r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7786cd9bd97e024b3a1d16215defaad2
786ddbb74b0b6bd9270622dbe0258d6caee407c1
9c297ccfd178eec7e472fb64a6b2e34d4c7a6dec32870f49982353e590196ba0
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9C297CCFD178EEC7E472FB64A6B2E34D4C7A6DEC32870F49982353E590196BA0"
Last-Modified: Mon, 14 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2372
Expires: Mon, 14 Nov 2022 15:47:44 GMT
Date: Mon, 14 Nov 2022 15:08:12 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 832aecaba9f06ee2d39d4d4bea65f13c
7195d6ffadfdbc6fc8e92c63ae28d4a3038a72dc
a437509314a97065de6c7b9e5e2b4b61f0234b45f5f5bf2649cbdf499577bfd3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6466
Cache-Control: max-age=162651
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:12 GMT
Etag: "637218f5-1d7"
Expires: Wed, 16 Nov 2022 12:19:03 GMT
Last-Modified: Mon, 14 Nov 2022 10:31:17 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 4736bac84ca28f2b1e961159fb4ea098
1319612979f53896fcfeacd4215c2715d4951e4c
5e81213e111ddf68c7f884f72b4e06fc4dc95eb902c3cf0762236b2418840dba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Length, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 14 Nov 2022 14:44:15 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 1437
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c88bc06741ab9fb81c2544acfcc34aa2
362cab19cff5aba27f472cc00071d5dfa38192e4
314ba27975f458e13917b2be91c9d5989a3e57c9e94b5a84dd52d0e21d27ae7f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "314BA27975F458E13917B2BE91C9D5989A3E57C9E94B5A84DD52D0E21D27AE7F"
Last-Modified: Mon, 14 Nov 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9636
Expires: Mon, 14 Nov 2022 17:48:48 GMT
Date: Mon, 14 Nov 2022 15:08:12 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: pvLoZ9ef8QS0XWULzuCbY0r2CRz3rQOBWtpaQQxXf+Hy2mKbuMKzisAp42QHS4P92fJ2SWgHzrPn/B9n7mkDiA==
x-amz-request-id: NEMMKB58TMG7XGYA
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 14 Nov 2022 14:51:08 GMT
age: 1024
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Cache-Control, Pragma, Last-Modified, ETag, Alert, Backoff, Content-Type, Retry-After, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 14 Nov 2022 14:44:48 GMT
cache-control: public,max-age=3600
age: 1405
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 3200044057cb585f1a435c0efece61c8
8305d5b5891288aa9996b4b4ca6fce2265413194
df45704534a24928e7659a6d8cd1b5ac9ffa9b224b02b34a2d6aed5ef69fd586
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5667
Cache-Control: max-age=156795
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:13 GMT
Etag: "63720535-1d7"
Expires: Wed, 16 Nov 2022 10:41:28 GMT
Last-Modified: Mon, 14 Nov 2022 09:07:01 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 279 B IP
Hash 34f976ad436e17a2aa284b0a9fb9f6fa
ef6eef563d855b72ea08c1046974f5cc7894461a
d69ba01e7d7a7f201542e43a9fe53b0661c65f2b8d489aa4672aa567fecf6db2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3278
Cache-Control: max-age=146866
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:13 GMT
Etag: "6371e7c1-117"
Expires: Wed, 16 Nov 2022 07:55:59 GMT
Last-Modified: Mon, 14 Nov 2022 07:01:21 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 279
cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css
200 OK 5.8 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css
IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash a7e25a22602a2b2ed35f90fd5210cff1
148c4f275b60e6cf6253d6b4c7bdc486515b2202
312d94bafa68e11e3a4a8d7c06bc25ee161d1d965afb1fa99db79815a272d0bf
GET /ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: text/css; charset=utf-8
content-length: 5845
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ed9-1149f"
last-modified: Mon, 04 May 2020 16:12:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 255516
expires: Sat, 04 Nov 2023 15:08:13 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=at3cl3l176tCOCCL1rsDOaVeu8QttBf0V94NsKgSo23QR7aWXhWKgCfW95VQpv7yYT7bIzbtOdjrCF59LCMx%2F78%2FEVEuyuvoEEyDAH7kgTIBEXsKri80YVvdvL23zSGe9cMB7jgP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 76a0a949496b0af6-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash b2d6aeeb303eaefc4cc6900e30da3b1b
4c3c027013211aa1b987006d0eb6c72f18c6a657
f542eab7c032d6c5f59710ee8993a01537e0fa2bf3882a6a699de85bba020999
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:13 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
mediafire.getz.my.id/
200 OK 4.0 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (370), with CRLF line terminators
Hash 02b52720b6141ffb19bbc33741682e1b
669bcfe6324eb16acb47b7cfb4703bdbc59f56ed
d85134255f20dcb99f887f649251c57426d4db5e4330641a2cedb367373e49dc
Analyzer Verdict Alert fortinet Phishing
GET / HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PAwbBpAt6KARrBJwl4LZ199rrCRo3USkiYbUUma5%2B1thRGj5jqGc08GQaVbCgQKwotk5eNzaDx%2FSGs6FmKI%2Fyrqr07TnMD45acKnhzZ0dC%2FocH43KCOFWJ%2FlWVsmCboETPTir9qhUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76a0a9447c58b523-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
i.postimg.cc/Sxyy8Kzz/footer-socmed-6.png
200 OK 4.3 kB URL HTTP/2 i.postimg.cc/Sxyy8Kzz/footer-socmed-6.png
IP
File type PNG image data, 184 x 140, 8-bit/color RGBA, non-interlaced\012- data
Hash 27eb10858d473bfd39cca3251fe35a26
f472c341ec3696a0c7bb85799495995ff72f941f
e0e93e88b46229223de82294608854d6578f0ade6f696b31f830cda37aae9b0e
GET /Sxyy8Kzz/footer-socmed-6.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 4316
last-modified: Wed, 13 Apr 2022 13:57:35 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
i.postimg.cc/w7RQzsJF/footer-socmed-5.png
200 OK 9.2 kB URL HTTP/2 i.postimg.cc/w7RQzsJF/footer-socmed-5.png
IP
File type PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash 2a03905025f0e6e39ce3934cb40b170f
72ccd4a954ae859709be05f27c5e425dc0c810eb
a72b0b2226327f8af54d11c68347fd2930f05d48004c0f05e1ef39c3505d8ba0
GET /w7RQzsJF/footer-socmed-5.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 9205
last-modified: Tue, 22 Mar 2022 04:48:19 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash b2d6aeeb303eaefc4cc6900e30da3b1b
4c3c027013211aa1b987006d0eb6c72f18c6a657
f542eab7c032d6c5f59710ee8993a01537e0fa2bf3882a6a699de85bba020999
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:13 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
200 OK 279 B IP
Hash 4e7f4711aba0859d6a9ead3f434c35c5
459b91573074387ebdfdcda9e7e0d9f5f5aa78dd
fd8fe2ecc14d30057a77f66e98e6a6ed4da7341fbe35da9e34dcfb20bef64350
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3011
Cache-Control: max-age=88620
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:13 GMT
Etag: "63710546-117"
Expires: Tue, 15 Nov 2022 15:45:13 GMT
Last-Modified: Sun, 13 Nov 2022 14:55:02 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash 34f976ad436e17a2aa284b0a9fb9f6fa
ef6eef563d855b72ea08c1046974f5cc7894461a
d69ba01e7d7a7f201542e43a9fe53b0661c65f2b8d489aa4672aa567fecf6db2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3278
Cache-Control: max-age=146866
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:13 GMT
Etag: "6371e7c1-117"
Expires: Wed, 16 Nov 2022 07:55:59 GMT
Last-Modified: Mon, 14 Nov 2022 07:01:21 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 279
fonts.googleapis.com/css2?family=Teko&display=swap
200 OK 33 kB URL HTTP/2 fonts.googleapis.com/css2?family=Teko&display=swap
IP
File type ASCII text, with very long lines (32072)
Hash 7f6a5f5f658106d30884a0e87328eea4
c84bf23b4464d9124386591ce03f76d928b775a6
73307305f1360e0be8f3ccf5da18fc814539570e3167906ed3be708434e39121
GET /css2?family=Teko&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Mon, 14 Nov 2022 15:08:13 GMT
date: Mon, 14 Nov 2022 15:08:13 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
i.postimg.cc/3wBVgZTz/login-Method1.png
200 OK 29 kB URL HTTP/2 i.postimg.cc/3wBVgZTz/login-Method1.png
IP
File type PNG image data, 604 x 158, 8-bit/color RGBA, non-interlaced\012- data
Hash 74190b93fc4f5d88f0c8e6411ba20bd8
89ce2ecb660a90b8e6ed1b335443d7767c59f28a
092a3cd5f86b3f039feefdeb86694cd16ae545af214cfda614bdbbe2d1bde401
GET /3wBVgZTz/login-Method1.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 28789
last-modified: Sun, 26 Dec 2021 01:51:44 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
200 OK 30 kB URL HTTP/2 ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
IP
File type ASCII text, with very long lines (32061)
Hash b90b3d2618cce9d766152cd3092b5c27
496339457cd00caab8118e2e1f30ea18dc05b9f4
b7b155aa8c6b5db28f9a6b41e88c96e9462c196c700add426f8ef32c9ce1ed41
GET /ajax/libs/jquery/2.1.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 29671
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Nov 2022 18:43:41 GMT
expires: Thu, 09 Nov 2023 18:43:41 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
age: 419072
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
i.postimg.cc/pV8Q4L9L/footer-img.png
200 OK 14 kB URL HTTP/2 i.postimg.cc/pV8Q4L9L/footer-img.png
IP
File type PNG image data, 669 x 99, 8-bit/color RGBA, non-interlaced\012- data
Hash d8e7ade119fece88de74909f9625a4f4
fcd55a597136e98a1ef13fb4ec78b5fdfe5ddffb
49c48ca56906e272d341083c726fc29a7304b7e66647ffd08b4ce7edd67430b4
GET /pV8Q4L9L/footer-img.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 14457
last-modified: Sun, 26 Dec 2021 01:40:34 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js
200 OK 30 kB URL HTTP/2 ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js
IP
File type ASCII text, with very long lines (32180)
Hash f16500423cc2867eff8b773df637c48f
1cd32d75b59a89c3a70274e383151a61ce0594f4
6ca5dc8ad67639c69117ace46c93703cf5fff82824cfc0bada0cf0fb3b2d41d7
GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 29707
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 12 Nov 2022 20:37:40 GMT
expires: Sun, 12 Nov 2023 20:37:40 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
age: 153033
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
i.postimg.cc/Thwcks3z/footer-socmed-2.png
200 OK 11 kB URL HTTP/2 i.postimg.cc/Thwcks3z/footer-socmed-2.png
IP
File type PNG image data, 180 x 148, 8-bit/color RGBA, non-interlaced\012- data
Hash 80c10d25063bc5137b0fcf63b4d6165f
9655f83c214eaccb92d34d8b8ca83581a56fb2a7
16f1ccc0e0a89629ef11948c8de6ca77591a6f9b937b8de44ebc18358225bd80
GET /Thwcks3z/footer-socmed-2.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 10864
last-modified: Tue, 22 Mar 2022 04:48:19 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
i.postimg.cc/jnLQLD1x/footer-socmed-1.png
200 OK 5.8 kB URL HTTP/2 i.postimg.cc/jnLQLD1x/footer-socmed-1.png
IP
File type PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash bef4c998aafaa09e5d29d60f46525c62
6c7f350282f0f6dc01f577c3785e0aaea0fcc2e6
dfba7a0c7d120366be1d50ada6b75adcf62ac2038a1c08fd6e1c77071a38b5d1
GET /jnLQLD1x/footer-socmed-1.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 5796
last-modified: Tue, 22 Mar 2022 04:48:19 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
i.postimg.cc/YvcfCqz7/footer-socmed-4.png
200 OK 14 kB URL HTTP/2 i.postimg.cc/YvcfCqz7/footer-socmed-4.png
IP
File type PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash 023bfaf2a56a2b76e7afc94885893502
225d5166c4b3f7346e3bfef148d6bfb87b5b4a96
8014774799900154e012ac41d6cdd404adc93c5955535ee4bd5372e054e90443
GET /YvcfCqz7/footer-socmed-4.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 13796
last-modified: Tue, 22 Mar 2022 04:48:19 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
i.postimg.cc/bdB94RGs/footer-socmed-3.png
200 OK 6.6 kB URL HTTP/2 i.postimg.cc/bdB94RGs/footer-socmed-3.png
IP
File type PNG image data, 180 x 128, 8-bit/color RGBA, non-interlaced\012- data
Hash bc99de2d262f8daf5c75d55ea0328990
8af7007005a8725a1c2e2a4710101be68a7ebfea
d1e50bf94ebb01626c1045d43541f5989f67f6b3d62d3d6eb38e34fe0be94595
GET /bdB94RGs/footer-socmed-3.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 6571
last-modified: Tue, 22 Mar 2022 04:48:19 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 5L2loIcUlbrZ+K8RPlt9fg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: V/0evLJi9UD2mRvrOSNVRWO9AJc=
i.postimg.cc/SxQ04Qn4/navbar-logo.png
200 OK 177 kB URL HTTP/2 i.postimg.cc/SxQ04Qn4/navbar-logo.png
IP
File type PNG image data, 1074 x 800, 8-bit/color RGBA, non-interlaced\012- data
Size 177 kB (177317 bytes)
Hash d2d4c42a8bef48daa7c8151a838870c9
7ad25c9e369e069f97093188699bd58a2b298888
a817051e4bb4f6a94ffc632b32ba786440fb33f2028b99a83c836631299ff587
GET /SxQ04Qn4/navbar-logo.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 177317
last-modified: Tue, 22 Mar 2022 04:46:34 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
mediafire.getz.my.id/css-zone/twitter.css
200 OK 684 B URL HTTP/1.1 mediafire.getz.my.id/css-zone/twitter.css
IP
Hash 25ba1091ec0397ac78a7507548c81098
8a3a35c6d6cc9caeaa00cac06329e304974a8378
4152c46cddde07d7e9180a35a10ef4700d9b44b2643a97ed1a846cd25a17df24
GET /css-zone/twitter.css HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b22ILcbVwTATvd15AXDoE1npJ3D89Cr8k7Lka67ZBCrcec6002PtVcTDrvomCozocbl6BuL0cZApK0KY9l80cClfAZVQvtXJCxCuSeuwHYZ9rRzurhG2VUnnCWc%2Buyxz4FrgMaYEjA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a948fab2b523-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/css-zone/facebook.css
200 OK 782 B URL HTTP/1.1 mediafire.getz.my.id/css-zone/facebook.css
IP
Hash bfeaf4073ae414d91e1c0e61eaeabb11
b8d9cc1c08392eb813369e1194788e446c000bd6
9a55d17d754d126936a4643fe1c5764eef84a831ea5d95653fede3071ad4b687
GET /css-zone/facebook.css HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RjRCQbG9Gy8AvSUNme0boulgAcJWwJV9I6JAMaVfFZf0X%2BvvBWe0oyH%2BBOvwCgADzqNNKuLuRrwih5R8w23drOCHjZ170v%2B9PodZjBMM6yyZSac4hnvwtKyPr503cfFaqvqUOlUTYA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a948fbc1b50b-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/js-zone/jquery.js
200 OK 451 B URL HTTP/1.1 mediafire.getz.my.id/js-zone/jquery.js
IP
File type exported SGML document, ASCII text, with very long lines (1757)
Hash 1abe5c025a16893ec52beb616bed7b16
9d69e05eeeecfb6f358bfa69e460168a7617f585
1dfae3417846d2cfbd7957679b81e8021a51949912e10b3101c71ca2f9d5dcb3
Analyzer Verdict Alert fortinet Phishing
GET /js-zone/jquery.js HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 22 Apr 2022 16:48:20 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o3HE2v%2BXP4DyQDSs4P2HVe29qcHmZAx%2BO2vgLMGDFa%2F3%2BDKwLqhT%2B3ReG4fnxB7bMlivfXxZqxauW%2Bt6xGSf3PiZBeEXcbIQtV2MdIqbS5R9Gpodtr3UWCt61ejjbP85CffwGBXmUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9491bb50b61-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/js-zone/main-zone.js
200 OK 345 B URL HTTP/1.1 mediafire.getz.my.id/js-zone/main-zone.js
IP
File type ASCII text, with very long lines (316)
Hash bbae78527e745cb146a632161f3012f4
c882ece393db1074d14ce6f7a31bbd1a75b063f2
c14640cd35d53dc1c450da2a35643dbcaf9877fc7818bc796580801c80c64922
Analyzer Verdict Alert fortinet Phishing
GET /js-zone/main-zone.js HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 22 Apr 2022 16:48:20 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hW%2BSPxQvQHJeNBOZGIY%2FeXkvBoviRT97hGGr3lAYp1YE615iSHmL3Ty%2FL26pYXbiulz%2BUH2jF%2B0hV6piURbFq%2F71KXNEu1Yrqtcc%2BW2Fq1vXI0CGRvnDXulczQDAFyTEwph9pg%2FJiw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9492bfdb50f-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/js-zone/myScript.js
200 OK 911 B URL HTTP/1.1 mediafire.getz.my.id/js-zone/myScript.js
IP
File type ASCII text, with CRLF line terminators
Hash 8b81aae1f1a16117e678ceceb64fa8d3
01dbdc3f3f281cd6ac8d1affa411b067e216c36a
385d6f5b09e75e31c3a79194ac71dc3c12495307479a0ce6502ce7dd59d3c791
Analyzer Verdict Alert fortinet Phishing
GET /js-zone/myScript.js HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 25 Jul 2022 10:25:08 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ccwQO9SLGRX%2BJNFa0tNabljhKDzJpoRANI26WrDD22ot7%2BjvVN%2FPzT5xlEhFltTYyjdzdSQlAiOUp3u%2BbdL8HwVZyhV9B5xE%2BXeK4PR8hpnWNvFKfcWVs6P8D0U9vfjCWFnKyHAvhw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a949cbb7b523-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
www.pubgmobile.com/en/images/nav_download.svg
200 OK 485 B URL HTTP/2 www.pubgmobile.com/en/images/nav_download.svg
IP
ASN #20940 Akamai International B.V.
File type SVG Scalable Vector Graphics image\012- HTML document, Unicode text, UTF-8 text, with very long lines (999), with no line terminators
Hash 105955f14143a23be57cadef8e91950e
98cc1e76113b4b2a2a77805bb1f1d6b364344d88
b85bdfd2887c4fe7681cae97896e604e74d27f150feb49598e1e7efebd3c6fc2
GET /en/images/nav_download.svg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/svg+xml
last-modified: Mon, 21 Mar 2022 13:24:17 GMT
etag: "62387c81-3ef"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
date: Mon, 14 Nov 2022 15:08:14 GMT
content-length: 485
X-Firefox-Spdy: h2
www.pubgmobile.com/id/event/royalepass10/images/icon_logo.jpg
200 OK 75 kB URL HTTP/2 www.pubgmobile.com/id/event/royalepass10/images/icon_logo.jpg
IP
ASN #20940 Akamai International B.V.
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 500x500, components 3\012- data
Hash 92c19dc5bd77186e5bb8ed35ce668979
646bf70d1c669c7d7388f95a0a33755e4721289c
0d9cf7eb8fb12be77685134e63f7dae9a95fbf9306ae0529bd0347582d18a8ef
GET /id/event/royalepass10/images/icon_logo.jpg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/jpeg
content-length: 75149
last-modified: Wed, 15 Sep 2021 06:46:59 GMT
etag: "614196e3-1258d"
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=189
expires: Mon, 14 Nov 2022 15:11:23 GMT
date: Mon, 14 Nov 2022 15:08:14 GMT
X-Firefox-Spdy: h2
www.pubgmobile.com/en/images/nav_language.svg
200 OK 675 B URL HTTP/2 www.pubgmobile.com/en/images/nav_language.svg
IP
ASN #20940 Akamai International B.V.
File type SVG Scalable Vector Graphics image\012- HTML document, Unicode text, UTF-8 text, with very long lines (1107), with no line terminators
Hash 77e7b8dcd13159c59219706782b1a897
a3c73409a8e9841a00b771d96ce6cb0ce76d222e
4f61e0a210a58bdf43f8a93bf658275291e6a16979f8090c0731f06b6fb3c5a4
GET /en/images/nav_language.svg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/svg+xml
last-modified: Mon, 21 Mar 2022 13:24:18 GMT
etag: "62387c82-45b"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
date: Mon, 14 Nov 2022 15:08:14 GMT
content-length: 675
X-Firefox-Spdy: h2
www.pubgmobile.com/en/images/nav_menu.svg
200 OK 426 B URL HTTP/2 www.pubgmobile.com/en/images/nav_menu.svg
IP
ASN #20940 Akamai International B.V.
File type SVG Scalable Vector Graphics image\012- HTML document, Unicode text, UTF-8 text, with very long lines (876), with no line terminators
Hash 76f5753e4fe160785df31ef342ada1c1
a78cc3e318b79b7fe5e7eb8df11683706b518e8f
52c48564638e7f165f23fae7f76b72d07905f2179ff659b939bfab7ec8b82a26
GET /en/images/nav_menu.svg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/svg+xml
last-modified: Mon, 21 Mar 2022 13:24:18 GMT
etag: "62387c82-374"
accept-ranges: bytes
unused62: 8096267
vary: Accept-Encoding
content-encoding: gzip
date: Mon, 14 Nov 2022 15:08:14 GMT
content-length: 426
X-Firefox-Spdy: h2
www.pubgmobile.com/en/images/nav_shop.svg
200 OK 526 B URL HTTP/2 www.pubgmobile.com/en/images/nav_shop.svg
IP
ASN #20940 Akamai International B.V.
File type SVG Scalable Vector Graphics image\012- HTML document, Unicode text, UTF-8 text, with very long lines (985), with no line terminators
Hash ad0548f5478991acc360e6464247e82a
40e3e327eebfc39a8e45b1aa46b725d65390cdcc
6654577abe5f4be7b3f9089fa76e5f746c8d0f5c7eae1cc8202a94fae1193fe3
GET /en/images/nav_shop.svg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/svg+xml
last-modified: Mon, 21 Mar 2022 13:24:18 GMT
etag: "62387c82-3e1"
accept-ranges: bytes
unused62: 8096267
vary: Accept-Encoding
content-encoding: gzip
date: Mon, 14 Nov 2022 15:08:14 GMT
content-length: 526
X-Firefox-Spdy: h2
mediafire.getz.my.id/index_files/css
200 OK 62 kB URL HTTP/1.1 mediafire.getz.my.id/index_files/css
IP
File type ASCII text, with very long lines (1116)
Hash 755df17a408beddb747e36f27ae4dedc
53daa61ef477c0badec68fa8942cb5ffce0c38b0
a2db023c6c27693f044211498c952a94f002c75b80926bde95c24d5dbab187f4
Analyzer Verdict Alert fortinet Phishing
GET /index_files/css HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Length: 62268
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
Accept-Ranges: bytes
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B76505DHYFg2IrTIvlukfvfZ%2FqDg%2BPdzEJH6uAGs2DN3WAaAD0hOYagPvhFNqkRXHz9IirzcIKnDAbGDj%2BTTYAnPvZNXRgpnh233lwkxnLMSaCP8XPPmwXOu9cOzRbhQJZPZMIzTnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76a0a948e8f90af6-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/index_files/gift-zone.js
200 OK 633 B URL HTTP/1.1 mediafire.getz.my.id/index_files/gift-zone.js
IP
Hash 36c66a5858739e6e4292644a69881502
c88534cd8a09aab21ef15eaee7ca3726584b0eb3
585e9d93d2a5e5eb3c781272abe9f16ded59439a48b5860ec4a321c991ac48d1
Analyzer Verdict Alert fortinet Phishing
GET /index_files/gift-zone.js HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PtUSK7hTcHDsXHc9eT1WMCf2fupheQaZ%2FpLtq1RchM%2FnatypD3iOVChHdbTwmoq8fjYiLUjIp8RLVhmN3DwVqSSZnr5yhT1YDIotKFdc3gGgRnCzpuvmivPdkALayFt9I0gRyYS%2FGg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a94c785ab50b-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/js-zone/slide-zone.js
200 OK 596 B URL HTTP/1.1 mediafire.getz.my.id/js-zone/slide-zone.js
IP
File type exported SGML document, ASCII text, with very long lines (530)
Hash c311a1bb166e62daf0cba4d7c329dcc5
ef905dfbe8b851daf1eaa09548da4f05b1ffd246
9af879c13db6a97f0fb98e8b1135d35ffb169caab7bf4265c02a9cc223605020
Analyzer Verdict Alert fortinet Phishing
GET /js-zone/slide-zone.js HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 22 Apr 2022 16:48:20 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZU%2FbMkIsI4tq3%2Bm7FqLEAzT3441EnS6RncnwJeMNRi3U9X82EU6sly8Ty8cgY6KnZ%2Fgrms98Krw8rKeKz4pDtL2y3c8yydOCMmGls78%2FQztbVgcQ0F17qjCSJ7zV1PedDhRud6NLng%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a94caf4c0b61-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/index_files/slide-zone.js.download
200 OK 603 B URL HTTP/1.1 mediafire.getz.my.id/index_files/slide-zone.js.download
IP
File type exported SGML document, ASCII text, with very long lines (530)
Hash 4cf548f0e7e5b5976fd486a35ded4aa7
fcc728cbe2ffee89f0eb00cdcef5f02d9936c329
8d5d314b61419668faa06ed57523c98bea7309b991b9686bbfaaed2f93b8b4fa
Analyzer Verdict Alert fortinet Phishing
GET /index_files/slide-zone.js.download HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A300IysRL3KgjltLy%2Fay9GpXYImQUsHecCIoqyEY8dJ6mpM2q5REmAB1SfDJmQM94OKAh0JEHN6dTKdvAElHB5GAyo3jODFe2bjajnW0EowUd76BYc3GMO%2B5Mv8Q%2BmQ4qBkvQWSXGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76a0a94cd8e5b50f-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 231836cebb6dabc96b37d243384bde2e
215947213c7e49a51edcff3a1a5a4220c918ca0e
1d881c252600e0b91da462cef783c95a30170a5d8f1b60ce4cb66b62ed181f2b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1D881C252600E0B91DA462CEF783C95A30170A5D8F1B60CE4CB66B62ED181F2B"
Last-Modified: Sun, 13 Nov 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3274
Expires: Mon, 14 Nov 2022 16:02:48 GMT
Date: Mon, 14 Nov 2022 15:08:14 GMT
Connection: keep-alive
l.top4top.io/m_1725u5z7i1.mp3
206 Partial Content 20 kB URL HTTP/2 l.top4top.io/m_1725u5z7i1.mp3
IP
ASN #24940 Hetzner Online GmbH
File type Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo\012- data
Hash ee5b5d12064ae26f839b882edb33da62
6fa93ef00f294eec4ef05276e81813db1e95e346
4bc5852e5cec62ceab9260f712961f59609868151e01b63e7b7cae2b00efed54
Analyzer Verdict Alert fortinet Malware
GET /m_1725u5z7i1.mp3 HTTP/1.1
Host: l.top4top.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 206 Partial Content
server: nginx
date: Mon, 14 Nov 2022 15:08:14 GMT
content-type: audio/mpeg
content-length: 19781
set-cookie: klj_40d147_downloads=kh51z; Max-Age=85000; Domain=.top4top.io; Path=/; Expires=Tue, 15 Nov 2022 14:44:54 GMT
last-modified: Mon, 21 Sep 2020 07:16:33 GMT
content-disposition: inline; filename="open_reward_tab.mp3"
etag: "5f685351-4d45"
expires: Mon, 14 Nov 2022 17:08:14 GMT
cache-control: max-age=7200
x-file-id: x34392023x
content-range: bytes 0-19780/19781
X-Firefox-Spdy: h2
a.top4top.io/m_1725zobal2.mp3
206 Partial Content 18 kB URL HTTP/2 a.top4top.io/m_1725zobal2.mp3
IP
File type Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo\012- data
Hash 70ded6b0b406f9710307bc35e221629f
7034ec2ff72c936255b04c0890ce8976599380cc
22e1575a06426f427b46598d6599c565e80ed3e937b1872b0d5d928bfe5b2d65
Analyzer Verdict Alert fortinet Malware
GET /m_1725zobal2.mp3 HTTP/1.1
Host: a.top4top.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 206 Partial Content
server: nginx
date: Mon, 14 Nov 2022 15:08:14 GMT
content-type: audio/mpeg
content-length: 17691
set-cookie: klj_40d147_downloads=kh520; Max-Age=85000; Domain=.top4top.io; Path=/; Expires=Tue, 15 Nov 2022 14:44:54 GMT
last-modified: Mon, 21 Sep 2020 07:16:33 GMT
content-disposition: inline; filename="close_reward_popup.mp3"
etag: "5f685351-451b"
expires: Mon, 14 Nov 2022 17:08:14 GMT
cache-control: max-age=7200
x-file-id: x34392024x
content-range: bytes 0-17690/17691
X-Firefox-Spdy: h2
mediafire.getz.my.id/js-zone/zero-zone.js
200 OK 360 B URL HTTP/1.1 mediafire.getz.my.id/js-zone/zero-zone.js
IP
File type exported SGML document, ASCII text, with very long lines (612)
Hash f5f344af95f2ea78322ba0231c998ad2
2cba1787df5a060739fc914ce979b71ec649b038
b3c218d6b3ec189d95b6b97ec73d66f4665101a0cad0709753df919c520ba205
Analyzer Verdict Alert fortinet Phishing
GET /js-zone/zero-zone.js HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:15 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 22 Apr 2022 16:48:20 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TlOa5tuL3tur9vwzh8fV7J2a4wDmvgVNP8Lrg8BoTc%2BxBOv6V52dbL0FVpdrfAHKezqgOCWWYaUYqIC0vFLmUkxXYuEoB%2BZ2AbCXpshWP9ZfKOyLo0%2FiwFJ2%2BytsI%2FL8Xy5tYo1VjA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9504d94b50f-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/index_files/jquery.min.js.download
200 OK 30 kB URL HTTP/1.1 mediafire.getz.my.id/index_files/jquery.min.js.download
IP
File type ASCII text, with very long lines (65451)
Hash 7a2513dd1222ccc86834066b309ca734
660d83e41a19e45b297f1073401563f303a9afd7
75db31ceaea7eb217a169aa1dddcbde14ff89eb22d9ca6a3f714ba3bb526a467
Analyzer Verdict Alert fortinet Phishing
GET /index_files/jquery.min.js.download HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d4Ckn%2B8pLc1QufthuKAAf3%2FJoF7la2JsInVJyNWlYsvz%2FWmChz1J%2BQrj71DJiKUdBKUp6KmGOD5S05T70RamBoRPqBkSQe556CqjSECr%2BsG8bMQi2vfbiW1BcPW0oHb%2B18RDLlyi2w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76a0a94c7f74b523-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 929d046b7cbed155022099e982ba0592
18ff58f5b4d98748552d6604bdcba9c57eb8f412
3c70c27c11afeaea96e782a0e7b7ae9c2f3ed35c94673fcd4361cb7406b078a9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C70C27C11AFEAEA96E782A0E7B7AE9C2F3ED35C94673FCD4361CB7406B078A9"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15878
Expires: Mon, 14 Nov 2022 19:32:53 GMT
Date: Mon, 14 Nov 2022 15:08:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 929d046b7cbed155022099e982ba0592
18ff58f5b4d98748552d6604bdcba9c57eb8f412
3c70c27c11afeaea96e782a0e7b7ae9c2f3ed35c94673fcd4361cb7406b078a9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C70C27C11AFEAEA96E782A0E7B7AE9C2F3ED35C94673FCD4361CB7406B078A9"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15878
Expires: Mon, 14 Nov 2022 19:32:53 GMT
Date: Mon, 14 Nov 2022 15:08:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 929d046b7cbed155022099e982ba0592
18ff58f5b4d98748552d6604bdcba9c57eb8f412
3c70c27c11afeaea96e782a0e7b7ae9c2f3ed35c94673fcd4361cb7406b078a9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C70C27C11AFEAEA96E782A0E7B7AE9C2F3ED35C94673FCD4361CB7406B078A9"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15878
Expires: Mon, 14 Nov 2022 19:32:53 GMT
Date: Mon, 14 Nov 2022 15:08:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 929d046b7cbed155022099e982ba0592
18ff58f5b4d98748552d6604bdcba9c57eb8f412
3c70c27c11afeaea96e782a0e7b7ae9c2f3ed35c94673fcd4361cb7406b078a9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C70C27C11AFEAEA96E782A0E7B7AE9C2F3ED35C94673FCD4361CB7406B078A9"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15878
Expires: Mon, 14 Nov 2022 19:32:53 GMT
Date: Mon, 14 Nov 2022 15:08:15 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 929d046b7cbed155022099e982ba0592
18ff58f5b4d98748552d6604bdcba9c57eb8f412
3c70c27c11afeaea96e782a0e7b7ae9c2f3ed35c94673fcd4361cb7406b078a9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C70C27C11AFEAEA96E782A0E7B7AE9C2F3ED35C94673FCD4361CB7406B078A9"
Last-Modified: Sat, 12 Nov 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15878
Expires: Mon, 14 Nov 2022 19:32:53 GMT
Date: Mon, 14 Nov 2022 15:08:15 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F03b751df-18d0-4e56-8d74-5d8e8d02f241.jpeg
200 OK 7.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F03b751df-18d0-4e56-8d74-5d8e8d02f241.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dfc7286992b2cebdf1ebb58f85576e61
a49a1bf9716e32979810931d04d1f84216d096c1
7c5288d4ae39202e00c7fd482faa10b5610d31edf0bba9fc69fa4fc1f422b837
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F03b751df-18d0-4e56-8d74-5d8e8d02f241.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7494
x-amzn-requestid: b07e424a-c11e-442f-8636-e0670cb6f864
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bd8heGBtoAMFYQA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636f0e09-7dcda14e5077563d726752ae;Sampled=0
x-amzn-remapped-date: Sat, 12 Nov 2022 03:07:53 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: VXu3wEUmBJjK6YiXRFYVAuZ3h-ApKkvK1miRBXpo6faKsx8OOXu0JQ==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 2ab6211e66998c8b58132661a7e3cade.cloudfront.net (CloudFront), 1.1 google
date: Mon, 14 Nov 2022 03:14:47 GMT
age: 42808
etag: "a49a1bf9716e32979810931d04d1f84216d096c1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F56802217-f3db-4036-987b-8614bd4098ef.jpeg
200 OK 9.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F56802217-f3db-4036-987b-8614bd4098ef.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 271563e0590df14c6116ae1925628b82
ef661c6f2999fe153d92a1c51208f08289236df6
fc6c3a8ac5268b1f646fc397e0d8630bb16df39a6c8a19e952417723062dbb51
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F56802217-f3db-4036-987b-8614bd4098ef.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9089
x-amzn-requestid: 6abc1d88-e1db-4bd3-add1-89bf9e31c836
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bgfLrHNpoAMFyYA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6370124a-7c19aafb547d2f1c0f861f2c;Sampled=0
x-amzn-remapped-date: Sat, 12 Nov 2022 21:38:18 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: MDqByRAtYxd9nHKBbSyXIMggauKoDHhZatoK-qd26s5NAyw_iKWSrw==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 ee330666adf9f04c8c30094f8ddcd004.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 22:03:37 GMT
age: 61478
etag: "ef661c6f2999fe153d92a1c51208f08289236df6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cd5bdc050716bb76afe8090fc81617e7
5109c156b180727767fc03c411190ccc0d3fb5fc
9b13e7838946c6654dda17886c2ca8d42de934acb93f4bddb1008dfa1bd1ea99
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11715
x-amzn-requestid: 20e508bd-6568-4225-9bee-c683a49d44f6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhUHkpIAMFfJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-7dc726b94a37fc667e2e6646;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: X3SUo1LP97TxraRav0ftskBhzWkTJInHaS44PW26yloF-dgD-bHBuA==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 21:52:43 GMT
age: 62132
etag: "5109c156b180727767fc03c411190ccc0d3fb5fc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F213417cd-cf64-4d28-ae86-bd6f16cecb3b.jpeg
200 OK 9.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F213417cd-cf64-4d28-ae86-bd6f16cecb3b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6f1e763f44800e4de06d69a3b2af74da
35afe48832221fe42de30260b9bcb15867109031
5f234c025d1f586b4364d2ef8c2818d3d4d441691444bb885e89f4c150b3d2a5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F213417cd-cf64-4d28-ae86-bd6f16cecb3b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9322
x-amzn-requestid: 0becd817-a29e-46bf-b9d6-2d18e12f5fe9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bjyDvE8DoAMFsiw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637163b1-5b4bf1674c4edf80458cf53f;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 21:37:53 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 6eUvvtJ48e5eRUJffmsuc9-blgv2dHt-Lsemnf-i8mLQ9CpY0Y94sQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 22:13:29 GMT
age: 60886
etag: "35afe48832221fe42de30260b9bcb15867109031"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb74e86a9-6c63-4a82-8e8b-64abdadca859.jpeg
200 OK 6.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb74e86a9-6c63-4a82-8e8b-64abdadca859.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2e9320a4be9c69eeda4a855b5a9535a5
a91bbc712fc0194b44d33fb7e04e49724ddfe14a
7aa0049111b04d0514dd3378ebe62bf3207b8725a6c1facf3d07ab465c6a6095
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb74e86a9-6c63-4a82-8e8b-64abdadca859.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6729
x-amzn-requestid: 6ceabd9e-4ac5-4835-b112-4aaeb81c9576
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bgfNIEZkoAMFgGg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63701253-0e9112ee682f0895683d80cb;Sampled=0
x-amzn-remapped-date: Sat, 12 Nov 2022 21:38:27 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: WyYtTIJd4s0XtBHAhe-PHXlBHnD2f4cDqaml3Ut-CCejf0eJNfwyeg==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 21:47:32 GMT
age: 62443
etag: "a91bbc712fc0194b44d33fb7e04e49724ddfe14a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5797e726-229b-4f42-9376-00ae67e14407.jpeg
200 OK 6.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5797e726-229b-4f42-9376-00ae67e14407.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a0db3498954921b58948ad8a4e7fd49f
6b618c3ff6e589f9e01650bd0a619acb70d8004e
fa3baa9e32e455ab2eeefab0c76714bf0ff5f67a5ccd7c10b3f5c21d8138c5cf
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5797e726-229b-4f42-9376-00ae67e14407.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6535
x-amzn-requestid: 3333aa65-c0c7-4704-9af1-fb0a49f830fb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bjyDtHbhoAMFSsg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637163b1-51c3e4513240b7e5662b8e6e;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 21:37:53 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 6dTOcWIKFuo-Thf3zUH_1WY70yFyQkj3w2xPrb6Ntjf8TUFPVG-_lA==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 9c675215120a4ade8754c4357ef2f3ea.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 22:01:14 GMT
age: 61621
etag: "6b618c3ff6e589f9e01650bd0a619acb70d8004e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
mediafire.getz.my.id/img/reward/6.png
200 OK 45 kB URL HTTP/1.1 mediafire.getz.my.id/img/reward/6.png
IP
File type PNG image data, 500 x 500, 8-bit colormap, non-interlaced\012- data
Hash 193711949042535538ba89a8ff8f597b
9e16deac47a834240916411a426362009a5b9741
22f58a0e433d4360083726a341776945bb576baaf4a0f461e82fbbe3342b71ba
GET /img/reward/6.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:15 GMT
Content-Type: image/png
Content-Length: 44591
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 07:40:32 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ERu8BzYsHwg9H5GITIFVvz3NBq9QTz%2BpLG%2BHHhoYN0PsSW65NqTuAS49Z0a3XeJYEMxRYvpJwlqlQCl3cc86VEFRJnPWejQqUO22cpRK8lL%2FsOg1G5%2BVAfek8VhwojURJDppli5DA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a94fec3bb523-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/img/reward/2.png
200 OK 26 kB URL HTTP/1.1 mediafire.getz.my.id/img/reward/2.png
IP
File type PNG image data, 500 x 500, 8-bit colormap, non-interlaced\012- data
Hash e1354ed1e173a0f644de60b8775019b0
9af8284123f1bd07081dc8fcb3e771fb6b435cc9
6d4fea2ffb9f3fb5c2758a8ec02a4f0ae70179c80d077a715658d6349575c1be
GET /img/reward/2.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:15 GMT
Content-Type: image/png
Content-Length: 26474
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 07:40:32 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sJ1Lvr30YVS2pODGVGm%2BJrhBbvPdCJNAy0%2FjSk8A2LUpc%2B3DFxeKKTU2tR4lHkZq3ROVpqXW8MpCoNnTdj2bjeH3kvfG6Az0OgjcLn2972eNoO3DbviQOtPwhIlX2JloUIbi6qyFYw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a94fec76b50b-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/img/reward/1.png
200 OK 58 kB URL HTTP/1.1 mediafire.getz.my.id/img/reward/1.png
IP
File type PNG image data, 500 x 500, 8-bit colormap, non-interlaced\012- data
Hash 0e4df1245f66d1bb80bde7bb122de75d
12b188d382938edef719ccef3552bdc54c65490f
db64067730eede2c793802490ae36b959159e750af50a660ce0cb707560dfc4e
GET /img/reward/1.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:15 GMT
Content-Type: image/png
Content-Length: 57528
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 07:40:32 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KUR52y0%2F4pBFFMzBDZjbb2S%2F96j71hOgBOZJ9O2pgvhihTLvFiZGpALTinAl9OZtTyYtnoNveAbywEXCjVDANjUcGSjiiVzfO%2B3OdtvCt6h1EHo6jQTgZR9h3yxkd%2BGWqxnoRztbeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a94fe82e0af6-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/js-zone/alert-zone.js
200 OK 17 kB URL HTTP/1.1 mediafire.getz.my.id/js-zone/alert-zone.js
IP
File type ASCII text, with very long lines (64301)
Hash e8b74c6795976bb00b39192913be9a32
dda8e1b9a91bfe6ddca677812c4968291e28786a
00da874465ecd5632f1b7461cf7f65f9aa53bce8408b23775d70f08d6a963322
Analyzer Verdict Alert fortinet Phishing
GET /js-zone/alert-zone.js HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:16 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 22 Apr 2022 16:48:20 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KjDFIOycKvlF7HJ17D%2F0OySiq7x7GMECw8TayTphwxMsADcc8ruId05kBymAEi2po4mnMCn4z7ljT6zHu8Qp0qQu0wQc20x7g37O2%2FX9cdUtlHvOidqQnU8FkkXjn1ms08t9IMJq7A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9502a350b61-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/img/reward/3.png
200 OK 95 kB URL HTTP/1.1 mediafire.getz.my.id/img/reward/3.png
IP
File type PNG image data, 1080 x 1080, 8-bit colormap, non-interlaced\012- data
Hash a2830ae61d43bd21ca6186eeafbe8a1d
3eef15dac36d395933fe5015f5b8d43fdf225900
e0c3eccbf8534af45e19bd503704b22a11fd84c459a4c775c5644d53ec9d0d28
GET /img/reward/3.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:16 GMT
Content-Type: image/png
Content-Length: 95004
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m0dosxL81Et3QRsI8lzMXoIQ%2BjgyeZ37MKEn3tNU9p4XVW5Ecx6HpDDPbG2gAk4s4V2lN2AIT20b6iM6Y9LORz9B5FJY44fQUcyvdBHP%2FPoU2pgleGgVc1EM4TxOtb3dyVFneUCcXw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9520fcdb50f-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/img/reward/4.png
200 OK 40 kB URL HTTP/1.1 mediafire.getz.my.id/img/reward/4.png
IP
File type PNG image data, 640 x 640, 8-bit colormap, non-interlaced\012- data
Hash e7134182b0622d7dc96ca39a9ee38f54
75ac9658535f6579b5b9295d3d280e9470c893bb
711f17bd667e28b99943069dab753cb68e00773621cae063de324f0e87d3d3aa
GET /img/reward/4.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:16 GMT
Content-Type: image/png
Content-Length: 39737
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KXNKvPMgQLqZkyGyMbO0lS9iQmMMbhi6VsPg2Y4mLUr7UUW6fjE1PzLzGYs%2FB7Izg3Q8gs%2BSwDn2Pu3MqWWc5FpLvXuI8ZG9%2F56MNwX8Zuf0vKI2rV%2BgpATDPePz%2BmnQ1Q7n7YKo0w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9550a1eb523-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/img/reward/5.png
200 OK 83 kB URL HTTP/1.1 mediafire.getz.my.id/img/reward/5.png
IP
File type PNG image data, 1080 x 1080, 8-bit colormap, non-interlaced\012- data
Hash 6aec64013499cd73ca387e441b9b1c7d
c4dfd8a78f00a94ed7989885cc6b1f38e5eabd5d
5bf4c4167595d05f6c1f39e314697b36c32b892e39036e267df8b8437d715e07
GET /img/reward/5.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:16 GMT
Content-Type: image/png
Content-Length: 82766
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 15:01:16 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aSV7N5O2Yun0VsaTRvFnzFNsK4gh4%2BOKifCEcux%2FbRkLvH%2F2%2F2kvBiHqUHubFkokALT9IUMMPS1ntthABSmhAryKEMBSny23hg9i02mqbc4gKB95vsfyJPs%2BRH0yPwUcuAmLf2VwCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9550b41b50b-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/img/draw.png
200 OK 107 kB URL HTTP/1.1 mediafire.getz.my.id/img/draw.png
IP
File type PNG image data, 700 x 710, 8-bit colormap, non-interlaced\012- data
Size 107 kB (106627 bytes)
Hash d364dbe62f597a52a12578369294a26a
956f898c5a10b8f5029677f359a262ec06634282
7fc37b0c27e8a24a1a67fbfe22af0c03a725832835ff9d507e6ca4f8a6a5d278
GET /img/draw.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:16 GMT
Content-Type: image/png
Content-Length: 106627
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 07:31:54 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3aJ3Vcf%2Fh%2Fd%2B2z%2FfTEn9pP7rlWD2%2BVG3XJQ9aWJTY0A6epNDHYvkX%2FfhgcqK35zhokVS8GSA0n74U8huIC2rbeVzmVv2NHPEtN4U3SOuw%2F83PRStYJ0LXNpIjwe06%2FirMEhN6RYVbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a953887cb523-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/css-zone/zero-zone.css
200 OK 983 B URL HTTP/1.1 mediafire.getz.my.id/css-zone/zero-zone.css
IP
File type ASCII text, with CRLF line terminators
Hash abc136b74d15699ba893a52bb4de05ab
ff407b7fde3a92e0d1d17c27b99965c5045e3643
15bdbc5f58b2097ccc9e88c73dca08d5c636f700836e9aced68ffeae16245f2f
GET /css-zone/zero-zone.css HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:16 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 14:18:20 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=93ZmaP7bBYf9rqbRfvILmeFceOroAC1VX0GQE6ODvl%2FRw%2BuM%2Fsv7gZWX6uX71saFgwTME1TH8zMPLOW1f%2FewtX8R6WJtnyBA%2BPvXq4MQ3QusB52vZjf73%2Ffswtx8LB0uxPyaz0WS4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a95909700b61-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/css-zone/style-zone.css
200 OK 4.1 kB URL HTTP/1.1 mediafire.getz.my.id/css-zone/style-zone.css
IP
File type ASCII text, with very long lines (411), with CRLF line terminators
Hash 86cb0b98f17ff67addafbdd67205a263
a19f5a5162cc78abce81fe04184949481bb1dfc6
08258353638577f8cb9f17aa92178bb3ed659643b75bc72891c03fd7c7b0382c
GET /css-zone/style-zone.css HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:17 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 14:29:56 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xQzoWoS5HFjkAlVz%2FAW7Pkq3HbW4uSBkQPIVlaIAy30tAJDPq1dnTh9ai6cl34FWd%2FlrsIo%2FEPs71R%2FnSCsntpZZLhw9uD8poZ4d%2B92hTye5i91Ua15reyGgfMZuD%2F2NoutdsgFGEw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a9590a680af6-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
www.pubgmobile.com/en/images/footer_link_bg.png
200 OK 1.6 kB URL HTTP/2 www.pubgmobile.com/en/images/footer_link_bg.png
IP
ASN #20940 Akamai International B.V.
File type PNG image data, 560 x 127, 8-bit/color RGBA, non-interlaced\012- data
Hash 92ae645b6114492e8c1c5464d949466a
1d27f2644c0f5e899e9478c78136a9bc94131150
f1bd509f6032d31635a91d57de9428b83929221b854768c38c8f1643877a9417
GET /en/images/footer_link_bg.png HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/png
content-length: 1630
last-modified: Mon, 21 Mar 2022 13:24:17 GMT
etag: "62387c81-65e"
accept-ranges: bytes
cache-control: max-age=297
expires: Mon, 14 Nov 2022 15:13:14 GMT
date: Mon, 14 Nov 2022 15:08:17 GMT
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 35ad471bf7f157abedbe322e59bb00ae
6f8c57f1c20377b6a1f74fd06849705a6370e291
b51251f347677a52f08a4a7c0d9ff0effed121992b6dc7fa709e33c400042e63
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
i.postimg.cc/02KwtTc7/footer-bg.jpg
200 OK 12 kB URL HTTP/2 i.postimg.cc/02KwtTc7/footer-bg.jpg
IP
File type JPEG image data, progressive, precision 8, 579x800, components 3\012- data
Hash 27b8ceba13cb26a4ac6951cecdd4a5d3
accbec4f1b6038f0bcd2032da80c2ee342033d2e
d1740f2a847c3b67a1071442fe2af27298bca56ab267e90ea8aec3d4e9b9552f
GET /02KwtTc7/footer-bg.jpg HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:17 GMT
content-type: image/jpeg
content-length: 11651
last-modified: Wed, 23 Mar 2022 19:15:53 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
fonts.gstatic.com/s/teko/v15/LYjNdG7kmE0gfaN9pQ.woff2
200 OK 13 kB URL HTTP/2 fonts.gstatic.com/s/teko/v15/LYjNdG7kmE0gfaN9pQ.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 13324, version 1.0\012- data
Hash b4082c888eefa2dca3fe2c9d46a87180
05aeb6c58175f659fe59eaca5a9d3735dd0530e3
352ad1513eeaeec51060f01d5bed32345862ec4d9c0802b81e0a47885951e4b6
GET /s/teko/v15/LYjNdG7kmE0gfaN9pQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://mediafire.getz.my.id
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 13324
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Nov 2022 21:50:21 GMT
expires: Thu, 09 Nov 2023 21:50:21 GMT
cache-control: public, max-age=31536000
age: 407876
last-modified: Wed, 27 Apr 2022 17:05:55 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 35ad471bf7f157abedbe322e59bb00ae
6f8c57f1c20377b6a1f74fd06849705a6370e291
b51251f347677a52f08a4a7c0d9ff0effed121992b6dc7fa709e33c400042e63
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 14 Nov 2022 15:08:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.pubgmobile.com/images/event/royalepassm13/m_bg_3.jpg
200 OK 125 kB URL HTTP/2 www.pubgmobile.com/images/event/royalepassm13/m_bg_3.jpg
IP
ASN #20940 Akamai International B.V.
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 750x1624, components 3\012- data
Size 125 kB (125421 bytes)
Hash c7605644b75df6e9a7bdff8426fa84c2
931e26a910d9b673650cc2acacba30a7c086d1f6
d17ffa328bc3680b6a3b5a17e113587beac035ebf78b3b60d3079f3f0f9bab55
GET /images/event/royalepassm13/m_bg_3.jpg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/jpeg
content-length: 125421
last-modified: Wed, 20 Jul 2022 05:46:16 GMT
etag: "62d796a8-1e9ed"
accept-ranges: bytes
cache-control: max-age=300
expires: Mon, 14 Nov 2022 15:13:17 GMT
date: Mon, 14 Nov 2022 15:08:17 GMT
X-Firefox-Spdy: h2
www.pubgmobile.com/images/event/royalepassm13/bg_1.jpg
200 OK 239 kB URL HTTP/2 www.pubgmobile.com/images/event/royalepassm13/bg_1.jpg
IP
ASN #20940 Akamai International B.V.
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x960, components 3\012- data
Size 239 kB (239138 bytes)
Hash 99b5b275610999bc3333160454cd16bd
656c1dc569f4a8e3203de2f41238341e88cd67c4
16770bb23394fee3adb2c37e09583a0a5efe80d27350650b79a16fbd41b9a7bc
GET /images/event/royalepassm13/bg_1.jpg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/jpeg
content-length: 239138
last-modified: Wed, 20 Jul 2022 05:46:15 GMT
etag: "62d796a7-3a622"
accept-ranges: bytes
cache-control: max-age=294
expires: Mon, 14 Nov 2022 15:13:11 GMT
date: Mon, 14 Nov 2022 15:08:17 GMT
X-Firefox-Spdy: h2
mediafire.getz.my.id/img/item-off.png
200 OK 114 kB URL HTTP/1.1 mediafire.getz.my.id/img/item-off.png
IP
File type PNG image data, 700 x 710, 8-bit colormap, non-interlaced\012- data
Size 114 kB (114406 bytes)
Hash e22e8c64a52b9aee71d0325ad98434f5
263f3fd557ed077ffc73d579db99c4f08f856550
51c8dc27564c06b970dd2bbd406a3cd7670f3127148308e0a10729332a4f7d15
GET /img/item-off.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/css-zone/zero-zone.css
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:17 GMT
Content-Type: image/png
Content-Length: 114406
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 07:31:54 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XTL%2Fh7yyzgMyANkW7%2FAJgbi0m6TTAS0uewX8rXQsf4S1WjitDc5DX6PQvW1zGRlipaDnZscEjDZjRnbkZa5OpZatKgvpJZjsemKVksYPYfINnJ5vtv5UDoEF%2B1JPyWHd1q2HQlTKpw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a95e6c00b50b-OSL
alt-svc: h2=":443"; ma=60
mediafire.getz.my.id/img/event-title.png
200 OK 92 kB URL HTTP/1.1 mediafire.getz.my.id/img/event-title.png
IP
File type PNG image data, 1264 x 306, 8-bit colormap, non-interlaced\012- data
Hash d0b5d74003143278974b5ee42f53f8c3
94669dad88e1a654d0000274409faea9325737ab
1dd77507bb1776b8ed0ef178ce2c60b180d35a1af4696560dd8b346c4b774920
GET /img/event-title.png HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mediafire.getz.my.id/css-zone/style-zone.css
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2022 15:08:18 GMT
Content-Type: image/png
Content-Length: 91452
Connection: keep-alive
Last-Modified: Fri, 22 Jul 2022 14:42:34 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v1wYm3FmAr3RAOMT9CjiXo6mClTbELY7IPMWaTk%2Fy5IJa2LKvKKn7sV6Ag3xHFscdZprLcus0ZqCcYfUuF7T1ZEdZ4o5SBoUzZxJYspVTytLGPoR136zo%2BgXKLUpySyAjMNUG59CSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 76a0a95e6813b50f-OSL
alt-svc: h2=":443"; ma=60
www.pubgmobile.com/common/images/icon_logo.jpg
200 OK 982 kB URL HTTP/2 www.pubgmobile.com/common/images/icon_logo.jpg
IP
ASN #20940 Akamai International B.V.
File type JPEG image data, baseline, precision 8, 1024x1024, components 3\012- data
Size 982 kB (982437 bytes)
Hash b83d8d3e9beecfac081f4e742d27661c
448330670bef8c2ee17baf6d2410ca974341cb88
5899c82b2f0563679a9c1ee79b5b28f2545864d95c7627c1a70e36a2f034497d
GET /common/images/icon_logo.jpg HTTP/1.1
Host: www.pubgmobile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/jpeg
content-length: 982437
last-modified: Mon, 30 Nov 2020 12:10:45 GMT
etag: "5fc4e145-efda5"
accept-ranges: bytes
unused62: 8096267
cache-control: max-age=143
expires: Mon, 14 Nov 2022 15:10:41 GMT
date: Mon, 14 Nov 2022 15:08:18 GMT
X-Firefox-Spdy: h2
mediafire.getz.my.id/media/spin.mp3
206 Partial Content 133 kB URL HTTP/1.1 mediafire.getz.my.id/media/spin.mp3
IP
File type Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 44.1 kHz, Stereo\012- data
Size 133 kB (132739 bytes)
Hash 5e6ad4032df296732508803deb114b90
99d585eab4db1d9d5555b5ea4aae2542c5c635e5
9f4633ff137414c473c1477d9345c1b379b5174544f5aa22e0666d778f6f3eed
Analyzer Verdict Alert fortinet Phishing
GET /media/spin.mp3 HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 206 Partial Content
Date: Mon, 14 Nov 2022 15:08:18 GMT
Content-Type: audio/mpeg
Content-Length: 132739
Connection: keep-alive
Last-Modified: Tue, 21 Jun 2022 07:07:42 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Content-Range: bytes 0-132738/132739
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EeGZj7xjZRwW7t0uquxuDqRNi480HazORULoydAj98uUsO%2FArnw4Sbfp83vn5xVXRhwB3Mv21LoNsaenjJn8QDrnJL1AqZ2iVzCdAjaV7ujUl0Tx9MJeBVcBmYndMRvevuJru02Xjw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76a0a95ee82c0af6-OSL
alt-svc: h2=":443"; ma=60
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68733d52-6c87-4ac4-ba56-bc5f74ff782b.jpeg
200 OK 9.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68733d52-6c87-4ac4-ba56-bc5f74ff782b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ac5583760066002adcbba078f6dd1be4
39ca30395586cf1a0a0fa739f7279af807f548a3
cb5986e3330858716cd290297a81d77e371b838637fc57eece94810211715a7c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F68733d52-6c87-4ac4-ba56-bc5f74ff782b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 9921
x-amzn-requestid: 933f6aa6-3bec-4f71-aba8-ef9e77942ae9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bjycgGB-oAMFsDQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371644f-47d26359464b62b7276316e6;Sampled=0
x-amzn-remapped-date: Sun, 13 Nov 2022 21:40:31 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 9DG6rCPdRRiHKrAVXztWJwZlUYYCb893lXH8YDzEMGSEUbeaVkABWw==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Sun, 13 Nov 2022 22:04:26 GMT
age: 61436
etag: "39ca30395586cf1a0a0fa739f7279af807f548a3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
unpkg.com/ionicons@5.0.0/dist/ionicons/ionicons.esm.js
200 OK 0 B URL HTTP/2 unpkg.com/ionicons@5.0.0/dist/ionicons/ionicons.esm.js
IP
GET /ionicons@5.0.0/dist/ionicons/ionicons.esm.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://mediafire.getz.my.id
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 15:08:17 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: W/"106-2QVIn+WWfE7GzXgXZTPbiG+yGbs"
via: 1.1 fly.io
fly-request-id: 01G4XQ07F3VERQN7D11X61A71M-fra
cf-cache-status: HIT
age: 13878986
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 76a0a9641cea0b55-OSL
content-encoding: br
X-Firefox-Spdy: h2
mediafire.getz.my.id/media/header.mp4
206 Partial Content 0 B URL HTTP/1.1 mediafire.getz.my.id/media/header.mp4
IP
Analyzer Verdict Alert fortinet Phishing
GET /media/header.mp4 HTTP/1.1
Host: mediafire.getz.my.id
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
HTTP/1.1 206 Partial Content
Date: Mon, 14 Nov 2022 15:08:18 GMT
Content-Type: video/mp4
Content-Length: 2804682
Connection: keep-alive
Last-Modified: Thu, 21 Jul 2022 06:22:44 GMT
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Content-Range: bytes 0-2804681/2804682
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pJoLKzHYMgurtF1J9U%2F6327cAtoQAM2MHIlXMSYfzQT7WqNN%2BRtR2skHCvGnpoOTkuN5f3fea0H1LzsHnTEFUvUO9EPrbXfazjyQaZHPKXIlxFRgYILlpIWsAee57fkXITzKBSiuYg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 76a0a95e4de2b523-OSL
alt-svc: h2=":443"; ma=60
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
200 OK 0 B URL HTTP/2 stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
IP
GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://mediafire.getz.my.id
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"269550530cc127b6aa5a35925a7de6ce"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 08/20/2022 02:30:56
cdn-proxyver: 1.02
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 601
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: d08ace21adce2c77659d94aabafbd718
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 76a0a9498df3b511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
unpkg.com/ion-package@2.4.3-Base/ionicons.js
200 OK 0 B URL HTTP/2 unpkg.com/ion-package@2.4.3-Base/ionicons.js
IP
GET /ion-package@2.4.3-Base/ionicons.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 14 Nov 2022 15:08:19 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: W/"2d36b-DW3sVG9/XUhjDzolCC9gaxDOpU4"
via: 1.1 fly.io
fly-request-id: 01GHVAY6MXA8Q3J7AGANGQB84C-fra
cf-cache-status: MISS
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 76a0a9640ea0b4f7-OSL
content-encoding: br
X-Firefox-Spdy: h2
unpkg.com/ion-package@2.4.3-Base/ionicons.map.js
200 OK 0 B URL HTTP/2 unpkg.com/ion-package@2.4.3-Base/ionicons.map.js
IP
GET /ion-package@2.4.3-Base/ionicons.map.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 14 Nov 2022 15:08:17 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: W/"3e3-ErTIot9avfsA+DAsFdeavtO+QrI"
via: 1.1 fly.io
fly-request-id: 01GHVAY2MTP7EMFES8GGCPWGGC-fra
cf-cache-status: MISS
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 76a0a94a6cecb4f7-OSL
content-encoding: br
X-Firefox-Spdy: h2
i.postimg.cc/dtyfWFF2/login-Method2.png
200 OK 0 B URL HTTP/2 i.postimg.cc/dtyfWFF2/login-Method2.png
IP
GET /dtyfWFF2/login-Method2.png HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mediafire.getz.my.id/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Mon, 14 Nov 2022 15:08:13 GMT
content-type: image/png
content-length: 4298
last-modified: Sun, 26 Dec 2021 01:53:00 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
104.21.16.227
172.67.216.120
162.19.88.69
23.36.77.32
104.16.122.175
93.184.220.29
65.21.235.194