Report - 0hlr9a8jxb.lspower.xyz/usps/verification.html

Report Overview

Submitted URL
0hlr9a8jxb.lspower.xyz/usps/verification.html
IP
188.114.96.1
ASN
#13335 CLOUDFLARENET
Submitted
2023-03-30 20:43:05
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
40

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-31T18:12:04Z	3.4 kB	8.9 kB	23.36.76.226
0hlr9a8jxb.lspower.xyz	unknown			11 kB	118 kB	188.114.96.1
firefox-settings-attachments.cdn.mozilla.net	11509	2019-11-30T10:32:57Z	2023-03-31T20:22:30Z	412 B	808 kB	34.111.73.144
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-31T18:12:09Z	333 B	391 B	34.117.237.239
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-31T18:14:44Z	8.6 kB	302 kB	35.241.9.150
tools.usps.com	12881	2013-04-18T14:00:39Z	2023-03-31T23:34:20Z	1.8 kB	10 kB	192.229.221.165
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-31T21:56:16Z	341 B	799 B	192.229.221.95
shavar.services.mozilla.com	3602	2015-09-28T08:30:01Z	2023-03-31T20:22:30Z	453 B	204 B	44.238.157.127
detectportal.firefox.com	1601	2018-08-30T11:52:03Z	2023-03-31T18:17:47Z	909 B	642 B	34.107.221.82
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-31T18:18:04Z	840 B	12 kB	34.160.144.191
getpocket.cdn.mozilla.net	1369	2018-08-28T15:15:36Z	2023-03-31T18:39:46Z	435 B	50 kB	34.120.5.221
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-31T18:13:52Z	606 B	127 B	35.163.121.16
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-31T07:51:33Z	3.2 kB	56 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/verification.html	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/layer/layer.js	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/jquery-3.2.1.js	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/layer/layer.js	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/change_address.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/holdmail.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/po_box.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/schedule_pickup.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/free_boxes.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/logo_mobile.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/featured_clicknship.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/search.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/location.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/stamps.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/logo-sb.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/calculate_price.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/hamburger.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/find_zip.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/tracking.svg	Phishing
2023-03-30	medium	0hlr9a8jxb.lspower.xyz/usps/static/usps/mailman.svg	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	0hlr9a8jxb.lspower.xyz/usps/verification.html	52 B	2023-03-09	2023-11-26
Pretty URL 0hlr9a8jxb.lspower.xyz/usps/verification.html IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 03:17:55 Last Seen2023-11-26 21:32:42 Times Seen3521 Hash 15c41ab852d2f96d6caafceb1b2fdf54 b827d336116bf188232f345f750f1e3e9012082a 0a678cc287c455b4433d05ba311acfe1924f72eb77422b6f6759f24fd4dab953 Loading...

	0hlr9a8jxb.lspower.xyz/usps/verification.html	24 B	2023-03-07	2024-04-17
Pretty URL 0hlr9a8jxb.lspower.xyz/usps/verification.html IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-17 18:24:10 Times Seen5673 Hash 56d62f55706e2e153678329e7bcd94d8 c00d14b88b1fa94b12c0aafb761e676e73758fc9 6949901ccecaa8c8c40ac181981a5a291b81648a0a5ab42223db4875bdd5235c Loading...

	0hlr9a8jxb.lspower.xyz/usps/verification.html	27 B	2023-03-07	2023-04-02
Pretty URL 0hlr9a8jxb.lspower.xyz/usps/verification.html IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:15:29 Last Seen2023-04-02 21:20:10 Times Seen3705 Hash d679a370635fd03a222368c143751d85 7eacb12232cbb3fa0ac526e917eca6e6a95f873a b5df22f95ada1fe2b3c64ed31446e1391d3723d688cf0bfbd84d0da0a8fe678a Loading...

		Size	First Seen	Last Seen
	#1 Write - 5531a5834816222280f20d1ef9e95f69	4 B	2023-03-12	2024-01-28
Pretty Observations First Seen2023-03-12 12:17:15 Last Seen2024-01-28 13:22:54 Times Seen21116 Hash 5531a5834816222280f20d1ef9e95f69 445cd2fd3273962bdf09425109a2d09f7170e837 d398b29d3dbbb9bf201d4c7e1c19ff9d43c15fd45a0cec46fbe9885ec3f6e97f Loading...

HTTP Transactions (81)

URL IP Response Size

detectportal.firefox.com/success.txt?ipv4

34.107.221.82

200 OK

8 B

URL HTTP/1.1
detectportal.firefox.com/success.txt?ipv4
IP
34.107.221.82:0
ASN
#15169 GOOGLE

File type
ASCII text
Size
8 B (8 bytes)
Hash
ae780585f49b94ce1444eb7d28906123
7d5ca8c0c03e883c56c4eb1ef6f6bb9bccad4d86
81b2bd4ea98c8db66554fbc8d7637a1a69a130f331feb732b75caab4c4868fd5

HTTP Headers

GET /success.txt?ipv4 HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Length: 8
Via: 1.1 google
Date: Thu, 30 Mar 2023 13:52:43 GMT
Age: 24605
Content-Type: text/plain
Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7af19a5145a4ee99bdf18831bad04bfd
7bdd2a4785b999ef54a2644211d2b2b7190fb8e1
3237bf0111ecdec3615c4d2d49a602f48f800335d0194f52b600bdaefbd63ed0

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3237BF0111ECDEC3615C4D2D49A602F48F800335D0194F52B600BDAEFBD63ED0"
Last-Modified: Thu, 30 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17098
Expires: Fri, 31 Mar 2023 01:27:46 GMT
Date: Thu, 30 Mar 2023 20:42:48 GMT
Connection: keep-alive

0hlr9a8jxb.lspower.xyz/usps/verification.html

188.114.96.1

200 OK

11 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/verification.html
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (969), with CRLF line terminators
Size
11 kB (10703 bytes)
Hash
e483a3212a7b63f518c4731a3cc3144a
72d6c7c604ccd89ad5fd43e07a0cc48f66c430f8
d3aacc1a20374ce01af6c7da028b2d914552aad8ae600b4b9589ff3cc1083503

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/verification.html HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Thu, 30 Mar 2023 20:42:48 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 28 Mar 2023 04:29:01 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rOIu%2BZ%2FdfJWoIFu%2FtLRW5tHS0wRO2a3USYfDfPR7gtI7inG41awz3GcmAo%2BmULHEL3B%2Ftp5bKWlOLnA3PAgcfgw0zSjDqxQuTsPXT1xF05zvi7bDlsyF14LfwMtOFN95MvSnZJ%2Bq1sFl"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e64adf80b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
76218c893040d958ae1c4231cdd2133c
6a7b336dee91d4aec26ace0a5883ecdfac52e68f
d35492b04d16ed00e9e195e7c84c99aa6a2b8a93abeb656baae0918986f0a7e4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D35492B04D16ED00E9E195E7C84C99AA6A2B8A93ABEB656BAAE0918986F0A7E4"
Last-Modified: Wed, 29 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11615
Expires: Thu, 30 Mar 2023 23:56:23 GMT
Date: Thu, 30 Mar 2023 20:42:48 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8e0c84bb4c8b23c3953fa21ed9609304
bba386505b766cebba17189ebe8219b2a644ce28
303be01b154868d266380af88c77b7db1c9b427540e19d4927b42364e9adcb23

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "303BE01B154868D266380AF88C77B7DB1C9B427540E19D4927B42364E9ADCB23"
Last-Modified: Thu, 30 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18243
Expires: Fri, 31 Mar 2023 01:46:51 GMT
Date: Thu, 30 Mar 2023 20:42:48 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: qotJ4TutbUPGBRX9Ts+eElT15DtrlyAZamTVxtPE3qmw9ekR+Q4JsX5ow1a1+vdy7ZwyYWyFVDc=
x-amz-request-id: SRYVCTZ9R9SBSFJF
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 30 Mar 2023 19:45:56 GMT
age: 3412
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=NO&count=30

34.120.5.221

200 OK

50 kB

URL HTTP/2
getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=NO&count=30
IP
34.120.5.221:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (65536), with no line terminators
Size
50 kB (49639 bytes)
Hash
10a3aec6714086d825ae94a8ed5003bd
2aeaa53785acc61a088049793e31e535890bdffb
164bea9647044637a0029735bac8004baf37024a3cf7a0772a75a5da04a9461d

HTTP Headers

GET /v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=NO&count=30 HTTP/1.1
Host: getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-location: global-recs.php
tcn: choice
x-frame-options: SAMEORIGIN
status: 200 OK
x-source: Pocket
pragma: cache
p3p: policyref="/w3c/p3p.xml", CP="ALL CURa ADMa DEVa OUR IND UNI COM NAV INT STA PRE"
x-cache: Hit from cloudfront
x-amz-cf-pop: SEA73-P2
x-amz-cf-id: 94CH4ej0g70nN1VpyF8rqI5HasetvGY_IPhpWbduDWPOZT_FMeaHrg==
content-encoding: gzip
via: 1.1 33d72803ad26b392c1b578a2b1276580.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 20:37:55 GMT
age: 385
content-type: application/json
vary: Accept-Encoding
content-length: 49639
cache-control: s-maxage=900,public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 30 Mar 2023 20:42:48 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b93010cbf31ba3ec785b4088e5d0f529
c0f1ab8a2aae3c445a8f24959a4eea433a345caf
2cc1a5865dee7636b82a68deddd3aff8b697e846e37789a694cc3c7c47340590

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2CC1A5865DEE7636B82A68DEDDD3AFF8B697E846E37789A694CC3C7C47340590"
Last-Modified: Wed, 29 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12126
Expires: Fri, 31 Mar 2023 00:04:54 GMT
Date: Thu, 30 Mar 2023 20:42:48 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
bc86ef2a0cee04915bc360f5821adc8f
3658f9028cce204d38f7f48fcfaa2a8e4f54383a
aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Backoff, Content-Length, Retry-After, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 30 Mar 2023 20:16:07 GMT
content-type: application/json
age: 1602
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

tools.usps.com/global-elements/footer/images/social-twitter_2.png

192.229.221.165

200 OK

1.8 kB

URL HTTP/2
tools.usps.com/global-elements/footer/images/social-twitter_2.png
IP
192.229.221.165:0
ASN
#15133 EDGECAST

File type
PNG image data, 50 x 48, 8-bit/color RGBA, non-interlaced\012- data
Size
1.8 kB (1842 bytes)
Hash
4f6b06552f2054fecb5a3ab3956d7a79
c1257b76200738ad53147be110920f84efd479b3
248385895aacd78d7a7b045cd5109103c2f849bbaef9cff5980d59823a620c91

HTTP Headers

GET /global-elements/footer/images/social-twitter_2.png HTTP/1.1
Host: tools.usps.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 80613
content-type: image/png
date: Thu, 30 Mar 2023 20:42:49 GMT
etag: "732-549b12f59b300"
last-modified: Wed, 01 Mar 2017 20:30:36 GMT
nncoection: close
server: ECAcc (dcb/7E88)
strict-transport-security: max-age=31536000 ; includeSubDomains
x-cache: HIT
x-frame-options: SAMEORIGIN
x-ruleset-version: 5.1
content-length: 1842
X-Firefox-Spdy: h2

tools.usps.com/global-elements/footer/images/social-youtube_3.png

192.229.221.165

200 OK

2.5 kB

URL HTTP/2
tools.usps.com/global-elements/footer/images/social-youtube_3.png
IP
192.229.221.165:0
ASN
#15133 EDGECAST

File type
PNG image data, 50 x 35, 8-bit/color RGBA, non-interlaced\012- data
Size
2.5 kB (2461 bytes)
Hash
e38ff6af4b8ff088fcb2dc92410b759b
529c88413dbc330fa05a0629b2084ca7931f453e
c2b609bbc0ed5b17740df6ab378bfcbe068e3b08d85e85b2d9dfbe6dd3c6be95

HTTP Headers

GET /global-elements/footer/images/social-youtube_3.png HTTP/1.1
Host: tools.usps.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 77368
content-type: image/png
date: Thu, 30 Mar 2023 20:42:49 GMT
etag: "99d-549b12f59b300"
last-modified: Wed, 01 Mar 2017 20:30:36 GMT
server: ECAcc (dcb/7F32)
strict-transport-security: max-age=31536000 ; includeSubDomains
x-cache: HIT
x-frame-options: SAMEORIGIN
x-ruleset-version: 5.1
content-length: 2461
X-Firefox-Spdy: h2

tools.usps.com/global-elements/footer/images/social-pinterest_6.png

192.229.221.165

200 OK

2.3 kB

URL HTTP/2
tools.usps.com/global-elements/footer/images/social-pinterest_6.png
IP
192.229.221.165:0
ASN
#15133 EDGECAST

File type
PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced\012- data
Size
2.3 kB (2325 bytes)
Hash
010bf7d7901ccaa3905cfe4b7c1cb50d
9c174f76a3ed50a173637d44793d6bc15a818112
67d664b844fdba0588665c6f1986b25fcb6d99e5122a455c36da8622f1eaab62

HTTP Headers

GET /global-elements/footer/images/social-pinterest_6.png HTTP/1.1
Host: tools.usps.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 80613
content-type: image/png
date: Thu, 30 Mar 2023 20:42:49 GMT
etag: "915-549b12f59b300"
last-modified: Wed, 01 Mar 2017 20:30:36 GMT
nncoection: close
server: ECAcc (dcb/7F0A)
strict-transport-security: max-age=31536000 ; includeSubDomains
x-cache: HIT
x-frame-options: SAMEORIGIN
x-ruleset-version: 5.1
content-length: 2325
X-Firefox-Spdy: h2

tools.usps.com/global-elements/footer/images/social-facebook_1.png

192.229.221.165

200 OK

1.9 kB

URL HTTP/2
tools.usps.com/global-elements/footer/images/social-facebook_1.png
IP
192.229.221.165:0
ASN
#15133 EDGECAST

File type
PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced\012- data
Size
1.9 kB (1873 bytes)
Hash
5d1fed200f7befa569074a293cf2abed
11bacbc9debe99986d9a6e974e9a819aaa74be29
9d0ef8aa34abec770b6a9fb4358842a29413d08c0d1e4b74f5c4c31ab477c14c

HTTP Headers

GET /global-elements/footer/images/social-facebook_1.png HTTP/1.1
Host: tools.usps.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
age: 80613
content-type: image/png
date: Thu, 30 Mar 2023 20:42:49 GMT
etag: "751-549b12f4a70c0"
last-modified: Wed, 01 Mar 2017 20:30:35 GMT
nncoection: close
server: ECAcc (dcb/7374)
strict-transport-security: max-age=31536000 ; includeSubDomains
x-cache: HIT
x-frame-options: SAMEORIGIN
x-ruleset-version: 5.1
content-length: 1873
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/bootstrap.min.css

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/bootstrap.min.css
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/bootstrap.min.css HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LbBFY4lRbWoXJfvt%2Fss0mgXNFfJvmvblV2k4fvsgryEKT2YPgJQOZO0PltUBDpTp2bvvgTlHC1DsalNzmA9CV1wYzorkDVo%2FHOJqjZBSNMJHn6YzRpftcXiSyNaVgZSDhWDZqVgpM8hF"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6809200b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/main.css

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/main.css
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/main.css HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sDAiYcVJqlbixPx%2B7G4U8i3dGY1Ku%2BPPkWOwSOcMc8mv5S%2FTBJpcA5rZgS3P7ap6QJz6qeoPAjZIDDrKbY2xPgeMMINZirx4njskBFeI%2FtYd%2Fo0I25Z0hqHn8GwvgEmOCh2fR2GAl5e6"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e680ed8fabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/megamenu-v2.css

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/megamenu-v2.css
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/megamenu-v2.css HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v7cN4Il6Fn7DqjA4Px2MDKQPFli8S3rK%2BKCTfFS2TkJfVDx0IO%2F%2F3o12396kVHf6VHmtWg4MBIhsNIqABMnCwz7l%2F198cYAzGCNVdSqwqg7%2FGfolvvZqDiS%2F7LI2Nuq%2FM9%2FB9kRVbvxQ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e680a0bb4eb-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/layer/layer.js

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/layer/layer.js
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/layer/layer.js HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K7nFlLR%2B2BCjd0TGEHZ9F7TvkCvwmMKdIxwdkTOfz02%2Fs%2Fcs8mRH3PLn8AAGbignTP4W4lHUnwWDCFO9GddfsJZXa81hfBagHsGyAMa2ENYjFh5GiG3klAHC86aTzjJPiltLkH99dXzZ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e682e79b524-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/jquery-3.2.1.js

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/jquery-3.2.1.js
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/jquery-3.2.1.js HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3zEd%2BFBo2BDKaorZvh8iBiz%2BazsP0OpPww1Q3GN70nj1%2FhYr1jt%2BD%2FzG%2FAWnIAWa9mKsyDCViVeT8hUlQyUekO6iw%2B8XGTBtKwjL02hQ1NdrB59HRIAOAY5gOkC9u9ZYQrfRgnFcybVB"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e682c70b515-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/main-sb.css

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/main-sb.css
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/main-sb.css HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QRu6fLQqGSiw7KNkFVXDsNKkr4OGXn5q7ZaaC3hJOczu93pKiF5V5oVFjrlmCQfl0%2BXgN9%2B0nQs1jyC%2FaBZDDSkD21xhQVKYbz%2BcpoWMdbpfcMvBJH7f5oBxEXMJxwfIY8LrtwTLI8hm"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6829b21c0e-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Last-Modified, Alert, Backoff, Content-Type, ETag, Cache-Control, Retry-After, Expires, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 30 Mar 2023 20:17:26 GMT
age: 1523
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

detectportal.firefox.com/success.txt?ipv4

34.107.221.82

200 OK

8 B

URL HTTP/1.1
detectportal.firefox.com/success.txt?ipv4
IP
34.107.221.82:0
ASN
#15169 GOOGLE

File type
ASCII text
Size
8 B (8 bytes)
Hash
ae780585f49b94ce1444eb7d28906123
7d5ca8c0c03e883c56c4eb1ef6f6bb9bccad4d86
81b2bd4ea98c8db66554fbc8d7637a1a69a130f331feb732b75caab4c4868fd5

HTTP Headers

GET /success.txt?ipv4 HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Length: 8
Via: 1.1 google
Date: Thu, 30 Mar 2023 13:52:43 GMT
Age: 24606
Content-Type: text/plain
Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600

0hlr9a8jxb.lspower.xyz/usps/static/usps/layer/layer.js

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/layer/layer.js
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/layer/layer.js HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 0
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GVhDMDx2wmpcV61w%2BvqOydAKbUdW%2BvESDgMuDriL9pA52SepOn9aubviglzVoHaZ1aLxgjT77g4Orf68LAAhDpMXG%2Bai%2BUQwvBrrl2SmDTihbfNsUuk%2Fc4OoeNwHHqVDSVoigranKKmn"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6a58c1fabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/main-sb.css

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/main-sb.css
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/main-sb.css HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 0
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fP%2Bs2XMI0xIbr4uVfgeBiibJKOOS1gaPQS3%2FlgP9%2FB17va9GauwD2b6qu6Pp74p52O2WVrYvAAmL2n6iSGqNFarTp7S1NJO2UdB6Acq9fn9TKxXpROFYr%2Fd7fYvEQA33gpNze%2B9FiRGY"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6a8d6eb4eb-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/footer-sb.css

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/footer-sb.css
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/footer-sb.css HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XFJET1WjRqzEs4j2kbJOVnqdpStnx7hfLVfFwts0dELS7qeb5j8sq7sByHlRIcDl3xIEExnWiNP0%2BUQ%2FRgpSmUZHEpUb05L9XtK0FuEH8sNeGrVC878uwZKdHjCt42b%2FvZZM7nB6UIa1"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e69aaec0b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

ocsp.digicert.com/

192.229.221.95

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
192.229.221.95:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
ba364e422ec1cdd9965876020d80075a
a0d6d06766f9eeca919d90cc07a583385ca9a57a
40a50fd9ac56c5f069c960cda1469b628259321f560177d7aadb04b1a9f0014c

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4065
Cache-Control: max-age=159624
Content-Type: application/ocsp-response
Date: Thu, 30 Mar 2023 20:42:49 GMT
Etag: "6425b0f0-1d7"
Expires: Sat, 01 Apr 2023 17:03:13 GMT
Last-Modified: Thu, 30 Mar 2023 15:55:28 GMT
Server: ECAcc (ska/F775)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
782ca4845ea5e0ec981e33231b1e61cb
032116b75e124c57877524e9e4f523b6d7c65820
94d007862fc7a4cd67f582ff22f2339619177435559c1dd5075a08c7240f3520

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94D007862FC7A4CD67F582FF22F2339619177435559C1DD5075A08C7240F3520"
Last-Modified: Wed, 29 Mar 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12938
Expires: Fri, 31 Mar 2023 00:18:27 GMT
Date: Thu, 30 Mar 2023 20:42:49 GMT
Connection: keep-alive

0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(2).png

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(2).png
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/go-now(2).png HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c1Rra7HrSRgfSl2YbWd2FmLx7nGV%2FjaGEY2U9ayTPzRCBNBCE7hJucgbfMPcRQPYLwRyYeZtkZL4iHTWOYJIQX5oF2ly12D6MfCLEcgKX2%2B79K82gFpBovG9vJS2KObIbQFxQRJmzDBe"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6b4cfa0b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

shavar.services.mozilla.com/downloads?client=Firefox&appver=96.0a&pver=2.2

44.238.157.127

200 OK

8 B

URL HTTP/1.1
shavar.services.mozilla.com/downloads?client=Firefox&appver=96.0a&pver=2.2
IP
44.238.157.127:0
ASN
#16509 AMAZON-02

File type
ASCII text
Size
8 B (8 bytes)
Hash
29fc57841962e407cb50c1be60284bf7
ce968a77e2996da5eee8925182318f171ccdce47
ae7e7075247dcfad763f1e131aeac3d2e756bb03d48b0d315a50c69636e5dc8b

HTTP Headers

POST /downloads?client=Firefox&appver=96.0a&pver=2.2 HTTP/1.1
Host: shavar.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 773
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Date: Thu, 30 Mar 2023 20:42:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 8
Connection: Close

push.services.mozilla.com/

35.163.121.16

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.163.121.16:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Cc/YwLrEmtOOl/OYC/HqrA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: /xFrmt69Pv67kCo4hrxD//JrD64=

0hlr9a8jxb.lspower.xyz/usps/static/usps/change_address.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/change_address.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5014 bytes)
Hash
1e0bb5a6869fb1b79c17da34f3115d60
3391745f95afce4a8f377cb3b77c68e3571b7e64
bf81fd88a5200e1b9c95c9c817c1fcc164a9cee092ec38f65acf818e5bb84447

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/change_address.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W%2Fog2CT8CsMgvbqcMoeGV%2Fp9m1VkVRPcBfRWKhMOas1mFIYspy30YqI7toOBNFLde2eiRFCsDCzYWC45p4%2Ft2sVIjn4LesZFiL%2FZvIxpvqfkS0Gn29CJuaXbNxiOSCOl8QNP5RkLLgoq"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6b495ffabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/holdmail.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/holdmail.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5003 bytes)
Hash
02f8886a1ee23abaa107d40648379b83
7c5ca9dad3ab75a143569000dd8cd0451baffde0
1afb2516844a7b2b04f6af0f765a6322b3fbf7df857704b1ea10897431465eb9

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/holdmail.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dsOkBdOYXfYA6Uj2I8tpWYJ4J56FoiQAaq6wl0ux6rzJJhNOziaS5B41HBX%2Br75nX%2BpYaQGqBkfPY%2FByJoPN0x29ahB3UeFuGExhkr3eZlzrycah%2BW72pHO96b4RvRr%2FXlaVjZVtqpRk"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6b4e49b4eb-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(1).png

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(1).png
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/go-now(1).png HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dtitQcZZo16PoANT%2Fondp4MkHkIOyVe9D73IIHte7Wov8AgjdotcKhhZyBnJbykE4C1u1vForrAvDA2alIKIGCubvSBr5KP5%2BIlhitm3%2Ff0q7ftAB5hpQPxl%2FU89F7cE6k%2BWvgJOqZOl"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6d0edc0b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=%221680203867219%22

35.241.9.150

200 OK

22 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=%221680203867219%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (22067), with no line terminators
Size
22 kB (22067 bytes)
Hash
33dbe9c02d75155dc385c618f61d562b
478a0ed1665441038013286bb0018bb127de8862
5666a032bb58c6ce5f5eb90aa6113f03e00ef4ec69ea56678b1c021badf59b81

HTTP Headers

GET /v1/buckets/monitor/collections/changes/changeset?_expected=%221680203867219%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Backoff, Content-Length, Retry-After, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 22067
via: 1.1 google
date: Thu, 30 Mar 2023 20:21:56 GMT
age: 1254
last-modified: Thu, 30 Mar 2023 19:17:47 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/addons-bloomfilters/changeset?_expected=1680201445669&_since=%221666204638208%22

35.241.9.150

200 OK

49 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/addons-bloomfilters/changeset?_expected=1680201445669&_since=%221666204638208%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (48988), with no line terminators
Size
49 kB (48988 bytes)
Hash
6b4cb6acccb2e110978175dd713538d9
fdc93e3ac37e90c0206a5d58ab241f05f1367d2e
ad955db5572d6dcee5dc2add8aab401a939b1d1631da31439a6464de13d2e985

HTTP Headers

GET /v1/buckets/blocklists/collections/addons-bloomfilters/changeset?_expected=1680201445669&_since=%221666204638208%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Backoff, Content-Type, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 48988
via: 1.1 google
date: Thu, 30 Mar 2023 19:52:33 GMT
age: 3017
last-modified: Thu, 30 Mar 2023 18:37:25 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
x-amz-id-2: NIjjPGWTS69csSURNq3QmMG8TtaYn8dLG0UO9EmYIsvMMhpAxAmXDpL6CfznJRyBASCqYsd0EPc=
x-amz-request-id: BBSV09PMH7RQ784Q
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 30 Mar 2023 20:33:49 GMT
age: 541
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/po_box.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/po_box.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5008 bytes)
Hash
2afedaa1a84fa97da10f4d75dc43d855
22f79dc8c408b83127e4eeaf3846b0d645bead39
6713840ba844f31fe1b4b8dd97f73e7b2ad12a5cc0eeaa33cfc1fa587370d464

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/po_box.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xmLGgCcG99znAeh0LJxG7M4MOcCC3LcrvJxNmZ%2BvWANlZj37TUuBvqQhvrnRaWhi06pFZWloy9FfM1yPuRFpfbKYhgg1fZcrfJodn0evzry0h5%2FACgbVN8q3fG96aOV1g2vjgVYsIj1Q"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6b4c241c0e-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now.png

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now.png
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/go-now.png HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GK%2FhWjDYJuW6yjLRDViK952zd2icxZi8htSVJu2IZOdbfNG62YWyQwVCpRXHPxMhS7sMfovP6cmVi%2BLJTVhMDBnM6UKMn0Ah9MA%2BBgDzcsNzS6z7WAAcSYZDsV2JebUoxjxueMmXA5A2"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6e9be7fabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
ed282214b024a7895d90e229e92bb1cc
1f447aa59287ce2b45860a1a909d005a41305f77
a35ae9f89cbc77ed5fe849acdc2701592799c335f2674776d69c25bca0a00c2e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Type, Alert, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 30 Mar 2023 20:28:18 GMT
content-type: application/json
age: 872
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/schedule_pickup.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/schedule_pickup.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5012 bytes)
Hash
691ff9d477b15700ecb61f2bf2bf898f
8621d4ed65a0262fb63e5a70a97642ee0e92c78c
bec8d81eb2c2a5607967b7cb02f994bdba758843bd0730262d3441d591164355

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/schedule_pickup.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hgc8ELffmUkt6OSeFHWrUKJHEC0Y8wqfpUBvFziy4QDuVbIk3u0wfar4eFNv42zgERtnLuG47HCy978PczuyVSSADV1UWVqFqqSVPX6hvuwCT21GFmQF%2BFYq9tHrc6dY%2B99R1MASuK0Y"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6b4b69b524-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/free_boxes.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/free_boxes.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5009 bytes)
Hash
e09c368acde03fadbee754de93880ffa
13470b1bac09a0e597d16a46fab6b0919ef56b86
50289034685a529aedc0be782177f30a2f3f8786c93d6381100b350868ea6d55

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/free_boxes.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UwIAde%2FvYocXS9BTD6SqSBXEvQukdDUQkpul6uMwYkY32fQm7g9DeoocERubM7Fg83N3CiHt%2FScYQ38SV6B%2Fju2dWB58WAmM2NXqDPPE8d%2BJbC4vy1jOaeqDtQyn8TKP%2B1cydduZtBvX"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6b489cb515-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6a96e18be5eb21fc0632312e355f1d29
ec00d631a7b0f1734a3ca78c571f4518169507ff
19052efbeb4baff72a64f9df8821e0937890ecfee2bfe918c646b3d143258218

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "19052EFBEB4BAFF72A64F9DF8821E0937890ECFEE2BFE918C646B3D143258218"
Last-Modified: Thu, 30 Mar 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5486
Expires: Thu, 30 Mar 2023 22:14:16 GMT
Date: Thu, 30 Mar 2023 20:42:50 GMT
Connection: keep-alive

firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/8038652a-6557-460a-858c-84f19a5a0987.bin

34.111.73.144

200 OK

807 kB

URL HTTP/2
firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/8038652a-6557-460a-858c-84f19a5a0987.bin
IP
34.111.73.144:0
ASN
#15169 GOOGLE

File type
data
Size
807 kB (807180 bytes)
Hash
914be443bdfbe8a1c3ded61e1c114bd6
4fe7c5ff83f6a29e6699f4cebc17550891504661
41b036d0c889509d547296b238027a063c313261ad52d5f7bb81922011791857

HTTP Headers

GET /staging/addons-bloomfilters/8038652a-6557-460a-858c-84f19a5a0987.bin HTTP/1.1
Host: firefox-settings-attachments.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: Wd2+EBlY7PBxlmtHxPIPsT5pgsjRxQQDDrKBdsbm9nqP99VGZ6s6OP4YbL2uB8aaiX/H2WEfVy0=
x-amz-request-id: XFCVPTEAB3J62XPY
x-amz-version-id: K1ODzappZsD35qeu0OM5zvs_BP1eybj7
accept-ranges: bytes
server: AmazonS3
content-length: 807180
via: 1.1 google
date: Thu, 30 Mar 2023 11:49:24 GMT
age: 32006
last-modified: Tue, 10 Jan 2023 12:38:46 GMT
etag: "914be443bdfbe8a1c3ded61e1c114bd6"
content-type: application/octet-stream
cache-control: public,max-age=604800
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(4).png

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(4).png
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/go-now(4).png HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P6%2FxCJ90J3Ermpu1SzdSbMHIPRvt6jDhVi2887MWymGQbx9LzjpxIMseCH%2F5oKau7%2FBE3pIjIB0nKYlbfpJTn9nIQx0a6dGXpcRbqPo07kTSOpGkePMuaUduUeiNjgKlmwv6rwo0FJGv"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6f8ce3fabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/gfx/changeset?_expected=1680018554787&_since=%221643818378440%22

35.241.9.150

200 OK

10 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/gfx/changeset?_expected=1680018554787&_since=%221643818378440%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (10096), with no line terminators
Size
10 kB (10096 bytes)
Hash
ceb5afa740b44e3ce7f4227d4b439113
c61643d28463d062f8ffee3b8ea1cd89cb7b5a6c
0a2f9b659d2e0c816d958925eba9ce4e1387ef3571542036b5c9641f0f364c26

HTTP Headers

GET /v1/buckets/blocklists/collections/gfx/changeset?_expected=1680018554787&_since=%221643818378440%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 10096
via: 1.1 google
date: Thu, 30 Mar 2023 20:01:23 GMT
age: 2487
last-modified: Tue, 28 Mar 2023 15:49:14 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/changeset?_expected=1678922485545&_since=%221661199949574%22

35.241.9.150

200 OK

25 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/changeset?_expected=1678922485545&_since=%221661199949574%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (25354), with no line terminators
Size
25 kB (25354 bytes)
Hash
1904d8293b5f2c002df47873f23e827b
3ad77fb86caaf84886bcd6a811e39c918ba39a34
7600832994dcc92fd44775fed282ca3fdf7baf4333d4ad8310ad0b50d5e010ce

HTTP Headers

GET /v1/buckets/main/collections/search-config/changeset?_expected=1678922485545&_since=%221661199949574%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 25354
via: 1.1 google
date: Thu, 30 Mar 2023 20:07:14 GMT
age: 2136
last-modified: Thu, 30 Mar 2023 16:36:43 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments/changeset?_expected=1680130245939&_since=%221666279968541%22

35.241.9.150

200 OK

71 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments/changeset?_expected=1680130245939&_since=%221666279968541%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (65536), with no line terminators
Size
71 kB (71260 bytes)
Hash
1cb5e8acb1eaa3c494afe656851003e0
c98665c9870b343135d1061880ab6ea91715e791
809036fd3df57822dac1a263f95920f8406d5b5f9fd7f195f3758ca451a6e3a6

HTTP Headers

GET /v1/buckets/main/collections/nimbus-desktop-experiments/changeset?_expected=1680130245939&_since=%221666279968541%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Type, Content-Length, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 71260
via: 1.1 google
date: Thu, 30 Mar 2023 19:52:40 GMT
age: 3010
last-modified: Wed, 29 Mar 2023 22:50:46 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(3).png

188.114.96.1

404 Not Found

109 B

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/go-now(3).png
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
109 B (109 bytes)
Hash
3bf8e5b194e806e33f65dfafeb99b824
e47321a5ce2bd7d63c3981c10dff614b0a449ba7
10dbaa1586440560d323e0d6aae3dd0d915e3be05b4975518b61190657827a3d

HTTP Headers

GET /usps/static/usps/go-now(3).png HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QOC8DzI8Kcclm6HN9IqW%2Fsi2wkif%2FRSdJOlBA8tLojL6107YckErtOhdpB7nbMhBGTaOMPT3uPoOgqN2qXOG%2FeyNBb4n5veTO2fFR9FBFU7Gc5Yeij4uMC%2FgCxOZKgLIzUqTYFpALg6x"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7b032e6fba93b524-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/normandy-recipes-capabilities/changeset?_expected=1680048066000&_since=%221666483264567%22

35.241.9.150

200 OK

94 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/normandy-recipes-capabilities/changeset?_expected=1680048066000&_since=%221666483264567%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (65536), with no line terminators
Size
94 kB (94145 bytes)
Hash
f4572adefd3ecea7598420c956ee846a
730c7e0818c2be35cceaf3ec67ddd2556678510d
fbefcc3fc55ca43a43fca916443ddab8c96f406c3ea1a79dd862f3d71dadb4ec

HTTP Headers

GET /v1/buckets/main/collections/normandy-recipes-capabilities/changeset?_expected=1680048066000&_since=%221666483264567%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Length, Retry-After, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 94145
via: 1.1 google
date: Thu, 30 Mar 2023 20:22:38 GMT
age: 1212
last-modified: Wed, 29 Mar 2023 00:01:06 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/logo_mobile.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/logo_mobile.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5012 bytes)
Hash
0ec9c07b3d3b82275b4eb0cc5e8a46bc
887ba8a44ba59109bae7392f63b1db2222bdcc7e
5d3f3096ae87e2474f1be4a3844d5db207c12fd3e08c9c08cc450dab605ad0d8

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/logo_mobile.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=12o%2B7jDkL2mEmCNuGDXcdYM3q7FhkWMNXjGhxUCVLX7LoDYtSdbQ633dAGb84qTaglFwxr%2FixIvawuDHlncKgZBowQeY25hA8hjn2yde7EguL%2BgVpyrB5P7VTXk97K5NaSLtAMe67i3w"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6eb8a50b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/featured_clicknship.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/featured_clicknship.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5013 bytes)
Hash
b6faf19807dd155ab70644c142839108
2d9c94b4fb170ad3b2a11208c66b1b17a6c9f8a1
b3f84f2635fb6682527001763d75d330ae6f09b34792cdae34d5dbd3a7e13243

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/featured_clicknship.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0iPB3aox0f4NuPIjZ7Tf6ijgvdHd38xPDyU52FwJgs6MExPE2FZL85%2ButUl3Hb3j89MclU%2FK8IQgpZJ5ZqOIWB%2BrmQELuFfZicAN8%2FC0b%2FPVQjBQU7XKMJaZwFa11IiKcewaDpm8eDDA"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6eab39b4eb-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/fxmonitor-breaches/changeset?_expected=1678202119172&_since=%221662044085942%22

35.241.9.150

200 OK

7.0 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/fxmonitor-breaches/changeset?_expected=1678202119172&_since=%221662044085942%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (6983), with no line terminators
Size
7.0 kB (6983 bytes)
Hash
43e4ae012aa36f9b6a3297174b84121b
114a70a8f2dbe4fa305435ffd386d0bf93009b2e
414f92b77ac1003e257269744bc94665e94eb8932460df4d6b0b80ba8a9ddce1

HTTP Headers

GET /v1/buckets/main/collections/fxmonitor-breaches/changeset?_expected=1678202119172&_since=%221662044085942%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Backoff, Content-Type, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 6983
via: 1.1 google
date: Thu, 30 Mar 2023 20:27:13 GMT
age: 937
last-modified: Tue, 28 Mar 2023 16:36:47 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

detectportal.firefox.com/success.txt?ipv4

34.107.221.82

200 OK

8 B

URL HTTP/1.1
detectportal.firefox.com/success.txt?ipv4
IP
34.107.221.82:0
ASN
#15169 GOOGLE

File type
ASCII text
Size
8 B (8 bytes)
Hash
ae780585f49b94ce1444eb7d28906123
7d5ca8c0c03e883c56c4eb1ef6f6bb9bccad4d86
81b2bd4ea98c8db66554fbc8d7637a1a69a130f331feb732b75caab4c4868fd5

HTTP Headers

GET /success.txt?ipv4 HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Length: 8
Via: 1.1 google
Date: Thu, 30 Mar 2023 13:52:43 GMT
Age: 24607
Content-Type: text/plain
Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600

firefox.settings.services.mozilla.com/v1/buckets/main/collections/query-stripping/changeset?_expected=1678736907773&_since=%221656585893704%22

35.241.9.150

200 OK

1.6 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/query-stripping/changeset?_expected=1678736907773&_since=%221656585893704%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (1646), with no line terminators
Size
1.6 kB (1646 bytes)
Hash
0530a1e9082b795cd4fd4c2b8bd25d70
3f0229439b1d96f80fcb6ab6b77a25feaa8775e9
84fac3b241036cfdcf0f5ded9e9a46d2b49eba4344b3db83755f7268ee21f553

HTTP Headers

GET /v1/buckets/main/collections/query-stripping/changeset?_expected=1678736907773&_since=%221656585893704%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 1646
via: 1.1 google
date: Thu, 30 Mar 2023 19:43:37 GMT
age: 3553
last-modified: Tue, 28 Mar 2023 16:36:46 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/search.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/search.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5006 bytes)
Hash
ac968aab3177455889e738ecfc5a1b09
bc8812f674a138f5bdf7209c8d87225a680304c7
2854ffb3b68b5398598892a1faf356fdfe9ea2119a4acce430964b4ff0f999e1

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/search.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YOgCde9FLBTrAH38BMBn5Q2bVNfckkN%2ByaysuEGoit%2F%2FWEvkKM1%2BOxcxNmkV%2FCzijYwRS6jyf54prHsS%2BmheWWeypAo%2F6qlYWUliUH%2BKDyB%2BgijRaH0Z4T8K87ICzqou2lIgdsj7OPuB"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6f4fbb1c0e-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/hijack-blocklists?_expected=1605801189258

35.241.9.150

200 OK

682 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/hijack-blocklists?_expected=1605801189258
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (682), with no line terminators
Size
682 B (682 bytes)
Hash
1e047b83920b53efa84372fbf1a81bee
e2404b9c4d03d1c58e71884919a54c2f9a3dedfd
7e9d0acd7bc581de92f53a81423bd582b348c3c871a02cd7b26229313d5e6013

HTTP Headers

GET /v1/buckets/main/collections/hijack-blocklists?_expected=1605801189258 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Type, Expires, Cache-Control, Content-Length, Retry-After, Last-Modified, Pragma, ETag, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 682
via: 1.1 google
date: Thu, 30 Mar 2023 20:16:20 GMT
age: 1590
last-modified: Sat, 25 Mar 2023 16:36:56 GMT
etag: "1679762216708"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/location.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/location.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5005 bytes)
Hash
ebd34ee3bf8a0b9176d0bbc7eb4b94bc
a0c156ea7f870eb34aa3cd7ce2f0cc09292fc822
cf5cc1ee78fb9c018bb928ad82488543769663d6544c8dc285b52e615fbc0615

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/location.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1woE%2FT6vOMj4uCJJpvC%2Bdz57b812Z%2FnutZ1kT14TCZ1oVJ1erOv6eBm%2BZOUThCNtQfljmsFl4f%2BOz%2FXFDkH5HxYI%2Fl8VsDI8hyccIHzNEETes5UPVuGaIePSauNnr18FxwOmFFh0r8o6"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e6fce67b515-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/language-dictionaries/changeset?_expected=1673270322227&_since=%221569410800356%22

35.241.9.150

200 OK

1.3 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/language-dictionaries/changeset?_expected=1673270322227&_since=%221569410800356%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (1251), with no line terminators
Size
1.3 kB (1251 bytes)
Hash
544e218878f656b4373563a094716a70
ae8f7f0929f1f4cf0b28eb0a2b5943e148ca61a9
532f508ccf0e693debde8f684a0fd170c3296dfad6f1bb27c672c37af6c3e7a7

HTTP Headers

GET /v1/buckets/main/collections/language-dictionaries/changeset?_expected=1673270322227&_since=%221569410800356%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Backoff, Content-Type, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 1251
via: 1.1 google
date: Thu, 30 Mar 2023 19:47:30 GMT
age: 3320
last-modified: Sat, 25 Mar 2023 16:36:46 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/password-recipes/changeset?_expected=1674595048726&_since=%221642005109349%22

35.241.9.150

200 OK

1.7 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/password-recipes/changeset?_expected=1674595048726&_since=%221642005109349%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (1742), with no line terminators
Size
1.7 kB (1742 bytes)
Hash
c6ffeaa329fe3d4b15ca88fc8d960a12
f3f1fbe76d66e7d72122d56efa5d47a660c758b3
0f4df13e808c9a2caa24aa9c2419b0b14f9a79514f32bedf2addb947dd285608

HTTP Headers

GET /v1/buckets/main/collections/password-recipes/changeset?_expected=1674595048726&_since=%221642005109349%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Length, Retry-After, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 1742
via: 1.1 google
date: Thu, 30 Mar 2023 19:49:11 GMT
age: 3219
last-modified: Sat, 25 Mar 2023 16:36:45 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/partitioning-exempt-urls/changeset?_expected=1675943045406&_since=%221657747510534%22

35.241.9.150

200 OK

2.4 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/partitioning-exempt-urls/changeset?_expected=1675943045406&_since=%221657747510534%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (2387), with no line terminators
Size
2.4 kB (2387 bytes)
Hash
377da5cb5955db6a3bbed6eaf61e789a
64f5e967b2d903ad2934ab11a8c567dbf282b025
60fe6df1f2d1e2e1727f1b8d44c1102f86558928b4df9cd7a92569d04f8724cf

HTTP Headers

GET /v1/buckets/main/collections/partitioning-exempt-urls/changeset?_expected=1675943045406&_since=%221657747510534%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Length, Retry-After, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 2387
via: 1.1 google
date: Thu, 30 Mar 2023 20:29:38 GMT
age: 792
last-modified: Fri, 24 Mar 2023 16:36:46 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/password-rules/changeset?_expected=1679600032742&_since=%221659924409785%22

35.241.9.150

200 OK

772 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/password-rules/changeset?_expected=1679600032742&_since=%221659924409785%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (772), with no line terminators
Size
772 B (772 bytes)
Hash
1150fc438e642be5635e3234834367d9
a421eab9d39f0fefd6a1f2ecda9fc11ceddb646c
2b980c60a311dafdf93d9983c4ed8ac7dea9f7ff61329ffb1e1a24d0909f3d15

HTTP Headers

GET /v1/buckets/main/collections/password-rules/changeset?_expected=1679600032742&_since=%221659924409785%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Length, Retry-After, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 772
via: 1.1 google
date: Thu, 30 Mar 2023 20:37:06 GMT
age: 344
last-modified: Thu, 23 Mar 2023 19:33:52 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/cfr/changeset?_expected=1666894461944&_since=%221659547595259%22

35.241.9.150

200 OK

1.5 kB

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/cfr/changeset?_expected=1666894461944&_since=%221659547595259%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (1506), with no line terminators
Size
1.5 kB (1506 bytes)
Hash
318c328ba16a767b6d94b0cbfc1a8b4d
40dfca34d6034f7bdeb27801f3b485e001699c38
6293349b31e326d2e8e4001e780554226b24584f981cc1325d70e48fbfa69ed0

HTTP Headers

GET /v1/buckets/main/collections/cfr/changeset?_expected=1666894461944&_since=%221659547595259%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Type, Alert, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 1506
via: 1.1 google
date: Thu, 30 Mar 2023 20:40:29 GMT
age: 141
last-modified: Thu, 23 Mar 2023 16:36:48 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
195589ff3c6c50463257f10da16de114
7119aeba010d5c5c224fa544feff6f1761739929
dbb5774621e0eee6f9641f6078a650a78d281019726ade7a52c150f0988cd12b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DBB5774621E0EEE6F9641F6078A650A78D281019726ADE7A52C150F0988CD12B"
Last-Modified: Wed, 29 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5661
Expires: Thu, 30 Mar 2023 22:17:11 GMT
Date: Thu, 30 Mar 2023 20:42:50 GMT
Connection: keep-alive

0hlr9a8jxb.lspower.xyz/usps/static/usps/stamps.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/stamps.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5000 bytes)
Hash
6edc6301df4933e1d0e102950d232a3b
5daac0730e938c7d38ee1166765a070b2112ca4f
bb3d57d9da7220435938bd1e63e1c1fc73fef92668f1db446b08df9a2fdcc18a

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/stamps.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:50 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WtruAM1KKtPL3v4N44pZNTE%2BFSdKd%2BFPuLIrs7yuTm50NRVaziIs8Iy15YMs8ld9RrCpj6oVMpzTNClvq6W41p5g669fdOAyY38A%2BsOe6B%2FEQw75%2FyccyZeyG0tno%2FGEpk5S8ZW1Omgh"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e706d6afabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
195589ff3c6c50463257f10da16de114
7119aeba010d5c5c224fa544feff6f1761739929
dbb5774621e0eee6f9641f6078a650a78d281019726ade7a52c150f0988cd12b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DBB5774621E0EEE6F9641F6078A650A78D281019726ADE7A52C150F0988CD12B"
Last-Modified: Wed, 29 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5661
Expires: Thu, 30 Mar 2023 22:17:11 GMT
Date: Thu, 30 Mar 2023 20:42:50 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/message-groups/changeset?_expected=1670425599656&_since=%221665698079854%22

35.241.9.150

200 OK

935 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/message-groups/changeset?_expected=1670425599656&_since=%221665698079854%22
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (935), with no line terminators
Size
935 B (935 bytes)
Hash
9122f99473d982e0cf08d156d80fa431
0c58a6dc78b365762e6cce14075639d4b5e12b15
5a12e97c12a31b264b4ff70f17bf92ed19aff7cd04029d71d913a37593e3d600

HTTP Headers

GET /v1/buckets/main/collections/message-groups/changeset?_expected=1670425599656&_since=%221665698079854%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 935
via: 1.1 google
date: Thu, 30 Mar 2023 19:58:00 GMT
age: 2690
last-modified: Thu, 23 Mar 2023 16:36:47 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
195589ff3c6c50463257f10da16de114
7119aeba010d5c5c224fa544feff6f1761739929
dbb5774621e0eee6f9641f6078a650a78d281019726ade7a52c150f0988cd12b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DBB5774621E0EEE6F9641F6078A650A78D281019726ADE7A52C150F0988CD12B"
Last-Modified: Wed, 29 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5661
Expires: Thu, 30 Mar 2023 22:17:11 GMT
Date: Thu, 30 Mar 2023 20:42:50 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
195589ff3c6c50463257f10da16de114
7119aeba010d5c5c224fa544feff6f1761739929
dbb5774621e0eee6f9641f6078a650a78d281019726ade7a52c150f0988cd12b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DBB5774621E0EEE6F9641F6078A650A78D281019726ADE7A52C150F0988CD12B"
Last-Modified: Wed, 29 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20241
Expires: Fri, 31 Mar 2023 02:20:11 GMT
Date: Thu, 30 Mar 2023 20:42:50 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2f7d2537-a0a5-4a19-9229-144648b886b8.jpeg

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2f7d2537-a0a5-4a19-9229-144648b886b8.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (12233 bytes)
Hash
db24198518d1a093c5c03e92e53925a2
288898a60e0a029946e7d770d2b0c64b6f3bf51d
4a15da439fa1a3ccdd3d329f250bacaab581287183293c4e367b05c2a83eb66d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2f7d2537-a0a5-4a19-9229-144648b886b8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12233
x-amzn-requestid: 781fd422-c720-49d7-bc90-6f8b18751caf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CkAynHgNoAMFvCA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6424ae76-5327bf334c985816289507b9;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Wed, 29 Mar 2023 21:32:38 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: nwdrJGU7u4C_ZtSQkSASfZ2qj8a31rIr87g_K8YvrrsoVN5yeN8CRQ==
via: 1.1 185f4b03b711932fc7e735c08fdc5abe.cloudfront.net (CloudFront), 1.1 fec77e486350d1bd33f526a760d8b5a4.cloudfront.net (CloudFront), 1.1 google
date: Wed, 29 Mar 2023 21:52:11 GMT
age: 82239
etag: "288898a60e0a029946e7d770d2b0c64b6f3bf51d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F85885238-8732-476a-b37c-1eac5dbc3e90.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.0 kB (6049 bytes)
Hash
253f48aa7cbf667d52cb37fda10cdb1f
e29478b866f90402b48d2b516d01d60a863c9cf9
b4a73ab71250b9e4a3f95e28dbf50dd000e1f338c7c3ac9f3351c1f6d6d3bfff

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F85885238-8732-476a-b37c-1eac5dbc3e90.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6049
x-amzn-requestid: 2d1a2a66-8b63-44f0-83ec-10628a5fcac6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CgvBFFMGIAMFhCg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64235ed3-2a90bf0365925acb3b348489;Sampled=0
x-amzn-remapped-date: Tue, 28 Mar 2023 21:40:35 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: bXiCIy2ZqOyLvougeQikdsmaIJ9BfMPpOO4oU-3nEGY33FQGCm0ZoQ==
via: 1.1 c28e01aa413e9ea602538ccda1511062.cloudfront.net (CloudFront), 1.1 49cdeca097624936e070b73619df7da8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 29 Mar 2023 21:50:29 GMT
age: 82341
etag: "e29478b866f90402b48d2b516d01d60a863c9cf9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff94a70cc-7556-4fae-8603-14d3b253f74c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.9 kB (9859 bytes)
Hash
da174e6ccc9451c5071ba10eeb97f6f6
c38827a9ac1218768839877263e1f2984fbdc454
76da406c8ae8cd6ca8471928f3aec3876aed2c21bc10edc0fbdaef5c100c1030

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff94a70cc-7556-4fae-8603-14d3b253f74c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9859
x-amzn-requestid: c00efe5b-7fdb-445a-a924-75ddd461b72b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: COQPtHizoAMF7-Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641bfa64-3eb90ae703b78e8a06130540;Sampled=0
x-amzn-remapped-date: Thu, 23 Mar 2023 07:06:12 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: nZfXy-IsoHliuLodEocEZlH-IvmIV9G-noSmSEU1wmuMPfBx3rLJ9w==
via: 1.1 02f1a759e4ec9fab6fc17c080dd851dc.cloudfront.net (CloudFront), 1.1 331202b5b8aab67acbf389883133f256.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 11:37:45 GMT
age: 32705
etag: "c38827a9ac1218768839877263e1f2984fbdc454"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffda18d5e-b73e-4202-b1f8-d36a10bc29f6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (6975 bytes)
Hash
c8de7c61ab5f849628db707ae7587904
f040cba140c3510c5e6fc0ae1e56505c3749d525
492ea40ba548983fcd3bc41a1e29b6337e4e4e83b1248dcccf82cc1e7e22df88

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffda18d5e-b73e-4202-b1f8-d36a10bc29f6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6975
x-amzn-requestid: bd3a35e2-22bc-4b5d-8c46-74f21205e512
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CkA4qHKCoAMFR4Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6424ae9d-7f1dd1175a4580f75a614254;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Wed, 29 Mar 2023 21:33:17 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: Q39PWwkZfIyNwmE_PBk86LfcqDKgLlbLsU2ewpLgeCv9hehTL9Gvsw==
via: 1.1 8731d2a1a7d15f67b588bf58f652f9f0.cloudfront.net (CloudFront), 1.1 d16c3f15bd14953a9d4109eaaa991de2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 29 Mar 2023 22:04:53 GMT
age: 81477
etag: "f040cba140c3510c5e6fc0ae1e56505c3749d525"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b95f765-7590-4263-b0a3-4db9c87a60df.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10271 bytes)
Hash
424b55535e5fd622b2fc96aac1246324
cf7cf08aa8969a86bf03695af2129686fd62fe86
c4bb26a7b2c431282b53b4df9999b9cc8e61369a79c606688a76499b31a65127

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b95f765-7590-4263-b0a3-4db9c87a60df.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10271
x-amzn-requestid: db0d1fe4-060a-4e61-90f3-ec9befee1295
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CkBoXGh5oAMFfzw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6424afce-2e9251552b4acdcb19e02dfc;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Wed, 29 Mar 2023 21:38:22 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C1
x-cache: Miss from cloudfront
x-amz-cf-id: 1cXec9_e-KpzyTwiHaNAaf0y5i12tw7BkZTXnduS5ek7yAAZ0LXTWw==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 d0387b833e3ca8cb748a1296b4b4bf2a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 29 Mar 2023 21:48:07 GMT
age: 82483
etag: "cf7cf08aa8969a86bf03695af2129686fd62fe86"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc2075fc9-4e24-4d01-853a-8aa29cb2b832.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.5 kB (4549 bytes)
Hash
2021c271f9290204bd14cd2a3a1680fc
39b68cbcaba381d63dc67bc289fb67c849adb9ff
a84c5dd1e52d7cd535e04cb455891a1442000eb0e4381031c976b4cf3be96f2f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc2075fc9-4e24-4d01-853a-8aa29cb2b832.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4549
x-amzn-requestid: 70e07309-5fc5-4307-b455-29a187eae0d6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CkBoBHFFoAMFx5Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6424afcc-298f18fd0cf0b37465a74c13;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Wed, 29 Mar 2023 21:38:20 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 0bqn9l0Lqaavg48Uv9xRI7-zbdu1OfBuxITVjbhnIhmT79W_dzC72g==
via: 1.1 f193acd25f2604e189bfbfaf539aaa06.cloudfront.net (CloudFront), 1.1 8ae6af4d17aae7471e5fe2792eb6abcc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 29 Mar 2023 21:41:40 GMT
age: 82870
etag: "39b68cbcaba381d63dc67bc289fb67c849adb9ff"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

0hlr9a8jxb.lspower.xyz/usps/static/usps/logo-sb.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/logo-sb.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5009 bytes)
Hash
0bd619794e295c7815dbae6997c3db0b
14be692c34dbb0ca90ae11c42ff7a8eb673f6416
c77cf0cf20cb049de352bf838abe4ec87d03e4a2ad47b02515e6a6d5b1457d2e

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/logo-sb.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R2JN6bO2asYhISTX6EwafVfF0p9MtjCzJ21prbK4W4GXazaukULyzdIp%2FVdt3w%2BcYARrmBoH1%2BXUrhxHgrlVYHzZre2uTkRCQFCafDbAr3i2bnrIqo%2BydZAvjYTFL7QEmZKpznrJ3Dpv"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e717d35b524-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/calculate_price.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/calculate_price.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5011 bytes)
Hash
8f89ba584091fd73cbd953ec52702334
ffb01cf2b8197963e3c44b6f3aebe091b738d962
293c665cb15cee7c23fcba17c7659527fbdbbe1e16dc425d4e8926d887db8f2f

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/calculate_price.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pmLY52YJjClSFA2Xk0EBo%2BXbvuhg8%2F9WpH9es25ewQ0xnHgiuCqdBkUbo7AoavgfIYxZOQli4wBpxdB5jotXSvBC1KVlQxgAZuAfTG1bpbTZR5BW%2BUz9ypU0xdlbfhyLN3t79CxB1yIX"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e721918b4eb-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/hamburger.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/hamburger.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5008 bytes)
Hash
dfa8a34654e86b2e318c0f13a2cda00e
f3265dfbcd6b1ad1ed3cbe5fe3061601b90a901c
995febbdedffb8c99d1f709c1367b3179d1c828a6940eab7b0c87a3bd33a441f

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/hamburger.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5j3saVIpxJjdMH9GsxBGmQyd6YImTJjbaMLIsfLP71Z2yjcdMCWfzpyRmQT%2BFYCxjK8mqa%2BxIAABBejb5wKcH%2BUyAYRaBMk%2FJjI1mAd8it22DLgA4NUFXPhaY13N5mx8lyMlW0gLVA4P"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e721c170b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/find_zip.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/find_zip.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5009 bytes)
Hash
059fabd300069ee33fbdfac224eae1ea
76d20957ba7421896902e52c57fcb19149c44593
e659c6178c3888b5e94a538f1849c56f9c4cd48d554481170a37f75b2f00a739

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/find_zip.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=USjUWKLSaYJ62Qght7csXQLhCtL8ee0424iJbqtjORTucRJOII0vwMBTXQi9e4jCGBFBbY9C9XA8aLSi2heabdVWZ8HYX4%2BBlbc9KeeWkQmFIxEC8JG2YnSq8Sp9hvmavXqB%2B4QD9YzJ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e72bb0f1c0e-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/tracking.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/tracking.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5006 bytes)
Hash
ee44bc43a79bcb7558e01f7a2929fac9
72d730ff00682294df6dd65b2a2d77f1b7a15221
b808ab49ef771a5637228d6f89ede4668effe64695e55d7b3a20b00a34d92c41

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/tracking.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5yIFPAqZXlFuO%2BybDbsgPc9%2FVZmJWsjOqqkjiKMbQ9cew%2FUj1DmziqWn5eCnDZ87e5thDeQz8ImKHN3S4SYMrm%2Ftv%2FulryxMNf1utGRxliCvcY6UsWdS3SjoMG0V7qTSvjRq3PGJ0QTR"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e731bb1b515-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/mailman.svg

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/mailman.svg
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5006 bytes)
Hash
4a5e03dfdcd470efac4f5a59a3b555ea
cd170b5614f5bf77d775420e91acd9abde7f5f8c
c61651badc7b18a3ae990dfe20f24d776028ea05d27dc3e0e4d70e6385c0db7c

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /usps/static/usps/mailman.svg HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JnGqF4eTCw8TALKcY6%2Fip8bYbIG7E78dffbeLtclAjJjRfAGdzwOlkRdCBfcW0gnHHvinrbDTUlzltCHx5kOTivnZHpiZeVhBoaevgVWgc7moywgnLhcfJZkG7stz3zZ8H3KIOi0D5XP"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e74787cfabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

0hlr9a8jxb.lspower.xyz/usps/static/usps/favicon.ico

188.114.96.1

404 Not Found

5.0 kB

URL HTTP/1.1
0hlr9a8jxb.lspower.xyz/usps/static/usps/favicon.ico
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (342)
Size
5.0 kB (5006 bytes)
Hash
5f48ce549f7f0614c0cac8add251995f
5aec1605af5fd65b4df98e78941f4767ce7e46c7
80ca94cc15aaff8fd61495e3d4b74c12f4f24f3d6f63efddcaf3cd8232042002

HTTP Headers

GET /usps/static/usps/favicon.ico HTTP/1.1
Host: 0hlr9a8jxb.lspower.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://0hlr9a8jxb.lspower.xyz/usps/verification.html

HTTP/1.1 404 Not Found
Date: Thu, 30 Mar 2023 20:42:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PvHtercuc0%2BPsdwlzIDrYW%2BC%2B59yelzgIZ9F2C7eCR7TSNRvONstC%2Bw%2BEOQ4V7DZ3g6olGschkL86tP0ywlae0UyKFvdnbJ1nh%2FOkzMQZwltT2PqBGJkH6MvF%2BfWDgeMybbutrqgK3xp"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7b032e777ab3fabc-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (81)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1