demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
301 Moved Permanently 0 B URL HTTP/1.1 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Aramex
fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/infos_de.php HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Wed, 28 Dec 2022 18:35:08 GMT
Accept-Ranges: bytes
Cache-Control: max-age=0
Location: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
X-HW: 1672252508.cds069.sk1.h2,1672252508.cds230.sk1.c
Link: <http://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php>; rel="canonical"
Access-Control-Allow-Origin: *
x-sp-metadata: HS256.COy0sp0GEksKJDQ0YTUyNTMyLWMyNzItNDllNy1iMGNmLTNiODQyOGIzZGU3ZBDYn4qBp9n7AhoGCNyYsp0GIgw5MS45MC40Mi4xNTQo1bsCMAIaKAgBEiQ4YTRkZmI4Yy04NDkxLTRiODEtODU2Ni0wODUzYWVhNmE2MWMiGAgCEhRjZHMyMzAuc2sxLmh3Y2RuLm5ldA==.JODir6M15jpFPLGE4l7g9um9oubGIHznRnJUm/6f1eA=
Connection: keep-alive
Content-Length: 0
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 259d3eba2ac4ea32f0410a59bd01c18a
ab02cd69e6c04e3842ad1778fb0daa6d0e86fddc
0d6ec941dac6d97a0b24c0cf00a5642a4edda68ae5ec8b3019d1ec05f40d2281
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0D6EC941DAC6D97A0B24C0CF00A5642A4EDDA68AE5EC8B3019D1EC05F40D2281"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9069
Expires: Wed, 28 Dec 2022 21:06:17 GMT
Date: Wed, 28 Dec 2022 18:35:08 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cd2bda30513692aa11a672c6a599935d
a944c3aa26b461063194a4bb95ce427d23a32d03
d975d1eab40c9fe4986ae0675d79e4f982eb9c0e2f503ca72b3bdf0ec9e7dfdc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D975D1EAB40C9FE4986AE0675D79E4F982EB9C0E2F503CA72B3BDF0EC9E7DFDC"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10351
Expires: Wed, 28 Dec 2022 21:27:39 GMT
Date: Wed, 28 Dec 2022 18:35:08 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 28 Dec 2022 17:35:20 GMT
content-type: application/json
age: 3588
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 07e619a5a572fa9bcb54fa70de27f0d4
c0499dcc7551831f517f189465812859d0f48ced
2213c856ce4dd64ebe28e4deff34d449b2c08be98565c0405427453ae948fa74
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2213C856CE4DD64EBE28E4DEFF34D449B2C08BE98565C0405427453AE948FA74"
Last-Modified: Tue, 27 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6627
Expires: Wed, 28 Dec 2022 20:25:35 GMT
Date: Wed, 28 Dec 2022 18:35:08 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
File type PEM certificate\012- , ASCII text
Hash b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: dauYwXECk8QnMWvPH+eQ5rd2MHxgeVjtu+BbpNeRoS1p+/mkcZKLJXCQDrUptbgsm01BsclTTlg=
x-amz-request-id: MAN1TYS8E4GDJ5T2
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 28 Dec 2022 17:56:16 GMT
age: 2332
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 28 Dec 2022 18:35:08 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
demo2.cloudwp.dev/favicon.ico
200 OK 1.2 kB URL HTTP/2 demo2.cloudwp.dev/favicon.ico
IP
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash 6af2b6286c753a22bf1dd95100bd3093
004c513c359ae3c57ed85910f27804def11e2d26
9a187b9fc2a7a7ebeae725b685c4a33848f94b2cf69d276a227401c10a268058
GET /favicon.ico HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=4f53f5e827e3902a33f2011ab2b292f5; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=GX
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:09 GMT
cache-control: max-age=5
content-length: 1189
content-type: image/x-icon
last-modified: Tue, 21 Apr 2015 20:19:14 GMT
accept-ranges: bytes
etag: "5536b0c2-4a5"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-origin: *
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO20sp0GEoYBCiQzNjZmMjk5MS1mZTMzLTRiNzEtOWI1YS00NzE4NzFmMzQ5ZDcQ2J+KgafZ+wIaBgjdmLKdBiIMOTEuOTAuNDIuMTU0KMVHMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogYzdkMmI0YzQ4NGE0MTNlMTkxZGU2YWNmZjJkYjIwMDkaKwgBEiQ2YWRmYjUwMy02ZjA4LTRlOGYtYjE1My1mNTJkNTA4ZjdhMTQYpQkiGAgCEhRjZHMwMTUuc2sxLmh3Y2RuLm5ldA==.1MpdhVV6FAEI/5HjZf2NDmC12zRPo6whpRgEd3Gbjsk=
x-hw: 1672252509.cds009.sk1.hn,1672252509.cds015.sk1.c
link: <https://demo2.cloudwp.dev/favicon.ico>; rel="canonical"
X-Firefox-Spdy: h2
demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=GX&sbbgs=h4bdd9efe539741b95d7b9b0a58ea2afdf44&ddl=-4
200 OK 11 kB URL HTTP/2 demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=GX&sbbgs=h4bdd9efe539741b95d7b9b0a58ea2afdf44&ddl=-4
IP
Hash d1987bb9dd16f4db97316822cea6c746
dc9d2a0a03b97a552b3adbfd6ed9608c8b2b0655
c03d6ae5937851d0671961b0cc005f98fcc11ab4c4a415d172fcfb7900e37a06
GET /sbbi/?sbbpg=sbbShell&gprid=GX&sbbgs=h4bdd9efe539741b95d7b9b0a58ea2afdf44&ddl=-4 HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=4f53f5e827e3902a33f2011ab2b292f5; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=GX
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:09 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
x-hw: 1672252509.cds009.sk1.hn,1672252509.cds206.sk1.sc,1672252509.cdn2-wafbe04-arn1.stackpath.systems.-.i,1672252509.cds206.sk1.p
access-control-allow-origin: *
x-sp-metadata: HS256.CO20sp0GEoYBCiQwYzBiZTNjZC1jZGExLTQ2MjktYWEwZi1hMjgxNzY2NTk1OGYQ2J+KgafZ+wIaBgjdmLKdBiIMOTEuOTAuNDIuMTU0KMVHMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogYzdkMmI0YzQ4NGE0MTNlMTkxZGU2YWNmZjJkYjIwMDkaJhIkY2M3YWQ4MmMtMTExMC00ZmI0LTkxMGQtNDU1ZDNhZGE5MTAxIhoIAhIUY2RzMjA2LnNrMS5od2Nkbi5uZXQYCA==.Shz64XyKCnYlFeaFzrB5PUNhGSPwxFnE2f46sihj3/s=
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 125553386d49a0b56facb82deab9bd9f
1a7480b79f4aada477fb5919794f6efd6d44921e
6f3f4223d3c994dd4754df67a11298d736e16f888f301ad2838d0b4db1ac01d7
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1904
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 18:35:09 GMT
Last-Modified: Wed, 28 Dec 2022 18:03:25 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: oeyhrZ3Ca35vyY7GW5XlgQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: EYQ46ae63IGZKsWFn06HC3Wh7oQ=
ocsp.digicert.com/
200 OK 279 B IP
Hash aaa1370e3342c33327dfd816c73e1435
8fb6511de801b02b33ba5b922ef11a841acb3e5a
f1b67598100c32a278495882d6b58f11596577e7ecab6a768554bfcca3106aff
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4494
Cache-Control: max-age=97486
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 18:35:10 GMT
Etag: "63ab549e-117"
Expires: Thu, 29 Dec 2022 21:39:56 GMT
Last-Modified: Tue, 27 Dec 2022 20:25:02 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 279
cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/jquery.payment.min.js
200 OK 2.4 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/jquery.payment.min.js
IP
File type Unicode text, UTF-8 text, with very long lines (8392)
Hash 5fa1a60087fef53b1c0c4f4d6014f684
361a5d6829ec17ebf82571f3b20bd472ab4b0141
43c8409c5dc3b3b21b12068ca0089744c14770ba7f316dfb704b4104cb951bef
GET /ajax/libs/jquery.payment/3.0.0/jquery.payment.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:10 GMT
content-type: application/javascript; charset=utf-8
content-length: 2420
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec3-210b"
last-modified: Mon, 04 May 2020 16:11:47 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 10964420
expires: Mon, 18 Dec 2023 18:35:10 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3A2BTk%2BvdwtGQFG22e1qHQUOhO72MfWV3OagO0Hmh6pKYDHGcRYBhcvhXC5aSkyo5HDt7vQhQPwm8YbcvCJ%2BVC2KSg9hyTs62Iefwb7EA26vM%2B83p1gxxQ2QnzgHnSV16OYWzZqy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 780c64ef8fcfb511-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 279 B IP
Hash aaa1370e3342c33327dfd816c73e1435
8fb6511de801b02b33ba5b922ef11a841acb3e5a
f1b67598100c32a278495882d6b58f11596577e7ecab6a768554bfcca3106aff
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4494
Cache-Control: max-age=97486
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 18:35:10 GMT
Etag: "63ab549e-117"
Expires: Thu, 29 Dec 2022 21:39:56 GMT
Last-Modified: Tue, 27 Dec 2022 20:25:02 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 279
ocsp.digicert.com/
200 OK 471 B IP
Hash 88845c0f599df5351e10ca0205fad5d1
d6b9429109a4e507c00fdde941c242256b29c211
71ec644913e39a00e233b210b3ae50d11ee2bae5aa6fc8195cb9c0c3ff55ac4d
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6000
Cache-Control: max-age=155500
Content-Type: application/ocsp-response
Date: Wed, 28 Dec 2022 18:35:10 GMT
Etag: "63ac315a-1d7"
Expires: Fri, 30 Dec 2022 13:46:50 GMT
Last-Modified: Wed, 28 Dec 2022 12:06:50 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3458
Expires: Wed, 28 Dec 2022 19:32:49 GMT
Date: Wed, 28 Dec 2022 18:35:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3458
Expires: Wed, 28 Dec 2022 19:32:49 GMT
Date: Wed, 28 Dec 2022 18:35:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3458
Expires: Wed, 28 Dec 2022 19:32:49 GMT
Date: Wed, 28 Dec 2022 18:35:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3458
Expires: Wed, 28 Dec 2022 19:32:49 GMT
Date: Wed, 28 Dec 2022 18:35:11 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 563a71326245b9544f7051f983f4d897
7293247391520689fb7aeac14ee6c984d82d7de3
17c444592282f17c3eb8a0d8e10ae9b3be096d621bdf2bbd8e12faf13ff4999c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17C444592282F17C3EB8A0D8E10AE9B3BE096D621BDF2BBD8E12FAF13FF4999C"
Last-Modified: Tue, 27 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3458
Expires: Wed, 28 Dec 2022 19:32:49 GMT
Date: Wed, 28 Dec 2022 18:35:11 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F346e7d95-abf9-4783-baa6-85137bb9cc29.jpeg
200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F346e7d95-abf9-4783-baa6-85137bb9cc29.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8ab36b0d168174ef2d960be9810fdb2d
7c8a7415cab3ef88b5d1204af214a687b1676dda
a1d842fd02273603db0090d34c317d7a3ce3e5f00f29271d45fc4ed6d09ee21e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F346e7d95-abf9-4783-baa6-85137bb9cc29.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7817
x-amzn-requestid: 21a68509-6fec-48b3-8bce-fb2ebfab3289
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0yuCEVwIAMFUrQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab64c0-5e23ceec731631d93e01e2c8;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:33:52 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1F1os87usGl0yMWsHxFZsVnrbmjJKydPf4ZXL4xsXjHau3fAS9Nf1Q==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:44:42 GMT
age: 75029
etag: "7c8a7415cab3ef88b5d1204af214a687b1676dda"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45fd5586-9fcc-4409-88f6-52a554307609.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45fd5586-9fcc-4409-88f6-52a554307609.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a022f080982dddeaf2decce39bf2f1f7
dd9cb19eb6008d3558f60332bc16c83108474f66
fe2c473fa2e8bb50ead0a1faef96024d711c765330b887e72f53219e96adaf20
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45fd5586-9fcc-4409-88f6-52a554307609.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5888
x-amzn-requestid: c2212a71-2743-49ed-80fe-5319f266932a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0y_0FUgoAMF1dA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab6531-05343b8c4c574b530118c293;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 7a0bEDDA67CyAKgVKUqz38Elve3uoZ392Ql0t0NVsypOXBc-zgjJNw==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:42:28 GMT
etag: "dd9cb19eb6008d3558f60332bc16c83108474f66"
content-type: image/jpeg
age: 75163
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7efeb4a1-9d83-4fe3-bd8d-999279ed4dcd.jpeg
200 OK 4.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7efeb4a1-9d83-4fe3-bd8d-999279ed4dcd.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ae5da67479fa2f3afda50a7566b5e46e
d71de1881ea09f0aed36703f95635cc0cd552429
a67eca901c4f8436074f48a594cd9942742430c8776745152baf3f858a9c3407
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7efeb4a1-9d83-4fe3-bd8d-999279ed4dcd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4443
x-amzn-requestid: 6ca832c3-dcdc-4fc3-bb60-6868d09f824b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0y_zFEOoAMF9KQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab6531-0a9be43a500ea8b41200cc43;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Qy-hxddkp68OmfI4OKNvNu8mRO8re9SQNxsxuPcPyP7-tqIEdl7pug==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:42:19 GMT
age: 75172
etag: "d71de1881ea09f0aed36703f95635cc0cd552429"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d43b473-21c7-4775-9398-1bdecb4d7d28.jpeg
200 OK 9.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d43b473-21c7-4775-9398-1bdecb4d7d28.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b373925ce249ca67e6984c436f5cd2b8
ddbc25025b933587990f8e9c32e91c9773256840
7d3c992b715283efeba9bee2e5c08042267017e76074ca6aad870e1dd45b4564
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4d43b473-21c7-4775-9398-1bdecb4d7d28.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9007
x-amzn-requestid: 15b3b2e5-d493-4b54-aab4-7374bf892e83
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: drrFbESxIAMFikw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a7beef-37f4ab8e7738b186705bb1db;Sampled=0
x-amzn-remapped-date: Sun, 25 Dec 2022 03:09:35 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Swp663gmExgpgDT8bZUFNOpLEJHZDQWrEeasO7jgP5GClXzyJUTWgw==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 28 Dec 2022 03:27:43 GMT
age: 54448
etag: "ddbc25025b933587990f8e9c32e91c9773256840"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac8e7926-34e8-4a65-ba5a-894c252c5826.jpeg
200 OK 9.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac8e7926-34e8-4a65-ba5a-894c252c5826.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b970ffab86fbe4a36726473524096ed1
92bc9a2cc454608eae4e310456f2ec180d4ccdca
9d9377466c1d69d25cbde0092dbebb8579ba3f172a001e3068690c7d7efc779c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac8e7926-34e8-4a65-ba5a-894c252c5826.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9103
x-amzn-requestid: d35b52dd-fc72-47ca-8232-00e48cd6d209
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0z_EEruIAMFlQA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab66c6-574a052f67683ba238966de5;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:42:30 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: ohxADRAP902PofikgbhHb6N0yLainQlafqatm4eBQ1u5DHGr1r15Fg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:42:30 GMT
etag: "92bc9a2cc454608eae4e310456f2ec180d4ccdca"
content-type: image/jpeg
age: 75161
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8978692-1057-4721-b58a-03675b009dec.webp
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8978692-1057-4721-b58a-03675b009dec.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 003be820cd1d0f0365928cab98019457
e2a5c2764e4850aa95594c8b303aa4963d33954b
098fd59f48bb33d33764f64eb15d14840467d84544c34f35a6f86bb893be516d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe8978692-1057-4721-b58a-03675b009dec.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5880
x-amzn-requestid: e87391e7-c302-42a9-9cdf-0ca5a264c973
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d0z-4GrNoAMFYyw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ab66c5-6b7d0f3044ed76e91a8815d7;Sampled=0
x-amzn-remapped-date: Tue, 27 Dec 2022 21:42:29 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QB3LsKzG9hiMrLwemezbf85srVaq07WnkcbHbOpjmO-chWigBRXwxw==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Dec 2022 21:42:29 GMT
etag: "e2a5c2764e4850aa95594c8b303aa4963d33954b"
content-type: image/jpeg
age: 75162
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/css/bootstrap.css
200 OK 26 kB URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/css/bootstrap.css
IP
File type Unicode text, UTF-8 text, with very long lines (560)
Hash f024ef9db4c3ac3e1d20273e01f812d5
cf10eaa7953c8c44ce13514ebd2b8e691d9c782f
bf94f428abdb18409f084e905f7bb80c65a2b4a196dc52e2032d30fa5a47f6fe
GET /trial-75t2u5z9/wp-content/plugins/sw/css/bootstrap.css HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-length: 25523
content-type: text/css
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
vary: Accept-Encoding
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQzM2FkY2Q5Ny02YTk3LTQ4NjMtOTRkMi0wOWFkZjAyNzUxNDgQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGioSJDNlYmRjNThmLWRiOWMtNGI4MC05YTU4LTQxMjUxNzI4Mjk5MhizxwEiGggCEhRjZHMwNjYuc2sxLmh3Y2RuLm5ldBgI.w445i9QCletb+lTwlXfjV+uEzjLHbczBYlZiYbyGKp0=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds066.sk1.sc,1672252511.cds066.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/css/bootstrap.css>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/b.png
200 OK 643 B URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/b.png
IP
File type PNG image data, 42 x 25, 8-bit/color RGBA, non-interlaced\012- data
Hash 0b26f7938650cb2a84556610eaf87937
f3cacc72714c070c36ae4326ec861116418c2915
58ead390cc509331a0ef667a2ed6df336c32af6d03f3c4342d84412f776188ef
Analyzer Verdict Alert urlquery phishing Phishing - Aramex
GET /trial-75t2u5z9/wp-content/plugins/sw/image/b.png HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-length: 643
content-type: image/png
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQzYzA4ZTA3NC01MTNkLTQ1YTItOTQxOS1jZjA2NWMzMzgxMGUQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJDY5ZTQ1MmYzLWNhYjAtNDdiNy04N2E0LTYwNGY5Mjc2YzQ1OBiDBSIaCAISFGNkczIwMS5zazEuaHdjZG4ubmV0GAg=.X2ztp2ENZNhVhWny/VtdVm+C+5mqsnEg5sSOwzjN6QM=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds201.sk1.sc,1672252511.cds201.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/b.png>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/jquery-3.5.1.min.js
200 OK 31 kB URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/jquery-3.5.1.min.js
IP
File type ASCII text, with very long lines (65451)
Hash afc5d07cd09f82e0b39ed2d05f6f16f5
41f2b25919d6493209e8ec1cd79ee006d1e1baa2
75fa5b5e9a01bb1488649ba9f0751bcdee5815038557bd17716ca8af5f24c030
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/js/jquery-3.5.1.min.js HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-length: 31147
content-type: application/javascript; charset=utf-8
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
vary: Accept-Encoding
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiRiZGMwM2RiOC00YzEzLTRhZmYtOGMwYS04ZGRkMTAzNjZmMDcQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGioSJDJlMTQ4MjhmLTI2MDMtNDFhMy05ZGM0LWQzYTY4ZTNkNjYwMhir8wEiGggCEhRjZHMyNjEuc2sxLmh3Y2RuLm5ldBgI.bwe59YLuH3GryBs7dGRV4nUgsGVKiSnsgaUkm2NCgM0=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds261.sk1.sc,1672252511.cds261.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/jquery-3.5.1.min.js>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/css/test.css
200 OK 628 B URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/css/test.css
IP
File type ASCII text, with CRLF line terminators
Hash fd866a6407e2eb24ee15a2bc5e212f35
cafa94fbe211fe5132fb06ae88c3150e5c68de49
a3e8ffcea0fbb4511ff922149a2553cffe62df4dcc6bcf7663c2bb0f0a74380d
GET /trial-75t2u5z9/wp-content/plugins/sw/css/test.css HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-length: 628
content-type: text/css
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
vary: Accept-Encoding
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiRjY2JiYzgyOC1mNjU2LTRkYzQtYTYxOC1kYzNlZjZjZWJiNTMQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJDNiYTQ2MjlmLThlZmEtNDEyNi05YzBiLWQ2NmFhMjAxNGMzORj0BCIaCAISFGNkczIwNy5zazEuaHdjZG4ubmV0GAg=.MSgap7cKaazvslXNDChY9wWM68/SYOeL/CmN45PJ+6w=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds207.sk1.sc,1672252511.cds207.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/css/test.css>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/jquery.mask.js
200 OK 5.9 kB URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/jquery.mask.js
IP
Hash 17c4e5347bdc0848a6fe80e1b6ec03b4
c92e84b1032ef7b28e857fb5425aec77c3afbc8a
8a8282663b83a7f857f11d869e99862743ae715e998a2b22c22cd980114117f7
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/js/jquery.mask.js HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-length: 5913
content-type: application/javascript; charset=utf-8
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
vary: Accept-Encoding
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQ3NDZmOWNjZS0wMjVjLTQzYjgtODAyZi02MWQzMjJkMjhhNDMQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJGIwZjFkNTQ3LWUzOWMtNDkzOC04NzQ1LTEyM2EzM2UyNjM0MxiZLiIaCAISFGNkczI0Ny5zazEuaHdjZG4ubmV0GAg=.J8bY6PQxgky2tVDi+GzrlWvfkDywPZQmdS5Aa4+Xpuk=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds247.sk1.sc,1672252511.cds247.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/jquery.mask.js>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/a.png
200 OK 677 B URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/a.png
IP
File type PNG image data, 42 x 25, 8-bit/color RGBA, non-interlaced\012- data
Hash 9f6f7e9e5648010f14d43d89b8119767
a98ce94f89f151b331b7a7a244ed63ce99199e8b
f1e8231c6f3bf3a4cbfc92a5f8beaff846a3014c21fe8396ed212bb0d0244db9
Analyzer Verdict Alert urlquery phishing Phishing - Aramex
GET /trial-75t2u5z9/wp-content/plugins/sw/image/a.png HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-length: 677
content-type: image/png
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQ0YjI1MjY1Ny1kNzBkLTQzNmUtOTQ2NC02MmI3NWFhMmNiYjUQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJDkxYmNiZWE0LTU3N2MtNGVmNy1hZTU4LWU2NzM0NmEzY2RlYRilBSIaCAISFGNkczAxNS5zazEuaHdjZG4ubmV0GAg=.Qo7qwcqc3MZKE695UzwHLZgDvpU3DMKGmiyLz77acdg=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds015.sk1.sc,1672252511.cds015.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/a.png>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/respond.min.js
200 OK 2.2 kB URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/respond.min.js
IP
File type HTML document, ASCII text, with very long lines (4453)
Hash 7cea5d5b30d9460809e70e99302487f3
3f0bd0581f5f08098ac5fbdf7ab5730f18584688
9c7e6b1c2ac6aa861ec27b4a3efb3d266de5d7149f1aa60af432fd032b75864f
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/js/respond.min.js HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-length: 2218
content-type: application/javascript; charset=utf-8
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
vary: Accept-Encoding
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQyYWEyZDI2Yi1lODAyLTQyMjQtYjdmZS1jOWI4OTliOGZjZjQQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJDFiNTliOTFjLTM3Y2EtNDBhZC05YzM0LTU3MDg1NjQxNDZkYxiqESIaCAISFGNkczIzOC5zazEuaHdjZG4ubmV0GAg=.WnQNl0yK8isEiV7dpeWAsJSBcyEiwu/Edea1r/4x0Z0=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds238.sk1.sc,1672252511.cds238.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/respond.min.js>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/VISAA.png
200 OK 2.6 kB URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/VISAA.png
IP
File type PNG image data, 76 x 48, 8-bit/color RGBA, non-interlaced\012- data
Hash 725caa991a29101f5da78da2fc1e1e63
cf4f10dfd71289c43273496120b79ef01a437d19
ef844111dee838dc5c8d388a96108379b2c97ced776fc95b2fa32b28f7ef6bde
GET /trial-75t2u5z9/wp-content/plugins/sw/image/VISAA.png HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-length: 2600
content-type: image/png
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQwODI1YjQwMC0xNDBmLTRlNDctOWVlOC0wYjFlYWM0YzdmOWUQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJDA1OWMxMTI0LWM4OTEtNDRkYy1hYWE5LWUyZmYzZTAwNDU3MhioFCIaCAISFGNkczIzNC5zazEuaHdjZG4ubmV0GAg=.x2aLRwNnqB4lrWJAwgrAPbTnC+pMJ7F42YVckXHWYRQ=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds234.sk1.sc,1672252511.cds234.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/VISAA.png>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
200 OK 6.3 kB URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6579), with CRLF, LF line terminators
Hash 256e5eb1b53287052d8d5f2473f98b54
d8ec082c5752b23bebac8a3048bba22b855a5492
edd27e1bf5db5be28738210cc237212471cfd757347a1c0cf9d3dbd095627b5a
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/infos_de.php HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=4f53f5e827e3902a33f2011ab2b292f5; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=GX; adOtr=42982575bb2
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:10 GMT
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
set-cookie: spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; path=/; SameSite=Strict; HttpOnly; expires=Wed, 28-Dec-22 20:35:09 GMT
adOtr=obsvl; path=/; SameSite=Lax; expires=Thu, 2 Aug 2001 20:47:11 UTC
PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; path=/
PRLST=; Sun, 25-Dec-22 18:35:09 GMT; path=/; SameSite=Lax;
sp_lit=3rAvcMZX35idPxQhLJUyKQ==; path=/; SameSite=Strict; HttpOnly; expires=Wed, 28-Dec-22 18:40:10 GMT
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php>; rel="canonical"
x-hw: 1672252509.cds244.sk1.hc,1672252509.cds230.sk1.sc,1672252510.cdn2-wafbe01-arn1.stackpath.systems.-.wx,1672252510.cds230.sk1.p
access-control-allow-origin: *
x-sp-metadata: HS256.CO60sp0GEocBCiQzZWE5OWZmNy1kYjY4LTQ4YTAtOThlMS04ZWFjMGZkZjgzZTMQ2J+KgafZ+wIaBgjdmLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGiYSJDY0ZDBmNjViLWQyZGEtNGJhYy04Yjg1LTJmYzk1MjM0YmJiNSIaCAISFGNkczIzMC5zazEuaHdjZG4ubmV0GAg=.bJ85xbJBMR4Xb1XXbNEzp1sK1AFa9cWyRNLvtRpcPsA=
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/bootstrap.min.js
200 OK 16 kB URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/bootstrap.min.js
IP
File type ASCII text, with very long lines (62126)
Hash 1919da01c9da8e4684a5139517d7f419
10c92ec7db92d72f15343d92cce96f99bcd9fe69
1f35692b0f01b3b928fd64f4bbd7b29a103639e799f19c333ebc31b216f9c6fd
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/js/bootstrap.min.js HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-length: 16197
content-type: application/javascript; charset=utf-8
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
vary: Accept-Encoding
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQ1YTk4YzMzYy1kMzFhLTRlMTAtYTg5My1iOTY3YzRhODIwZTQQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJDc4ZDJjODRmLTNjNjItNDBjYy04OGY3LTdmYWNkZmNkYjdkMxjFfiIaCAISFGNkczA2OC5zazEuaHdjZG4ubmV0GAg=.nUggemaQ3ppzaM7lThZ8eI3sV+a48CQXYdGbDOzYZc0=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds068.sk1.sc,1672252511.cds068.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/js/bootstrap.min.js>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=GX&sbbgs=h4bdd9efe539741b95d7b9b0a58ea2afdf44&ddl=-4
200 OK 2.4 kB URL HTTP/2 demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=GX&sbbgs=h4bdd9efe539741b95d7b9b0a58ea2afdf44&ddl=-4
IP
Hash f5f496d1ec9f92b021e585eb9131648a
10379c2b233ad821745a8977700dbea4133dc4e0
a6454c12f200f11e372c62dfc390ab73e46ca1b7cbfa2354ac98afdd5097afb4
POST /sbbi/?sbbpg=sbbShell&gprid=GX&sbbgs=h4bdd9efe539741b95d7b9b0a58ea2afdf44&ddl=-4 HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 498
Origin: https://demo2.cloudwp.dev
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=GX&sbbgs=h4bdd9efe539741b95d7b9b0a58ea2afdf44&ddl=-4
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=4f53f5e827e3902a33f2011ab2b292f5; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=GX; adOtr=42982575bb2
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:09 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
x-hw: 1672252509.cds009.sk1.hn,1672252509.cds212.sk1.sc,1672252509.cdn2-wafbe03-arn1.stackpath.systems.-.i,1672252509.cds212.sk1.p
access-control-allow-origin: *
x-sp-metadata: HS256.CO20sp0GEoYBCiRhNTk5NDUwOC04NGU3LTRiZDktOTZjNi00NzdkM2YxNTFhMTIQ2J+KgafZ+wIaBgjdmLKdBiIMOTEuOTAuNDIuMTU0KMVHMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogYzdkMmI0YzQ4NGE0MTNlMTkxZGU2YWNmZjJkYjIwMDkaJhIkMGExYWM4YmYtMjJlNi00NWUxLWE5ZmQtYzY1NmNmOWExNjE4IhoIAhIUY2RzMjEyLnNrMS5od2Nkbi5uZXQYCA==.H5bHbOABiEyHY9lSLLfNWy+swCDV6/BW8g/FfoUEssU=
X-Firefox-Spdy: h2
pro.fontawesome.com/releases/v5.10.0/webfonts/fa-solid-900.woff2
200 OK 123 kB URL HTTP/2 pro.fontawesome.com/releases/v5.10.0/webfonts/fa-solid-900.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 123004, version 330.15728\012- data
Size 123 kB (123004 bytes)
Hash 88fd444847dc842d15e229df26571b03
bde84da4343e573a148af56adde21bddf74bb2a6
d27aa8bf9677cf4ef12acd7b37afc20f1f661d7c163b929ae9caf103b01fce37
GET /releases/v5.10.0/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: pro.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://demo2.cloudwp.dev
Connection: keep-alive
Referer: https://pro.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
content-type: font/woff2
content-length: 123004
x-amz-id-2: EAJpCMxFwUw6ZOg0TEOifJ/ENjcDyz3AoEJ2z3zqA6LD1eW9UcRUR2874Y4v0iZDCsqJDD0oV38=
x-amz-request-id: 71HX97JEMMQ87FEV
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Mon, 28 Jun 2021 16:56:06 GMT
etag: "88fd444847dc842d15e229df26571b03"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 32417
accept-ranges: bytes
server: cloudflare
cf-ray: 780c64f4ed88b529-OSL
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg
200 OK 0 B URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg
IP
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-type: image/svg+xml
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiQyMjdmNzVmYS1jODA5LTQxNjItYmQ3Yy0yMDhiOTViN2JjN2EQ2J+KgafZ+wIaBgjemLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGikSJDZkZjU3ZjU0LTVmMDUtNGVkYi04NDk2LWViNzZlZWMyZjAxMhjkJiIaCAISFGNkczI1MS5zazEuaHdjZG4ubmV0GAg=.nV4MXmSnCCxtDKXhcOF9HvZ+NaSZmzKrq8bXTifq0Jo=
x-hw: 1672252510.cds244.sk1.hc,1672252510.cds251.sk1.sc,1672252511.cds251.sk1.pr
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
200 OK 0 B URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
IP
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/infos_de.php HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:08 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
set-cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; path=/; HttpOnly; SameSite=Lax;
SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; path=/; HttpOnly; SameSite=Lax;
spcsrf=4f53f5e827e3902a33f2011ab2b292f5; path=/; SameSite=Strict; HttpOnly; expires=Wed, 28-Dec-22 20:35:08 GMT
adOtr=obsvl; path=/; SameSite=Lax; expires=Thu, 2 Aug 2001 20:47:11 UTC
UTGv2=D-h4bdd9efe539741b95d7b9b0a58ea2afdf44; path=/; SameSite=Lax; expires=Mon, 26-Jun-23 18:35:08 GMT
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php>; rel="canonical"
x-hw: 1672252508.cds009.sk1.hn,1672252508.cds230.sk1.sc,1672252508.cdn2-wafbe01-arn1.stackpath.systems.-.w,1672252508.cds230.sk1.p
access-control-allow-origin: *
x-sp-metadata: HS256.COy0sp0GEoYBCiQ5MDY0OWIxYi1lNjYwLTQwMjctYjdmYy1lNDIwNmQzNTFjODEQ2J+KgafZ+wIaBgjcmLKdBiIMOTEuOTAuNDIuMTU0KMVHMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogYzdkMmI0YzQ4NGE0MTNlMTkxZGU2YWNmZjJkYjIwMDkaJhIkNDBjYjRmYjEtYTE4Yy00ZGM4LWI1ZjItNzgwOGZkODczMDhhIhoIAhIUY2RzMjMwLnNrMS5od2Nkbi5uZXQYCA==.x/c7qN0BT2J/MOWZWfc3f6yt4LILIY2KQ09MHKFpxiA=
X-Firefox-Spdy: h2
demo2.cloudwp.dev/sbbi/?sbbpg=utMedia&vii=2h947b2d4d89be5f5e25b369f774f1db49c53d473ba99bf02ab588de8a62bafftdgfj4y4
200 OK 0 B URL HTTP/2 demo2.cloudwp.dev/sbbi/?sbbpg=utMedia&vii=2h947b2d4d89be5f5e25b369f774f1db49c53d473ba99bf02ab588de8a62bafftdgfj4y4
IP
GET /sbbi/?sbbpg=utMedia&vii=2h947b2d4d89be5f5e25b369f774f1db49c53d473ba99bf02ab588de8a62bafftdgfj4y4 HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=4f53f5e827e3902a33f2011ab2b292f5; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=GX
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:09 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-type: image/gif
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
x-hw: 1672252509.cds009.sk1.hn,1672252509.cds224.sk1.sc,1672252509.cdn2-wafbe04-arn1.stackpath.systems.-.i,1672252509.cds224.sk1.p
access-control-allow-origin: *
x-sp-metadata: HS256.CO20sp0GEoYBCiRmYjcwODVjYi1kN2FjLTQ4ZjctODg4NS1kOWU5YmM4NzE5YmMQ2J+KgafZ+wIaBgjdmLKdBiIMOTEuOTAuNDIuMTU0KMVHMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogYzdkMmI0YzQ4NGE0MTNlMTkxZGU2YWNmZjJkYjIwMDkaJhIkYmE0YTgyMTQtN2JjMC00OGFiLTkzNDAtYjY4NzRmNTJjZWU1IhoIAhIUY2RzMjI0LnNrMS5od2Nkbi5uZXQYCA==.AELTyvU06vut6zeut2Y3AfyAfUSLwdmyeppowYKNjmk=
X-Firefox-Spdy: h2
demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg
200 OK 0 B URL HTTP/2 demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg
IP
Analyzer Verdict Alert fortinet Phishing
GET /trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=eB; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
etag: "1671378141"
cache-control: max-age=30
content-encoding: gzip
content-type: image/svg+xml
last-modified: Sun, 18 Dec 2022 15:42:21 GMT
accept-ranges: bytes
x-proxy-cache: MISS
x-robots-tag: noindex, nofollow, noarchive, nosnippet
strict-transport-security: max-age=31536000; includeSubDomains
server: fbs
x-sp-metadata: HS256.CO+0sp0GEocBCiRiN2M2ZTVjNC0xMmRjLTRiOTQtODVkMy03ZDZiZmNkYzgyYTQQ2J+KgafZ+wIaBgjfmLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGisIARIkOWVkNDQ3YzUtMWQwYS00NDQ4LWFkMTYtOGM2MzAxYWUzOTU2GOQmIhgIAhIUY2RzMjUxLnNrMS5od2Nkbi5uZXQ=.JGNFDV/Xe+HbSgbAxQdqpAd83xSJRQ6elK4l0t/5V1E=
x-hw: 1672252511.cds244.sk1.hc,1672252511.cds251.sk1.c
link: <https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/image/logo.svg>; rel="canonical"
access-control-allow-origin: *
X-Firefox-Spdy: h2
demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=eB
200 OK 0 B URL HTTP/2 demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=eB
IP
GET /sbbi/?sbbpg=sbbShell&gprid=eB HTTP/1.1
Host: demo2.cloudwp.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/trial-75t2u5z9/wp-content/plugins/sw/infos_de.php
Cookie: SPSI=297248b552b6f7fd4c343a9f2b8d86bf; SPSE=X0B/cu+84XSQJvNica2RB2LyM9btqb6gHnczu0XHQT4tV/l4yA9bXXLGTeY3RX/krYreqyuKj2OPmZk0abaUBA==; spcsrf=0b6036fd0256763e6c493a1b9ec32bf6; UTGv2=h4bdd9efe539741b95d7b9b0a58ea2afdf44; sbtsck=javctXxcz66H78MWWgGRWszvwm5HeTi3sdVO5c+LHTPcCA=; PRLST=eB; PHPSESSID=00db0b5d5e5f8ec7c4cf46750ade8ad6; sp_lit=3rAvcMZX35idPxQhLJUyKQ==
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:11 GMT
cache-control: no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
server: fbs
x-accel-expires: 0
link: <https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
x-hw: 1672252511.cds244.sk1.hc,1672252511.cds257.sk1.sc,1672252511.cdn2-wafbe01-arn1.stackpath.systems.-.i,1672252511.cds257.sk1.p
access-control-allow-origin: *
x-sp-metadata: HS256.CO+0sp0GEocBCiQxNDAyNWE1My01OWJiLTQ5MGQtYWIyOC04Mzk5NzYxYmEzMjcQ2J+KgafZ+wIaBgjfmLKdBiIMOTEuOTAuNDIuMTU0KKqpAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIGIyZTMyMTQ2MDdjMjc0ZTNiNzJmMTQ0NzFhMGFkZDlkGiYSJDg0ZDU5ZmYwLWViZmQtNGRhYy1iZWJmLTMwNGZhNWQ1ZjNlYiIaCAISFGNkczI1Ny5zazEuaHdjZG4ubmV0GAg=.u27k2Z667fNvH2rguN5qbV9Sl0NvURPBlHjJ4SzTTRI=
X-Firefox-Spdy: h2
pro.fontawesome.com/releases/v5.10.0/css/all.css
200 OK 0 B URL HTTP/2 pro.fontawesome.com/releases/v5.10.0/css/all.css
IP
GET /releases/v5.10.0/css/all.css HTTP/1.1
Host: pro.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://demo2.cloudwp.dev
Connection: keep-alive
Referer: https://demo2.cloudwp.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 28 Dec 2022 18:35:10 GMT
content-type: text/css
x-amz-id-2: qF4VyP3dnT8kL2Lls6MF3RneOtu1j/dVPaTfv0iV2q8uFd56sTGODkta4k91TVj3RZv9bamBsLA=
x-amz-request-id: MQKP3RK10D2EZF03
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Mon, 28 Jun 2021 16:54:32 GMT
etag: W/"aa1272633e7e552395d147a499bad186"
cache-control: max-age=31556926
cf-cache-status: HIT
age: 32417
server: cloudflare
cf-ray: 780c64efcf35b529-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
151.139.128.10
23.33.119.27
93.184.220.29
104.17.24.14