r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 60e4edea7b5f4d19f3547a3bb2d5df57
3ee076bab4da3416c2c5808f730cb316c28baef7
763e2dadfdd286a51327cd2000ca335e30cd0b9b7267875d22ca33f7556ba200
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "763E2DADFDD286A51327CD2000CA335E30CD0B9B7267875D22CA33F7556BA200"
Last-Modified: Fri, 30 Sep 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12645
Expires: Sun, 02 Oct 2022 21:36:37 GMT
Date: Sun, 02 Oct 2022 18:05:52 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
18.165.201.80200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP 18.165.201.80:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 2d12f67fe57a87e7366b662d153a5582
d7b02d81cc74f24a251d9363e0f4b0a149264ec1
73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Retry-After, Content-Length
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 02 Oct 2022 18:03:12 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 507372273c5029d1ae2439349f7f1458.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: ymiY96ypFEG4-0WZ5uPd8krq4st6LfjYhX_VkDPaAavQW0g_Xpnrmg==
Age: 160
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
108.156.28.39200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP 108.156.28.39:0
File type PEM certificate\012- , ASCII text
Hash 6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 02 Oct 2022 03:33:17 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 3c40a0775e2798dc9f20a237d0225e44.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: QOOer4PZY-oS4t26FChG2-WbbDpz4CVpEmsdeilvAPEfVIchfubs2g==
age: 52356
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 18:05:52 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
18.165.201.80200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 18.165.201.80:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Cache-Control, Alert, Last-Modified, Backoff, Retry-After, Expires, Content-Length, Pragma, ETag
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Sun, 02 Oct 2022 17:32:53 GMT
Expires: Sun, 02 Oct 2022 17:43:53 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 680c9e756bdd27fcfeee763a87afaa06.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: P3HwJIWjr1ZOSzY56O-AB32oXaeQDLTezQ8y73wUOCEl8cpb7f4AVA==
Age: 1980
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 4eb30b4a4234809cf7d5f89fa1f6ceeb
797242aab2f13c820050aa9accd11b7b950cd177
ce9d833a0ac321a908184b655d6632c481f758a04a9c936a7c303bb253444146
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4025
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Last-Modified: Sun, 02 Oct 2022 16:58:48 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471
4721227.fls.doubleclick.net/activityi;src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html?
142.250.74.70200 OK 386 B URL HTTP/1.1 4721227.fls.doubleclick.net/activityi;src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html?
IP 142.250.74.70:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (514), with no line terminators
Hash 296deb3695167c3c5554400fac013f71
6d2e86f0cae8fecc3f6e86fe5c749a687a681ec6
7e5eb591696539bfc010e9c16144f877f6b027804491e4910fce2068bdbff984
GET /activityi;src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html? HTTP/1.1
Host: 4721227.fls.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Date: Sun, 02 Oct 2022 18:05:53 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Strict-Transport-Security: max-age=21600
Content-Type: text/html; charset=UTF-8
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 386
X-XSS-Protection: 0
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 471 B IP 142.250.74.3:0
Hash ab779588f01243aca896d41395f8bd90
b8ef2d7cdc6366c283db0d608766a126dce37164
5531deca73d8380883740395d82457f4d39761134404876881242e2135b1546a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
push.services.mozilla.com/
44.238.202.79101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 44.238.202.79:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: /AcpIlN/Q0RooLUYxb4/Lw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: bcGcZP2NzblW0qm5xa0fTSVIRbU=
www.scdn.co/build/js/sp-analytics-a3e2493d01.js
151.101.86.248301 Moved Permanently 0 B URL HTTP/1.1 www.scdn.co/build/js/sp-analytics-a3e2493d01.js
IP 151.101.86.248:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /build/js/sp-analytics-a3e2493d01.js HTTP/1.1
Host: www.scdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 0
Retry-After: 0
Location: https://www.scdn.co/build/js/sp-analytics-a3e2493d01.js
Accept-Ranges: bytes
Date: Sun, 02 Oct 2022 18:05:53 GMT
X-Served-By: cache-bma1654-BMA
X-Cache: HIT
X-Cache-Hits: 0
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
adservice.google.com/ddm/fls/i/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html
142.250.74.2200 OK 385 B URL HTTP/2 adservice.google.com/ddm/fls/i/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html
IP 142.250.74.2:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (513), with no line terminators
Hash 6da5969356df80d83312d6b0bca604e8
a352bd59cfe4068c776cc9d3acb723eb4e1609af
4514880eba4798114d09a67b93f1433cf06ece4beeee8266b101fd27b3070d5e
GET /ddm/fls/i/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html HTTP/1.1
Host: adservice.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://4721227.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 18:05:53 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 385
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.scdn.co/build/js/sp-analytics-a3e2493d01.js
151.101.86.248200 OK 2.9 kB URL HTTP/1.1 www.scdn.co/build/js/sp-analytics-a3e2493d01.js
IP 151.101.86.248:0
File type ASCII text, with very long lines (7916)
Hash 46f7394944aba4665f842d75ef972bb3
65046fbc4dc0c4d397210e6141702bb70873e273
602d76b0de139658e9c504c4e8f7f1c5858d33d2da30040766d78fb1c9702964
GET /build/js/sp-analytics-a3e2493d01.js HTTP/1.1
Host: www.scdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 2934
Last-Modified: Thu, 09 Aug 2018 08:55:55 GMT
ETag: "3b8ea9b9fed8d12d22fd1c7b7c4367b8"
x-goog-generation: 1533804955085745
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7969
x-amz-meta-goog-reserved-file-mtime: 1533804724
Content-Type: application/javascript
Content-Encoding: gzip
Accept-Ranges: bytes
Date: Sun, 02 Oct 2022 18:05:53 GMT
Age: 4096223
Timing-Allow-Origin: *
X-Served-By: cache-chi-kigq8000063-CHI, cache-bma1653-BMA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 1
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
163.44.198.59200 OK 29 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (743)
Hash 08ce35e754d2234cd96dd99e7ff451d6
d143e70cbb9cad1cb08d702eed9c556e69da4b1a
1ece5ebafae25c9db69d85036fb6e7a1960d115b980ac2b1716e0d0e5d6ad0f0
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:53 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 471 B IP 142.250.74.3:0
Hash 8c665d81a8995febfec300bd9f554c90
aa3599f282cff5e07d5681ec4854b70a82590f6d
57cd30b987eb23f54208b51c04daefd3657fdd84325f4035817b32e4ad5b5461
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash e4f94a2722366412417efbb65aa368b8
f2942fbd2a6f0326f99c3a271de2dab12c881b15
97805013c570f1c9ad0158d99dfc6f521628bfb4b72a2a5d79526ec7b04df2f4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
adservice.google.no/ddm/fls/i/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html
172.217.21.162302 Found 0 B URL HTTP/2 adservice.google.no/ddm/fls/i/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html
IP 172.217.21.162:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ddm/fls/i/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html HTTP/1.1
Host: adservice.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 18:05:53 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
location: https://4721227.fls.doubleclick.net/ddm/fls/r/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/activityi(2).html
163.44.198.59200 OK 526 B URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/activityi(2).html
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash 4111ba0635356cb00c95c1e7df71bc7a
478e66ccd3ea1606c21b0bc2dc7be11fb4980c81
368050e24650d085ae45ff96cb255eafd8196154f484969f0492ceaab7d9d9c5
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/activityi(2).html HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:53 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "20e-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 526
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash e4f94a2722366412417efbb65aa368b8
f2942fbd2a6f0326f99c3a271de2dab12c881b15
97805013c570f1c9ad0158d99dfc6f521628bfb4b72a2a5d79526ec7b04df2f4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 965a43dfae645e95ef92ec6fa232661e
f4032a0c7ab75037730d8b8865e50788f353e971
8b456c52e93958769d377cc84748653ecc99726d5a9a5cf282c02133384f28bb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
4721227.fls.doubleclick.net/ddm/fls/r/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html
142.250.74.70200 OK 810 B URL HTTP/2 4721227.fls.doubleclick.net/ddm/fls/r/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html
IP 142.250.74.70:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (605)
Hash 491829d94d11c593c5e13c746519b674
676caaca2116a50807fe27a04675afdead57f8a2
91b4b4087bafc56e81cd7586ea02acf165671395e607698d4d0f78c7e37eeccd
GET /ddm/fls/r/src=4721227;type=uidfq0;cat=spoti0;ord=5160187481151;gtm=G1u;u2=undefined;~oref=file%3A%2F%2F%2FC%3A%2FAppServ%2Fwww%2FOVO%2520v2.7%2FSpotify%2FSubscription%2520and%2520payment%2520-%2520Spotify.html HTTP/1.1
Host: 4721227.fls.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adservice.google.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 18:05:53 GMT
expires: Sun, 02 Oct 2022 18:05:53 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 810
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 02-Oct-2022 18:20:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 965a43dfae645e95ef92ec6fa232661e
f4032a0c7ab75037730d8b8865e50788f353e971
8b456c52e93958769d377cc84748653ecc99726d5a9a5cf282c02133384f28bb
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash bf77d5cd803e80b5072e44d1460eceea
c41cb94bd4ed33fbf63a15d53d17ec8779eb2367
39f2dcdef07f1d425270f60340a5766a5e7fd894161d5b2fc36d94403eff4fc7
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googleadservices.com/pagead/conversion.js
142.250.74.162200 OK 17 kB URL HTTP/2 www.googleadservices.com/pagead/conversion.js
IP 142.250.74.162:0
File type ASCII text, with very long lines (2021)
Hash facf633646edbf5b62983e22d11aa160
0373848f224ca40d2982581b205a8cf28b72dd7c
ce5955eb70e6611579323a75ba5536d9af9a224a593fe1a2d8d204fa1127f524
GET /pagead/conversion.js HTTP/1.1
Host: www.googleadservices.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 02 Oct 2022 18:05:53 GMT
expires: Sun, 02 Oct 2022 18:05:53 GMT
cache-control: private, max-age=3600
content-type: text/javascript; charset=UTF-8
etag: 11313833467736987248
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 16840
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 3959239fe93cc41b701cbce99e546170
1ce0c0d216fd2a4eccd12b87b765b7593ad560dc
b12fecab79eb348a730bf255623a86305606a803b595998a050f0458966e8106
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.maskedinput.js
163.44.198.59200 OK 10 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.maskedinput.js
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
Hash 6f7c106ad7a91b4d75ffbdce35b1907b
e1937b367daea561b96d7f47be85132a5a8ad55b
b63e5bcbf53f3f1ab4bcf0845a900fab7b25981693e753d73cfd2784a8046446
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/jquery.maskedinput.js HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "2805-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 10245
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/embedded-checkout-7f51b6350a.css
163.44.198.59200 OK 16 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/embedded-checkout-7f51b6350a.css
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type ASCII text, with very long lines (16242), with no line terminators
Hash 7f51b6350a9a704d466a234099088106
c86c363d221743f1fd094dc449ebd173c9978998
c98fd9d8e74817c15654a9bc1381f9cd3850b87fc5da82d92f1f6aa7558ba09f
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /~cp785288/hlep/Login/files/embedded-checkout-7f51b6350a.css HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:53 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "3f72-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 16242
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.js
163.44.198.59200 OK 86 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.js
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type ASCII text, with very long lines (32034), with CRLF line terminators
Hash 1a0d5be2d25ff036a0e088e0ec0b3600
7a9ae64f46b3c59ab06648d5681434a89c3d605c
2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/jquery.js HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:53 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "15147-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 86343
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.v-form.js
163.44.198.59200 OK 7.1 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.v-form.js
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
Hash 8d3893b549d0d074acd24a67fa6bb19c
e1612052c6092b2ed31a89bd4f2657fd7ca960f6
4e5b8d16044077193472b2bad96dabf3f322452461b533f469846de23b94995f
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/jquery.v-form.js HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "1bc7-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 7111
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.additional-methods.js
163.44.198.59200 OK 22 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.additional-methods.js
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type Unicode text, UTF-8 text, with very long lines (1231)
Hash 90ea2fdca7a2817e04c6f508fc70fc82
8ea4223a744c83d354c257bbce3e85e6804e9147
72d04d4e4fec062d1c4ef989026f021267b61ffa1d0350855a7007e81f49bba6
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/jquery.additional-methods.js HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "56ed-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 22253
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
ocsp.globalsign.com/gsgccr3dvtlsca2020
104.18.21.226200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsgccr3dvtlsca2020
IP 104.18.21.226:0
Hash 3779ee72a7b26f8a1547e59924517ba9
e1d1b52d970146d6403c942511a374fa94cdd317
b9ec82bb9f8a586a447b4dab8eded139b4fc2891f6decee58b4935d693506e5f
POST /gsgccr3dvtlsca2020 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Content-Type: application/ocsp-response
Content-Length: 1414
Connection: keep-alive
Expires: Thu, 06 Oct 2022 15:30:35 GMT
ETag: "e1d1b52d970146d6403c942511a374fa94cdd317"
Last-Modified: Sun, 02 Oct 2022 15:30:36 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1990
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 753f5e709ea1b517-OSL
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6329
Expires: Sun, 02 Oct 2022 19:51:23 GMT
Date: Sun, 02 Oct 2022 18:05:54 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6329
Expires: Sun, 02 Oct 2022 19:51:23 GMT
Date: Sun, 02 Oct 2022 18:05:54 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6329
Expires: Sun, 02 Oct 2022 19:51:23 GMT
Date: Sun, 02 Oct 2022 18:05:54 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6329
Expires: Sun, 02 Oct 2022 19:51:23 GMT
Date: Sun, 02 Oct 2022 18:05:54 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6329
Expires: Sun, 02 Oct 2022 19:51:23 GMT
Date: Sun, 02 Oct 2022 18:05:54 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd4280e4-6b15-45b7-9469-d13ba14c37db.jpeg
34.120.237.76200 OK 6.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd4280e4-6b15-45b7-9469-d13ba14c37db.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9dddb9d84a16a3004821d89836b83dc3
087521979efd5936416fd7f030779fa5725f0a8f
a6251ac43958031d765b5743d43e14bc04b1e465bed81f757c3609ee6f2bea66
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd4280e4-6b15-45b7-9469-d13ba14c37db.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6871
x-amzn-requestid: e1fdb2ee-c0e7-4a0c-ae26-d968aef00503
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEIOGp2IAMFxSQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3ce-24b26a8048ffd84071a2ad57;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:30 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: -svKnYBuiMSdWObzJyNah9TDIi6IuPP6VMzEJWmn0zxoZbFmwpzkJw==
via: 1.1 c07670802688417c8b871124c547eb0a.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:48:33 GMT
age: 73041
etag: "087521979efd5936416fd7f030779fa5725f0a8f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg
34.120.237.76200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash edded48f558f739287a040151349ef67
d63b6ba630736d32c364b0e6a369274b2389b7ff
33b4a459df0ba7b36b907ba96d74e08660cc75640c42a5748b97d18ec2e9d533
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11083
x-amzn-requestid: 53e2c961-bcc0-4977-8648-ee3c1aed9cde
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEHRFWfIAMFhlA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3c7-070212d7386d5efa1b4aa8d3;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Z1KmxHJh9QNfg5x0enkqOjbmiqHvg7nlQiMnuDuCRNWQUBFEiKELbw==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:48:36 GMT
etag: "d63b6ba630736d32c364b0e6a369274b2389b7ff"
content-type: image/jpeg
age: 73038
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7fcf832b-84d6-4938-a540-280bf3205df1.jpeg
34.120.237.76200 OK 9.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7fcf832b-84d6-4938-a540-280bf3205df1.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b11c8ecfed53e302ab48fa5f757513a4
b3cb36455b3cb0a160c705958add6c422a0a48a2
fb66239038dddd134d3c5c7a656c91c57737bc784fabefe15a5ef2981e68e2b0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7fcf832b-84d6-4938-a540-280bf3205df1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9012
x-amzn-requestid: 4ea2bfb1-fc99-4777-aa98-0605d4a704ee
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDpmEBlIAMFj2Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b30a-039358f5691f895941f485fd;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:37:14 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: l0e62S36B9SFUKCi0WA22gXNhfdCLjqD7c3cg_I_Y8-OVKkfwiJFgQ==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 22:25:06 GMT
etag: "b3cb36455b3cb0a160c705958add6c422a0a48a2"
content-type: image/jpeg
age: 70848
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg
34.120.237.76200 OK 5.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 463bdcfbec5426e18ecef83b1c373b71
2e533332ee5c49143e58dad32ee3717a39179532
2c40befd28781482b9be249a792571612d68d7045324083d2c832fa5ec42f04b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4987
x-amzn-requestid: 763edd04-7f8d-42ae-8864-482be3549958
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEHpFs4oAMFbqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3ca-2f7b67e85aa83b69183e62b5;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:26 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 2Zoggf30lA-Kvt5QYa-IdhGePHCNiphR7pfFiOaFvL8ZkWZIaiK4pA==
via: 1.1 f4367b41311e3e9a490d7461b7b85490.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:48:37 GMT
etag: "2e533332ee5c49143e58dad32ee3717a39179532"
content-type: image/jpeg
age: 73037
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg
34.120.237.76200 OK 6.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 206fb65e75dbadf119512f71e0b78402
58ff0bf8ce7528b303d28bab01a80ad721705569
56c8d5f3b3060ee54bf81995269b86c070855d8c33bf437161339a45b309703f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6315
x-amzn-requestid: 6aa75b16-32e4-48a7-9fb0-9e3d5528c2d5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWSdsHUnIAMFXtw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338cabd-742d8a436403683e0cd9368f;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 23:18:21 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 5sAzc5Ewv4g6Wqq6JJiLylG3Jyy_nlWrr5Oteeo6ebEgq7Rvss4XaQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Sun, 02 Oct 2022 04:41:00 GMT
age: 48294
etag: "58ff0bf8ce7528b303d28bab01a80ad721705569"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F18b1ba6d-ca56-4474-afa8-cd3b53cce28e.jpeg
34.120.237.76200 OK 9.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F18b1ba6d-ca56-4474-afa8-cd3b53cce28e.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6047192460abf4afd600948abb5e6ee1
6d6d52fb5024e7772dd45dd459bfe3ec90cb5ce4
d1fd21a5913f6831d2128c8e9e84767d9730bf9e779da5395dc31b82a10e32e9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F18b1ba6d-ca56-4474-afa8-cd3b53cce28e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9340
x-amzn-requestid: e892265e-836d-4638-871f-0548eda57745
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDf8FCEoAMFyow=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b2cc-7f39bb92066a75a90868dd03;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:36:12 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Sk1Dahp1gliiBIghSCZselE7-Fy45svrCk7TdmunOwNefSNqY1P1jA==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:48:34 GMT
etag: "6d6d52fb5024e7772dd45dd459bfe3ec90cb5ce4"
content-type: image/jpeg
age: 73040
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.CardValidator.js
163.44.198.59200 OK 6.4 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.CardValidator.js
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
Hash 27c724fa448269f77118494361b0fc0c
7455679ba0a9811fd31ab5ea8f76ebfe4ba22ec9
8802adf5641c1056fcf4feeeabb83be1b1e3724d9b460cecc791dfdd6422bc3b
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/jquery.CardValidator.js HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "18df-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 6367
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.validate.js
163.44.198.59200 OK 46 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.validate.js
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type Unicode text, UTF-8 text, with very long lines (511)
Hash 17836a76e9a044bc7dad83f6dcef42ef
3467edcee0e9cecd3e5be5bfd21227c8676c05ac
d030f6633a5d0efd3f76fcf5ec98a0468c76770e618a401ffe5ddc7f6ccc844b
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/jquery.validate.js HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "b4bb-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 46267
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/form_offer_panel.html
163.44.198.59200 OK 5.3 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/form_offer_panel.html
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (993)
Hash c118ac3a4ba997458c78eade2e1fdac4
faf216d9d3d102571af688fa9aa4b52da44257fb
cfa2f7dc5b0d7b3bc7190aab46525cefb46185c2c0251de98a3290440b5282d1
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/form_offer_panel.html HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "1489-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 5257
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.mask.js
163.44.198.59200 OK 18 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/jquery.mask.js
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
Hash 219d169a80568884a3d6baab3e5e7def
61d00104de8c972c820cd9b527d8e2edb30e5c4a
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
Analyzer Verdict Alert fortinet Phishing
GET /~cp785288/hlep/Login/files/jquery.mask.js HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "47fe-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 18430
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/spotify-543b91ee3c.css
163.44.198.59200 OK 334 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/spotify-543b91ee3c.css
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type ASCII text, with very long lines (65371)
Size 334 kB (333717 bytes)
Hash 543b91ee3c2476d8cef5ea60c31e9c89
6d966ee2076be0b1497de6584b2f4b03b4dfcdc2
758ad9846aa8db4fd6d7958b03c8db3a2416c1e200fd203c4da5d0129f701e94
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /~cp785288/hlep/Login/files/spotify-543b91ee3c.css HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:53 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "51795-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 333717
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/account-4445741da9.css
163.44.198.59200 OK 113 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/account-4445741da9.css
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type ASCII text, with very long lines (65536), with no line terminators
Size 113 kB (113191 bytes)
Hash 4445741da9c2fcc072a15b124aca043b
6496e6d22375b3c56470b0d163a704e5f5a1dd72
279c2837ecb9591e8dcfd0d1da12755faf0360ff9154f5a2dfde51f138c09489
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /~cp785288/hlep/Login/files/account-4445741da9.css HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:54 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "1ba27-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 113191
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash c120ef4802f4eb64e93225496ba6944a
cdebb30349fa79f7ddb7d13aac47735565ac0ba2
1bcd7dc722018962f16783f0f888742a7926c0a7e466deef174f0f4fc5eb4a4e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
bat.bing.com/bat.js
13.107.21.200200 OK 11 kB IP 13.107.21.200:0
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
File type Unicode text, UTF-8 text, with very long lines (38826), with no line terminators
Hash 293ae3e0fc8b0d5c143fdf9d8490228d
3976c659b908e70818a3a1ac71860b497fe2d1a9
04a840d967ae836e14179bde574cabf14a1fc871182ca0f8193e7a0b06c727ab
GET /bat.js HTTP/1.1
Host: bat.bing.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: private,max-age=1800
content-length: 11367
content-type: application/javascript
content-encoding: gzip
last-modified: Thu, 28 Jul 2022 17:32:37 GMT
accept-ranges: bytes
etag: "80a8697a8a2d81:0"
vary: Accept-Encoding
set-cookie: MUID=09F7C5759B2F6B172519D7449ADA6ACD; domain=.bing.com; expires=Fri, 27-Oct-2023 18:05:55 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 251F7C38458147969C5F67EAFCF8A396 Ref B: OSL30EDGE0209 Ref C: 2022-10-02T18:05:55Z
date: Sun, 02 Oct 2022 18:05:55 GMT
X-Firefox-Spdy: h2
googleads.g.doubleclick.net/pagead/viewthroughconversion/938675917/?random=1664733955338&cv=9&fst=1664733955338&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4
142.250.74.162200 OK 1.2 kB URL HTTP/2 googleads.g.doubleclick.net/pagead/viewthroughconversion/938675917/?random=1664733955338&cv=9&fst=1664733955338&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4
IP 142.250.74.162:0
File type ASCII text, with very long lines (2718), with no line terminators
Hash 8295fa19d648cfaa96a6b09b90f4a01b
4f637039590c3d99032f589ab50a9450d694d058
fb17ddb9820bfb9da7315e1c98bb4b6a3c89d05475f2d6f9c63a914ef5a8dfc2
GET /pagead/viewthroughconversion/938675917/?random=1664733955338&cv=9&fst=1664733955338&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4 HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 18:05:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 1156
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 02-Oct-2022 18:20:55 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
bat.bing.com/p/action/5489004.js
13.107.21.200204 No Content 0 B URL HTTP/2 bat.bing.com/p/action/5489004.js
IP 13.107.21.200:0
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /p/action/5489004.js HTTP/1.1
Host: bat.bing.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
cache-control: private,max-age=1800
set-cookie: MUID=390F149B802269940E8C06AA81D7681E; domain=.bing.com; expires=Fri, 27-Oct-2023 18:05:55 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DD90D747992F4EA981246D9B23F19D13 Ref B: OSL30EDGE0209 Ref C: 2022-10-02T18:05:55Z
date: Sun, 02 Oct 2022 18:05:55 GMT
X-Firefox-Spdy: h2
bat.bing.com/action/0?ti=5489004&Ver=2&mid=fcf483dd-eba9-4fa6-b766-dc3873ab4bc0&msclkid=N&pi=0&lg=en-US&sw=1280&sh=1024&sc=24&p=https%3A%2F%2Fadservice.google.com%2F&r=<=1764&evt=pageLoad&ifm=1&sv=1&rn=213247
13.107.21.200204 No Content 0 B URL HTTP/2 bat.bing.com/action/0?ti=5489004&Ver=2&mid=fcf483dd-eba9-4fa6-b766-dc3873ab4bc0&msclkid=N&pi=0&lg=en-US&sw=1280&sh=1024&sc=24&p=https%3A%2F%2Fadservice.google.com%2F&r=<=1764&evt=pageLoad&ifm=1&sv=1&rn=213247
IP 13.107.21.200:0
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /action/0?ti=5489004&Ver=2&mid=fcf483dd-eba9-4fa6-b766-dc3873ab4bc0&msclkid=N&pi=0&lg=en-US&sw=1280&sh=1024&sc=24&p=https%3A%2F%2Fadservice.google.com%2F&r=<=1764&evt=pageLoad&ifm=1&sv=1&rn=213247 HTTP/1.1
Host: bat.bing.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=124433DBCC0768C32AAC21EACDF2697F; domain=.bing.com; expires=Fri, 27-Oct-2023 18:05:55 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F6743B4FE257484DB28392078D7BF012 Ref B: OSL30EDGE0209 Ref C: 2022-10-02T18:05:55Z
date: Sun, 02 Oct 2022 18:05:55 GMT
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash 544d205b2f709e0bed39ebfc751d6187
71559b505f318323405eeb5ff59499c63e806559
692e14681ceb7536d5c09cf8700810a258b574e02e93c391e7551690111a5bc7
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.3200 OK 472 B IP 142.250.74.3:0
Hash ceb7f2392dd816131e0001a76cb54e19
6416c2a788f016ff94f0a10616e443e47890e97f
517337577ada3f7f9e3da9c42ce722b5a760721d59a0404afdb2810fe252245e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
sp-bootstrap.global.ssl.fastly.net/8.2.0/images/flags/int.svg
151.101.85.194200 OK 20 kB URL HTTP/1.1 sp-bootstrap.global.ssl.fastly.net/8.2.0/images/flags/int.svg
IP 151.101.85.194:0
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (48095), with no line terminators
Hash f0502bfcc1f3e782c835f8451b65b007
121a2c65c3081cfbc124f475b411adb92b2bc1bc
4d148629e85b4da29493dd19bd6d02acfcf63b3085475b7154e3279811cdfa56
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /8.2.0/images/flags/int.svg HTTP/1.1
Host: sp-bootstrap.global.ssl.fastly.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 20408
Last-Modified: Mon, 21 Mar 2022 12:56:04 GMT
ETag: "d15d3150af5b38c95ccbe16ba344d47f"
x-goog-generation: 1647867364791394
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 48095
x-amz-meta-goog-reserved-file-mtime: 1504812661
Content-Type: image/svg+xml
Content-Encoding: gzip
Accept-Ranges: bytes
Date: Sun, 02 Oct 2022 18:05:55 GMT
Age: 2860963
X-Served-By: cache-chi-klot8100114-CHI, cache-bma1661-BMA
X-Cache: HIT, HIT
X-Cache-Hits: 136, 1
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-book.woff2
151.101.85.194200 OK 64 kB URL HTTP/1.1 sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-book.woff2
IP 151.101.85.194:0
File type Web Open Font Format (Version 2), TrueType, length 64512, version 1.66\012- data
Hash 0c0dfc4df72c07c84b15651ab6f951a6
06d7669306b19fffec534f47b18eedce61c5aa73
16f860a080d405f412750f83c4ee2168302cd1f3347416b5b3ae50bae3571b28
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /8.2.0/fonts/circular-book.woff2 HTTP/1.1
Host: sp-bootstrap.global.ssl.fastly.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://cpanel10wh.bkk1.cloud.z.com
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 64512
Last-Modified: Mon, 21 Mar 2022 12:56:03 GMT
ETag: "0c0dfc4df72c07c84b15651ab6f951a6"
x-goog-generation: 1647867363540028
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 64512
x-amz-meta-goog-reserved-file-mtime: 1504812661
Content-Type: font/woff2
Accept-Ranges: bytes
Date: Sun, 02 Oct 2022 18:05:55 GMT
Age: 1053080
X-Served-By: cache-chi-kigq8000135-CHI, cache-bma1657-BMA
X-Cache: HIT, HIT
X-Cache-Hits: 63, 1
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
www.google.no/pagead/1p-user-list/938675917/?random=1664733955338&cv=9&fst=1664733600000&num=1&guid=ON&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=2060657836&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
142.250.74.3200 OK 42 B URL HTTP/2 www.google.no/pagead/1p-user-list/938675917/?random=1664733955338&cv=9&fst=1664733600000&num=1&guid=ON&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=2060657836&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP 142.250.74.3:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/938675917/?random=1664733955338&cv=9&fst=1664733600000&num=1&guid=ON&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=2060657836&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 18:05:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-medium.woff2
151.101.85.194200 OK 66 kB URL HTTP/1.1 sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-medium.woff2
IP 151.101.85.194:0
File type Web Open Font Format (Version 2), TrueType, length 66268, version 1.66\012- data
Hash 251eb282f9ea3a40421d0ae5a549fb92
1a82cf4b6869398509c5bd982495e461c1eb3823
a9d8ae96f7d8b1c672c9cdf8709e876e76172e41c2d9f15a842fc6d9c6f5573d
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /8.2.0/fonts/circular-medium.woff2 HTTP/1.1
Host: sp-bootstrap.global.ssl.fastly.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://cpanel10wh.bkk1.cloud.z.com
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 66268
Last-Modified: Mon, 21 Mar 2022 12:56:03 GMT
ETag: "251eb282f9ea3a40421d0ae5a549fb92"
x-goog-generation: 1647867363628825
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 66268
x-amz-meta-goog-reserved-file-mtime: 1504812661
Content-Type: font/woff2
Accept-Ranges: bytes
Date: Sun, 02 Oct 2022 18:05:55 GMT
Age: 1064861
X-Served-By: cache-chi-kigq8000155-CHI, cache-bma1677-BMA
X-Cache: HIT, HIT
X-Cache-Hits: 37, 1
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-bold.woff2
151.101.85.194200 OK 69 kB URL HTTP/1.1 sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-bold.woff2
IP 151.101.85.194:0
File type Web Open Font Format (Version 2), TrueType, length 69140, version 1.66\012- data
Hash 14bfce9501e5a5dc0adbe559dd630bc6
1347f73fa1907fd9762431cbcfc1e14918cdbddc
0e1e4f36fc8076dd1b5f30ac8aeaeed4b5927e475d0d4e7b8d63a33beb2fd0b5
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /8.2.0/fonts/circular-bold.woff2 HTTP/1.1
Host: sp-bootstrap.global.ssl.fastly.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://cpanel10wh.bkk1.cloud.z.com
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 69140
Last-Modified: Mon, 21 Mar 2022 12:56:03 GMT
ETag: "14bfce9501e5a5dc0adbe559dd630bc6"
x-goog-generation: 1647867363593511
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 69140
x-amz-meta-goog-reserved-file-mtime: 1504812661
Content-Type: font/woff2
Accept-Ranges: bytes
Date: Sun, 02 Oct 2022 18:05:55 GMT
Age: 4621957
X-Served-By: cache-chi-kigq8000076-CHI, cache-bma1653-BMA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 1
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/sprites_cc_logos.png
163.44.198.59200 OK 24 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/sprites_cc_logos.png
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type PNG image data, 37 x 948, 8-bit/color RGBA, non-interlaced\012- data
Hash 0cc5525016888556c3fb82f2cdab246a
f7fbe9b43f6d01cad02f9b016d4b0f0abb8c4423
a47f9feda7682c5085fa780e2560144c5bc70caa592a8d1a345a852948efa94a
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /~cp785288/hlep/Login/files/sprites_cc_logos.png HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:55 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "5e74-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 24180
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-black.woff2
151.101.85.194200 OK 69 kB URL HTTP/1.1 sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-black.woff2
IP 151.101.85.194:0
File type Web Open Font Format (Version 2), TrueType, length 69188, version 1.66\012- data
Hash 9e0ddf791ff8bdc860603330b6b1c88e
9a721a21c1928f089ee0eae1988acd8c83fa1a33
769dae020149617e3d70328c3e1557fa3ca53fa128a9743ab389b2bfcb5327f1
Analyzer Verdict Alert urlquery Phishing - Spotify
GET /8.2.0/fonts/circular-black.woff2 HTTP/1.1
Host: sp-bootstrap.global.ssl.fastly.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://cpanel10wh.bkk1.cloud.z.com
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 69188
Last-Modified: Mon, 21 Mar 2022 12:56:03 GMT
ETag: "9e0ddf791ff8bdc860603330b6b1c88e"
x-goog-generation: 1647867363538571
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 69188
x-amz-meta-goog-reserved-file-mtime: 1504812660
Content-Type: font/woff2
Accept-Ranges: bytes
Date: Sun, 02 Oct 2022 18:05:55 GMT
Age: 2183102
X-Served-By: cache-chi-kigq8000145-CHI, cache-bma1633-BMA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 1
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
www.google.com/pagead/1p-user-list/938675917/?random=1664733955338&cv=9&fst=1664733600000&num=1&guid=ON&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=2060657836&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
142.250.74.164200 OK 42 B URL HTTP/2 www.google.com/pagead/1p-user-list/938675917/?random=1664733955338&cv=9&fst=1664733600000&num=1&guid=ON&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=2060657836&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
IP 142.250.74.164:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/938675917/?random=1664733955338&cv=9&fst=1664733600000&num=1&guid=ON&eid=375603261&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F4721227.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D4721227%3Btype%3Duidfq0%3Bcat%3Dspoti0%3Bord%3D5160187481151%3Bgtm%3DG1u%3Bu2%3Dundefined%3B~oref%3Dfile%253A%252F%252F%252FC%253A%252FAppServ%252Fwww%252FOVO%252520v2.7%252FSpotify%252FSubscription%252520and%252520payment%252520-%252520Spotify.html&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=2060657836&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 18:05:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cpanel10wh.bkk1.cloud.z.com/build/i/sprite/icon-provider-9b3624f0bb.png
163.44.198.59404 Not Found 10 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/build/i/sprite/icon-provider-9b3624f0bb.png
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4070)
Hash 8ab03eea8a33164c1ce3ec8f0d36eeca
e8c54a4ba299f331242141911ec86b3b076b2d41
d58740bbac37558530f05af2db2532b84b3ad2a6990df94d8cf5bd9a5faed831
GET /build/i/sprite/icon-provider-9b3624f0bb.png HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/account-4445741da9.css
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 404 Not Found
Date: Sun, 02 Oct 2022 18:05:55 GMT
Server: Apache
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 72e8c21988f5ecd736fde162321f0984
4bb9f82a2f6114b344600d920f91f1cc9260bc42
326533b2b3a8b24f0b21dbe9b94e5d9086f862ad74a1d01942fb829dff0352f3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4107
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 18:05:55 GMT
Last-Modified: Sun, 02 Oct 2022 16:57:28 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/script.min.js.download
163.44.198.59200 OK 102 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/script.min.js.download
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
File type ASCII text, with very long lines (606)
Size 102 kB (102502 bytes)
Hash 97a4272e14f1f22426b66cf76d35cb6c
37b019ee762cf810d1f7afb2093759555a7b9a82
5eac9ca987f8ea95d31583f360ea2211f3cd58afda19ead30f9e890106d460b2
Analyzer Verdict Alert urlquery Phishing - Spotify
fortinet Phishing
GET /~cp785288/hlep/Login/files/script.min.js.download HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/files/form_offer_panel.html
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 18:05:55 GMT
Server: Apache
Last-Modified: Tue, 16 Jul 2019 16:30:28 GMT
ETag: "19066-58dcee4fb3100"
Accept-Ranges: bytes
Content-Length: 102502
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/vv.gif
163.44.198.59404 Not Found 15 kB URL HTTP/1.1 cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/vv.gif
IP 163.44.198.59:0
ASN #135161 GMO-Z com NetDesign Holdings Co., Ltd.
Hash b817fdf801051dc3e746410b51cd8859
1bab3c3ae0f358c8edeaf60007af78f5bd15738e
4592b78ad2c8b1a08edc112dc01d70870da957fc8261b166015c45fefe4ed34e
GET /~cp785288/hlep/Login/vv.gif HTTP/1.1
Host: cpanel10wh.bkk1.cloud.z.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/~cp785288/hlep/Login/billing.php?verify_account=session=NL&1ea5d09f79e65ee089bc671aa1affeb3&dispatch=7789a9717300104ca4218ad08bcbd57bbc81867b
Cookie: PHPSESSID=ialq69hunpl6cur2ndp667dge1
HTTP/1.1 404 Not Found
Date: Sun, 02 Oct 2022 18:05:55 GMT
Server: Apache
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
connect.facebook.net/signals/config/1483047915331997?v=2.8.12&r=stable
157.240.221.16200 OK 54 kB URL HTTP/2 connect.facebook.net/signals/config/1483047915331997?v=2.8.12&r=stable
IP 157.240.221.16:0
Hash 8c9f4d7fb4caddb3606300be9b03dfcd
314bcd3d4d02db2b51d9c37619626757464aa0d1
345501fa746b4278e0c5e4ff5ecb782b910f58329b1914a8d200d98c0f430916
GET /signals/config/1483047915331997?v=2.8.12&r=stable HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://cpanel10wh.bkk1.cloud.z.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: 5Vdoiu8XsxhxUuk5eGHIzw5mEBLNqp9AShV3QiU1pa6Q/kDWe9xrIjrhsjKha4907t2cGP4EX7Vgon5SPZhQdQ==
x-fb-trip-id: 1679558926
date: Sun, 02 Oct 2022 18:05:56 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
insight.adsrvr.org/track/conv/?adv=3ysyqec&ct=0:2azffrr&fmt=3
15.197.193.217200 OK 0 B URL HTTP/2 insight.adsrvr.org/track/conv/?adv=3ysyqec&ct=0:2azffrr&fmt=3
IP 15.197.193.217:0
GET /track/conv/?adv=3ysyqec&ct=0:2azffrr&fmt=3 HTTP/1.1
Host: insight.adsrvr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://4721227.fls.doubleclick.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 02 Oct 2022 18:05:54 GMT
content-type: image/gif
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
set-cookie: TDID=385a9c3d-c1bd-4f56-bd91-e8e198faeb73; domain=.adsrvr.org; expires=Mon, 02-Oct-2023 18:05:55 GMT; path=/; secure; SameSite=None
TDCPM=CAEYBTgBQgQiAggB; domain=.adsrvr.org; expires=Mon, 02-Oct-2023 18:05:55 GMT; path=/; secure; SameSite=None
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
X-Firefox-Spdy: h2