Report - spgroup.live/dms-content/plugins/beefiness/aquotization

Report Overview

Submitted URL
spgroup.live/dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j
IP
65.108.9.247
ASN
#24940 Hetzner Online GmbH
Submitted
2023-02-04 10:46:16
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
16

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
befjajh.hornydats.com	unknown	2022-07-17T02:15:12Z	2023-02-25T20:40:11Z	14 kB	70 kB	178.162.199.80
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	54.149.213.50
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	55 kB	34.120.237.76
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
localandhorny.com	unknown	2022-08-29T14:04:22Z	2023-02-04T11:46:16Z	1.0 kB	1.9 kB	46.161.40.116
spgroup.live	unknown	2018-10-28T18:12:46Z	2023-01-30T16:19:52Z	934 B	871 B	65.108.9.247
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3.4 kB	8.9 kB	95.101.11.115

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-04	medium	localandhorny.com/horny1/index.html	Phishing
2023-02-04	medium	localandhorny.com/horny1/obfuscated_redirect.js	Phishing
2023-02-04	medium	befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn	Phishing
2023-02-04	medium	befjajh.hornydats.com/bundle/421/assets/js/functions.js	Phishing
2023-02-04	medium	befjajh.hornydats.com/js/click.js?9	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-02-04	medium	localandhorny.com	Sinkholed
2023-02-04	medium	localandhorny.com	Sinkholed
2023-02-04	medium	localandhorny.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	localandhorny.com/horny1/obfuscated_redirect.js	1.3 kB	2023-03-07	2023-03-17
Pretty URL localandhorny.com/horny1/obfuscated_redirect.js IP 46.161.40.116 ASN #209272 Alviva Holding Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:05:52 Last Seen2023-03-17 11:41:50 Times Seen1 Hash c149792602301d278ac82d855782f45b 285c0f6b89b93c9419f1a68934642d5d7fe83508 6ce38803e4ba2f371634ff438803376ae989e6165a465bb0ebf680c00d3e0b85 Loading...

	befjajh.hornydats.com/bundle/421/assets/js/functions.js	4.4 kB	2023-03-07	2023-03-13
Pretty URL befjajh.hornydats.com/bundle/421/assets/js/functions.js IP 178.162.199.80 ASN #28753 Leaseweb Deutschland GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 14:57:42 Last Seen2023-03-13 23:21:15 Times Seen1 Hash 50e622c17f69346789f2131341566018 17b1ce8d0c8692a647241548fc9f57209f8ee4ae 547a987cc5b52ca3724168abeb650ac6ebd3bb9378a8c31e3d54b66fdf9c6aff Loading...

	befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn	800 B	2023-03-07	2023-07-04
Pretty URL befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn IP 178.162.199.80 ASN #28753 Leaseweb Deutschland GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:14:35 Last Seen2023-07-04 23:44:10 Times Seen218 Hash 95d0345d30a683b55552f88523905902 5c3b20ccc0817febdb27ee12d273c2021e4ba04c 06f49d481b230265f1c45b6e00bbe0a21181c79b2ceefee8b54202fa2ffc6055 Loading...

	befjajh.hornydats.com/s/62cf1c2230951	111 B	2023-03-13	2023-03-13
Pretty URL befjajh.hornydats.com/s/62cf1c2230951 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 16:40:29 Last Seen2023-03-13 16:40:29 Times Seen1 Hash eea823773311330026d84f6183a3efa9 dc4fad8a937ce03236a76c5b57c4ce61a2dd2bbe bcb0a3a7c4099045b84bed745bff4fed9a15fc73278884f4fe6f35a5c4682e34 Loading...

	befjajh.hornydats.com/js/click.js?9	5.3 kB	2023-03-08	2023-03-13
Pretty URL befjajh.hornydats.com/js/click.js?9 IP 178.162.199.80 ASN #28753 Leaseweb Deutschland GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 05:59:12 Last Seen2023-03-13 16:40:29 Times Seen1 Hash 8207d083c909c6386927c5197eff584c a5f1148a0e9923191d3f8ed4c1750240374af2a9 f71ae9723255b00dcc8e3631fe419cbbb56a80b3034f184ca5292127d7b3eea9 Loading...

HTTP Transactions (33)

URL IP Response Size

spgroup.live/dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j

65.108.9.247

301 Moved Permanently

162 B

URL HTTP/1.1
spgroup.live/dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j
IP
65.108.9.247:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
162 B (162 bytes)
Hash
4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

HTTP Headers

GET /dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j HTTP/1.1
Host: spgroup.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 04 Feb 2023 10:46:05 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://spgroup.live/dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1cdc095521e9ee2606059be447d1fdd5
02b5d0a5b5823e2338daf7e144700babe2a213af
8bda3aabcf331c2bfcc4c7023cd797c760fd301dc353641bb95048e072f66c66

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8BDA3AABCF331C2BFCC4C7023CD797C760FD301DC353641BB95048E072F66C66"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20663
Expires: Sat, 04 Feb 2023 16:30:28 GMT
Date: Sat, 04 Feb 2023 10:46:05 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e051e6e01b12b9ad6e0014603f93431a
ada9efe77054d8593f2687fb3a7eada8908ef7e8
c41be8ffe176ca674efb0588164fdfd237754c6b5b461f8f46387b96ae7d6090

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C41BE8FFE176CA674EFB0588164FDFD237754C6B5B461F8F46387B96AE7D6090"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2998
Expires: Sat, 04 Feb 2023 11:36:03 GMT
Date: Sat, 04 Feb 2023 10:46:05 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Retry-After, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 04 Feb 2023 10:43:37 GMT
content-type: application/json
age: 148
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
fb7b6b46e708ad73eaaa3c21e74569ae
950663c025acad81556af5aa3022ecc9d55097fe
763f58b9fb838378c92033b59907b036f4c33081f5103d9bcc2ca2a8de500d64

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "763F58B9FB838378C92033B59907B036F4C33081F5103D9BCC2CA2A8DE500D64"
Last-Modified: Sat, 04 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12090
Expires: Sat, 04 Feb 2023 14:07:35 GMT
Date: Sat, 04 Feb 2023 10:46:05 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: +ZXZ8UkSozkefTGNqxdB3etScbKZmKcBBCUrjOL79oVKQCaMIOQ8oRkQepZ0rykD3El38rXQfiA=
x-amz-request-id: 6P1HVP5MBTBTCT41
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 04 Feb 2023 09:52:47 GMT
age: 3198
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 10:46:05 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a4b74f94e21598a79ecad76f99231f76
53102932a6cffc6dc4b1a12106f4419a84b07670
679eb063299b9d3bcef20c077688c950231ede9c2f7f9def9fa9a5de6f1dbf36

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "679EB063299B9D3BCEF20C077688C950231EDE9C2F7F9DEF9FA9A5DE6F1DBF36"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21562
Expires: Sat, 04 Feb 2023 16:45:27 GMT
Date: Sat, 04 Feb 2023 10:46:05 GMT
Connection: keep-alive

spgroup.live/dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j

65.108.9.247

200 OK

114 B

URL HTTP/1.1
spgroup.live/dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j
IP
65.108.9.247:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document, ASCII text
Size
114 B (114 bytes)
Hash
f4a47be584a2427db1f69b3859278ab8
c08ffb476ff3ead72137fefada4d29b6c2032687
e235d10a7f88d01cb7189e5307aa54db098811dfaa5392b4b219ac1691fb7eb0

HTTP Headers

GET /dms-content/plugins/beefiness/aquotization_multiloquious.html?nye=vyvq7h6j HTTP/1.1
Host: spgroup.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 Feb 2023 10:46:05 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 114
Last-Modified: Sat, 30 Jul 2022 09:21:35 GMT
Connection: keep-alive
ETag: "62e4f81f-72"
Expires: Sat, 04 Feb 2023 10:46:04 GMT
Cache-Control: no-cache
X-UA-Compatible: IE=Edge
Accept-Ranges: bytes

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Content-Type, ETag, Last-Modified, Alert, Retry-After, Content-Length, Cache-Control, Pragma, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 04 Feb 2023 09:49:07 GMT
age: 3418
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

localandhorny.com/horny1/index.html

46.161.40.116

200 OK

114 B

URL HTTP/1.1
localandhorny.com/horny1/index.html
IP
46.161.40.116:0
ASN
#209272 Alviva Holding Limited

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
114 B (114 bytes)
Hash
a8bcb92cad83595aea92d5cce3846750
39b701b14d8214a7580e35ab600160ea75dfb663
ad38224be64f82bbf803ff6bb43db294414e9a67b3a13ff3587a286f7de6fd6f

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /horny1/index.html HTTP/1.1
Host: localandhorny.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 10:46:05 GMT
Server: Apache/2
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 26 May 2021 18:12:52 GMT
ETag: "7c-5c33f97483100-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 114
Keep-Alive: timeout=2, max=100
Content-Type: text/html

localandhorny.com/horny1/obfuscated_redirect.js

46.161.40.116

200 OK

644 B

URL HTTP/1.1
localandhorny.com/horny1/obfuscated_redirect.js
IP
46.161.40.116:0
ASN
#209272 Alviva Holding Limited

File type
ASCII text, with very long lines (1250), with no line terminators
Size
644 B (644 bytes)
Hash
da225d03a0de80ca99e030b13725cd3a
42c2e181305910246b40930b45e37a292a289967
977170fc12183ae333a116e60b81605cac5f95019ce25349545102042454bb80

Detections

Analyzer	Verdict	Alert
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /horny1/obfuscated_redirect.js HTTP/1.1
Host: localandhorny.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://localandhorny.com/horny1/index.html

HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 10:46:06 GMT
Server: Apache/2
Last-Modified: Thu, 01 Sep 2022 09:49:00 GMT
ETag: "4e2-5e79a85d71b00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 644
Keep-Alive: timeout=2, max=99
Connection: Keep-Alive
Content-Type: application/javascript

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
dedf9c519ac38c4bece9c5bc895787d7
4911175c3f8a435978c5301c33c7a99a5e00a1d5
bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BDDD7E3A4939F863642A7C5348C1C8B9BC569B35C10A27F4CF5EC71F7E6B9698"
Last-Modified: Fri, 03 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14326
Expires: Sat, 04 Feb 2023 14:44:52 GMT
Date: Sat, 04 Feb 2023 10:46:06 GMT
Connection: keep-alive

localandhorny.com/favicon.ico

46.161.40.116

404 Not Found

201 B

URL HTTP/1.1
localandhorny.com/favicon.ico
IP
46.161.40.116:0
ASN
#209272 Alviva Holding Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
201 B (201 bytes)
Hash
11d8570e6f09cefc0a417c0e2d307ce9
9361b5994ac08dc41537a92b9cbdd68be4c717b8
687ee7e61c6d9dfe78632f5ec94dd5868a45deccb30438cec172c33a023bf7bc

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: localandhorny.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://localandhorny.com/horny1/index.html

HTTP/1.1 404 Not Found
Date: Sat, 04 Feb 2023 10:46:06 GMT
Server: Apache/2
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 201
Keep-Alive: timeout=2, max=98
Connection: Keep-Alive
Content-Type: text/html

push.services.mozilla.com/

54.149.213.50

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.149.213.50:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: IxJBTlczqYfhjFnMQjDUEA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: lbOtuTGmbfy0n6hTdOmEg7WRGTQ=

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1b25bf82638deaab60981e1315ee0849
e3bd912fd1a890e64ee6746a78a674db7ff77039
a99b0dfa9ca7176b21cc2d65963a1b6eb6d534b3767d02ef06cc207a63331ebf

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A99B0DFA9CA7176B21CC2D65963A1B6EB6D534B3767D02EF06CC207A63331EBF"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15118
Expires: Sat, 04 Feb 2023 14:58:05 GMT
Date: Sat, 04 Feb 2023 10:46:07 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1b25bf82638deaab60981e1315ee0849
e3bd912fd1a890e64ee6746a78a674db7ff77039
a99b0dfa9ca7176b21cc2d65963a1b6eb6d534b3767d02ef06cc207a63331ebf

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A99B0DFA9CA7176B21CC2D65963A1B6EB6D534B3767D02EF06CC207A63331EBF"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15118
Expires: Sat, 04 Feb 2023 14:58:05 GMT
Date: Sat, 04 Feb 2023 10:46:07 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1b25bf82638deaab60981e1315ee0849
e3bd912fd1a890e64ee6746a78a674db7ff77039
a99b0dfa9ca7176b21cc2d65963a1b6eb6d534b3767d02ef06cc207a63331ebf

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A99B0DFA9CA7176B21CC2D65963A1B6EB6D534B3767D02EF06CC207A63331EBF"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15118
Expires: Sat, 04 Feb 2023 14:58:05 GMT
Date: Sat, 04 Feb 2023 10:46:07 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1b25bf82638deaab60981e1315ee0849
e3bd912fd1a890e64ee6746a78a674db7ff77039
a99b0dfa9ca7176b21cc2d65963a1b6eb6d534b3767d02ef06cc207a63331ebf

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A99B0DFA9CA7176B21CC2D65963A1B6EB6D534B3767D02EF06CC207A63331EBF"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15118
Expires: Sat, 04 Feb 2023 14:58:05 GMT
Date: Sat, 04 Feb 2023 10:46:07 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a6c7026-85a2-4419-bd6b-ba1bac463dda.jpeg

34.120.237.76

200 OK

8.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a6c7026-85a2-4419-bd6b-ba1bac463dda.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.5 kB (8527 bytes)
Hash
6661b7263315f5eb3cd2465f671e1fcd
b7b5831c6b3ccc41d7a980b6088adc10ff8785f1
eb25507950d81db4b54a1af7fadaceee1bcff780eb28b6a04dbfb3886785f5b7

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3a6c7026-85a2-4419-bd6b-ba1bac463dda.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8527
x-amzn-requestid: f95a2821-ae89-4ea9-93b2-43e570285df3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyEC3FyboAMFe0A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8078-7e2177f11d5715d4092cad2c;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:45:28 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: dcFgY5x3Ef0J__7wGn3llTjZ9as5nX1H4HErIT3VlKfeQaQTjymW2g==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:10:33 GMT
etag: "b7b5831c6b3ccc41d7a980b6088adc10ff8785f1"
content-type: image/jpeg
age: 45334
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64144d1c-f524-496f-8b52-ba63714dbfc5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11565 bytes)
Hash
e366b32074025aaf60bbae8bdb08d330
a52c2883bad98fa20333aa639a5dd3a5bf544c8e
9d661c26effaec9efee16833f6459d6ecbe4f77b822c9c46e2a6433bda816e5c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64144d1c-f524-496f-8b52-ba63714dbfc5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11565
x-amzn-requestid: 87a84ffd-1176-4656-aac4-e98f38ec2cd9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fboIrFGboAMFyyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d48704-162ed8114aa1809204500548;Sampled=0
x-amzn-remapped-date: Sat, 28 Jan 2023 02:23:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: lsQxPtozrh2Ty1T-3d-1crDfi8HgVKRafOXb1UFl033bCx3kAzTS7w==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 21:48:04 GMT
age: 46683
etag: "a52c2883bad98fa20333aa639a5dd3a5bf544c8e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c030376-7935-4601-969c-86a91f4f5e85.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.2 kB (7249 bytes)
Hash
d7afd5ce8fb9ec7b62e528bf97705e49
afbf22f5d8f54adcb00e8980a9b22f2c5b6703c3
b2d93ba6c0ed2c858d91afba1c81251afbffa41c779be2e9203994dcfb7bbc9d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c030376-7935-4601-969c-86a91f4f5e85.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7249
x-amzn-requestid: 007ce521-ed5c-4074-a314-684ad0df2e22
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyD9GH5goAMF_ag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8053-7060f02b767c90371991a190;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:44:51 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 5fTV_e56nzjiXo4Guu67WXDDvp3nrjB0Yfyy6ByjcDSx23J-8r0fmQ==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:10:21 GMT
age: 45346
etag: "afbf22f5d8f54adcb00e8980a9b22f2c5b6703c3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe387e59d-188b-44a0-b94c-033d7d635117.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.7 kB (6718 bytes)
Hash
45c6a062f8637e689819f505b019dc0e
61665688f1039c4fad848853a68e28d057718ad1
c9b14113eba535a2e1a6cbbf121a818ad0204fc6dd7b2ea9b592830ab927d6d1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe387e59d-188b-44a0-b94c-033d7d635117.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6718
x-amzn-requestid: 662f889b-4c25-4dec-85d4-ea9dfa8b8974
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyD7DE5boAMF_cA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8046-33ca99fc7b6eac8d5486d6c1;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:44:38 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: WvNs1hPPXHBJs5rTIBqH3DbqLLX6si9jHF46KrsuT9BFB2N2V3zeUA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:06:20 GMT
age: 45587
etag: "61665688f1039c4fad848853a68e28d057718ad1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F650fe1e4-0f8a-4306-9cff-2ad3248d13b1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.9 kB (3868 bytes)
Hash
77e225775154732b55c206faa6fce355
126bdaa18d9a1650b5e3a4e883d89188e8bbf136
af7fb0e6cfe7082af183bd2ba5ef43ab3ef3f9e6df2761ed4534bd48aa078798

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F650fe1e4-0f8a-4306-9cff-2ad3248d13b1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3868
x-amzn-requestid: f130379c-2ea2-43d6-a1b0-e3afd4811bc3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyEwLFYgIAMFzwg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd819a-3d0199ab38a410ff7a78a675;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:50:18 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QrCYar2bxFJ_7bBH-5oJ4qdaS58NXDwNJxLI7ILxrBkzvzGV95PSFw==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:30:36 GMT
etag: "126bdaa18d9a1650b5e3a4e883d89188e8bbf136"
content-type: image/jpeg
age: 44131
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F10640252-429d-4110-bf18-1908ac233402.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10253 bytes)
Hash
392b61306c346508d3ac4a2f28218f9c
d2de32b52e0d3f4fc6acaf687b3521294b01dc03
018712a4d6734b84ac1777124f97dae4d93b1e5b297a5dcfe0955b52710b8a35

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F10640252-429d-4110-bf18-1908ac233402.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10253
x-amzn-requestid: a90cb6b3-8a72-4b4b-b4f5-6dafc8c6752a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyD7GGv5IAMFu8A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8046-3ca59e7c52800a4e44bda8fd;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:44:38 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: G8F3Fflod6HB4QFtjpD09xzi-2LKPw_DBJT0PKYKU3bs3pvOwO_LRw==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:10:32 GMT
age: 45335
etag: "d2de32b52e0d3f4fc6acaf687b3521294b01dc03"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2fef7e9126dc6cc4c6a2f2bef481bf08
00f151af944ca5ac65ea6209042313dee6be5047
3f0b3d4c86b0dbb94bff31e6262eda6161a9b76f2712fa1aaab685a696bf4fa8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3F0B3D4C86B0DBB94BFF31E6262EDA6161A9B76F2712FA1AAAB685A696BF4FA8"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6125
Expires: Sat, 04 Feb 2023 12:28:14 GMT
Date: Sat, 04 Feb 2023 10:46:09 GMT
Connection: keep-alive

befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn

178.162.199.80

200 OK

2.2 kB

URL HTTP/1.1
befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn
IP
178.162.199.80:0
ASN
#28753 Leaseweb Deutschland GmbH

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text
Size
2.2 kB (2249 bytes)
Hash
8ab19be7417a956121a9dec4f8fef934
2d01bdd646c3e5932fb687899cb8643169c9c3f1
5237ded3ae2e1094001180e7ba776816e558581f48b2a259e9ac8295af73d46f

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /s/62cf1c2230951?track=locandhorn HTTP/1.1
Host: befjajh.hornydats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://localandhorny.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: openresty/1.19.3.1
Date: Sat, 04 Feb 2023 10:46:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: s=BsDB9SdphrHuHE%2BbdzqYmiFUeE7%2FYbJ9ZJRrLsU2GBDgzUpDSPtkDvKiX9pfKw9yPIFNQfTPzn4YRnninBFaAyB%2BNvgRH6NV%2FTdQXjIa1ZpDf5aqTExfs4jdO90Cczva7KUnIXmRS%2F50XFY3%2B0rEApsno0knQYf1Dy4H%2FUJeEqrGgi%2FpeW7QVJC3zgaf0qc4VTq9VigcryP8lQYxo5Olc28gysVBwNgE1AGsFeB2SDRjFOjRb0RHTrdl%2Bmt4cs8cOZl8kNX2e5EQ1ja%2BEwjHUdI6AqtaWfC72zstItesyC0z1RBI1%2FIojn8%2BOrh9Nuo4Nu5X4DGTDkw5QBmoMFUwIyjOTI0YShzsB6a9taFPnlQyob98KD6zQaOZAaeDiwUY5lzoR%2BXmAYUlZLCjvvB6TF7bRiVn7Jv%2FCqwWDizYgRUol40ngZa2rcWgUw1yb2%2FzfLZxjNi5%2FXmh2%2FCw5Mqt3xs0hgpiFxGkEZJJ8S55Ab8ZRYupLYT0anojcQyUtMxGyKJvVpyGGFdLMaqFPhe2PmtAS%2FzWsRi3hGNKr9MmtjKrmVtSBDUS8bXVEz%2BOKfXVwjtqy%2BBVSBFrLLaY8Nz2sBpikDxFjChiboHber3LKa6eATLtjjOWQvDgga1umYjcY89oxMS8m77zoQTLMSQnb9LCE3MPI8936vJzUFqaeWCYe6L%2Bb%2FQ0lG83JBCgIzgJha4EAhqgMNZbyZ4YQUt18Beb4KtUhHnVPUcQT3X1EfSSdiuTXfnHd0e%2B3cymL6R2CFB%2B1bkkZWpkjWEzXVgOrRp9l7gy%2Fewy4i14zH92VaRgudpuYkjrogIqh5k1p6%2BEOc5Zhkoox4ZdYMo%2F2%2Fw0XlrbUBIDiyKwhCuE%2B%2BhSM9zxFg5Ap6rozL1WU15T6MV5LexR5OK7iSYZKmrSF3V1PIl55hCXdgZ2%2FPHBUjB6JwGnd2u66ZMvc25xxfQp8nQjfHEQauk5Bfg%2BTWgaaA1iIWRH%2FK4wSdsYxpRFF1cm9eSdFfFqjoSuuBYMfurwqkTPOc8A2VDJad9LDDL54ixvcDtC7ReVxJZNz%2FLEoOM%2BC1FeR1S%2F6Q47ShsJTzh4wLez0RoRRWbAJvS1b%2FdZ5uNRFj2qC2IpBwVIfxoAsNA6XUAbX90lLkRtN2QuGCFtf8SpWsv6nxgJ0%2FDw9jkSp9CRIM22YzOc4bWnDa0kpjx9tsOqs5tTQl9qqi91dAhHXkN28orbxiej%2BphAqGr1wQ%2FqJoqucuWt91Tc7v068nT5%2FlI5mYpeje2YTpcCbyd45UzoQDW%2BfOybNjSeFBvVjr1rpmh3Dfe4EPmxhYrL3rxaM8xRpy7rYHe0OczVbxt5WNUtVBfIfL60W4lINw%2F77DQTJlZvkzUEceVUj%2B0d40gxJhRJ1HArPoMo3DjcPvJa6nxu8JKyUYa%2FaJ9QzT1EeTTvnWD7Hvlkkv18FjPetfTjcnhy%2BEwyBx%2FTAYOlIoeRXj0YNW6mEBzZzntddLtpMpoIICPsqsIim9%2FaYMjTY9DU6ePF4EA7wm%2BJMDVkdLIYA%2FhVDKziOxTkDbVZ7RL3lZM%2FdZrRdmMNM6dzri940%2FYV0wSDXBKGrukFIxSyxSuc41UX236iWznd%2FBKNt3r5iECYONOQ; expires=Sun, 05-Feb-2023 10:46:09 GMT; Max-Age=86400; path=/; domain=hornydats.com
SID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=hornydats.com
ESID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=hornydats.com
Content-Encoding: gzip

befjajh.hornydats.com/bundle/421/assets/css/style.css

178.162.199.80

200 OK

24 kB

URL HTTP/1.1
befjajh.hornydats.com/bundle/421/assets/css/style.css
IP
178.162.199.80:0
ASN
#28753 Leaseweb Deutschland GmbH

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
24 kB (23836 bytes)
Hash
bdaeaf388c0a108edd5373536bedff4c
9f02aa8224b84a0338fd1e7ff99d1760745257ee
da6221de3931704d9dda90bf91597fcdab5c79375c5dfa3cf098d1ad366c236a

HTTP Headers

GET /bundle/421/assets/css/style.css HTTP/1.1
Host: befjajh.hornydats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn
Cookie: s=BsDB9SdphrHuHE%2BbdzqYmiFUeE7%2FYbJ9ZJRrLsU2GBDgzUpDSPtkDvKiX9pfKw9yPIFNQfTPzn4YRnninBFaAyB%2BNvgRH6NV%2FTdQXjIa1ZpDf5aqTExfs4jdO90Cczva7KUnIXmRS%2F50XFY3%2B0rEApsno0knQYf1Dy4H%2FUJeEqrGgi%2FpeW7QVJC3zgaf0qc4VTq9VigcryP8lQYxo5Olc28gysVBwNgE1AGsFeB2SDRjFOjRb0RHTrdl%2Bmt4cs8cOZl8kNX2e5EQ1ja%2BEwjHUdI6AqtaWfC72zstItesyC0z1RBI1%2FIojn8%2BOrh9Nuo4Nu5X4DGTDkw5QBmoMFUwIyjOTI0YShzsB6a9taFPnlQyob98KD6zQaOZAaeDiwUY5lzoR%2BXmAYUlZLCjvvB6TF7bRiVn7Jv%2FCqwWDizYgRUol40ngZa2rcWgUw1yb2%2FzfLZxjNi5%2FXmh2%2FCw5Mqt3xs0hgpiFxGkEZJJ8S55Ab8ZRYupLYT0anojcQyUtMxGyKJvVpyGGFdLMaqFPhe2PmtAS%2FzWsRi3hGNKr9MmtjKrmVtSBDUS8bXVEz%2BOKfXVwjtqy%2BBVSBFrLLaY8Nz2sBpikDxFjChiboHber3LKa6eATLtjjOWQvDgga1umYjcY89oxMS8m77zoQTLMSQnb9LCE3MPI8936vJzUFqaeWCYe6L%2Bb%2FQ0lG83JBCgIzgJha4EAhqgMNZbyZ4YQUt18Beb4KtUhHnVPUcQT3X1EfSSdiuTXfnHd0e%2B3cymL6R2CFB%2B1bkkZWpkjWEzXVgOrRp9l7gy%2Fewy4i14zH92VaRgudpuYkjrogIqh5k1p6%2BEOc5Zhkoox4ZdYMo%2F2%2Fw0XlrbUBIDiyKwhCuE%2B%2BhSM9zxFg5Ap6rozL1WU15T6MV5LexR5OK7iSYZKmrSF3V1PIl55hCXdgZ2%2FPHBUjB6JwGnd2u66ZMvc25xxfQp8nQjfHEQauk5Bfg%2BTWgaaA1iIWRH%2FK4wSdsYxpRFF1cm9eSdFfFqjoSuuBYMfurwqkTPOc8A2VDJad9LDDL54ixvcDtC7ReVxJZNz%2FLEoOM%2BC1FeR1S%2F6Q47ShsJTzh4wLez0RoRRWbAJvS1b%2FdZ5uNRFj2qC2IpBwVIfxoAsNA6XUAbX90lLkRtN2QuGCFtf8SpWsv6nxgJ0%2FDw9jkSp9CRIM22YzOc4bWnDa0kpjx9tsOqs5tTQl9qqi91dAhHXkN28orbxiej%2BphAqGr1wQ%2FqJoqucuWt91Tc7v068nT5%2FlI5mYpeje2YTpcCbyd45UzoQDW%2BfOybNjSeFBvVjr1rpmh3Dfe4EPmxhYrL3rxaM8xRpy7rYHe0OczVbxt5WNUtVBfIfL60W4lINw%2F77DQTJlZvkzUEceVUj%2B0d40gxJhRJ1HArPoMo3DjcPvJa6nxu8JKyUYa%2FaJ9QzT1EeTTvnWD7Hvlkkv18FjPetfTjcnhy%2BEwyBx%2FTAYOlIoeRXj0YNW6mEBzZzntddLtpMpoIICPsqsIim9%2FaYMjTY9DU6ePF4EA7wm%2BJMDVkdLIYA%2FhVDKziOxTkDbVZ7RL3lZM%2FdZrRdmMNM6dzri940%2FYV0wSDXBKGrukFIxSyxSuc41UX236iWznd%2FBKNt3r5iECYONOQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: openresty/1.19.3.1
Date: Sat, 04 Feb 2023 10:46:10 GMT
Content-Type: text/css
Content-Length: 23836
Connection: keep-alive
Last-Modified: Fri, 27 Nov 2020 19:43:18 GMT
Vary: Accept-Encoding
ETag: "5fc156d6-5d1c"
Accept-Ranges: bytes

befjajh.hornydats.com/bundle/421/assets/img/loadingbar.gif

178.162.199.80

200 OK

5.8 kB

URL HTTP/1.1
befjajh.hornydats.com/bundle/421/assets/img/loadingbar.gif
IP
178.162.199.80:0
ASN
#28753 Leaseweb Deutschland GmbH

File type
GIF image data, version 89a, 208 x 13\012- data
Size
5.8 kB (5837 bytes)
Hash
e7476fddd806e1ad72356ec86ae2a35a
162d8b87e6d1c3ef0ed5839ffd54cf5ac0c23e54
dfa0ad12a293332f47c0c0b7c4d7681d3670915a2f75f086aaf61b9a2835b24a

HTTP Headers

GET /bundle/421/assets/img/loadingbar.gif HTTP/1.1
Host: befjajh.hornydats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn
Cookie: s=BsDB9SdphrHuHE%2BbdzqYmiFUeE7%2FYbJ9ZJRrLsU2GBDgzUpDSPtkDvKiX9pfKw9yPIFNQfTPzn4YRnninBFaAyB%2BNvgRH6NV%2FTdQXjIa1ZpDf5aqTExfs4jdO90Cczva7KUnIXmRS%2F50XFY3%2B0rEApsno0knQYf1Dy4H%2FUJeEqrGgi%2FpeW7QVJC3zgaf0qc4VTq9VigcryP8lQYxo5Olc28gysVBwNgE1AGsFeB2SDRjFOjRb0RHTrdl%2Bmt4cs8cOZl8kNX2e5EQ1ja%2BEwjHUdI6AqtaWfC72zstItesyC0z1RBI1%2FIojn8%2BOrh9Nuo4Nu5X4DGTDkw5QBmoMFUwIyjOTI0YShzsB6a9taFPnlQyob98KD6zQaOZAaeDiwUY5lzoR%2BXmAYUlZLCjvvB6TF7bRiVn7Jv%2FCqwWDizYgRUol40ngZa2rcWgUw1yb2%2FzfLZxjNi5%2FXmh2%2FCw5Mqt3xs0hgpiFxGkEZJJ8S55Ab8ZRYupLYT0anojcQyUtMxGyKJvVpyGGFdLMaqFPhe2PmtAS%2FzWsRi3hGNKr9MmtjKrmVtSBDUS8bXVEz%2BOKfXVwjtqy%2BBVSBFrLLaY8Nz2sBpikDxFjChiboHber3LKa6eATLtjjOWQvDgga1umYjcY89oxMS8m77zoQTLMSQnb9LCE3MPI8936vJzUFqaeWCYe6L%2Bb%2FQ0lG83JBCgIzgJha4EAhqgMNZbyZ4YQUt18Beb4KtUhHnVPUcQT3X1EfSSdiuTXfnHd0e%2B3cymL6R2CFB%2B1bkkZWpkjWEzXVgOrRp9l7gy%2Fewy4i14zH92VaRgudpuYkjrogIqh5k1p6%2BEOc5Zhkoox4ZdYMo%2F2%2Fw0XlrbUBIDiyKwhCuE%2B%2BhSM9zxFg5Ap6rozL1WU15T6MV5LexR5OK7iSYZKmrSF3V1PIl55hCXdgZ2%2FPHBUjB6JwGnd2u66ZMvc25xxfQp8nQjfHEQauk5Bfg%2BTWgaaA1iIWRH%2FK4wSdsYxpRFF1cm9eSdFfFqjoSuuBYMfurwqkTPOc8A2VDJad9LDDL54ixvcDtC7ReVxJZNz%2FLEoOM%2BC1FeR1S%2F6Q47ShsJTzh4wLez0RoRRWbAJvS1b%2FdZ5uNRFj2qC2IpBwVIfxoAsNA6XUAbX90lLkRtN2QuGCFtf8SpWsv6nxgJ0%2FDw9jkSp9CRIM22YzOc4bWnDa0kpjx9tsOqs5tTQl9qqi91dAhHXkN28orbxiej%2BphAqGr1wQ%2FqJoqucuWt91Tc7v068nT5%2FlI5mYpeje2YTpcCbyd45UzoQDW%2BfOybNjSeFBvVjr1rpmh3Dfe4EPmxhYrL3rxaM8xRpy7rYHe0OczVbxt5WNUtVBfIfL60W4lINw%2F77DQTJlZvkzUEceVUj%2B0d40gxJhRJ1HArPoMo3DjcPvJa6nxu8JKyUYa%2FaJ9QzT1EeTTvnWD7Hvlkkv18FjPetfTjcnhy%2BEwyBx%2FTAYOlIoeRXj0YNW6mEBzZzntddLtpMpoIICPsqsIim9%2FaYMjTY9DU6ePF4EA7wm%2BJMDVkdLIYA%2FhVDKziOxTkDbVZ7RL3lZM%2FdZrRdmMNM6dzri940%2FYV0wSDXBKGrukFIxSyxSuc41UX236iWznd%2FBKNt3r5iECYONOQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: openresty/1.19.3.1
Date: Sat, 04 Feb 2023 10:46:10 GMT
Content-Type: image/gif
Content-Length: 5837
Connection: keep-alive
Last-Modified: Fri, 27 Nov 2020 19:43:18 GMT
ETag: "5fc156d6-16cd"
Accept-Ranges: bytes

befjajh.hornydats.com/bundle/421/assets/js/functions.js

178.162.199.80

200 OK

4.4 kB

URL HTTP/1.1
befjajh.hornydats.com/bundle/421/assets/js/functions.js
IP
178.162.199.80:0
ASN
#28753 Leaseweb Deutschland GmbH

File type
ASCII text, with CRLF line terminators
Size
4.4 kB (4390 bytes)
Hash
50e622c17f69346789f2131341566018
17b1ce8d0c8692a647241548fc9f57209f8ee4ae
547a987cc5b52ca3724168abeb650ac6ebd3bb9378a8c31e3d54b66fdf9c6aff

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /bundle/421/assets/js/functions.js HTTP/1.1
Host: befjajh.hornydats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn
Cookie: s=BsDB9SdphrHuHE%2BbdzqYmiFUeE7%2FYbJ9ZJRrLsU2GBDgzUpDSPtkDvKiX9pfKw9yPIFNQfTPzn4YRnninBFaAyB%2BNvgRH6NV%2FTdQXjIa1ZpDf5aqTExfs4jdO90Cczva7KUnIXmRS%2F50XFY3%2B0rEApsno0knQYf1Dy4H%2FUJeEqrGgi%2FpeW7QVJC3zgaf0qc4VTq9VigcryP8lQYxo5Olc28gysVBwNgE1AGsFeB2SDRjFOjRb0RHTrdl%2Bmt4cs8cOZl8kNX2e5EQ1ja%2BEwjHUdI6AqtaWfC72zstItesyC0z1RBI1%2FIojn8%2BOrh9Nuo4Nu5X4DGTDkw5QBmoMFUwIyjOTI0YShzsB6a9taFPnlQyob98KD6zQaOZAaeDiwUY5lzoR%2BXmAYUlZLCjvvB6TF7bRiVn7Jv%2FCqwWDizYgRUol40ngZa2rcWgUw1yb2%2FzfLZxjNi5%2FXmh2%2FCw5Mqt3xs0hgpiFxGkEZJJ8S55Ab8ZRYupLYT0anojcQyUtMxGyKJvVpyGGFdLMaqFPhe2PmtAS%2FzWsRi3hGNKr9MmtjKrmVtSBDUS8bXVEz%2BOKfXVwjtqy%2BBVSBFrLLaY8Nz2sBpikDxFjChiboHber3LKa6eATLtjjOWQvDgga1umYjcY89oxMS8m77zoQTLMSQnb9LCE3MPI8936vJzUFqaeWCYe6L%2Bb%2FQ0lG83JBCgIzgJha4EAhqgMNZbyZ4YQUt18Beb4KtUhHnVPUcQT3X1EfSSdiuTXfnHd0e%2B3cymL6R2CFB%2B1bkkZWpkjWEzXVgOrRp9l7gy%2Fewy4i14zH92VaRgudpuYkjrogIqh5k1p6%2BEOc5Zhkoox4ZdYMo%2F2%2Fw0XlrbUBIDiyKwhCuE%2B%2BhSM9zxFg5Ap6rozL1WU15T6MV5LexR5OK7iSYZKmrSF3V1PIl55hCXdgZ2%2FPHBUjB6JwGnd2u66ZMvc25xxfQp8nQjfHEQauk5Bfg%2BTWgaaA1iIWRH%2FK4wSdsYxpRFF1cm9eSdFfFqjoSuuBYMfurwqkTPOc8A2VDJad9LDDL54ixvcDtC7ReVxJZNz%2FLEoOM%2BC1FeR1S%2F6Q47ShsJTzh4wLez0RoRRWbAJvS1b%2FdZ5uNRFj2qC2IpBwVIfxoAsNA6XUAbX90lLkRtN2QuGCFtf8SpWsv6nxgJ0%2FDw9jkSp9CRIM22YzOc4bWnDa0kpjx9tsOqs5tTQl9qqi91dAhHXkN28orbxiej%2BphAqGr1wQ%2FqJoqucuWt91Tc7v068nT5%2FlI5mYpeje2YTpcCbyd45UzoQDW%2BfOybNjSeFBvVjr1rpmh3Dfe4EPmxhYrL3rxaM8xRpy7rYHe0OczVbxt5WNUtVBfIfL60W4lINw%2F77DQTJlZvkzUEceVUj%2B0d40gxJhRJ1HArPoMo3DjcPvJa6nxu8JKyUYa%2FaJ9QzT1EeTTvnWD7Hvlkkv18FjPetfTjcnhy%2BEwyBx%2FTAYOlIoeRXj0YNW6mEBzZzntddLtpMpoIICPsqsIim9%2FaYMjTY9DU6ePF4EA7wm%2BJMDVkdLIYA%2FhVDKziOxTkDbVZ7RL3lZM%2FdZrRdmMNM6dzri940%2FYV0wSDXBKGrukFIxSyxSuc41UX236iWznd%2FBKNt3r5iECYONOQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: openresty/1.19.3.1
Date: Sat, 04 Feb 2023 10:46:10 GMT
Content-Type: application/javascript
Content-Length: 4390
Connection: keep-alive
Last-Modified: Fri, 27 Nov 2020 19:43:18 GMT
Vary: Accept-Encoding
ETag: "5fc156d6-1126"
Accept-Ranges: bytes

befjajh.hornydats.com/js/click.js?9

178.162.199.80

200 OK

5.3 kB

URL HTTP/1.1
befjajh.hornydats.com/js/click.js?9
IP
178.162.199.80:0
ASN
#28753 Leaseweb Deutschland GmbH

File type
ASCII text
Size
5.3 kB (5260 bytes)
Hash
8207d083c909c6386927c5197eff584c
a5f1148a0e9923191d3f8ed4c1750240374af2a9
f71ae9723255b00dcc8e3631fe419cbbb56a80b3034f184ca5292127d7b3eea9

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /js/click.js?9 HTTP/1.1
Host: befjajh.hornydats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn
Cookie: s=BsDB9SdphrHuHE%2BbdzqYmiFUeE7%2FYbJ9ZJRrLsU2GBDgzUpDSPtkDvKiX9pfKw9yPIFNQfTPzn4YRnninBFaAyB%2BNvgRH6NV%2FTdQXjIa1ZpDf5aqTExfs4jdO90Cczva7KUnIXmRS%2F50XFY3%2B0rEApsno0knQYf1Dy4H%2FUJeEqrGgi%2FpeW7QVJC3zgaf0qc4VTq9VigcryP8lQYxo5Olc28gysVBwNgE1AGsFeB2SDRjFOjRb0RHTrdl%2Bmt4cs8cOZl8kNX2e5EQ1ja%2BEwjHUdI6AqtaWfC72zstItesyC0z1RBI1%2FIojn8%2BOrh9Nuo4Nu5X4DGTDkw5QBmoMFUwIyjOTI0YShzsB6a9taFPnlQyob98KD6zQaOZAaeDiwUY5lzoR%2BXmAYUlZLCjvvB6TF7bRiVn7Jv%2FCqwWDizYgRUol40ngZa2rcWgUw1yb2%2FzfLZxjNi5%2FXmh2%2FCw5Mqt3xs0hgpiFxGkEZJJ8S55Ab8ZRYupLYT0anojcQyUtMxGyKJvVpyGGFdLMaqFPhe2PmtAS%2FzWsRi3hGNKr9MmtjKrmVtSBDUS8bXVEz%2BOKfXVwjtqy%2BBVSBFrLLaY8Nz2sBpikDxFjChiboHber3LKa6eATLtjjOWQvDgga1umYjcY89oxMS8m77zoQTLMSQnb9LCE3MPI8936vJzUFqaeWCYe6L%2Bb%2FQ0lG83JBCgIzgJha4EAhqgMNZbyZ4YQUt18Beb4KtUhHnVPUcQT3X1EfSSdiuTXfnHd0e%2B3cymL6R2CFB%2B1bkkZWpkjWEzXVgOrRp9l7gy%2Fewy4i14zH92VaRgudpuYkjrogIqh5k1p6%2BEOc5Zhkoox4ZdYMo%2F2%2Fw0XlrbUBIDiyKwhCuE%2B%2BhSM9zxFg5Ap6rozL1WU15T6MV5LexR5OK7iSYZKmrSF3V1PIl55hCXdgZ2%2FPHBUjB6JwGnd2u66ZMvc25xxfQp8nQjfHEQauk5Bfg%2BTWgaaA1iIWRH%2FK4wSdsYxpRFF1cm9eSdFfFqjoSuuBYMfurwqkTPOc8A2VDJad9LDDL54ixvcDtC7ReVxJZNz%2FLEoOM%2BC1FeR1S%2F6Q47ShsJTzh4wLez0RoRRWbAJvS1b%2FdZ5uNRFj2qC2IpBwVIfxoAsNA6XUAbX90lLkRtN2QuGCFtf8SpWsv6nxgJ0%2FDw9jkSp9CRIM22YzOc4bWnDa0kpjx9tsOqs5tTQl9qqi91dAhHXkN28orbxiej%2BphAqGr1wQ%2FqJoqucuWt91Tc7v068nT5%2FlI5mYpeje2YTpcCbyd45UzoQDW%2BfOybNjSeFBvVjr1rpmh3Dfe4EPmxhYrL3rxaM8xRpy7rYHe0OczVbxt5WNUtVBfIfL60W4lINw%2F77DQTJlZvkzUEceVUj%2B0d40gxJhRJ1HArPoMo3DjcPvJa6nxu8JKyUYa%2FaJ9QzT1EeTTvnWD7Hvlkkv18FjPetfTjcnhy%2BEwyBx%2FTAYOlIoeRXj0YNW6mEBzZzntddLtpMpoIICPsqsIim9%2FaYMjTY9DU6ePF4EA7wm%2BJMDVkdLIYA%2FhVDKziOxTkDbVZ7RL3lZM%2FdZrRdmMNM6dzri940%2FYV0wSDXBKGrukFIxSyxSuc41UX236iWznd%2FBKNt3r5iECYONOQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: openresty/1.19.3.1
Date: Sat, 04 Feb 2023 10:46:10 GMT
Content-Type: application/javascript
Content-Length: 5260
Connection: keep-alive
Last-Modified: Thu, 02 Feb 2023 12:43:52 GMT
Vary: Accept-Encoding
ETag: "63dbb008-148c"
Accept-Ranges: bytes

befjajh.hornydats.com/bundle/421/assets/img/6.jpg

178.162.199.80

200 OK

18 kB

URL HTTP/1.1
befjajh.hornydats.com/bundle/421/assets/img/6.jpg
IP
178.162.199.80:0
ASN
#28753 Leaseweb Deutschland GmbH

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 420x540, components 3\012- data
Size
18 kB (17976 bytes)
Hash
55ee671833c579f2e004eb8377a1db86
ac1753f935fb775de6498375c63849310c66d239
5d05fc51e308b468e5440135b300d9a7bd2bebb1760b33e795311d92de07ee23

HTTP Headers

GET /bundle/421/assets/img/6.jpg HTTP/1.1
Host: befjajh.hornydats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn
Cookie: s=BsDB9SdphrHuHE%2BbdzqYmiFUeE7%2FYbJ9ZJRrLsU2GBDgzUpDSPtkDvKiX9pfKw9yPIFNQfTPzn4YRnninBFaAyB%2BNvgRH6NV%2FTdQXjIa1ZpDf5aqTExfs4jdO90Cczva7KUnIXmRS%2F50XFY3%2B0rEApsno0knQYf1Dy4H%2FUJeEqrGgi%2FpeW7QVJC3zgaf0qc4VTq9VigcryP8lQYxo5Olc28gysVBwNgE1AGsFeB2SDRjFOjRb0RHTrdl%2Bmt4cs8cOZl8kNX2e5EQ1ja%2BEwjHUdI6AqtaWfC72zstItesyC0z1RBI1%2FIojn8%2BOrh9Nuo4Nu5X4DGTDkw5QBmoMFUwIyjOTI0YShzsB6a9taFPnlQyob98KD6zQaOZAaeDiwUY5lzoR%2BXmAYUlZLCjvvB6TF7bRiVn7Jv%2FCqwWDizYgRUol40ngZa2rcWgUw1yb2%2FzfLZxjNi5%2FXmh2%2FCw5Mqt3xs0hgpiFxGkEZJJ8S55Ab8ZRYupLYT0anojcQyUtMxGyKJvVpyGGFdLMaqFPhe2PmtAS%2FzWsRi3hGNKr9MmtjKrmVtSBDUS8bXVEz%2BOKfXVwjtqy%2BBVSBFrLLaY8Nz2sBpikDxFjChiboHber3LKa6eATLtjjOWQvDgga1umYjcY89oxMS8m77zoQTLMSQnb9LCE3MPI8936vJzUFqaeWCYe6L%2Bb%2FQ0lG83JBCgIzgJha4EAhqgMNZbyZ4YQUt18Beb4KtUhHnVPUcQT3X1EfSSdiuTXfnHd0e%2B3cymL6R2CFB%2B1bkkZWpkjWEzXVgOrRp9l7gy%2Fewy4i14zH92VaRgudpuYkjrogIqh5k1p6%2BEOc5Zhkoox4ZdYMo%2F2%2Fw0XlrbUBIDiyKwhCuE%2B%2BhSM9zxFg5Ap6rozL1WU15T6MV5LexR5OK7iSYZKmrSF3V1PIl55hCXdgZ2%2FPHBUjB6JwGnd2u66ZMvc25xxfQp8nQjfHEQauk5Bfg%2BTWgaaA1iIWRH%2FK4wSdsYxpRFF1cm9eSdFfFqjoSuuBYMfurwqkTPOc8A2VDJad9LDDL54ixvcDtC7ReVxJZNz%2FLEoOM%2BC1FeR1S%2F6Q47ShsJTzh4wLez0RoRRWbAJvS1b%2FdZ5uNRFj2qC2IpBwVIfxoAsNA6XUAbX90lLkRtN2QuGCFtf8SpWsv6nxgJ0%2FDw9jkSp9CRIM22YzOc4bWnDa0kpjx9tsOqs5tTQl9qqi91dAhHXkN28orbxiej%2BphAqGr1wQ%2FqJoqucuWt91Tc7v068nT5%2FlI5mYpeje2YTpcCbyd45UzoQDW%2BfOybNjSeFBvVjr1rpmh3Dfe4EPmxhYrL3rxaM8xRpy7rYHe0OczVbxt5WNUtVBfIfL60W4lINw%2F77DQTJlZvkzUEceVUj%2B0d40gxJhRJ1HArPoMo3DjcPvJa6nxu8JKyUYa%2FaJ9QzT1EeTTvnWD7Hvlkkv18FjPetfTjcnhy%2BEwyBx%2FTAYOlIoeRXj0YNW6mEBzZzntddLtpMpoIICPsqsIim9%2FaYMjTY9DU6ePF4EA7wm%2BJMDVkdLIYA%2FhVDKziOxTkDbVZ7RL3lZM%2FdZrRdmMNM6dzri940%2FYV0wSDXBKGrukFIxSyxSuc41UX236iWznd%2FBKNt3r5iECYONOQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: openresty/1.19.3.1
Date: Sat, 04 Feb 2023 10:46:10 GMT
Content-Type: image/jpeg
Content-Length: 17976
Connection: keep-alive
Last-Modified: Fri, 27 Nov 2020 19:43:18 GMT
ETag: "5fc156d6-4638"
Accept-Ranges: bytes

befjajh.hornydats.com/bundle/421/assets/img/favicon.png

178.162.199.80

200 OK

6.2 kB

URL HTTP/1.1
befjajh.hornydats.com/bundle/421/assets/img/favicon.png
IP
178.162.199.80:0
ASN
#28753 Leaseweb Deutschland GmbH

File type
PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced\012- data
Size
6.2 kB (6152 bytes)
Hash
024b79c399646cd754c99e8d4b0a5e87
e42de65ba384b1db6bfcc56bcedbb2b80df229e4
014a887229b9cd82de1090f8f53a6860c00a468269f31e1f5f15dd88cc5c3284

HTTP Headers

GET /bundle/421/assets/img/favicon.png HTTP/1.1
Host: befjajh.hornydats.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://befjajh.hornydats.com/s/62cf1c2230951?track=locandhorn
Cookie: s=BsDB9SdphrHuHE%2BbdzqYmiFUeE7%2FYbJ9ZJRrLsU2GBDgzUpDSPtkDvKiX9pfKw9yPIFNQfTPzn4YRnninBFaAyB%2BNvgRH6NV%2FTdQXjIa1ZpDf5aqTExfs4jdO90Cczva7KUnIXmRS%2F50XFY3%2B0rEApsno0knQYf1Dy4H%2FUJeEqrGgi%2FpeW7QVJC3zgaf0qc4VTq9VigcryP8lQYxo5Olc28gysVBwNgE1AGsFeB2SDRjFOjRb0RHTrdl%2Bmt4cs8cOZl8kNX2e5EQ1ja%2BEwjHUdI6AqtaWfC72zstItesyC0z1RBI1%2FIojn8%2BOrh9Nuo4Nu5X4DGTDkw5QBmoMFUwIyjOTI0YShzsB6a9taFPnlQyob98KD6zQaOZAaeDiwUY5lzoR%2BXmAYUlZLCjvvB6TF7bRiVn7Jv%2FCqwWDizYgRUol40ngZa2rcWgUw1yb2%2FzfLZxjNi5%2FXmh2%2FCw5Mqt3xs0hgpiFxGkEZJJ8S55Ab8ZRYupLYT0anojcQyUtMxGyKJvVpyGGFdLMaqFPhe2PmtAS%2FzWsRi3hGNKr9MmtjKrmVtSBDUS8bXVEz%2BOKfXVwjtqy%2BBVSBFrLLaY8Nz2sBpikDxFjChiboHber3LKa6eATLtjjOWQvDgga1umYjcY89oxMS8m77zoQTLMSQnb9LCE3MPI8936vJzUFqaeWCYe6L%2Bb%2FQ0lG83JBCgIzgJha4EAhqgMNZbyZ4YQUt18Beb4KtUhHnVPUcQT3X1EfSSdiuTXfnHd0e%2B3cymL6R2CFB%2B1bkkZWpkjWEzXVgOrRp9l7gy%2Fewy4i14zH92VaRgudpuYkjrogIqh5k1p6%2BEOc5Zhkoox4ZdYMo%2F2%2Fw0XlrbUBIDiyKwhCuE%2B%2BhSM9zxFg5Ap6rozL1WU15T6MV5LexR5OK7iSYZKmrSF3V1PIl55hCXdgZ2%2FPHBUjB6JwGnd2u66ZMvc25xxfQp8nQjfHEQauk5Bfg%2BTWgaaA1iIWRH%2FK4wSdsYxpRFF1cm9eSdFfFqjoSuuBYMfurwqkTPOc8A2VDJad9LDDL54ixvcDtC7ReVxJZNz%2FLEoOM%2BC1FeR1S%2F6Q47ShsJTzh4wLez0RoRRWbAJvS1b%2FdZ5uNRFj2qC2IpBwVIfxoAsNA6XUAbX90lLkRtN2QuGCFtf8SpWsv6nxgJ0%2FDw9jkSp9CRIM22YzOc4bWnDa0kpjx9tsOqs5tTQl9qqi91dAhHXkN28orbxiej%2BphAqGr1wQ%2FqJoqucuWt91Tc7v068nT5%2FlI5mYpeje2YTpcCbyd45UzoQDW%2BfOybNjSeFBvVjr1rpmh3Dfe4EPmxhYrL3rxaM8xRpy7rYHe0OczVbxt5WNUtVBfIfL60W4lINw%2F77DQTJlZvkzUEceVUj%2B0d40gxJhRJ1HArPoMo3DjcPvJa6nxu8JKyUYa%2FaJ9QzT1EeTTvnWD7Hvlkkv18FjPetfTjcnhy%2BEwyBx%2FTAYOlIoeRXj0YNW6mEBzZzntddLtpMpoIICPsqsIim9%2FaYMjTY9DU6ePF4EA7wm%2BJMDVkdLIYA%2FhVDKziOxTkDbVZ7RL3lZM%2FdZrRdmMNM6dzri940%2FYV0wSDXBKGrukFIxSyxSuc41UX236iWznd%2FBKNt3r5iECYONOQ
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: openresty/1.19.3.1
Date: Sat, 04 Feb 2023 10:46:10 GMT
Content-Type: image/png
Content-Length: 6152
Connection: keep-alive
Last-Modified: Fri, 27 Nov 2020 19:43:18 GMT
ETag: "5fc156d6-1808"
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (33)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type