Overview

URLwebbhaarti.in/mailer/posten/manage/
IP 192.185.129.233 (United States)
ASN#46606 UNIFIEDLAYER-AS-1
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2022-12-03 21:32:35 UTC
StatusLoading report..
IDS alerts0
Blocklist alert13
urlquery alerts
37
Phishing - Posten Norge
Tags None

Domain Summary (43)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 54.186.209.73
acdn.adnxs.com (1) 573 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 281 3727 23.38.200.189
z.moatads.com (1) 374 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 387 1412 23.38.201.146
www.googletagmanager.com (7) 75 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2252 124953 142.250.74.40
in.taskanalytics.com (21) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 6300 6132 108.128.72.146
translate.googleapis.com (1) 1005 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 412 4566 216.58.211.10
adservice.google.com (1) 76 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 783 968 142.250.74.66
ocsp.digicert.com (5) 86 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1705 3805 93.184.220.29
adservice.google.no (1) 96969 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 776 1064 142.250.74.130
vars.hotjar.com (1) 1014 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 563 788 65.9.44.23
posten.boost.ai (1) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 370 868 54.170.32.124
8260928.fls.doubleclick.net (5) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3503 5172 142.250.74.38
siteimproveanalytics.com (1) 3559 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 301 14006 188.114.97.1
encrypted-tbn0.gstatic.com (1) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 451 7165 142.250.74.78
www.gstatic.com (2) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 840 4303 142.250.74.35
ib.adnxs.com (3) 241 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1638 1029 37.252.172.123
px.ads.linkedin.com (1) 522 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 490 824 13.107.42.14
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5844 34.160.144.191
ocsp.globalsign.com (1) 2075 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 368 1920 104.18.20.226
img-getpocket.cdn.mozilla.net (6) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3246 42557 34.120.237.76
static.ads-twitter.com (2) 614 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 671 16259 151.101.244.157
connect.facebook.net (3) 139 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1060 2792 157.240.240.1
webbhaarti.in (17) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 6088 279457 192.185.129.233
www.googleadservices.com (1) 107 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 383 15958 142.250.74.130
www.google.com (1) 7 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 708 1285 142.250.74.132
www.google.no (1) 25607 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 720 874 142.250.74.163
fonts.googleapis.com (1) 8877 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 393 746 142.250.74.106
r3.o.lencr.org (6) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2028 5321 23.36.77.32
tienda.correos.es (1) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 386 1059 94.23.87.92
www.google-analytics.com (2) 40 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 746 22386 216.239.34.178
6015663.global.siteimproveanalytics.io (1) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 629 615 3.123.165.229
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2373 34.102.187.140
cdn.jsdelivr.net (2) 439 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 801 31123 151.101.65.229
b.scorecardresearch.com (1) 3959 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 284 2432 143.204.55.96
static.hotjar.com (1) 641 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 373 627 65.9.44.78
script.hotjar.com (1) 887 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 381 89481 143.204.55.68
googleads.g.doubleclick.net (1) 42 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 735 873 216.58.207.226
www.facebook.com (1) 99 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 349 31.13.72.36
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 229 34.117.237.239
ocsp.pki.goog (19) 175 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 6517 13297 142.250.74.131
cdn.mycomandia.com (7) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3094 23051 176.31.233.37
ocsp.sca1b.amazontrust.com (2) 1015 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 700 2005 54.230.96.27
snap.licdn.com (1) 1044 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 378 4887 23.36.76.210

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2022-12-03 medium webbhaarti.in/mailer/posten/manage/ Posten Norge

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-12-03 medium webbhaarti.in/mailer/posten/manage/ Phishing
2022-12-03 medium webbhaarti.in/mailer/posten/manage/file/1.txt Phishing
2022-12-03 medium webbhaarti.in/mailer/posten/manage/file/f.txt Phishing
2022-12-03 medium webbhaarti.in/mailer/posten/manage/file/1(1).txt Phishing
2022-12-03 medium webbhaarti.in/mailer/posten/manage/file/moatframe.js.t%C3%A9l%C3%A9chargement Phishing
2022-12-03 medium webbhaarti.in/_/asset/no.posten.website:1594301215/js/bundle.js Phishing
2022-12-03 medium webbhaarti.in/_/asset/no.posten.website:1594301215/js/chatbot.js Phishing
2022-12-03 medium webbhaarti.in/mailer/posten/manage/file/js Phishing
2022-12-03 medium webbhaarti.in/mailer/posten/manage/file/moatframe.js.t%C3%A9l%C3%A9chargement Phishing
2022-12-03 medium webbhaarti.in/mailer/posten/manage/file/moatframe.js.t%C3%A9l%C3%A9chargement Phishing
2022-12-03 medium webbhaarti.in/_/asset/no.posten.website:1594301215/js/bundle.js Phishing
2022-12-03 medium webbhaarti.in/_/asset/no.posten.website:1594301215/js/chatbot.js Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 4 reports on IP: 192.185.129.233
Date UQ / IDS / BL URL IP
2023-01-13 07:49:44 UTC 0 - 0 - 11 webbhaarti.in/mailer/posten/manage/ 192.185.129.233
2022-11-13 19:39:48 UTC 0 - 0 - 10 webbhaarti.in/mailer/posten/manage/ 192.185.129.233
2022-12-03 21:32:35 UTC 37 - 0 - 13 webbhaarti.in/mailer/posten/manage/ 192.185.129.233
2022-12-03 17:54:19 UTC 36 - 0 - 13 webbhaarti.in/mailer/posten/manage/ 192.185.129.233


Last 5 reports on ASN: UNIFIEDLAYER-AS-1
Date UQ / IDS / BL URL IP
2023-06-01 05:45:10 UTC 0 - 1 - 0 sanaskaintimates.com/~roo/htttp.www.paypal.co (...) 192.185.36.108
2023-06-01 05:32:08 UTC 0 - 0 - 9 192.185.180.229/~calmmed/Dun/xps/update=NWSC_ (...) 192.185.180.229
2023-06-01 05:32:03 UTC 0 - 0 - 9 192.185.180.229/~calmmed/Dun/xps/update=NWSC_ (...) 192.185.180.229
2023-06-01 05:27:55 UTC 0 - 0 - 9 192.185.180.229/~calmmed/Dun/xps/update=NWSC_ (...) 192.185.180.229
2023-06-01 05:26:07 UTC 0 - 0 - 9 192.185.180.229/~calmmed/Dun/xps/update=NWSC_ (...) 192.185.180.229


Last 4 reports on domain: webbhaarti.in
Date UQ / IDS / BL URL IP
2023-01-13 07:49:44 UTC 0 - 0 - 11 webbhaarti.in/mailer/posten/manage/ 192.185.129.233
2022-11-13 19:39:48 UTC 0 - 0 - 10 webbhaarti.in/mailer/posten/manage/ 192.185.129.233
2022-12-03 21:32:35 UTC 37 - 0 - 13 webbhaarti.in/mailer/posten/manage/ 192.185.129.233
2022-12-03 17:54:19 UTC 36 - 0 - 13 webbhaarti.in/mailer/posten/manage/ 192.185.129.233


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-02-17 13:58:39 UTC 23 - 0 - 12 www.demaflexsnc.it/public/posten/ 31.11.33.147
2023-02-17 13:55:00 UTC 36 - 0 - 13 www.lmlenzitrasporti.com/page1/rola/posten/ 89.46.110.68
2023-01-16 07:09:12 UTC 35 - 0 - 0 www.lmlenzitrasporti.com/page1/rola/posten/ 89.46.110.68
2022-12-28 18:08:20 UTC 31 - 0 - 11 www.lmlenzitrasporti.com/page1/rola/posten/ 89.46.110.68
2022-11-14 12:39:20 UTC 0 - 0 - 12 www.lmlenzitrasporti.com/page1/rola/posten/ 62.149.140.201

JavaScript

Executed Scripts (29)

Executed Evals (5)
#1 JavaScript::Eval (size: 87) - SHA256: 57417104a96d1a427e8d15e07d2d7ee0cf0cc28b9c5c4b6cc5b69d94b15d3175
(function() {
    var a = google_tag_manager["GTM-M83DX4"].macro(3).split("/");
    return a[1]
})();
#2 JavaScript::Eval (size: 38) - SHA256: 21e1463f2dbdf773d27eb5b59524062b4aedb68414d396e65bb440516cdeae44
(function() {
    return document.title
})();
#3 JavaScript::Eval (size: 873) - SHA256: ed04fe40f9d557c156a53678bc2ebda259efb1c1b4c42215b1cd57a590ab3db2
(function() {
    function k(c, b) {
        for (var a = 0; a < c.length; a++)
            if (c[a].toLowerCase().includes("*")) {
                if (b.toLowerCase().startsWith(c[a].toLowerCase().slice(0, -1))) return !0
            } else if (b.toLowerCase() == c[a].toLowerCase()) return !0
    }
    try {
        var l = "q type count _ga dclid gcl* ds_* utm_*".split(" "),
            e = [],
            f = [],
            h = [],
            a = google_tag_manager["GTM-M83DX4"].macro(2);
        String.prototype.startsWith || (String.prototype.startsWith = function(a, b) {
            return this.substr(!b || 0 > b ? 0 : +b, a.length) === a
        });
        String.prototype.includes || (String.prototype.includes = function(a,
            b) {
            "number" !== typeof b && (b = 0);
            return b + a.length > this.length ? !1 : -1 !== this.indexOf(a, b)
        });
        if (-1 < a.indexOf("?")) {
            a = a.split(/\?(.+)/, 2);
            e = a[1].split("\x26");
            for (var g = 0; g < e.length; g++) f = e[g].split("\x3d"), k(l, f[0]) && h.push(f.join("\x3d"));
            var d = a[0] + "?" + h.join("\x26");
            "?" === d.slice(-1) ? d = d.slice(0, -1) : d;
            return d
        }
        return a
    } catch (c) {
        console.error(c)
    }
})();
#4 JavaScript::Eval (size: 132) - SHA256: cefd82456250e4101fa38516ce1c37e1414218788d6106605297abce42788e69
(function() {
    var a = google_tag_manager["GTM-M83DX4"].macro(4).split("/");
    return "undefined" == a[3] || void 0 == a[3] ? a[2] : a[2] + "-" + a[3]
})();
#5 JavaScript::Eval (size: 873) - SHA256: afdb6c824fa50b49f1ad290a4c94fd53f39f598902460805804cc0c1775e6720
(function() {
    function k(c, b) {
        for (var a = 0; a < c.length; a++)
            if (c[a].toLowerCase().includes("*")) {
                if (b.toLowerCase().startsWith(c[a].toLowerCase().slice(0, -1))) return !0
            } else if (b.toLowerCase() == c[a].toLowerCase()) return !0
    }
    try {
        var l = "q type count _ga dclid gcl* ds_* utm_*".split(" "),
            e = [],
            f = [],
            h = [],
            a = google_tag_manager["GTM-M83DX4"].macro(5);
        String.prototype.startsWith || (String.prototype.startsWith = function(a, b) {
            return this.substr(!b || 0 > b ? 0 : +b, a.length) === a
        });
        String.prototype.includes || (String.prototype.includes = function(a,
            b) {
            "number" !== typeof b && (b = 0);
            return b + a.length > this.length ? !1 : -1 !== this.indexOf(a, b)
        });
        if (-1 < a.indexOf("?")) {
            a = a.split(/\?(.+)/, 2);
            e = a[1].split("\x26");
            for (var g = 0; g < e.length; g++) f = e[g].split("\x3d"), k(l, f[0]) && h.push(f.join("\x3d"));
            var d = a[0] + "?" + h.join("\x26");
            "?" === d.slice(-1) ? d = d.slice(0, -1) : d;
            return d
        }
        return a
    } catch (c) {
        console.error(c)
    }
})();

Executed Writes (0)


HTTP Transactions (137)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14462
Expires: Sun, 04 Dec 2022 01:33:26 GMT
Date: Sat, 03 Dec 2022 21:32:24 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 4227
Cache-Control: max-age=137355
Date: Sat, 03 Dec 2022 21:32:24 GMT
Etag: "638b2570-1d7"
Expires: Mon, 05 Dec 2022 11:41:39 GMT
Last-Modified: Sat, 03 Dec 2022 10:31:12 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 03 Dec 2022 21:20:00 GMT
cache-control: public,max-age=3600
age: 744
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2632
Expires: Sat, 03 Dec 2022 22:16:16 GMT
Date: Sat, 03 Dec 2022 21:32:24 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: 1mOrevUCHzwHbII6jVWZxvUiDSslq/JfKiewNFrrapOGtogvqPmD73UGDlRwxKGIcryEL7vYOrM=
x-amz-request-id: FENH9G9BE0XGHGCN
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 03 Dec 2022 20:46:42 GMT
age: 2742
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Sat, 03 Dec 2022 21:32:24 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /activityi;src=8260928;type=global;cat=postengl;ord=1922311046310;gtm=2wg621;auiddc=749134256.1623120281;u1=https%3A%2F%2Fwipahs.com%2Fapp%2FHttp%2Fposten%2Fmanage%2Findex.php;u2=app;u3=Http-posten;u4=rekkef%C3%B8lge%20Post-no;u5=;~oref=https%3A%2F%2Fwipahs.com%2Fapp%2FHttp%2Fposten%2Fmanage%2Findex.php? HTTP/1.1 
Host: 8260928.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/
Upgrade-Insecure-Requests: 1

                                        
                                             142.250.74.38
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:24 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Strict-Transport-Security: max-age=21600
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 414
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (608), with no line terminators
Size:   414
Md5:    415c77e688fc5d3f78964820de6e797d
Sha1:   0ee369806020b01a4f0030d126ea0669d0e549a1
Sha256: a7934ecd043ce8d241dacdf0f4a99672e45e377f5b7130d3638af59e5dea9991
                                        
                                            GET /js/siteanalyze_6015663.js HTTP/1.1 
Host: siteimproveanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             188.114.97.1
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Date: Sat, 03 Dec 2022 21:32:24 GMT
Content-Length: 13074
Connection: keep-alive
x-amz-id-2: 9/WdHECJok25ZZfVhRs98Sm5aurG1QvXNQ9jaiasWBCXoDm4Mn6Zx2c3y3n55lMz2s0tScL6mcE=
x-amz-request-id: R343DG4BXBB0RWV3
Cache-Control: max-age=86400, no-transform
Content-Encoding: gzip
Last-Modified: Fri, 11 Nov 2022 10:21:56 GMT
ETag: "8d34b09483a348aee12efa3ac53237d1"
CF-Cache-Status: HIT
Age: 3013
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hXPPt7pZqKzsL%2FPk35WRVqrtK8lH%2FujxeBqrJKFXblCxzjbKUjpnqKMtu1C6Vq1qac3DoghZxxAGTxcknJ%2F909wKR0ZSlgx9JoagF2rDTYwlE595ICXrfCNH3AnQOdmUbatPCab%2BvtSa%2FuY%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773f6a2f08c2b529-OSL
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (46126), with no line terminators
Size:   13074
Md5:    8d34b09483a348aee12efa3ac53237d1
Sha1:   7da6ecc2b915b04cffaa8cce4729f045b14928fa
Sha256: 3eaff7010e8f409a2c3eb1bb86608c66191110f22d6d9ae427fbae37c028db07
                                        
                                            GET /addthismoatframe568911941483/moatframe.js HTTP/1.1 
Host: z.moatads.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.38.201.146
HTTP/2 200 OK
content-type: application/x-javascript
                                            
x-amz-id-2: e0HboiVQpjIDEK8WTxqU5+8G8wOtu9bNCFY72alTHLP0/Yb+qoiTOxu6fad89ebRofzHxENxOOg=
x-amz-request-id: 61EC92F13BB22DD4
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
etag: "f14b4e1f799b14f798a195f43cf58376"
content-encoding: gzip
accept-ranges: bytes
content-length: 948
server: AmazonS3
vary: Accept-Encoding
cache-control: max-age=32840
date: Sat, 03 Dec 2022 21:32:24 GMT
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (523)
Size:   948
Md5:    f14b4e1f799b14f798a195f43cf58376
Sha1:   b6fd3b3d407fb4c0a00fb8a31862235e2a6e0a86
Sha256: 92ed3e9fda5fa4d738ff4d9023846b56633617363dda6a750cacb4fba53241ac
                                        
                                            GET /gtm.js?id=GTM-M83DX4 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             142.250.74.40
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                            
Location: https://www.googletagmanager.com/gtm.js?id=GTM-M83DX4
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:24 GMT
Server: Google Tag Manager
Content-Length: 250
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Size:   250
Md5:    1373afd5f63dc37d3b1e0cd4a9857230
Sha1:   c6f8ae3f09ce337c9e491f0946bdfe8eab86188a
Sha256: 989490b30a61855760b9f74412798e09385461c1f5f07e630d5fa943bc27a47e
                                        
                                            GET /00012/tm.js?r=&1623121013633 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1623121013638 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1623121013630 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595299259698 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /npm/@posten/hedwig@11/assets/fonts.css HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             151.101.65.229
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 11.9.5
x-jsd-version-type: version
etag: W/"855-mRW2/GJzwxRji+sy+ksrjfYsJnE"
content-encoding: gzip
accept-ranges: bytes
date: Sat, 03 Dec 2022 21:32:24 GMT
age: 986
x-served-by: cache-fra19167-FRA, cache-bma1621-BMA
x-cache: MISS, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 542
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   542
Md5:    b24719d55767c669113336d8c684644d
Sha1:   24067e2371e11e36586528918e5c7adb7356edb9
Sha256: ff84dceacce38a1a37e28e25757da04eec677c08070213f46fa0384c375ca2e7
                                        
                                            GET /00012/tm.js?r=&1623121014145 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595299259862 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /npm/@posten/hedwig@11/dist/posten.css HTTP/1.1 
Host: cdn.jsdelivr.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             151.101.65.229
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 11.9.5
x-jsd-version-type: version
etag: W/"35ae7-VIUJ2giFc9+RlRgcbyfbUh4mbO8"
content-encoding: gzip
accept-ranges: bytes
date: Sat, 03 Dec 2022 21:32:24 GMT
age: 36443
x-served-by: cache-fra-eddf8230074-FRA, cache-bma1621-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 29077
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (54670)
Size:   29077
Md5:    cab4a25d88a7f23bbe46846ffc169ace
Sha1:   d470188177492d7ce663c298301c852a9cfbde59
Sha256: 6971be30d85421291f18493ae6d84494f4fc9cd42d194aefd7197031f730cbe7
                                        
                                            GET /00012/tm.js?r=&1595293061723 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595293061872 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595299259690 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595285185398 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:24 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /translate_static/css/translateelement.css HTTP/1.1 
Host: translate.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             216.58.211.10
HTTP/2 200 OK
content-type: text/css
                                            
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="rosetta"
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-length: 3619
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 03 Dec 2022 20:54:50 GMT
expires: Sat, 03 Dec 2022 21:54:50 GMT
cache-control: public, max-age=3600
age: 2254
last-modified: Wed, 17 Aug 2022 23:38:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (18670)
Size:   3619
Md5:    897ba9a21d9625286674da769dacc2e2
Sha1:   84b4923ab7dee562395160824d53496314499b77
Sha256: 696cbf5c2f3f1efae555562b72abbbb22bed02eff03d62074555cab241190ae0
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.20.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "A1464742167E1ED61096BFAE0D673147DB3C0B55"
Expires: Sun, 04 Dec 2022 08:00:00 GMT
Last-Modified: Sat, 03 Dec 2022 20:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 2282
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773f6a30587fb50f-OSL


--- Additional Info ---
Magic:  data
Size:   1462
Md5:    ecde8efd07c5fa9cf674ba737a5ce915
Sha1:   21e4e4486cafc53267c7dab906b53ed0a5ffb359
Sha256: 49eaa6f870f9613da94ba83411eeca951162baba9cbe76ae852520ef921f62c6
                                        
                                            GET /gtag/js?id=DC-9852050&l=dataLayer&cx=c HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.40
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 03 Dec 2022 21:32:25 GMT
expires: Sat, 03 Dec 2022 21:32:25 GMT
cache-control: private, max-age=900
last-modified: Sat, 03 Dec 2022 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 44152
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1921)
Size:   44152
Md5:    f2df9ac07d2fea0965028184d095f673
Sha1:   e0f284b123d9a67da6869ac048f298c87da494b1
Sha256: 8e754948a30e382262546f55640fc7e6e02642908b14825a5adb0604cbc27912
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /css/common-dynamic.css HTTP/1.1 
Host: tienda.correos.es
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             94.23.87.92
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: server
Date: Sat, 03 Dec 2022 21:32:25 GMT
Transfer-Encoding: chunked
Backend: 1
Content-Encoding: gzip
X-IPLB-Request-ID: 5B5A2A9A:392D_5E17575C:01BB_638BC068_771C6:1251B
X-IPLB-Instance: 35326
Set-Cookie: SERVERID139651=c80001a3|Y4vAb|Y4vAb; path=/; HttpOnly
Cache-control: private


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   717
Md5:    45bca144e962bb998d9d807e54e521c3
Sha1:   63beb9c869ed56068010f501fde069d8e02164d7
Sha256: 31dda737e3779db2e9efd81ab860e724f61738acce5b10558cb6c56c76daf544

urlquery:
  - Phishing - Posten Norge
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /gtm.js?id=GTM-M83DX4 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://webbhaarti.in/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.40
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 03 Dec 2022 21:32:25 GMT
expires: Sat, 03 Dec 2022 21:32:25 GMT
cache-control: private, max-age=900
last-modified: Sat, 03 Dec 2022 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 76645
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (23428)
Size:   76645
Md5:    1acf5aa522c82ac96d6fa65fae948d84
Sha1:   59fb4e98b8b57bad3372d4df5cb979cce361183f
Sha256: 0595862df12d8c5e571ebcb7e4757a9597373824db415033377b7f6ea5679e7c
                                        
                                            GET /static/shop/common/fonts/flaticon/flaticon.css?v=2019.12.17 HTTP/1.1 
Host: cdn.mycomandia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             176.31.233.37
HTTP/2 200 OK
content-type: text/css
                                            
date: Sat, 03 Dec 2022 21:32:25 GMT
content-length: 1210
last-modified: Tue, 27 Aug 2019 11:07:48 GMT
etag: "5d650f04-4ba"
server: rebelio-n2
expires: Sun, 03 Dec 2023 21:32:25 GMT
cache-control: max-age=31536000
backend: 2
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   1210
Md5:    e8b5e4d5eb0df11eb339ba959520b978
Sha1:   24777a5efa576aec4026ff30bcf4fd6ecd81b003
Sha256: 2650ffdcb2bf4147d062825fee353bd86e80c1f1c22c0b29ea856fdd3213e0a3

urlquery:
  - Phishing - Posten Norge
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /ddm/fls/i/src=8260928;type=global;cat=postengl;ord=1922311046310;gtm=2wg621;auiddc=749134256.1623120281;u1=https%3A%2F%2Fwipahs.com%2Fapp%2FHttp%2Fposten%2Fmanage%2Findex.php;u2=app;u3=Http-posten;u4=rekkef%C3%B8lge%20Post-no;u5=;~oref=https%3A%2F%2Fwipahs.com%2Fapp%2FHttp%2Fposten%2Fmanage%2Findex.php HTTP/1.1 
Host: adservice.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://8260928.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.66
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:32:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 288
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (607), with no line terminators
Size:   288
Md5:    47d159eaf212360cf34c2d50c81f335b
Sha1:   29fe300eb3bea36a5027929a3b56b3dde7283131
Sha256: fc1ef109df28824692bc47445de99ca8a5638b11abc71e57a927d731f372ee6f
                                        
                                            GET /static/shop/common/css/validationEngine.jquery.css?v=2019.12.17 HTTP/1.1 
Host: cdn.mycomandia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             176.31.233.37
HTTP/2 200 OK
content-type: text/css
                                            
date: Sat, 03 Dec 2022 21:32:25 GMT
content-length: 3334
last-modified: Thu, 18 Oct 2018 11:43:12 GMT
etag: "5bc871d0-d06"
server: rebelio-n2
expires: Sun, 03 Dec 2023 21:32:25 GMT
cache-control: max-age=31536000
backend: 2
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   3334
Md5:    a8935f51f8ca663bf3a18d4b1da31bf7
Sha1:   6f2e6f9c21ced7020e6d8c73c2e8ad71d797aa9d
Sha256: cd363d0f8425d6b271c14ee5d6a8d693c3aa1323b64979b69c69d26661927303

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Retry-After, ETag, Alert, Expires, Cache-Control, Backoff, Content-Length, Content-Type, Pragma, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 03 Dec 2022 21:08:58 GMT
cache-control: public,max-age=3600
age: 1407
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /mailer/posten/manage/ HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             192.185.129.233
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:21 GMT
Server: nginx/1.21.6
Vary: Accept-Encoding
Content-Encoding: gzip
X-Server-Cache: true
X-Proxy-Cache: HIT
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (4648)
Size:   160629
Md5:    18171156880e697eaaf98eba01557ffd
Sha1:   89fedf76c123f80abd3f455d7814752fe488f252
Sha256: 83c9674583b556df71468ce958e6a8e543f30c8d5beec08572f71ba18768f8f4

Blocklists:
  - openphish: Posten Norge
  - fortinet: Phishing
                                        
                                            GET /mailer/posten/manage/file/new-style.css HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Date: Sat, 03 Dec 2022 21:32:24 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade
Last-Modified: Tue, 08 Jun 2021 00:17:24 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 14822


--- Additional Info ---
Magic:  ASCII text, with very long lines (306), with CRLF line terminators
Size:   14822
Md5:    287c4bbb5287abe233a7fb4a4f24296a
Sha1:   b7720982dc666a8224bb33edf9ce9192ad1f2eef
Sha256: 1572caeb735d363e28f22773782f1d95e6dcfe0078c1729b14638998adbf6dd9
                                        
                                            GET /mailer/posten/manage/file/1.txt HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 200 OK
Content-Type: text/plain
                                            
Date: Sat, 03 Dec 2022 21:32:21 GMT
Server: nginx/1.21.6
Content-Length: 198
Last-Modified: Tue, 08 Jun 2021 00:17:24 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Server-Cache: true
X-Proxy-Cache: HIT
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   198
Md5:    e8eb78614cd69ba5458449ee67661a79
Sha1:   415d4f5c96e7fd519a5c16343b16507bd0ddd9dc
Sha256: b3256232be85e192b3f6ad9276d3aa22c01e36fdcdf424cde262134bb60d8e24

urlquery:
  - Phishing - Posten Norge
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /mailer/posten/manage/file/f.txt HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 200 OK
Content-Type: text/plain
                                            
Date: Sat, 03 Dec 2022 21:32:21 GMT
Server: nginx/1.21.6
Content-Length: 13491
Last-Modified: Tue, 08 Jun 2021 00:17:24 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Server-Cache: true
X-Proxy-Cache: EXPIRED
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (1994)
Size:   13491
Md5:    f77547e2b905fde29b5afa1927834ea5
Sha1:   be66ea81ab3f729c3f7e87e15dda48abb9211535
Sha256: cd988a722db4feefd43b0ccea6b5fc744e94b4b804516e7bee3f5d5a850342e5

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /mailer/posten/manage/file/1(1).txt HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 200 OK
Content-Type: text/plain
                                            
Date: Sat, 03 Dec 2022 21:32:21 GMT
Server: nginx/1.21.6
Content-Length: 811
Last-Modified: Tue, 08 Jun 2021 00:17:24 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Server-Cache: true
X-Proxy-Cache: HIT
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (1529), with no line terminators
Size:   811
Md5:    ad5e42e75805f8b897d81d944f3d9a60
Sha1:   ccf3b1f6beb46d20f36b273981d19ff079045959
Sha256: ce14e4d5d04fb7b788ecbf0833b657262eb7e061378d7cd9ca9e766cc8efa2f5

Blocklists:
  - fortinet: Phishing
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /static/shop/common/bundle/font-awesome-5/web-fonts-with-css/css/fontawesome-all.min.css?v=2019.12.17 HTTP/1.1 
Host: cdn.mycomandia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             176.31.233.37
HTTP/2 200 OK
content-type: text/css
                                            
date: Sat, 03 Dec 2022 21:32:25 GMT
last-modified: Thu, 18 Oct 2018 11:43:16 GMT
vary: Accept-Encoding
etag: W/"5bc871d4-8ef7"
server: rebelio-n2
expires: Sun, 03 Dec 2023 21:32:25 GMT
cache-control: max-age=31536000
backend: 2
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   9688
Md5:    e190341190e0f10352ff749bda468c64
Sha1:   7e0c91e7018ff50c419ef482b20390feb17398b6
Sha256: 79a974b69f5e8bc7f9311787d8693853ada6c410d0b29f4020a5a811f6fe1c42
                                        
                                            GET /ddm/fls/i/src=8260928;type=global;cat=postengl;ord=1922311046310;gtm=2wg621;auiddc=749134256.1623120281;u1=https%3A%2F%2Fwipahs.com%2Fapp%2FHttp%2Fposten%2Fmanage%2Findex.php;u2=app;u3=Http-posten;u4=rekkef%C3%B8lge%20Post-no;u5=;~oref=https%3A%2F%2Fwipahs.com%2Fapp%2FHttp%2Fposten%2Fmanage%2Findex.php HTTP/1.1 
Host: adservice.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.130
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:32:25 GMT
expires: Sat, 03 Dec 2022 21:32:25 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 85
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with no line terminators
Size:   85
Md5:    4a3b3637744caa4a0b08fabbd76cc830
Sha1:   755e5626762ecf38f55012da892a227bf50f15f1
Sha256: 6a12009f3d99f10dd5acb27389beefed79eddd7fa55ddcc591baf92861d51bfb
                                        
                                            GET /static/logos/correos-paq-72-mini.png HTTP/1.1 
Host: cdn.mycomandia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             176.31.233.37
HTTP/2 200 OK
content-type: image/png
                                            
date: Sat, 03 Dec 2022 21:32:25 GMT
content-length: 2373
last-modified: Mon, 10 May 2021 14:53:58 GMT
etag: "60994906-945"
server: rebelio-n2
expires: Sun, 03 Dec 2023 21:32:25 GMT
cache-control: max-age=31536000
backend: 2
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 175 x 30, 8-bit/color RGBA, interlaced\012- data
Size:   2373
Md5:    ad8f5552abb3d774a9c23cf3b0c9272b
Sha1:   4fc71ddac34c0b7438effc6883956ba2149a6a0c
Sha256: 984461e2d55896f29bb79d75b8ab42c1f8c4111bd2fb0c5f03dbc50d1b24b894

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /static/logos/correos-paq72.png HTTP/1.1 
Host: cdn.mycomandia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             176.31.233.37
HTTP/2 200 OK
content-type: image/png
                                            
date: Sat, 03 Dec 2022 21:32:25 GMT
content-length: 1976
last-modified: Mon, 28 Dec 2020 12:06:56 GMT
etag: "5fe9ca60-7b8"
server: rebelio-n2
expires: Sun, 03 Dec 2023 21:32:25 GMT
cache-control: max-age=31536000
backend: 2
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 128 x 40, 8-bit/color RGBA, non-interlaced\012- data
Size:   1976
Md5:    567c7f32c85fe6ca5625f95403eb05e9
Sha1:   ef5da723f8b205d4f75bcb2b63b6e948fa25f330
Sha256: 5d2fb215dbbcbfd1bd663a0cdeaf31c63abde8c6f20aa63551733ebc498bf605

urlquery:
  - Phishing - Posten Norge
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /_/asset/no.posten.website:1594301215/css/postenstyle.css HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Apache
Content-Length: 0
Connection: close

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 4218
Cache-Control: max-age=132284
Date: Sat, 03 Dec 2022 21:32:25 GMT
Etag: "638b11ab-1d7"
Expires: Mon, 05 Dec 2022 10:17:09 GMT
Last-Modified: Sat, 03 Dec 2022 09:06:51 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /mailer/posten/manage/file/moatframe.js.t%C3%A9l%C3%A9chargement HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Apache
Content-Length: 0
Connection: close


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /_/asset/no.posten.website:1594301215/js/bundle.js HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Apache
Content-Length: 0
Connection: close


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /gtm.js?id=GTM-M83DX4 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             142.250.74.40
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                            
Location: https://www.googletagmanager.com/gtm.js?id=GTM-M83DX4
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Google Tag Manager
Content-Length: 250
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Size:   250
Md5:    1373afd5f63dc37d3b1e0cd4a9857230
Sha1:   c6f8ae3f09ce337c9e491f0946bdfe8eab86188a
Sha256: 989490b30a61855760b9f74412798e09385461c1f5f07e630d5fa943bc27a47e
                                        
                                            GET /_/asset/no.posten.website:1594301215/js/chatbot.js HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Apache
Content-Length: 0
Connection: close


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /00012/tm.js?r=&1595299259690 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:25 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595299259862 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:25 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595299259698 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:25 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             54.230.96.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=131109
Date: Sat, 03 Dec 2022 21:32:25 GMT
Etag: "638b0933-1d7"
Expires: Mon, 05 Dec 2022 09:57:34 GMT
Last-Modified: Sat, 03 Dec 2022 08:30:43 GMT
Server: ECS (bsa/EB15)
X-Cache: Miss from cloudfront
Via: 1.1 f9a0ddc3860252ab6c4d02ab024b4890.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN1-C1
X-Amz-Cf-Id: 8uWEAYLOw2r_jJMTMrmslBtQdsq0hQ04KcbKncTNd7os4bYEuVczrA==
Age: 5211

                                        
                                            GET /mailer/posten/manage/file/js HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 200 OK
                                            
Date: Sat, 03 Dec 2022 21:32:21 GMT
Server: nginx/1.21.6
Content-Length: 85977
Last-Modified: Tue, 08 Jun 2021 00:17:24 GMT
X-Server-Cache: true
X-Proxy-Cache: EXPIRED
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (1578)
Size:   85977
Md5:    104e07e0e93bf6709dfd128626ae22c1
Sha1:   bc4f6f38b6331802f3768e92f71c51fe9122c374
Sha256: 6a8e46cbefc58dbc1b2f11902814d141b0c76200257c9144c5b0a025e535aa4e

urlquery:
  - Phishing - Posten Norge
Blocklists:
  - fortinet: Phishing
                                        
                                            GET /mailer/posten/manage/file/moatframe.js.t%C3%A9l%C3%A9chargement HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Apache
Content-Length: 0
Connection: close


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /gtm.js?id=GTM-M83DX4 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             142.250.74.40
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                            
Location: https://www.googletagmanager.com/gtm.js?id=GTM-M83DX4
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Google Tag Manager
Content-Length: 250
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Size:   250
Md5:    1373afd5f63dc37d3b1e0cd4a9857230
Sha1:   c6f8ae3f09ce337c9e491f0946bdfe8eab86188a
Sha256: 989490b30a61855760b9f74412798e09385461c1f5f07e630d5fa943bc27a47e
                                        
                                            GET /00012/tm.js?r=&1595293061872 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:25 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1595293061723 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:25 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Duu0mCIqfax3PsUYgBfN3w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             54.186.209.73
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Q/rD5+UPsSsEodE6riDbg2N6tWM=

                                        
                                            GET /mailer/posten/manage/file/moatframe.js.t%C3%A9l%C3%A9chargement HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Apache
Content-Length: 0
Connection: close


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /gtm.js?id=GTM-M83DX4 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             142.250.74.40
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                            
Location: https://www.googletagmanager.com/gtm.js?id=GTM-M83DX4
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:25 GMT
Server: Google Tag Manager
Content-Length: 250
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Size:   250
Md5:    1373afd5f63dc37d3b1e0cd4a9857230
Sha1:   c6f8ae3f09ce337c9e491f0946bdfe8eab86188a
Sha256: 989490b30a61855760b9f74412798e09385461c1f5f07e630d5fa943bc27a47e
                                        
                                            GET /00012/tm.js?r=&1595285185398 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:25 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /_/asset/no.posten.website:1594301215/css/postenstyle.css HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:26 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, close
Content-Length: 0

                                        
                                            GET /gtm.js?id=GTM-M83DX4 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             142.250.74.40
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                            
Location: https://www.googletagmanager.com/gtm.js?id=GTM-M83DX4
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:26 GMT
Server: Google Tag Manager
Content-Length: 250
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Size:   250
Md5:    1373afd5f63dc37d3b1e0cd4a9857230
Sha1:   c6f8ae3f09ce337c9e491f0946bdfe8eab86188a
Sha256: 989490b30a61855760b9f74412798e09385461c1f5f07e630d5fa943bc27a47e
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /00012/tm.js?r=&1670103144060 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:26 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /activityi;src=8260928;type=global;cat=postengl;ord=9230837533443;gtm=2wgbu0;auiddc=1429949512.1670103144;u1=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F;u2=mailer;u3=posten-manage;u4=rekkef%C3%B8lge%20Post-no;u5=;~oref=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F? HTTP/1.1 
Host: 8260928.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.38
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:32:26 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 03-Dec-2022 21:47:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (592), with no line terminators
Size:   276
Md5:    2061e0d588be62f8996fd16a6eed8455
Sha1:   aa61c5a0bccaaf9448b4f680acc8c62b61ce14d4
Sha256: 48aad84101bef38142bec8960873fe0293ec904ff5253a480da3acc7e819ea41
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /static/shop/common/fonts/flaticon/Flaticon.woff2 HTTP/1.1 
Host: cdn.mycomandia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://webbhaarti.in
Connection: keep-alive
Referer: https://cdn.mycomandia.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             176.31.233.37
HTTP/2 200 OK
content-type: application/octet-stream
                                            
date: Sat, 03 Dec 2022 21:32:26 GMT
content-length: 2024
last-modified: Tue, 27 Aug 2019 11:07:46 GMT
etag: "5d650f02-7e8"
server: rebelio-n2
expires: Sun, 03 Dec 2023 21:32:26 GMT
cache-control: max-age=31536000
backend: 2
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 2024, version 1.0\012- data
Size:   2024
Md5:    c1b7ca92614b5e76d59b8b467f1d8dd9
Sha1:   6ada3f43e5b4ec1a77383f2af00dd2b3c990af5c
Sha256: a92c73eb3e53032a9846ca27c2c579b424b45a893ac814288954762e878b5e1b

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /_/asset/no.posten.website:1594301215/js/bundle.js HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/
Cookie: _gcl_au=1.1.1429949512.1670103144

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:26 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, close
Content-Length: 0


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15561
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:32:26 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15561
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:32:26 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15561
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:32:26 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15561
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:32:26 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F627a3f86-b7fa-44c4-a119-2e3d23eb8b6a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5354
x-amzn-requestid: 3d58ffea-3433-4c5c-a60b-17f6de3a33e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cSsnvG44oAMFfyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638427ca-63b375f04189b7ce7d84cd5d;Sampled=0
x-amzn-remapped-date: Mon, 28 Nov 2022 03:15:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GBhAilKMKo9RvIzqzF9V4jTZbvpa2rPZeoy6Jy8fMc1-JO078OAYzQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 05:53:40 GMT
age: 56326
etag: "65c8b4abf957f9b54d99d0f78559e639adb29efb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5354
Md5:    1e74254b3fdce7d6b84a71a7aff43789
Sha1:   65c8b4abf957f9b54d99d0f78559e639adb29efb
Sha256: f278c3cc6734da7188862a8c651c803e7ac1fda82234e191761453cb1359d3ee
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XvG2dAUeB914GQ1qJwQRHovAtra8OSjG-CsXeR8UOBq5r8qVjEbPBQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 22:39:04 GMT
age: 82402
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   2942
Md5:    b47431190f34eccf0a6efb98e2a32b7d
Sha1:   9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
Sha256: 08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F864be807-d5f6-42e3-bd58-f7641a256b9a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7732
x-amzn-requestid: 3781c2b7-082a-468a-a186-f7483494e749
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoEq3IAMFnKg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-679fe9f905e07abf4e6a812c;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: V4Z3TZtTDMjnyxZx7VdJrKtZ-PbZkWnsQ0-1eFDem4TVyRGvk0dc7A==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:53:36 GMT
age: 85130
etag: "d45dceb3dc58a07197aa5077582b5b1cd2ff791a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7732
Md5:    379a4a1b95d3aa3c5a4f8e7f9abb030f
Sha1:   d45dceb3dc58a07197aa5077582b5b1cd2ff791a
Sha256: 1b92dec5bf90beffbcd9060052b8788f08645dd4ba34219f7ddb2d40bbd2d151
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7dc00fa-a8d3-44bf-ba84-1998d8dd7c5a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4309
x-amzn-requestid: c824c317-e6e3-4006-9f9d-ea54e8170a4c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cf2_tGErIAMF8_A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63896b97-7fc523296afea4dd4b5d1de8;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 03:05:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tp50A9LYeT1RvSPImBUoQNKtarPryKb8Zacm_nxqDh-gegwdQov7Nw==
via: 1.1 40b967aa4aa18637c4b91214147f3cb4.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 03:50:52 GMT
age: 63694
etag: "544428cdad754b1bb7be3cd46a79bf078fd5b450"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    fcb89ca25035b2bbb71ae5dd175fcd40
Sha1:   544428cdad754b1bb7be3cd46a79bf078fd5b450
Sha256: 36dcbbe6cd2710ee502776b4bcf32053e92b750a55e2bd4cdeadbc694c7c2699
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 06:00:50 GMT
age: 55896
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6174
Md5:    b986f9fcbeca91ed5c8d58fbfaf47d19
Sha1:   6e6c8bd2bce144cc4da1cd7be375b046b60dca79
Sha256: 07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73b53015-e415-4fff-9252-8a16bbe000f5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9715
x-amzn-requestid: c8102cfa-78dc-4d81-ad6a-e16b9132e238
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZO2HQKIAMF8IA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f2b-350c586b568e6565763376bd;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:31 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0QkVKyYm9UwlF5FEeli9UsRAQwEi3-c3bMR-QSJxIKRQe7WWT76dGQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:37:54 GMT
age: 86072
etag: "d4b3052021ff3ad1dc4134fa25eb12a98e7c17da"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9715
Md5:    45182367fd4f8b6dd234eef1022acdb1
Sha1:   d4b3052021ff3ad1dc4134fa25eb12a98e7c17da
Sha256: a57fadaf74db2fb457cfe761314d56f021d22146f5bdb6a8bf11b6519e8a558d
                                        
                                            GET /_/asset/no.posten.website:1594301215/js/chatbot.js HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/
Cookie: _gcl_au=1.1.1429949512.1670103144

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:26 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, close
Content-Length: 0


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /activityi;src=8260928;type=global;cat=postengl;ord=1731455357069;gtm=2wg783;auiddc=1977740214.1595281331;u1=https%3A%2F%2Fwww.posten.no%2F;u2=;u3=undefined;u4=Posten.no;u5=;~oref=https%3A%2F%2Fwww.posten.no%2F? HTTP/1.1 
Host: 8260928.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/
Upgrade-Insecure-Requests: 1

                                        
                                             142.250.74.38
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:27 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Strict-Transport-Security: max-age=21600
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 379
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (514), with no line terminators
Size:   379
Md5:    b0d6eab9eab3a20438b0bd13da342a70
Sha1:   134028116c2bead7b536a69aff5cdffbe7cef66c
Sha256: a10b560c3b8f69897480622085a0ab5675665bff0b3e3f8ead749b3f2535c7dc

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /activityi;src=8260928;type=global;cat=postengl;ord=4649758211791;gtm=2wg783;auiddc=1528092789.1593547249;u1=http%3A%2F%2Flocalhost%2Fpage%2Fmanage%2F;u2=page;u3=manage-;u4=Posten.no;u5=http%3A%2F%2Flocalhost%2Fpage%2Fmanage%2F;~oref=http%3A%2F%2Flocalhost%2Fpage%2Fmanage%2F%3Fview%3Dlogin%26appIdKey%3Dfcd00c0656cc490%26country%3D? HTTP/1.1 
Host: 8260928.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/
Upgrade-Insecure-Requests: 1

                                        
                                             142.250.74.38
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:27 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Strict-Transport-Security: max-age=21600
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 427
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (636), with no line terminators
Size:   427
Md5:    78b225543f9ea122bf259d94fd379b4b
Sha1:   cbe260dd69e0791c6479bf8c214f28aa09a41286
Sha256: e2e8bdcba10a07de068f0c41f8f0c7dd6bfed0b8b0f4aaedae5b263cd70e0362

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /activityi;src=8260928;type=global;cat=postengl;ord=8037061832867;gtm=2wg783;auiddc=1528092789.1593547249;u1=http%3A%2F%2Flocalhost%2Fpage%2Fmanage%2F;u2=page;u3=manage-;u4=Posten.no;u5=http%3A%2F%2Flocalhost%2Fpage%2Fmanage%2F;~oref=http%3A%2F%2Flocalhost%2Fpage%2Fmanage%2F%3Fview%3Dlogin%26appIdKey%3Dfcd00c0656cc490%26country%3D? HTTP/1.1 
Host: 8260928.fls.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/
Upgrade-Insecure-Requests: 1

                                        
                                             142.250.74.38
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 03 Dec 2022 21:32:27 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Strict-Transport-Security: max-age=21600
Pragma: no-cache
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 427
X-XSS-Protection: 0


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (636), with no line terminators
Size:   427
Md5:    7894f56de7efa41c42aab98bd8cd19ba
Sha1:   4a3a8110cc5a2e6deccedda3ac6d00bed188ff10
Sha256: 34c3b01b8c469b58e9933b67e4a12c9dd98ec4daefd4324f0aceb92cf8dd6d44

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1670103144926 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:27 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1670103144924 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:27 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1670103144925 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:27 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /00012/tm.js?r=&1670103144926 HTTP/1.1 
Host: in.taskanalytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             108.128.72.146
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
                                            
Server: Cowboy
Connection: keep-alive
Vary: origin
Access-Control-Expose-Headers: WWW-Authenticate,Server-Authorization
Cache-Control: no-cache
Content-Length: 7
Date: Sat, 03 Dec 2022 21:32:27 GMT
Via: 1.1 vegur


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   7
Md5:    9394bb34611399534ffac4f0ece96b7f
Sha1:   b4e856ccc12dd97ea890dfc802609afe410903b1
Sha256: 63446cf888571b1c5373a4ac8452e35ac378cdee775d3e5dee86903a1381d536

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /beacon.js HTTP/1.1 
Host: b.scorecardresearch.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             143.204.55.96
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 28 Jun 2022 13:19:23 GMT
x-amz-server-side-encryption: AES256
Server: AmazonS3
Content-Encoding: gzip
Date: Sat, 03 Dec 2022 01:57:21 GMT
Cache-Control: max-age=86400
ETag: W/"eaf85c1c6758e84acfe134efd70e9373"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: oPGys8Tpu30yIm-ImIOjO5hHxpeCEWpPNkHsY20wVnJG3aYsNxeCLw==
Age: 70507


--- Additional Info ---
Magic:  ASCII text, with very long lines (3936)
Size:   1857
Md5:    ccbe1595614949962ea0f4c9ec84e783
Sha1:   65525e8918223db782724d28fce74efb513a0fb0
Sha256: f422f26d9197a10abf1a13a13a87a5fcc4b98ad57aae11fadfddf2df02b591f5
                                        
                                            GET /dmp/up/pixie.js HTTP/1.1 
Host: acdn.adnxs.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             23.38.200.189
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Last-Modified: Wed, 02 Jun 2021 15:04:00 GMT
ETag: "60b79de0-23b3"
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 3340
Cache-Control: max-age=86402
Expires: Sun, 04 Dec 2022 21:32:29 GMT
Date: Sat, 03 Dec 2022 21:32:27 GMT
Connection: keep-alive
Vary: Accept-Encoding


--- Additional Info ---
Magic:  ASCII text, with very long lines (9139), with no line terminators
Size:   3340
Md5:    75b9af81e30e45403e6856566e888545
Sha1:   d013e9a47331447f32c2bdf6f35b286e711788f0
Sha256: dd26e2e55783f6174ceea7c7a3b10e5af1c7fca56fc2543956a38b848f32a151
                                        
                                            GET /uwt.js HTTP/1.1 
Host: static.ads-twitter.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             151.101.244.157
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
                                            
Connection: keep-alive
Content-Length: 15375
Last-Modified: Thu, 27 Oct 2022 18:55:37 GMT
Cache-Control: no-cache
Content-Encoding: gzip
Etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
Accept-Ranges: bytes
Date: Sat, 03 Dec 2022 21:32:27 GMT
X-Served-By: cache-iad-kjyo7100147-IAD, cache-hel1410031-HEL
X-Cache: HIT, HIT
Vary: Accept-Encoding,Host
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT


--- Additional Info ---
Magic:  ASCII text, with very long lines (57596), with no line terminators
Size:   15375
Md5:    573e6a7f86f6f3063763360ef0672c01
Sha1:   b12eab3b4ac8872d49ac6e15f9cd17741765c0cf
Sha256: 02445eb022a04139531f0ce8d8980c31083a1c670936f1477f5cfc4d252133f7
                                        
                                            GET /box-XMRheight:%201px%20!important;%20opacity:%200%20!important;%20pointer-events:%20none%20!important; HTTP/1.1 
Host: vars.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        
                                             65.9.44.23
HTTP/2 403 Forbidden
content-type: application/xml
                                            
content-length: 243
date: Sat, 03 Dec 2022 21:32:27 GMT
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Error from cloudfront
via: 1.1 9dc04feb591f6b5ae6ea4527a23d28da.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: Z5WRYiKLaPc6FbjNu65o1CMzdenG3CQdddWOzfLeDb2TDAdCbYK4GQ==
X-Firefox-Spdy: h2

                                        
                                            GET /li.lms-analytics/insight.min.js HTTP/1.1 
Host: snap.licdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             23.36.76.210
HTTP/2 200 OK
content-type: application/x-javascript;charset=utf-8
                                            
last-modified: Thu, 17 Nov 2022 18:52:45 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=16895
date: Sat, 03 Dec 2022 21:32:27 GMT
content-length: 4581
x-cdn: AKAM
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (12961)
Size:   4581
Md5:    c1a25b303b61b25e995516f5559bcdea
Sha1:   3c16a6fa3a2a6dc59d57a9ea1588c4f259884688
Sha256: 2063d2d1415ce9437e9331cb9a798714a5b2e106a65d6dc0ef0d426a5a4c30f2
                                        
                                            GET /modules.a1fbf755044ca8f629ba.js HTTP/1.1 
Host: script.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             143.204.55.68
HTTP/2 200 OK
content-type: application/javascript
                                            
content-length: 88758
date: Tue, 15 Nov 2022 07:02:34 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=31536000
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: "db69fc2480d3485a988c1628d311d0c0"
last-modified: Wed, 22 Jul 2020 09:42:49 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a7d2a4ec2f50830f128dc406960aef9a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: H2HRwGzCmgn0lH6hTNw5Xl7YaEOMk-29Lz24rvHbLLmvnAvrQUP4Xg==
age: 1607393
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   88758
Md5:    db69fc2480d3485a988c1628d311d0c0
Sha1:   82abdfda4d399e9e8032a71f1f962e91ad80860f
Sha256: 7517e0f2be2260c0cd09514fb51ac73f72751caa5e58e4fa5267732f3862b318
                                        
                                            GET /en_US/fbevents.js HTTP/1.1 
Host: connect.facebook.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/

                                        
                                             157.240.240.1
HTTP/1.1 301 Moved Permanently
Content-Type: text/plain
                                            
Location: https://connect.facebook.net/en_US/fbevents.js
Server: proxygen-bolt
Date: Sat, 03 Dec 2022 21:32:27 GMT
Connection: keep-alive
Content-Length: 0

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /plugins/ua/linkid.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             216.239.34.178
HTTP/2 200 OK
content-type: text/javascript
                                            
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 859
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 03 Dec 2022 20:34:27 GMT
expires: Sat, 03 Dec 2022 21:34:27 GMT
cache-control: public, max-age=3600
age: 3480
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1335)
Size:   859
Md5:    904463ce35aee800847ab85ec948aaf6
Sha1:   904e4d2647466c7f7e0f7412019984e3b2ccfb24
Sha256: 057b4d29359dfe2536a2ec40243bdfa7b151222efcc1eb358608994a14c34237
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             216.239.34.178
HTTP/2 200 OK
content-type: text/javascript
                                            
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Sat, 03 Dec 2022 20:46:55 GMT
expires: Sat, 03 Dec 2022 22:46:55 GMT
cache-control: public, max-age=7200
age: 2732
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1325)
Size:   20039
Md5:    47e6f374ca946fddd5b59871b325736c
Sha1:   baa9282efc8785e84d247c3bff518eaa45f101c4
Sha256: 16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
                                        
                                            GET /uwt.js HTTP/1.1 
Host: static.ads-twitter.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/
If-Modified-Since: Thu, 27 Oct 2022 18:55:37 GMT
If-None-Match: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"

                                        
                                             151.101.244.157
HTTP/1.1 304 Not Modified
                                            
Connection: keep-alive
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: no-cache
ETag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
X-Served-By: cache-hel1410031-HEL
X-Cache: HIT
Vary: Accept-Encoding,Host
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /c/hotjar-507531.js?sv=7 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             65.9.44.78
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
content-length: 0
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
date: Sat, 03 Dec 2022 21:32:27 GMT
cache-control: max-age=60
etag: W/d41d8cd98f00b204e9800998ecf8427e
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 990c1aa70667fe4e8f93d88ac8400fc4.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: iozMK90UgEeJX77iQbgN_vVLKWo4sTZnu9pWVP7pE_Ho0ShgpVqUkQ==
X-Firefox-Spdy: h2

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5315
Cache-Control: 'max-age=158059'
Date: Sat, 03 Dec 2022 21:32:27 GMT
Last-Modified: Sat, 03 Dec 2022 20:03:52 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /pagead/conversion_async.js HTTP/1.1 
Host: www.googleadservices.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.130
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 03 Dec 2022 21:32:27 GMT
expires: Sat, 03 Dec 2022 21:32:27 GMT
cache-control: private, max-age=3600
etag: 16595884479219046262
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 15190
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1654)
Size:   15190
Md5:    f2258b08ae7f4c53a27c27e21536ef06
Sha1:   65fe239266dc4c3f8f8e25dfd039a77733f75f67
Sha256: fd9775067ede051cfe4861265da0e9374a20cd833fedcd3c9708af0b525f8921
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5315
Cache-Control: 'max-age=158059'
Date: Sat, 03 Dec 2022 21:32:27 GMT
Last-Modified: Sat, 03 Dec 2022 20:03:52 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /pagead/1p-conversion/undefined/?random=1670103144052&cv=11&fst=1670103144052&bg=ffffff&guid=ON&async=1&gtm=2wgbu0&u_w=1280&u_h=1024&label=undefined&hn=www.google.com&frm=0&url=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&tiba=rekkef%C3%B8lge%20Post-no&value=0&bttype=purchase&auid=1429949512.1670103144&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4 HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.132
HTTP/2 302 Found
content-type: text/javascript; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:32:27 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
location: https://www.google.no/pagead/1p-conversion/undefined/?random=1670103144052&cv=11&fst=1670103144052&bg=ffffff&guid=ON&async=1&gtm=2wgbu0&u_w=1280&u_h=1024&label=undefined&hn=www.google.com&frm=0&url=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&tiba=rekkef%C3%B8lge%20Post-no&value=0&bttype=purchase&auid=1429949512.1670103144&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y&prhg=0
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 63
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   63
Md5:    0339f8f57d1bf75003db591e28957e45
Sha1:   ae2286e497c9f76a02cb40c40a674b73bd293b76
Sha256: 609cd8e12464fe137cfaa9f1ab6637150d44e105559c901b6df50303fd05aa26
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /images?q=tbn%3AANd9GcQTrX8MP4pA-vzwCA0DiAM71Fj69Cm9CP7aY7NITLF99rsGcwM9 HTTP/1.1 
Host: encrypted-tbn0.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.78
HTTP/2 200 OK
content-type: image/jpeg
                                            
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-length: 6238
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 03 Dec 2022 21:32:27 GMT
expires: Sun, 03 Dec 2023 21:32:27 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 28 Dec 2017 03:23:06 GMT
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x168, components 3\012- data
Size:   6238
Md5:    2063951383d22405d0663550e2ed3762
Sha1:   6a256b7cdec8d0e0aaf2c86c17e7cc34693a609e
Sha256: 0fb41ab8877699782e17566fafad17e01b8d04b840db658583cb0d3b9508fff4

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /images/branding/product/1x/translate_24dp.png HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: image/png
                                            
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 846
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 03 Dec 2022 20:51:51 GMT
expires: Sun, 03 Dec 2023 20:51:51 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
age: 2436
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size:   846
Md5:    e9cd262114358f26b7608b56905185dc
Sha1:   6dbde0a96deaab2b529723ce26c62043cf9180ab
Sha256: 5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

urlquery:
  - Phishing - Posten Norge
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5315
Cache-Control: 'max-age=158059'
Date: Sat, 03 Dec 2022 21:32:27 GMT
Last-Modified: Sat, 03 Dec 2022 20:03:52 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /pagead/viewthroughconversion/undefined/?random=1670103144052&cv=11&fst=1670103144052&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgbu0&u_w=1280&u_h=1024&label=undefined&hn=www.google.com&frm=0&url=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&tiba=rekkef%C3%B8lge%20Post-no&value=0&bttype=purchase&auid=1429949512.1670103144&gcp=1&ct_cookie_present=1 HTTP/1.1 
Host: googleads.g.doubleclick.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             216.58.207.226
HTTP/2 200 OK
content-type: image/gif
                                            
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:32:27 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 03-Dec-2022 21:47:27 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /images/branding/product/2x/translate_24dp.png HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://translate.googleapis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.35
HTTP/2 200 OK
content-type: image/png
                                            
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1842
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 03 Dec 2022 19:49:44 GMT
expires: Sun, 03 Dec 2023 19:49:44 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
age: 6163
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Size:   1842
Md5:    c69c796362406f9e11c7f4bf5bb628da
Sha1:   e489ce95ab56208090868882113d7416abf46775
Sha256: 4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

urlquery:
  - Phishing - Posten Norge
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /pixie?e=PageView&pi=9c3f7c51-769b-4487-8db5-bef9b5c66993&it=1670103145063&v=0.0.20&u=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&st=1670103145062&et=1670103145064&if=0 HTTP/1.1 
Host: ib.adnxs.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             37.252.172.123
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx/1.21.3
Date: Sat, 03 Dec 2022 21:32:27 GMT
Content-Length: 42
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /pagead/1p-conversion/undefined/?random=1670103144052&cv=11&fst=1670103144052&bg=ffffff&guid=ON&async=1&gtm=2wgbu0&u_w=1280&u_h=1024&label=undefined&hn=www.google.com&frm=0&url=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&tiba=rekkef%C3%B8lge%20Post-no&value=0&bttype=purchase&auid=1429949512.1670103144&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y&prhg=0 HTTP/1.1 
Host: www.google.no
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://webbhaarti.in/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.163
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                            
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 21:32:27 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 63
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   63
Md5:    0339f8f57d1bf75003db591e28957e45
Sha1:   ae2286e497c9f76a02cb40c40a674b73bd293b76
Sha256: 609cd8e12464fe137cfaa9f1ab6637150d44e105559c901b6df50303fd05aa26
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /pixie?e=PageView&pi=3ff1e0a2-bf36-4112-bfb2-d9ea337ee435&it=1670103145062&v=0.0.20&u=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&st=1670103145062&et=1670103145062&if=0 HTTP/1.1 
Host: ib.adnxs.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             37.252.172.123
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx/1.21.3
Date: Sat, 03 Dec 2022 21:32:27 GMT
Content-Length: 42
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /pixie?e=PageView&pi=3ff1e0a2-bf36-4112-bfb2-d9ea337ee435&it=1670103145062&v=0.0.20&u=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&st=1670103145062&et=1670103145063&if=0 HTTP/1.1 
Host: ib.adnxs.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             37.252.172.123
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Server: nginx/1.21.3
Date: Sat, 03 Dec 2022 21:32:27 GMT
Content-Length: 42
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.131
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             54.230.96.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=92859
Date: Sat, 03 Dec 2022 21:32:27 GMT
Etag: "638a80bf-1d7"
Expires: Sun, 04 Dec 2022 23:20:06 GMT
Last-Modified: Fri, 02 Dec 2022 22:48:31 GMT
Server: ECS (bsa/EB24)
X-Cache: Miss from cloudfront
Via: 1.1 f9a0ddc3860252ab6c4d02ab024b4890.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN1-C1
X-Amz-Cf-Id: nhdgozxiH4losCJwsSJKRPD7-4RO5iej9P6fU-6_JlXplURAfsc4pQ==
Age: 1895

                                        
                                            GET /image.aspx?url=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&title=rekkef%C3%B8lge%20Post-no&res=1280x1024&accountid=6015663&rt=3111&prev=2dd8d910-6ce2-d2ed-822a-f0e6f466f3e0&luid=232199fe-268d-6123-420b-0682b4b069b2&rnd=64884 HTTP/1.1 
Host: 6015663.global.siteimproveanalytics.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             3.123.165.229
HTTP/2 200 OK
content-type: image/gif
                                            
date: Sat, 03 Dec 2022 21:32:27 GMT
content-length: 34
set-cookie: AWSALB=dofVZye8y2ozMDwU/75oDkHDHPRtThCoF6vP2Eo9GRX2i8BL6ErzGnHGUmtFTNcD+zKdpblnx/v6OMw1UtiK7LFcjLOSeZL+1qpGkgWSTWmTHMeVlXjkX+GGT3NS; Expires=Sat, 10 Dec 2022 21:32:27 GMT; Path=/ AWSALBCORS=dofVZye8y2ozMDwU/75oDkHDHPRtThCoF6vP2Eo9GRX2i8BL6ErzGnHGUmtFTNcD+zKdpblnx/v6OMw1UtiK7LFcjLOSeZL+1qpGkgWSTWmTHMeVlXjkX+GGT3NS; Expires=Sat, 10 Dec 2022 21:32:27 GMT; Path=/; SameSite=None; Secure
cache-control: max-age=0
expires: Sat, 03 Dec 2022 21:32:27 UTC
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   34
Md5:    a82ba3a9d42148e9cf209df13d8c3f3d
Sha1:   dba80835d31175bdcf0bcad1abafefb06d86e304
Sha256: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

urlquery:
  - Phishing - Posten Norge
                                        
                                            GET /collect?v=2&fmt=js&pid=&time=1670103145090&url=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F HTTP/1.1 
Host: px.ads.linkedin.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             13.107.42.14
HTTP/2 200 OK
content-type: application/javascript
                                            
set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=ads.linkedin.com; Secure bcookie="v=2&8036eec9-daff-4cd6-8389-ce978c963c5b"; domain=.linkedin.com; Path=/; Secure; Expires=Sun, 03-Dec-2023 21:32:27 GMT; SameSite=None lidc="b=OGST09:s=O:r=O:a=O:p=O:g=2386:u=1:x=1:i=1670103147:t=1670189547:v=2:sig=AQFDXdOAGFeAdFY3gGhxYsdMUTnkY-Kr"; Expires=Sun, 04 Dec 2022 21:32:27 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-pop: afd-prod-lor1-x
x-li-proto: http/2
x-li-uuid: AAXu8zDYpg8QR+Cjw1nl+A==
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: 7E68D3936A324CC6941EAD016F694125 Ref B: OSL30EDGE0517 Ref C: 2022-12-03T21:32:27Z
date: Sat, 03 Dec 2022 21:32:26 GMT
content-length: 0
X-Firefox-Spdy: h2

                                        
                                            GET /_/image/60b33711-0a7f-40bc-974b-0209e50dae4a:91dbc5bf28c5fb069b0219ca5856e5da19efea66/square-16/posten-logo.png HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/
Cookie: _gcl_au=1.1.1429949512.1670103144

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, close
Content-Length: 0

                                        
                                            GET /_/image/60b33711-0a7f-40bc-974b-0209e50dae4a:91dbc5bf28c5fb069b0219ca5856e5da19efea66/square-192/posten-logo.png HTTP/1.1 
Host: webbhaarti.in
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webbhaarti.in/mailer/posten/manage/
Cookie: _gcl_au=1.1.1429949512.1670103144

                                        
                                             192.185.129.233
HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:32:27 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, close
Content-Length: 0

                                        
                                            GET /tr/?id=843920095719058&ev=PageView&dl=http%3A%2F%2Fwebbhaarti.in%2Fmailer%2Fposten%2Fmanage%2F&rl=&if=false&ts=1670103145760&sw=1280&sh=1024&v=2.9.89&r=stable&ec=0&o=30&fbp=fb.1.1670103145759.166217570&it=1670103145280&coo=false&rqm=GET HTTP/1.1 
Host: www.facebook.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             31.13.72.36
HTTP/2 200 OK
content-type: text/plain
                                            
access-control-allow-origin:
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400
date: Sat, 03 Dec 2022 21:32:27 GMT
X-Firefox-Spdy: h2

                                        
                                            GET /css?family=PT+Sans:400,700 HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             142.250.74.106
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                            
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 03 Dec 2022 21:32:25 GMT
date: Sat, 03 Dec 2022 21:32:25 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /static/shop/common/bundle/bootstrap-4.1.0/css/bootstrap.min.css?v=2019.12.17 HTTP/1.1 
Host: cdn.mycomandia.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             176.31.233.37
HTTP/2 200 OK
content-type: text/css
                                            
date: Sat, 03 Dec 2022 21:32:25 GMT
last-modified: Thu, 18 Oct 2018 11:43:18 GMT
vary: Accept-Encoding
etag: W/"5bc871d6-22485"
server: rebelio-n2
expires: Sun, 03 Dec 2023 21:32:25 GMT
cache-control: max-age=31536000
backend: 2
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /en_US/fbevents.js HTTP/1.1 
Host: connect.facebook.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             157.240.240.1
HTTP/2 200 OK
content-type: application/x-javascript; charset=utf-8
                                            
vary: Accept-Encoding
content-encoding: gzip
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: zNRHu0d94qjLej+8b2GZPkzUKQjCaJ8ASJIFALo8/HPkwkwBQTAQI0R2730kvi/qiAhry1u9VLua6NTI7mn5Hw==
priority: u=3,i
content-length: 27340
x-fb-trip-id: 1679558926
date: Sat, 03 Dec 2022 21:32:27 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /signals/config/843920095719058?v=2.9.40&r=stable HTTP/1.1 
Host: connect.facebook.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             157.240.240.1
HTTP/2 200 OK
content-type: application/x-javascript; charset=utf-8
                                            
vary: Accept-Encoding
content-encoding: gzip
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: Zshvm3kw4LdO+0A4mfDBcyVAMc1kVSDxcRBp3atQwsOLHoIcoh8ArEpbP5SpZOE6G8MdrMJe9E/CeLUNbMqdcg==
priority: u=3,i
x-fb-trip-id: 1679558926
date: Sat, 03 Dec 2022 21:32:27 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /chatPanel/chatPanel.js HTTP/1.1 
Host: posten.boost.ai
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://webbhaarti.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             54.170.32.124
HTTP/2 200 OK
content-type: application/javascript
                                            
date: Sat, 03 Dec 2022 21:32:25 GMT
server: Apache
access-control-allow-methods: POST, GET, OPTIONS
strict-transport-security: max-age=94608000; includeSubDomains
access-control-allow-credentials: true
vary: Origin,Accept-Encoding
last-modified: Wed, 30 Nov 2022 13:46:53 GMT
etag: "b2b60-5eeb056537c32-gzip"
accept-ranges: bytes
cache-control: max-age=600
expires: Sat, 03 Dec 2022 21:42:25 GMT
content-encoding: gzip
x-frame-options: SAMEORIGIN
access-control-allow-headers: content-type, X-Requested-With, accept, Origin, Access-Control-Request-Method, Access-Control-Request-Headers, X-CSRF-TOKEN, X-XSRF-TOKEN, X-XHR-Logon, x-ms-client-application-name, x-ms-client-request-id, x-ms-client-session-id, x-ms-effective-locale
access-control-max-age: 600
x-robots-tag: noindex
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: