Report - www.homepagina.to/log-1/

Report Overview

Submitted URL
www.homepagina.to/log-1/
IP
104.21.64.4
ASN
#13335 CLOUDFLARENET
Submitted
2023-02-02 01:21:37
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
26

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.sectigo.com	487	2019-11-29T12:50:24Z	2023-03-13T08:22:43Z	340 B	963 B	104.18.32.68
www.gstatic.com	unknown	2016-07-26T11:37:06Z	2023-03-13T07:57:11Z	419 B	1.5 kB	142.250.74.35
c.amazon-adsystem.com	300	2012-05-22T23:02:12Z	2023-03-13T05:21:15Z	373 B	623 B	54.230.111.210
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	52.35.140.96
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	3.1 kB	6.3 kB	142.250.74.163
i3.plug.it	unknown	2022-08-02T23:21:58Z	2023-02-07T11:05:36Z	400 B	1.0 kB	143.204.55.63
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	2.2 kB	30 kB	34.120.237.76
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2.4 kB	6.2 kB	23.36.77.32
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.8 kB	34.160.144.191
translate.googleapis.com	1005	2012-05-31T09:21:21Z	2023-03-13T08:44:18Z	417 B	4.5 kB	142.250.74.106
login.libero.it	277279	2012-05-25T11:40:21Z	2023-02-15T14:48:56Z	386 B	11 kB	213.209.36.1
securepubads.g.doubleclick.net	190	2013-05-31T06:19:39Z	2023-03-13T05:09:45Z	778 B	161 kB	142.250.74.130
www.iolam.it	203511	2018-03-07T08:54:25Z	2023-03-07T14:13:43Z	362 B	379 B	213.209.30.161
www.homepagina.to	unknown	2023-01-15T14:38:58Z	2023-02-02T03:31:14Z	7.0 kB	831 kB	172.67.173.183
ocsp.usertrust.com	899	2012-05-21T17:43:18Z	2023-03-13T08:38:38Z	342 B	2.8 kB	172.64.155.188

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-02 01:21:50	medium	Client IP	Internal IP	ET DNS Query for .to TLD
2023-02-02 01:21:50	medium	Client IP	Internal IP	ET DNS Query for .to TLD

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-02-01	medium	www.homepagina.to/log-1/	Libero
2023-02-01	medium	www.homepagina.to/log-1/	Libero

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-02	medium	www.homepagina.to/log-1/	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/m	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tracking_login-libero-it.min.js.download	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/IOL.Analytics.Tracking.min.js.download	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/gpt.js.download	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tcf-v2-0.20.6.js.download	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/iam2.0.js.download	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/f.txt	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/pubads_impl_2023010901.js.download	Phishing
2023-02-02	medium	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/logo.svg	Phishing
2023-02-02	medium	www.homepagina.to/log-1/	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (8)

	URL	Size	First Seen	Last Seen
	www.homepagina.to/log-1/	246 B	2023-03-13	2023-03-14
Pretty URL www.homepagina.to/log-1/ IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 14:35:45 Last Seen2023-03-14 00:08:08 Times Seen1 Hash 0b4c35f727b0c83e1eaa6b3e980d23c2 c685d72b329aa07cd82ec872e3c6a482cc2f786a 746cbb9d936a8a16b948043b7170e15e86f75ba6a9a006657da003a8955717b6 Loading...

	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/iam2.0.js.download	151 kB	2023-03-13	2023-03-14
Pretty URL www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/iam2.0.js.download IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 03:27:48 Last Seen2023-03-14 00:08:08 Times Seen1 Hash fb5dbd025406d9aaa9cfa3a306e938ad 52e6ae28e8a3e9ff2ed312031f8c10267d5b959d 23cad0395b76b51a4f4839bd7406211e14d202f7edb7ab6df21d98a6bb0d6aa3 Loading...

	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/gpt.js.download	82 kB	2023-03-13	2023-03-14
Pretty URL www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/gpt.js.download IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 14:35:45 Last Seen2023-03-14 00:08:08 Times Seen1 Hash ae2501d985c7db427a41e79513fcf84f 8f2af94751e32a2ea440c7216e1afd3456ab81a9 5b263ee6929f963e0735dbc0580dd210b2a9d49e9f1d7763b995b5ebc0b5e8cb Loading...

	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/pubads_impl_2023010901.js.download	391 kB	2023-03-12	2023-03-14
Pretty URL www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/pubads_impl_2023010901.js.download IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 19:34:03 Last Seen2023-03-14 00:08:08 Times Seen1 Hash c092ac6167fb0a739f9a8552ef37f048 2ec223d2a7be532e195c447c9095f8abcdca78c1 1029b050487059828b253f9da4693cbf8a28067c5f9bf0bbef108b3ff1b0ed7d Loading...

	www.homepagina.to/log-1/	66 B	2023-03-13	2023-03-14
Pretty URL www.homepagina.to/log-1/ IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 14:35:45 Last Seen2023-03-14 00:08:08 Times Seen1 Hash aae81ca49d3893a23312f21fe0c48c9d 7ab3ca081abb7f73ee06e4152d78090d4e31b27a 1ab37ec3277cb8867b69297b3be8ade2286f884f4f21463b83ece04953b9efec Loading...

	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tracking_login-libero-it.min.js.download	5.9 kB	2023-03-13	2023-11-21
Pretty URL www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tracking_login-libero-it.min.js.download IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 03:27:48 Last Seen2023-11-21 03:43:10 Times Seen5 Hash a74c4931e8922eb02ded30aa554978a9 70a7aed0372bf2e164f9d487e240c30e23c53a2d ba622f81f692dd7f4b54e5379346086874eff141a501881982c5a5b3b2370df8 Loading...

	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/IOL.Analytics.Tracking.min.js.download	46 kB	2023-03-13	2023-11-21
Pretty URL www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/IOL.Analytics.Tracking.min.js.download IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 03:27:48 Last Seen2023-11-21 03:43:10 Times Seen7 Hash 10fd38d35c7d0ffd25b63da5cb552fdb 999634b63d59cb76162ddfe39d03f3bf8bc6d2dd 17e49df09dd14c40d50c5e4693c448e99cfee8ee79aa5a9c5bd2be5be3105562 Loading...

	www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tcf-v2-0.20.6.js.download	111 kB	2023-03-12	2023-03-14
Pretty URL www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tcf-v2-0.20.6.js.download IP 172.67.173.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 13:56:57 Last Seen2023-03-14 00:08:08 Times Seen1 Hash ae53e9bd065951bf9cafede37f3a0c76 219eb29fd7eb1ad53e9069a81b44c09f3d249ddc 30cd6a74c5d89413e56c3651a6f7cc35b8ee688ce04eef8f08af246d3b279f60 Loading...

HTTP Transactions (51)

URL IP Response Size

www.homepagina.to/log-1/

172.67.173.183

301 Moved Permanently

0 B

URL HTTP/1.1
www.homepagina.to/log-1/
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
openphish	Libero
fortinet	Phishing

HTTP Headers

GET /log-1/ HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Thu, 02 Feb 2023 01:21:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 02 Feb 2023 02:21:26 GMT
Location: https://www.homepagina.to/log-1/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dXaTzYyX4c70t1J%2F4Pp59uVYLqDvk7ImCPQSxp%2BrijQNA1eIELbOuSfzBycT4SZpA1pCZpYoeutVf4zXZmFujeFeb%2FoNcJCSUzn%2Bhwr6YSLRi1%2BGeMIkWofjBJ8sO%2BRfK6jhew%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 792f1c2aff69b521-OSL
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e935ea42be4feaed61a824b0b903913e
f966cfa80d65a805cb9d7c6a53b3340865d7c51a
eb0ce9ae50d156fe5924b2d77346735e4e93b5240cff301c9aa835bb0b385815

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB0CE9AE50D156FE5924B2D77346735E4E93B5240CFF301C9AA835BB0B385815"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14237
Expires: Thu, 02 Feb 2023 05:18:43 GMT
Date: Thu, 02 Feb 2023 01:21:26 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7e05c8461bd2dc5a149f71e2c465ea29
705983959c887e243cb55a8a1796757b579ee977
4d9ea085d5dda9dabed11af9847c2b0aa6182358673b356a4e2bd631e22a9922

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4D9EA085D5DDA9DABED11AF9847C2B0AA6182358673B356A4E2BD631E22A9922"
Last-Modified: Tue, 31 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15451
Expires: Thu, 02 Feb 2023 05:38:57 GMT
Date: Thu, 02 Feb 2023 01:21:26 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 02 Feb 2023 00:43:26 GMT
content-type: application/json
age: 2280
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a8d45deaa7ebfcd996c2055dae592ab8
55befe074589fe7b39757c145968058162a8fc6b
50d7d516f446458145a304b288a0a39d391cd37ea50dabea36ae48d291c65ba7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "50D7D516F446458145A304B288A0A39D391CD37EA50DABEA36AE48D291C65BA7"
Last-Modified: Tue, 31 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9469
Expires: Thu, 02 Feb 2023 03:59:15 GMT
Date: Thu, 02 Feb 2023 01:21:26 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: TMwLHiJkWx36K7aF71ItPv4tE51Eg8hxEGZc6HEMfZfofx3qwgP7hTyHrTztOr17xwwC44YzosQ=
x-amz-request-id: J2YRSQH8JVZAF8J4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 02 Feb 2023 00:51:46 GMT
age: 1780
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 02 Feb 2023 01:21:26 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.pki.goog/s/gts1p5/FXnzrwNfxN0

142.250.74.163

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1p5/FXnzrwNfxN0
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
6a077fa61cb72eacffd0640d1c2c9b12
5822c5ba1bd5893d2cbfb916621dd2725f3cedf6
6b2adc5998e448569d5c25e6f7c31f8b0cd204bde286140e275bb52a3b1f7b51

HTTP Headers

POST /s/gts1p5/FXnzrwNfxN0 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:26 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Content-Type, ETag, Last-Modified, Alert, Retry-After, Content-Length, Cache-Control, Pragma, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 02 Feb 2023 00:41:43 GMT
age: 2383
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8913af0be619500295008bb91f506660
a7b8068ba9aa506205a295b24458c2616997a0d1
6a9838d00256431807ca382fc205064b07c08d5054f2895c2ae3cc4e9094179a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6A9838D00256431807CA382FC205064B07C08D5054F2895C2AE3CC4E9094179A"
Last-Modified: Wed, 01 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10612
Expires: Thu, 02 Feb 2023 04:18:19 GMT
Date: Thu, 02 Feb 2023 01:21:27 GMT
Connection: keep-alive

ocsp.pki.goog/s/gts1p5/FXnzrwNfxN0

142.250.74.163

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1p5/FXnzrwNfxN0
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
6a077fa61cb72eacffd0640d1c2c9b12
5822c5ba1bd5893d2cbfb916621dd2725f3cedf6
6b2adc5998e448569d5c25e6f7c31f8b0cd204bde286140e275bb52a3b1f7b51

HTTP Headers

POST /s/gts1p5/FXnzrwNfxN0 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:27 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
de49044c9365e16fec3a6d361cb94728
2b7b69c16de6fda1ae5206f92fe781ee07bd182a
6e76887b036544a5da3918116a180876c094cc3b31676abce8d5b7b716b00c30

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

translate.googleapis.com/translate_static/css/translateelement.css

142.250.74.106

200 OK

3.6 kB

URL HTTP/2
translate.googleapis.com/translate_static/css/translateelement.css
IP
142.250.74.106:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (22967)
Size
3.6 kB (3632 bytes)
Hash
f7bf2121608909b56672e6398ac2335c
864ef3bac46b08ab6609fad23f00d5f09815647d
b9d3a8600d9b6edf9c71b793c42782282ecfb01e2026e0128608b949e91e152c

HTTP Headers

GET /translate_static/css/translateelement.css HTTP/1.1
Host: translate.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="rosetta"
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-length: 3632
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 Feb 2023 00:42:12 GMT
expires: Thu, 02 Feb 2023 01:42:12 GMT
cache-control: public, max-age=3600
age: 2355
last-modified: Mon, 09 Jan 2023 20:58:00 GMT
content-type: text/css
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

push.services.mozilla.com/

52.35.140.96

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.35.140.96:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: QFhB2VMmfTU0Cmr4HHIJIQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: GXGPIymOwmAkKT1JyCQiEX3H+8c=

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
de49044c9365e16fec3a6d361cb94728
2b7b69c16de6fda1ae5206f92fe781ee07bd182a
6e76887b036544a5da3918116a180876c094cc3b31676abce8d5b7b716b00c30

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.sectigo.com/

104.18.32.68

200 OK

471 B

URL HTTP/1.1
ocsp.sectigo.com/
IP
104.18.32.68:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
471 B (471 bytes)
Hash
765ac0f98f2583b0e20b0552b9d5f4b7
cc302d283cdc220691a199627896ad6f2bf4b79c
b2a41bf6b2e728bb466bd819f65c9c0f967fbb75273c04cc4413a3443a8cafe6

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 02 Feb 2023 01:21:27 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Tue, 31 Jan 2023 02:44:43 GMT
Expires: Tue, 07 Feb 2023 02:44:42 GMT
Etag: "cc302d283cdc220691a199627896ad6f2bf4b79c"
Cache-Control: max-age=436394,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 792f1c32bfa8b505-OSL

ocsp.usertrust.com/

172.64.155.188

200 OK

2.2 kB

URL HTTP/1.1
ocsp.usertrust.com/
IP
172.64.155.188:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
2.2 kB (2236 bytes)
Hash
30f7454085a7cf9e78262ec69ab57cf4
362a51e182e88868549b2b2aa42ecff0adf0ba6e
e6cfc0951c4bac92238f7871061857e1383565ea6cf587e0039722e0a4d92ce4

HTTP Headers

POST / HTTP/1.1
Host: ocsp.usertrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 02 Feb 2023 01:21:27 GMT
Content-Type: application/ocsp-response
Content-Length: 2236
Connection: keep-alive
Last-Modified: Wed, 01 Feb 2023 10:12:16 GMT
Expires: Wed, 08 Feb 2023 10:12:15 GMT
Etag: "362a51e182e88868549b2b2aa42ecff0adf0ba6e"
Cache-Control: max-age=602295,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 108
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 792f1c331cbdb529-OSL

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/m

172.67.173.183

200 OK

44 B

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/m
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
GIF image data, version 89a, 1 x 1\012- data
Size
44 B (44 bytes)
Hash
354857de9229bae15647fbc6364a4b19
f23e9c4fadc2e01bf323e90e5c1459bb6cf4f917
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/m HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-length: 44
last-modified: Wed, 18 Jan 2023 01:07:20 GMT
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dqgo%2FqMxv354KOYTc5ebsEUkOpUxWLX40B%2FJEq3URqaTXIKAMOTjoyqcwTlX2hmKm5KFqRDz%2BFv73OyIbmXz4f5UixU0wG%2FGvAat7x3TtuliTijYxX3oMHCLgefLYeorWylA%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c320a1c0b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

i3.plug.it/banners/img/AdvContent20x20.png

143.204.55.63

200 OK

537 B

URL HTTP/2
i3.plug.it/banners/img/AdvContent20x20.png
IP
143.204.55.63:0
ASN
#16509 AMAZON-02

File type
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced\012- data
Size
537 B (537 bytes)
Hash
b2a5b41a5f227f2cf53963759b4c65c5
818043a085b4b90b28c33b9da2d4f4902a5045e3
68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c

HTTP Headers

GET /banners/img/AdvContent20x20.png HTTP/1.1
Host: i3.plug.it
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: image/png
content-length: 537
server: nginx
last-modified: Tue, 09 Jun 2020 08:23:45 GMT
accept-ranges: bytes
date: Wed, 01 Feb 2023 06:07:44 GMT
expires: Wed, 01 Feb 2023 06:27:44 GMT
cache-control: max-age=1200, public
etag: "5edf4711-219"
x-cache: Hit from cloudfront
via: 1.1 a6d89f7e2d55548b941f1ff5d5b3c8d4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: j1RvXOI7SI6z3iyMqW6wX06b7C-NQf4VSYzElGNH8-fJjHZ5JPwjaA==
age: 69223
X-Firefox-Spdy: h2

213.209.36.1

200 OK

9.0 kB

URL HTTP/1.1
login.libero.it/?ref=hpl-hdx
IP
213.209.36.1:0
ASN
#8660 Italiaonline S.p.A.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5180), with CRLF, LF line terminators
Size
9.0 kB (8958 bytes)
Hash
9b0224abe02923765a15d1718bacd5de
780f56a99afbf25daf7f551327110ceffbd4eae6
b13896f7cd08ad6cb11a4821068a4842efc0c63a2ec3feb4358edb1aa9820cbb

HTTP Headers

GET /?ref=hpl-hdx HTTP/1.1
Host: login.libero.it
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Thu, 02 Feb 2023 01:21:27 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
Set-Cookie: cookies_enabled=yes; path=/
LIB_PROV_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=libero.it
LIB_LOG_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=login.libero.it; Secure; SameSite=None
LIB_LOG_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; Secure; SameSite=None
LIB_SSO_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=libero.it; Secure; SameSite=None
LIB_NAME_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=libero.it
LIB_TK_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=libero.it
LIB_LOG_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=login.libero.it; Secure; SameSite=None
LIB_LOG_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; Secure; SameSite=None
LIB_SSO_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=libero.it; Secure; SameSite=None
LIB_NAME_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=libero.it
LIB_TK_CK=0; expires=Tue, 09-Feb-1993 01:21:27 GMT; Max-Age=0; path=/; domain=libero.it
X-XSS-Protection: 1; mode=block
Content-Length: 8958
Keep-Alive: timeout=3, max=400
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/AdvContent20x20.png

172.67.173.183

200 OK

537 B

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/AdvContent20x20.png
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced\012- data
Size
537 B (537 bytes)
Hash
b2a5b41a5f227f2cf53963759b4c65c5
818043a085b4b90b28c33b9da2d4f4902a5045e3
68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/AdvContent20x20.png HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: image/png
content-length: 537
cache-control: public, max-age=604800
expires: Thu, 09 Feb 2023 01:21:27 GMT
last-modified: Wed, 18 Jan 2023 01:07:18 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jrIbrP8MySyU6j7l9k69H6gYG%2F%2FT7ahvJFVfPDKAiOxfHP2u%2B9R8DzaqUSuWRNpwR1%2BpvQdqN1%2FO6lqiKveXBtLgKrro%2BtFVCzR%2BH18tP8Qi1AUeNLoWyF5YT4g62Kk2RIq%2Bag%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 792f1c31b9fd0b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tracking_login-libero-it.min.js.download

172.67.173.183

200 OK

5.9 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tracking_login-libero-it.min.js.download
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text
Size
5.9 kB (5930 bytes)
Hash
a74c4931e8922eb02ded30aa554978a9
70a7aed0372bf2e164f9d487e240c30e23c53a2d
ba622f81f692dd7f4b54e5379346086874eff141a501881982c5a5b3b2370df8

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/tracking_login-libero-it.min.js.download HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: application/octet-stream
content-length: 5930
last-modified: Wed, 18 Jan 2023 01:07:20 GMT
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ng0yAMnmr3J9ac6mxk5%2B6QDzd0DEcWZQv7CcF4PWlqpMoFXnXEsVbqBzFaWISY5V7RZ0qRdeY5Oen4cOjz5NQISZipMwZ3N2wzjTckDIrBGvoh5GEJlzFfVwPggMBVeD3jWAPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c320a1d0b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/logo-dilei.png

172.67.173.183

200 OK

635 B

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/logo-dilei.png
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 64 x 20, 8-bit colormap, non-interlaced\012- data
Size
635 B (635 bytes)
Hash
ecafeea2c8c12d19e1f683a3f8303041
90618f79efe53c34394437e6b795540b2f773ca3
03b627991fbbfcdd77b0903bb7131c69214bb2f6540e533ebb7f0e1239825b97

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/logo-dilei.png HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: image/png
content-length: 635
cache-control: public, max-age=604800
expires: Thu, 09 Feb 2023 01:21:27 GMT
last-modified: Wed, 18 Jan 2023 01:07:18 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EbjIJHzKZX9bh90SJc6VpVuT%2FJgK1WA1O1ZWAGUAds6Le6RORRG7C8cWWpBCSUKI%2FTVUd2RLglu%2BJ0AGE0NefY4r30FYqD7YTsnTW38zEm1u1iKDpKgen5GWdyE2J1osD3BVIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 792f1c320a190b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/translate_24dp.png

172.67.173.183

200 OK

846 B

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/translate_24dp.png
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
846 B (846 bytes)
Hash
e9cd262114358f26b7608b56905185dc
6dbde0a96deaab2b529723ce26c62043cf9180ab
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/translate_24dp.png HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: image/png
content-length: 846
cache-control: public, max-age=604800
expires: Thu, 09 Feb 2023 01:21:27 GMT
last-modified: Wed, 18 Jan 2023 01:07:20 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5lfE2LB5KpHi%2FOLpTyOwK33fEvjt1%2FqWb8RMxFcNxmPpk6rZ%2FEjinPb4rAPHp1q0p6IdfWQxkoyW4ifAK21%2Bl4W7TioxiQTINuNKIlLt40CmkboTiEAyDM6iL1%2B%2FaPucZTmhSw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 792f1c323a390b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/IOL.Analytics.Tracking.min.js.download

172.67.173.183

200 OK

46 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/IOL.Analytics.Tracking.min.js.download
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (32029)
Size
46 kB (46107 bytes)
Hash
10fd38d35c7d0ffd25b63da5cb552fdb
999634b63d59cb76162ddfe39d03f3bf8bc6d2dd
17e49df09dd14c40d50c5e4693c448e99cfee8ee79aa5a9c5bd2be5be3105562

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/IOL.Analytics.Tracking.min.js.download HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: application/octet-stream
content-length: 46107
last-modified: Wed, 18 Jan 2023 01:07:20 GMT
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ncw4Piudd7box4aSpSH9y02VEeP%2FtGNJvTNopP30dhnZ5zpfoi1G5HFShIKhHOvL%2FFdIbuU5Zwg4wPrXqBjWzLQlXYeGplUUefAke1hw%2BTSwhVTqlXPW9Cf%2FrYde4ExTPe4KsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c323a380b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/gpt.js.download

172.67.173.183

200 OK

82 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/gpt.js.download
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (39228)
Size
82 kB (81647 bytes)
Hash
ae2501d985c7db427a41e79513fcf84f
8f2af94751e32a2ea440c7216e1afd3456ab81a9
5b263ee6929f963e0735dbc0580dd210b2a9d49e9f1d7763b995b5ebc0b5e8cb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/gpt.js.download HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: application/octet-stream
content-length: 81647
last-modified: Wed, 18 Jan 2023 01:07:16 GMT
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DN6k6RTpKOp2H1RwYEv%2F7CguF7w69bR2g2DpDwdy5GDqCTHiILEK9FwE1%2FmnyUOvPXNbycxjpyvTB1T6LAzKzaWpGz6vUPC9YueYb%2B6SwZcBWz9iNdbh0%2F%2BsBebgMCTNOlOhNw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c31a9f30b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tcf-v2-0.20.6.js.download

172.67.173.183

200 OK

111 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/tcf-v2-0.20.6.js.download
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65536), with no line terminators
Size
111 kB (111033 bytes)
Hash
ae53e9bd065951bf9cafede37f3a0c76
219eb29fd7eb1ad53e9069a81b44c09f3d249ddc
30cd6a74c5d89413e56c3651a6f7cc35b8ee688ce04eef8f08af246d3b279f60

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/tcf-v2-0.20.6.js.download HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: application/octet-stream
content-length: 111033
last-modified: Wed, 18 Jan 2023 01:07:18 GMT
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9448mQE08sRkktr9vCF1WCHQctkhjjgQDngdWVuPAZASZ92ehAom6wGiiX41p1eljYCvC588ciNVtXCPIcUkoDNshOIVh4qj4mXMjtCSCVcL1Chvd6Bhg0d8VM6j1Djq5iQetA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c31a9f40b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/iam2.0.js.download

172.67.173.183

200 OK

151 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/iam2.0.js.download
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
C source, ASCII text, with very long lines (13343)
Size
151 kB (151391 bytes)
Hash
fb5dbd025406d9aaa9cfa3a306e938ad
52e6ae28e8a3e9ff2ed312031f8c10267d5b959d
23cad0395b76b51a4f4839bd7406211e14d202f7edb7ab6df21d98a6bb0d6aa3

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/iam2.0.js.download HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: application/octet-stream
content-length: 151391
last-modified: Wed, 18 Jan 2023 01:07:16 GMT
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xDk4hpLoXVVKh%2FGqBD26R6hQr4RZLTx4P8aUhVbYbxA9Xly93KsSHHl0eHUt1CI5EjEa7odhrG0kiIEpfg0prSdbZwvQ9qmV%2F5AsuxnJX68ipGlEgLV5wqA8GXEQS7wWoq%2FNlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c3199eb0b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7262
Expires: Thu, 02 Feb 2023 03:22:30 GMT
Date: Thu, 02 Feb 2023 01:21:28 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7262
Expires: Thu, 02 Feb 2023 03:22:30 GMT
Date: Thu, 02 Feb 2023 01:21:28 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7262
Expires: Thu, 02 Feb 2023 03:22:30 GMT
Date: Thu, 02 Feb 2023 01:21:28 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe18f9e12-0986-423b-911d-6271bb996db4.jpeg

34.120.237.76

200 OK

5.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe18f9e12-0986-423b-911d-6271bb996db4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.4 kB (5356 bytes)
Hash
7c823f1d6bf1c50d58eb263b85e6e37c
a7b74d11494fb3254df907e5cc1eead070d84617
b2706961eb756383e0988dfdb501dc424aea59697aedd1e4a6c294c314a31935

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe18f9e12-0986-423b-911d-6271bb996db4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5356
x-amzn-requestid: fef22c83-35a4-4990-9008-af5853f838d1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frc5BEB6oAMFczg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dadb6c-68d3017555c069bc3107d150;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 21:36:44 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: i697kJpdT4ZPeMLWIftWf16pWCic0-v4tL4GDKfVfTZLo-E4-3FwDQ==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 22:21:38 GMT
age: 10790
etag: "a7b74d11494fb3254df907e5cc1eead070d84617"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/translateelement.css

172.67.173.183

200 OK

19 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/translateelement.css
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (22967)
Size
19 kB (19338 bytes)
Hash
9206b602e3d45d3db6466e626caae179
4c8c697fbb0b3d9f681b8fc753a7041ee129d49a
7952ac89614fe93344536f2761642615342cdc6c8cd916aa45bc062d8efe5e31

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/translateelement.css HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: text/css
cache-control: public, max-age=604800
expires: Thu, 09 Feb 2023 01:21:27 GMT
last-modified: Wed, 18 Jan 2023 01:07:18 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ks6JEPOXq24L3gj5kBX%2BCfMky81NLa1fjRg%2BwioClMKCUtUM1cIJZYSj6dqmlyIbXtS%2FivIc8Wo%2FHZY14giMYUOFmq5FB%2BSdW0m1hdOMEkIjMtb49DxFlxXhL1ETZKNCA8JkCg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c31a9f70b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e30ba8-4b02-4bad-8cbf-1a128aa4376f.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.6 kB (9600 bytes)
Hash
3366ef4f8733cb9c89a5c88f63a0a441
7da46843b6d885f38a4759a08e6c899906ab7b97
7114397ee5c251cc5cb46f3433c2cc17ff68a08e0872e227671198e9b61eba0a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e30ba8-4b02-4bad-8cbf-1a128aa4376f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9600
x-amzn-requestid: 91987222-d376-4099-a4e9-5f877b5212be
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fLzO2FSDIAMFktg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ce325e-281a7e062ee3039d42ae8f83;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 07:08:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: SEH32iK4aCkxhxQyu3fSlW8uVM1Oj5hwnl2U09k_THEOdAqdEeVMJw==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 22:03:43 GMT
age: 11865
etag: "7da46843b6d885f38a4759a08e6c899906ab7b97"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

2.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9d807a49-adb3-465b-bdcf-f7b8f276af86.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
2.9 kB (2874 bytes)
Hash
a62a4f48037f1f84b8fd03347daf9ab9
e67e666749b07a0d343d1d0f74d59155ba25d687
5a9ebe1bec39e5d69b20c9747f32c85be906cddba92501052d54dc9a37d3c52d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9d807a49-adb3-465b-bdcf-f7b8f276af86.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 2874
x-amzn-requestid: 0102a009-be1f-4890-97db-674ebd79e449
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frep5EBOoAMFgiA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dade3f-371af67b2cc767ed35cb81d6;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 21:48:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: MwPmKlNm1j7hqbrlEgxAlfu0gQQNhnkrHnL-YABUr7P8_oFaoFDgFA==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 22:00:37 GMT
age: 12051
etag: "e67e666749b07a0d343d1d0f74d59155ba25d687"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/f.txt

172.67.173.183

200 OK

11 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/f.txt
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with no line terminators
Size
11 kB (11283 bytes)
Hash
7f58f6105741a813da269d913ff08c09
4894ea2d106c89b3c4edbc1894046657de1006f4
591037ca06c18bac2bc9cf72eeabc08f044c69a8cfddb2a29f6f00f226fbbdc5

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/f.txt HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: text/plain
last-modified: Wed, 18 Jan 2023 01:07:18 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X8gfTIWRTluZkModnitVCJQZdJmzfZ%2BKdo%2FlcZZuhXkopmrDbwwsTJoNNhMK%2Bo5qxHuU%2FpnglsA2Rp4t9E%2FmpYBBTvgRgpsIjJHGBEhfHYW3Zf9UetSz6O7U8bv7yrwf2I1dpQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c31a9f90b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53ad6bfb-91d6-4204-960a-49f84cc18db2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.3 kB (8296 bytes)
Hash
5129c5bd93215d4f092922326826223e
b6df7a2f09b0efd9342589ffde5621ca6f894285
07fb43e6e0e11d9cd4bcf5d51d248f0fb85d41e231042bc7ad6c1897b3e82556

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53ad6bfb-91d6-4204-960a-49f84cc18db2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8296
x-amzn-requestid: 5961f5cd-2288-44e2-9eb2-35c115cdd95f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frdKVGqWoAMF34A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dadbdb-609946154fa2e547084125e4;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 21:38:35 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: JFS3n1VPoHesu6OC4w3L5ygNtVOxAL2EyfIZG-S26x8m9GFKdJpHpA==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Feb 2023 22:00:22 GMT
age: 12066
etag: "b6df7a2f09b0efd9342589ffde5621ca6f894285"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/pubads_impl_2023010901.js.download

172.67.173.183

200 OK

391 kB

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/pubads_impl_2023010901.js.download
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65395)
Size
391 kB (391105 bytes)
Hash
c092ac6167fb0a739f9a8552ef37f048
2ec223d2a7be532e195c447c9095f8abcdca78c1
1029b050487059828b253f9da4693cbf8a28067c5f9bf0bbef108b3ff1b0ed7d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/pubads_impl_2023010901.js.download HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: application/octet-stream
content-length: 391105
last-modified: Wed, 18 Jan 2023 01:07:18 GMT
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KJ6vvWK5j%2Flz2a8UB7hr%2Fb1U8foHRAsjM5eiuNuS9%2FUyoRCaYsMQATXFrh2NqwDHd15UpV12Pu6BIUENHHsyPjeXS5l5cVlq2Avrq4T4puPDe0E8yt%2B1PvQKWzmeN9eo3Nww2w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c31a9f50b02-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
2dc2e297877f6332a114de88eeeaca61
cc91e58f3dd132b078223d21cd3177f0819e40e7
94f1191402d63bc2757d7ec854bc418dd6929b5aa9efb815d9bd35f8dab98fef

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
42d54c8c12a2f90c448a11bf42800e86
bb66d35435411c825bfcd0a091f33b7d1708191e
3b67d91fbb38e5c47b6ebff53da366b87af3a308e5c588775ac66a808761dbb1

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
2dc2e297877f6332a114de88eeeaca61
cc91e58f3dd132b078223d21cd3177f0819e40e7
94f1191402d63bc2757d7ec854bc418dd6929b5aa9efb815d9bd35f8dab98fef

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.gstatic.com/images/branding/product/1x/translate_24dp.png

142.250.74.35

200 OK

846 B

URL HTTP/2
www.gstatic.com/images/branding/product/1x/translate_24dp.png
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
846 B (846 bytes)
Hash
e9cd262114358f26b7608b56905185dc
6dbde0a96deaab2b529723ce26c62043cf9180ab
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

HTTP Headers

GET /images/branding/product/1x/translate_24dp.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 846
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 30 Jan 2023 12:53:47 GMT
expires: Tue, 30 Jan 2024 12:53:47 GMT
cache-control: public, max-age=31536000
age: 217662
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

securepubads.g.doubleclick.net/gpt/pubads_impl_2023011001.js

142.250.74.130

200 OK

132 kB

URL HTTP/2
securepubads.g.doubleclick.net/gpt/pubads_impl_2023011001.js
IP
142.250.74.130:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (65395)
Size
132 kB (132153 bytes)
Hash
a344447109340139f738ff26bd250622
14186d9b2e48a5862e966c70b7455c7d61c64f32
8aa4051a878ef7def2931388765116c1ef5a2380e58ba69164b44ddf281a12d8

HTTP Headers

GET /gpt/pubads_impl_2023011001.js HTTP/1.1
Host: securepubads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 132153
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 01 Feb 2023 23:21:57 GMT
expires: Thu, 01 Feb 2024 23:21:57 GMT
cache-control: public, immutable, max-age=31536000
age: 7172
last-modified: Tue, 10 Jan 2023 09:35:18 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

securepubads.g.doubleclick.net/tag/js/gpt.js

142.250.74.130

200 OK

28 kB

URL HTTP/2
securepubads.g.doubleclick.net/tag/js/gpt.js
IP
142.250.74.130:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (39375)
Size
28 kB (27562 bytes)
Hash
25c56ed8bb84a01d9935f0cad43085f2
52b8c4ce64902a164b4e12525415e72e454abc47
7636c5dd5777baebccfeb67d4cbc2b39a880b59ff06514f46e9a10ebd4f0a572

HTTP Headers

GET /tag/js/gpt.js HTTP/1.1
Host: securepubads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 27562
date: Thu, 02 Feb 2023 01:21:29 GMT
expires: Thu, 02 Feb 2023 01:21:29 GMT
cache-control: private, max-age=900, stale-while-revalidate=3600
etag: "1470 / 354 of 1000 / last-modified: 1675292972"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
42d54c8c12a2f90c448a11bf42800e86
bb66d35435411c825bfcd0a091f33b7d1708191e
3b67d91fbb38e5c47b6ebff53da366b87af3a308e5c588775ac66a808761dbb1

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
2dc2e297877f6332a114de88eeeaca61
cc91e58f3dd132b078223d21cd3177f0819e40e7
94f1191402d63bc2757d7ec854bc418dd6929b5aa9efb815d9bd35f8dab98fef

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 02 Feb 2023 01:21:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

c.amazon-adsystem.com/aax2/apstag.js

54.230.111.210

200 OK

0 B

URL HTTP/2
c.amazon-adsystem.com/aax2/apstag.js
IP
54.230.111.210:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /aax2/apstag.js HTTP/1.1
Host: c.amazon-adsystem.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: application/javascript
date: Thu, 02 Feb 2023 00:36:30 GMT
last-modified: Wed, 01 Feb 2023 21:25:54 GMT
etag: W/"ca579f2de02c4700bc4fa6f925ed06a1"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=3600
server: AmazonS3
content-encoding: gzip
via: 1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront), 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA60-P1, OSL50-P1
x-amz-cf-id: vY6iXV9aY5pxjc8wR-57p09qUa-1d3b3UOui--zMA4VYUBSwh5_hdw==
age: 2698
X-Firefox-Spdy: h2

www.iolam.it/js/prebid.js

213.209.30.161

200 OK

0 B

URL HTTP/2
www.iolam.it/js/prebid.js
IP
213.209.30.161:0
ASN
#8660 Italiaonline S.p.A.

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /js/prebid.js HTTP/1.1
Host: www.iolam.it
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
server: Apache
strict-transport-security: max-age=63072000;
accept-ranges: bytes
expires: Thu, 02 Feb 2023 19:33:30 GMT
vary: Accept-Encoding
cache-control: max-age=86400
x-original-content-length: 399619
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/style.css

172.67.173.183

200 OK

0 B

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/style.css
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/style.css HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: text/css
cache-control: public, max-age=604800
expires: Thu, 09 Feb 2023 01:21:27 GMT
last-modified: Wed, 18 Jan 2023 01:07:16 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QC1NVEcQcci8sNp50rDuXET4xoB67iZtcpyyFI%2FMrIoYjctB2%2B1Nlp1PI%2BIdwXku4SQ7ecJSgGZV%2F9qXuz1grtp8ahMlGeweCf391XQQSJDxbcAH4hOSKnTAo08dknb05mbMUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c3199e80b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/logo.svg

172.67.173.183

200 OK

0 B

URL HTTP/2
www.homepagina.to/log-1/Libero%20Mail%20-%20login_files/logo.svg
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /log-1/Libero%20Mail%20-%20login_files/logo.svg HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.homepagina.to/log-1/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: image/svg+xml
cache-control: public, max-age=604800
expires: Thu, 09 Feb 2023 01:21:27 GMT
last-modified: Wed, 18 Jan 2023 01:07:18 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LcaBOy1H1dfFqyCKBBok2GsM1sMkCxqlwnDJ0Wi9vSDZ0ntvjrjmPuTHccFl0p71radkGqLFinVunjqZEABgixRV1PC%2B0yCjkEH%2By%2BUr9RXRzK7NzJBFVFvkwWl1ygKVAZXuwA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c320a1a0b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.homepagina.to/log-1/

172.67.173.183

200 OK

0 B

URL HTTP/2
www.homepagina.to/log-1/
IP
172.67.173.183:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
openphish	Libero
fortinet	Phishing

HTTP Headers

GET /log-1/ HTTP/1.1
Host: www.homepagina.to
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
date: Thu, 02 Feb 2023 01:21:27 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.2.34
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S3FcSrGpGiXRifBC6MW5crykQPLsnt7cl%2F4mg1FzkEPfoMk97fejeAvrFkRkIdHVdCCEqtUUsFvq6OWY%2B280mtp2%2FP%2Ft70iBC5rMBhO8YmDKRuB9vdu4TQm5Cu40xlqFL%2Fsoeg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 792f1c2e084a0b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (8)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML