMT
age: 81634
etag: "343a5bfba0f8fec28f9345f276b44f44c6eaf6a6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0ea68cc-d723-41ae-8bc2-16e2e422e2aa.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.9 kB (5914 bytes)
Hash
c6380f73d47906bd63b9c48137e4df61
94e053461d2db89e9d08321f26a2555ebcd7e0b9
84144e3c3e7acc7339fd1da9b373f18582734b6f4d235b2aef8c90616ed1c8a7

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0ea68cc-d723-41ae-8bc2-16e2e422e2aa.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5914
x-amzn-requestid: 175363fa-bb7a-4c95-8aa4-ebb3f16f3745
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b1lI3HaqIAMFmTA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63788238-1bb736b52bbae37c5e19486f;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 07:14:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 39Lmple6qq9vrKeKJ4lcditVdK5XfRFtv3Cs0_R8B7pVDYPiRAGFtg==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Tue, 22 Nov 2022 22:13:08 GMT
age: 79998
etag: "94e053461d2db89e9d08321f26a2555ebcd7e0b9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4cb92473-220a-4ebb-b8d8-6c17618bc006.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.3 kB (4308 bytes)
Hash
bd62f641e9d58eee10e41db0fa00b5f2
4210e5f150a49d6f6ee26cbb11ded8173ab8cf74
5858451bf7cac97b8881dde7e3197110fa8639c1d94b51934859669c51221e1a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4cb92473-220a-4ebb-b8d8-6c17618bc006.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4308
x-amzn-requestid: 7db10594-4acc-448d-b724-1c4bc8ec42ca
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b-IrVFtRoAMFTzg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637bee48-0a466f6b0bd48f3532216bca;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 21:31:52 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1jsMEd95BMQEVGjykWxCP06JnMA6O5RJ-Fe6kEyuYpBIkdVUjeidxw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 22 Nov 2022 21:46:31 GMT
age: 81595
etag: "4210e5f150a49d6f6ee26cbb11ded8173ab8cf74"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45ca81c5-d11a-4d86-a922-dbdce0f6b46c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.0 kB (4977 bytes)
Hash
0cc111ba6ae699fca7fbff3490640960
18084197b48ea3b4a143636250396e8791d0285f
34fbba92e665ad371ea2bd1a871251cf0c5b7832d6f4661b21b2cfbd7f786923

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45ca81c5-d11a-4d86-a922-dbdce0f6b46c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4977
x-amzn-requestid: 3e56de91-7ed1-4b1e-b230-5f19b2cc6601
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bxQKBHzdIAMFpUw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6376c70c-41c572d27999534d3c198372;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 23:43:08 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Or1B6k7o4cYqVXfndjJsKLOV-aYKX8bfHCQIUqNzvofjQSnIf8f04A==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Tue, 22 Nov 2022 21:52:42 GMT
age: 81224
etag: "18084197b48ea3b4a143636250396e8791d0285f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feb8f06b6-da2d-4cb1-8494-f82414961039.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.4 kB (7352 bytes)
Hash
3e742dbb7da82cf64e6c22ff14c13667
996283008bc67ba4d7e2c7624b149047a8303ada
9ce9d0271c57a1b7a1ebca41a8829a4d64bfff0581e0bd37d62154c0243e036c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feb8f06b6-da2d-4cb1-8494-f82414961039.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7352
x-amzn-requestid: 44a7ba72-f86a-4eb7-a85d-b551e72ddd81
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b7UGJEFToAMFqxQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637acd5a-3d2f91e3085731a3387a4d68;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 00:59:06 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: 7BLmsnZrGU-G5IDwPnDDJhXDInTZTk1Hdo7lKQbhuvSD3Uk8vGffxQ==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 b2d3922a177f6cecf9222a78a0a1ad32.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 07:33:49 GMT
age: 46357
etag: "996283008bc67ba4d7e2c7624b149047a8303ada"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F20f7461d-18d1-4343-9ecb-d68d44ce1ee4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.6 kB (7589 bytes)
Hash
06c6e720bc9900b38e88cd72f739603e
22884cbc78622d6f78c1c3397c9b440946144a99
8675d08e6d8ae5bdedbc7c7ce647f8c6e72cc457917b4ed1856c50b11c2fe88b

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F20f7461d-18d1-4343-9ecb-d68d44ce1ee4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7589
x-amzn-requestid: 533d7650-cb21-4090-a50a-e205adad316d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: brr5zH4qoAMF79Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63748d0b-017f7bf4390eb124097af648;Sampled=0
x-amzn-remapped-date: Wed, 16 Nov 2022 07:11:07 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: ZtjzvMh_vqVaOqm8xPfZ2EWGGl0X7Iv8GK40Z32EbKM4wk6tGPnlYA==
via: 1.1 95b0ac620fa3a80ee590ecf1cda1c698.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Tue, 22 Nov 2022 22:27:21 GMT
age: 79145
etag: "22884cbc78622d6f78c1c3397c9b440946144a99"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

gotravellbtg.com/wp-content/themes/twentytwenty/assets/fonts/inter/Inter-upright-var.woff2

198.187.31.85

200 OK

224 kB

URL HTTP/1.1
gotravellbtg.com/wp-content/themes/twentytwenty/assets/fonts/inter/Inter-upright-var.woff2
IP
198.187.31.85:0
ASN
#22612 NAMECHEAP-NET

File type
Web Open Font Format (Version 2), TrueType, length 223892, version 1.0\012- data
Size
224 kB (223892 bytes)
Hash
2f136faf2d0ef6368898d1a515ab707c
81dbe45ccd7fae3a0a298c5c166b4317c985f538
e03c2df7ef439d2708bbc168a21c0a00da63e5664d286120c994c39644addd03

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /wp-content/themes/twentytwenty/assets/fonts/inter/Inter-upright-var.woff2 HTTP/1.1
Host: gotravellbtg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: http://gotravellbtg.com/wp-content/themes/twentytwenty/style.css?ver=2.1
Connection: keep-alive

HTTP/1.1 200 OK
keep-alive: timeout=5, max=100
cache-control: public, max-age=31536000
expires: Thu, 23 Nov 2023 20:26:26 GMT
content-type: application/font-woff2
etag: "36a94-5fd05e00-0;;;"
accept-ranges: bytes
content-length: 223892
date: Wed, 23 Nov 2022 20:26:26 GMT
server: LiteSpeed
referrer-policy: no-referrer-when-downgrade
x-turbo-charged-by: LiteSpeed

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (28)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size