franckcoms.blogspot.com/
301 Moved Permanently 177 B IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 5fa8224186a3b105d0529e0e57442ffc
fc2a802e8a43b65652015e8e9bade57d5f52ef77
fc0e7ab9994b5ff8aa0bb2ec2efab363718b8d4a8cf1abab6c52b02823adc109
Analyzer Verdict Alert openphish Orange
fortinet Phishing
GET / HTTP/1.1
Host: franckcoms.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Location: https://franckcoms.blogspot.com/
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Date: Wed, 08 Feb 2023 00:59:39 GMT
Expires: Wed, 08 Feb 2023 00:59:39 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-XSS-Protection: 1; mode=block
Content-Length: 177
Server: GSE
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 507011ccb9124dcd57e84a90a0965cc4
1a6575d0ac979c7184490cc9836ac4812ad2afd1
01626c18e1e68507aa33ef7448dbc3311901ab6f29adc2f51d449409b0680dce
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "01626C18E1E68507AA33EF7448DBC3311901AB6F29ADC2F51D449409B0680DCE"
Last-Modified: Sun, 05 Feb 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4598
Expires: Wed, 08 Feb 2023 02:16:17 GMT
Date: Wed, 08 Feb 2023 00:59:39 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 565c1bbc5c1c40be1988b3bf6fd9dc1a
cfdba5bc597130461dd67bf6cda53183be592493
60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5067
Expires: Wed, 08 Feb 2023 02:24:06 GMT
Date: Wed, 08 Feb 2023 00:59:39 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 08 Feb 2023 00:34:10 GMT
content-type: application/json
age: 1529
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cc14b0d2f7c451f6431dc87ba54d1d60
bab8bfda6fa3e2f17125353f5147211787dc25d0
b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD"
Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4525
Expires: Wed, 08 Feb 2023 02:15:04 GMT
Date: Wed, 08 Feb 2023 00:59:39 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP
File type PEM certificate\012- , ASCII text
Hash e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6
GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 4QIECNrdCQa0RKBKwgK5FvC/j6AMZ2MpP5Bv/L6Q1bIKMO79dvHf5qa7p3FHv0k8/U1PqzS/+Zo=
x-amz-request-id: 7C0G33P6WR46NP79
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 08 Feb 2023 00:35:43 GMT
age: 1436
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 83e22821bb0489f9ffd588625ddc354a
631978b5167b8ee78608b27c6595779dcb48c252
ef35eab5ca69dd44e3d5bcf9229bc97c226ff44f38f53c096f14121714b3d234
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 00:59:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 08 Feb 2023 00:59:39 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
franckcoms.blogspot.com/
200 OK 15 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6565)
Hash 5004c5c539eb8436d1fa19765d5499fc
4c5b51d804934519d592ef861383edbc9392f0db
93b05740e38153e7b8bab36aa24a41473731f826e10e742693b1418e64c1bc9f
Analyzer Verdict Alert openphish Orange
fortinet Phishing
GET / HTTP/1.1
Host: franckcoms.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
expires: Wed, 08 Feb 2023 00:59:39 GMT
date: Wed, 08 Feb 2023 00:59:39 GMT
cache-control: private, max-age=0
last-modified: Mon, 06 Feb 2023 11:30:47 GMT
etag: W/"66ce3315bde561ea8dc43e2b61b76bdf5f1b11da8e8f02dd1385deaee67fae21"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 15129
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 83e22821bb0489f9ffd588625ddc354a
631978b5167b8ee78608b27c6595779dcb48c252
ef35eab5ca69dd44e3d5bcf9229bc97c226ff44f38f53c096f14121714b3d234
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 00:59:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Content-Type, Pragma, ETag, Retry-After, Backoff, Expires, Alert, Cache-Control, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 08 Feb 2023 00:14:52 GMT
age: 2687
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9b88bae61bca33aba8aa99f6128db8d9
a07b61fb2458917699613fcae68710941b595416
54915c2f79822732e06a592d027da421ad1e7a6458c545f98333db25612b3dea
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "54915C2F79822732E06A592D027DA421AD1E7A6458C545F98333DB25612B3DEA"
Last-Modified: Mon, 06 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2192
Expires: Wed, 08 Feb 2023 01:36:11 GMT
Date: Wed, 08 Feb 2023 00:59:39 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash e6f866fef699b67ddbf95cc9b43d5245
6600608e4cdae28a49cb43081e1897defc6d4133
a548249583820cd9768177af96ed7ee502e42e1a08b60de6602f4b7bb5c08d23
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2773
Cache-Control: max-age=106905
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 00:59:40 GMT
Etag: "63e1e7c0-1d7"
Expires: Thu, 09 Feb 2023 06:41:25 GMT
Last-Modified: Tue, 07 Feb 2023 05:55:12 GMT
Server: ECS (amb/6B9F)
X-Cache: HIT
Content-Length: 471
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout
301 Moved Permanently 380 B URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 5b310e09d50d00482f9100399c1c67fb
5621e6442effd46f5fadf4ce1e7b470061fe82c1
eb50fcb39d4dfd9beeae8da02854dd05d37b5430597fce7ff84e9bb6eb976217
Analyzer Verdict Alert openphish Orange
fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://franckcoms.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
date: Wed, 08 Feb 2023 00:59:40 GMT
content-type: text/html; charset=iso-8859-1
content-length: 380
location: http://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: EVQ8yKbb1EXbpMJ2gA70VQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: uiHr+iptID/1fegnRcvYT6E4zLo=
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/
302 Found 26 B URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/
IP
File type ASCII text, with CRLF line terminators
Hash 86106fc20da83a7159c9719ec5835c98
c914a861bba4073d4b1f290306ec847b36f34599
acb6e92fcb6d58c4191c9f3deb0ff9eac72378b58cbbad2af2380c2307ee43fe
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/ HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
date: Wed, 08 Feb 2023 00:59:40 GMT
content-type: text/html; charset=UTF-8
content-length: 26
location: e1fb812efb16369/login.php?particulier#_e1fb812efb1636928
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin; path=/
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
200 OK 13 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (52492), with CRLF line terminators
Hash 11dc8fabec674a8f864e16033629e07c
99f2b9a86e80807069e69209759753baae571c20
4bf40bd2ab14ba9e0c6755f69d61dd0c185805c17c2cf5a78130362d7e6ad128
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/html; charset=UTF-8
content-length: 12952
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/bundle.min.css
200 OK 32 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/bundle.min.css
IP
File type Unicode text, UTF-8 text, with very long lines (822), with CRLF line terminators
Hash 9b43f2abe0db62709e92a36c7792c003
fd450b2b7cc102bfee496731fec4b4211e7f94a7
f87e5f7941fbb16a94adceecfc3444f98735420511fc2b8a4c2b4dfedff367a8
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/src/bundle.min.css HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/css
content-length: 31535
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"37c50-5f425c775c3e4-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.17.2/js/bundle.min.js
200 OK 54 kB URL HTTP/1.1 cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.17.2/js/bundle.min.js
IP
File type ASCII text, with very long lines (65451)
Hash eee6c500c98ad948dd000678c626d6af
820cfcd3d1fec3810e3e304562e125eb6ee61ca4
14de5a067a17f66ceb314f2181563353ac74c494afab0c0b0fb44ce15c439309
GET /c15d9d8fc98141b084d96f795046449b/auth-2.17.2/js/bundle.min.js HTTP/1.1
Host: cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding, Origin,Accept-Encoding
Last-Modified: Tue, 18 Aug 2020 15:38:10 GMT
X-Timestamp: 1597765089.87661
X-Object-Meta-Mtime: 1597764295.000000
X-Trans-Id: tx721ccf1d673543a388a6d-0063e2f3e5
Cache-Control: max-age=31536000
Age: 23
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/common.css
200 OK 315 B URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/common.css
IP
File type ASCII text, with very long lines (1210), with no line terminators
Hash ede133ac23e99c913a431685e0ebb999
209a24624be368e4f58f98a95f05c4a651198176
7526f49283749dd6159f0a78490bffb5a58170ef83f48468c38e01c456f9abd7
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/src/common.css HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/css
content-length: 315
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"4ba-5f425c775c3e4-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/logo-orange.png
404 Not Found 21 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/logo-orange.png
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (8047)
Hash d8eeb36e0a25f71219b28260b9284eb7
4a247a042c7b5601098a56c232a879d70b972bc4
dace30c7258370759216028439f24403fc2af9e1d36401066286fff2c25a2942
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/src/logo-orange.png HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/html; charset=UTF-8
content-length: 20687
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://wordpress-105593-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.17.2/images/services_comm/Logo_MC_noir_fond_transparent_small.png
200 OK 853 B URL HTTP/1.1 cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.17.2/images/services_comm/Logo_MC_noir_fond_transparent_small.png
IP
File type PNG image data, 20 x 30, 8-bit/color RGBA, non-interlaced\012- data
Hash bbfb3a4e950d63bd020add300cf15332
3ccb7cfe0d1409489ac3c40b6fa5c9c7b9a47c6c
4ae42e92bba9df8768146f10ff90e5be5d949425d05752f87a6fd8d2e27ece88
Analyzer Verdict Alert urlquery phishing Phishing - Orange
GET /c15d9d8fc98141b084d96f795046449b/auth-2.17.2/images/services_comm/Logo_MC_noir_fond_transparent_small.png HTTP/1.1
Host: cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: image/png
Content-Length: 853
Connection: keep-alive
Vary: Origin,Accept-Encoding
Last-Modified: Tue, 18 Aug 2020 15:38:09 GMT
Etag: bbfb3a4e950d63bd020add300cf15332
X-Timestamp: 1597765088.42556
X-Object-Meta-Mtime: 1597764295.000000
X-Trans-Id: txc0a9d25efd4842e9a833d-0063e2ebea
Cache-Control: max-age=31536000
Age: 2067
X-Mid: pr3s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.17.2/images/services_comm/Logo_MC_orange_fond_transparent_small.png
200 OK 858 B URL HTTP/1.1 cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.17.2/images/services_comm/Logo_MC_orange_fond_transparent_small.png
IP
File type PNG image data, 20 x 30, 8-bit/color RGBA, non-interlaced\012- data
Hash 6000d3e42563def838266719364eba06
e850fa48a787af8f1450bab7f47925e311977c06
27ffcc2c1144b73849cddaab57af25ea3ecb95a0434936d03e9dce93683a3c85
Analyzer Verdict Alert urlquery phishing Phishing - Orange
GET /c15d9d8fc98141b084d96f795046449b/auth-2.17.2/images/services_comm/Logo_MC_orange_fond_transparent_small.png HTTP/1.1
Host: cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: image/png
Content-Length: 858
Connection: keep-alive
Vary: Origin,Accept-Encoding
Last-Modified: Tue, 18 Aug 2020 15:38:09 GMT
Etag: 6000d3e42563def838266719364eba06
X-Timestamp: 1597765088.66183
X-Object-Meta-Mtime: 1597764295.000000
X-Trans-Id: txe667b993973a49e5a4f4b-0063e2ebea
Cache-Control: max-age=31536000
Age: 2067
X-Mid: pr1s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16655
Expires: Wed, 08 Feb 2023 05:37:16 GMT
Date: Wed, 08 Feb 2023 00:59:41 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16655
Expires: Wed, 08 Feb 2023 05:37:16 GMT
Date: Wed, 08 Feb 2023 00:59:41 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16655
Expires: Wed, 08 Feb 2023 05:37:16 GMT
Date: Wed, 08 Feb 2023 00:59:41 GMT
Connection: keep-alive
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/o_onei_responsive.css
200 OK 503 B URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/o_onei_responsive.css
IP
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/src/o_onei_responsive.css HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/css
content-length: 15007
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"2410b-5f425c775c3e4-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 68273225f74fbf7493f395610d7a73fc
5a8779ef5656aeeba23b365aad60b7901c5dd7fc
c83f285a1f3df0f7ac758a68ee95cc3d2671f80264c2e143cc0561cc574e3f19
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C83F285A1F3DF0F7AC758A68EE95CC3D2671F80264C2E143CC0561CC574E3F19"
Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16655
Expires: Wed, 08 Feb 2023 05:37:16 GMT
Date: Wed, 08 Feb 2023 00:59:41 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6de3153-62d2-494b-8acf-6d3ac8adba7d.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6de3153-62d2-494b-8acf-6d3ac8adba7d.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 003fc35e140a75a12b7795c3986426ec
da002b22e2a01f48a545b369d4403eabb17a10d5
bb0754411aa7d0a5036b86b282d0e93d13227765ca9ccaf3a34e8e486cb413d1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6de3153-62d2-494b-8acf-6d3ac8adba7d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13160
x-amzn-requestid: 34aa6dfe-7f14-48d0-89b2-90548621be79
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fzVxSHh7IAMFjAg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63de033b-49587fff75aebe96136137be;Sampled=0
x-amzn-remapped-date: Sat, 04 Feb 2023 07:03:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 81DTnHIh40lNEi6l5hC87Vo9R8k4w79Fr71zibyvGP0iJm4kmhWITA==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 07:45:27 GMT
age: 62054
etag: "da002b22e2a01f48a545b369d4403eabb17a10d5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce53bc9b-2505-4efd-9151-fa75ed70138a.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce53bc9b-2505-4efd-9151-fa75ed70138a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash be9f475292d4b5b0502d4381ccdf455b
ecb943b48c822b086ea699d802f8f1bb5ee26651
ed22a5102709dc7a067107a6c0cde26931f7781065de9cee49e22de6b9086e31
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce53bc9b-2505-4efd-9151-fa75ed70138a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8703
x-amzn-requestid: 6456aa7d-11f7-4066-a833-9ac5312c0c24
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O7JGLTIAMFqdQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c513-0679a75676cdc19251c81bdd;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:31 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oDXgginig1GJvV9QIPvDGVumNDnOrBbrGRZSqyJ_NDRUX4XP5jxHxQ==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 22:03:47 GMT
age: 10554
etag: "ecb943b48c822b086ea699d802f8f1bb5ee26651"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/trust-latest/datadome.js
200 OK 22 kB URL HTTP/1.1 cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/trust-latest/datadome.js
IP
File type ASCII text, with very long lines (65432)
Hash 80a7f2046423aa013542fbc5ec064e11
1b2d7bf5984e9e3059db68032e6769b794b34e10
5b38cf63a32e9903e39139542dfe2e73b053d372c28184787537c667213fcbc2
GET /c15d9d8fc98141b084d96f795046449b/trust-latest/datadome.js HTTP/1.1
Host: cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding, Origin,Accept-Encoding
Last-Modified: Fri, 28 May 2021 09:08:23 GMT
X-Timestamp: 1622192902.48024
X-Object-Meta-Mtime: 1622192884.931981
X-Trans-Id: txdb625682795f473ca963b-0063c6727d
Cache-Control: max-age=31536000
Age: 1868159
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5416f10c-2a0c-46e5-a76b-853a2be4c374.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5416f10c-2a0c-46e5-a76b-853a2be4c374.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash fe800d6af728cd622a6192ad5e7dda6a
3a301dd894fc428c7d1863c9d5eaf2652f5c2083
f4923c211ef24e933bbe73bd8d2033d6b6da4a9fa0c9d4699a1041a7bd8bf5a2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5416f10c-2a0c-46e5-a76b-853a2be4c374.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12216
x-amzn-requestid: cc61a63b-35fe-4bfa-ad20-1db3f4165446
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O7LFrCIAMFoYQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c514-2b5e27c62218510b74ea0989;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:32 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Cf13Lp2SFHQ4SSF6_KpC4zx339tZRkMmnmF-OKM_2hbWbIoR3OLJ_g==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:50:49 GMT
age: 11332
etag: "3a301dd894fc428c7d1863c9d5eaf2652f5c2083"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5708e132-62b1-4b5b-aa88-fe22e522eb0e.jpeg
200 OK 6.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5708e132-62b1-4b5b-aa88-fe22e522eb0e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4b327816bc2c6fd7291c75c693685d54
771070be61d0724b1c90ca86ea34c804bd7e501a
d45188239cacc7b228bc75ccc95afb48914aaa434c418cd5b786533e8b9cb983
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5708e132-62b1-4b5b-aa88-fe22e522eb0e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6838
x-amzn-requestid: 54fc5ae9-d37a-46cf-97e0-d05de1417cfb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O7QEsCoAMFY1w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c514-40de6212468fcd0e78a93708;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:32 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mgfr5wO7Bj5BVjKYY7O0c4ogLognfq09QrA9khZROr2CVyOWgKTz1g==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:52:35 GMT
age: 11226
etag: "771070be61d0724b1c90ca86ea34c804bd7e501a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F363ca744-ffa5-4390-9968-412e24620e36.jpeg
200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F363ca744-ffa5-4390-9968-412e24620e36.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5129898de057eb92808f18d120eb7a70
eb0a900843beac5c4ee46686b89b3e8b8d77f80f
7ce3e4f7be652895e93cb8c1a9019b70d699c0a9da013d311395a6440b4e9f96
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F363ca744-ffa5-4390-9968-412e24620e36.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7847
x-amzn-requestid: 60759e32-ac58-4dda-8ea3-fd80413c0deb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_OkkEpMoAMFnGw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c483-61b8715a0da73f4526215649;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:37:07 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: NwaKQCUYm5ov0l7aSUXurRhRMvaAOsjf5QOIWCttb8xkUbgrQei-Yw==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:52:18 GMT
age: 11243
etag: "eb0a900843beac5c4ee46686b89b3e8b8d77f80f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06b5f2a3-c53c-4690-b548-2c3d0f556f73.jpeg
200 OK 8.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06b5f2a3-c53c-4690-b548-2c3d0f556f73.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 02fde25be5ded120af759d19d8304f73
8d2a4d9ab5947113ce0737d4d4bed3e30a971026
7cdf26668cca22f28eee047d3fcf30cea8d97b1d8804fe2132728f26cd11558d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F06b5f2a3-c53c-4690-b548-2c3d0f556f73.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8629
x-amzn-requestid: cc20d28e-3937-4826-97ef-100fb5dd2645
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O7LFn3oAMF61A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c514-6e764236604212fa26dab38a;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:32 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0sEMzqETD-gbgXOXb_CJmLjYQmNGMN4-_ggiB7ifbifltHJYsTRRsQ==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:52:22 GMT
age: 11239
etag: "8d2a4d9ab5947113ce0737d4d4bed3e30a971026"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/eyeclose.png
200 OK 7.7 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/eyeclose.png
IP
File type PNG image data, 376 x 325, 8-bit/color RGBA, non-interlaced\012- data
Hash 9367e3550bb368981c5b93f0e1f808c1
b5cd3f6f77431f9992cda3df0937642d0e593780
ece31766aa4c25c70e7337149d8914626510df28b1648873f83be154ed1b6b47
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/eyeclose.png HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: image/png
content-length: 7710
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"1f02-5f425c775c3e4-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/567x302_megamenu_Cashback.jpg
200 OK 27 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/567x302_megamenu_Cashback.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 567x302, components 3\012- data
Hash ffa97acd1552c1eed4eb36739f56f143
bd1b1e651a92319e9eb8de8edf22682ba3fd1a84
f473516ff0aacfbe3f891a65e958258a72faa6c4b1e7db138b75b34dc4e4e0ab
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/src/567x302_megamenu_Cashback.jpg HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: image/jpeg
content-length: 26889
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"71ea-5f425c775c3e4-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/eyeopen.png
200 OK 7.7 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/eyeopen.png
IP
File type PNG image data, 512 x 512, 8-bit colormap, non-interlaced\012- data
Hash bca9e8d400ae6b4ac8fc57b9ad8e4c6f
52304d43599e63ab53c5a6cb2cf3472cb03e48dc
88192d0e1d7020c51660a15a623845bbdd01e92b95e7f6e51b509b79d5c5fdd5
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/eyeopen.png HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: image/png
content-length: 7711
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"22a4-5f425c775d383-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/mark.png
200 OK 865 B URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/mark.png
IP
File type PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced\012- data
Hash 76044652b53107a38f9651c0c0160435
495b2a0b6715d63e88f5aee26e9dc36b3ee01397
74ac5029c07b7025cc18a2122f3f094ed233a4ed455f13fe8edab316ec0d70ea
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/mark.png HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: image/png
content-length: 865
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"3f6-5f425c775e323-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/3.2.1/jquery.min.js
200 OK 30 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/3.2.1/jquery.min.js
IP
File type ASCII text, with very long lines (32058), with CRLF line terminators
Hash 9be8097803999b702fa83ec17dd66984
283299e8c5a59c73e949e4a275e0a70f9cf08f9f
c3702d18d04969c4d2c56a024a957ed897ec418bc15d66cea9eca0f1101a0c48
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/3.2.1/jquery.min.js HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: application/x-javascript
content-length: 30147
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"15287-5f425c775d383-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.10.0/images/services_comm/om_desktop.png
200 OK 29 kB URL HTTP/1.1 cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.10.0/images/services_comm/om_desktop.png
IP
File type PNG image data, 300 x 320, 8-bit/color RGB, non-interlaced\012- data
Hash bfd2858e4707255b0200abbe93131293
f693dffde9c8263e2aab90fb16a0ff070b5b4104
8dab2dc2566251e916a476c846ea0ed1ce459d26917a088146765ea6b2bef997
Analyzer Verdict Alert urlquery phishing Phishing - Orange
GET /c15d9d8fc98141b084d96f795046449b/auth-2.10.0/images/services_comm/om_desktop.png HTTP/1.1
Host: cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: image/png
Content-Length: 29367
Connection: keep-alive
Vary: Origin,Accept-Encoding
Last-Modified: Tue, 14 Jan 2020 13:29:56 GMT
Etag: bfd2858e4707255b0200abbe93131293
X-Timestamp: 1579008595.06236
X-Object-Meta-Mtime: 1576674392.000000
X-Trans-Id: tx031485ede6224cc39ec65-0063e2e560
Cache-Control: max-age=31536000
Age: 3741
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/jquery.min.js
200 OK 34 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/jquery.min.js
IP
File type ASCII text, with very long lines (32029), with CRLF line terminators
Hash 71805fdf87f894e50a7c848a071fe657
e2e7cd90ec4e96e27eabd69c28959998127ab6b1
162f6a591d1e454607caa5b7e75b139cddfa5ac601b50d98d2bea852c0f6285b
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/jquery.min.js HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: application/x-javascript
content-length: 33816
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"17be1-5f425c775d383-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/jquery-ui.min_1.js
200 OK 21 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/jquery-ui.min_1.js
IP
File type ASCII text, with very long lines (33186), with CRLF line terminators
Hash b74dec96d32f0f4bde67fbebf4c04db6
cd4d2c95f306b2e841bf87b379b18d9946521f35
0a1f5f144628fc6c73e5e1cb26d400d07c33a7f54d762b987c6b43deb0404c8c
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/ajax/libs/jquery/jquery-ui.min_1.js HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: application/x-javascript
content-length: 21327
last-modified: Wed, 08 Feb 2023 00:59:40 GMT
etag: W/"149c7-5f425c775d383-gzip"
accept-ranges: bytes
cache-control: max-age=31536000
expires: Thu, 08 Feb 2024 00:59:41 GMT
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/logo-orange.png
404 Not Found 21 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/logo-orange.png
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (8047)
Hash d7d266f53d2f75863dc4832fe0db49ce
ef93b44d80cb6c406564e3cb0d724fdbe5957c0d
de01d78669a24938a27a30489fd8777b416ba0aa8f404d642f772c154ec479e1
Analyzer Verdict Alert quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/src/logo-orange.png HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/login.php?particulier
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/html; charset=UTF-8
content-length: 20687
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://wordpress-105593-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
c.woopic.com/libs/common/o_load_responsive.js
200 OK 15 kB URL HTTP/1.1 c.woopic.com/libs/common/o_load_responsive.js
IP
File type HTML document text\012- C source, Unicode text, UTF-8 text, with very long lines (31919)
Hash a27d8c612959c474d58826085140c4ed
a5c9ab73a08899e09ebbff999d194b362919ea34
718359341af51c30d72473efc7416d6477a3cd39543dfe3efc8fced8af926bea
GET /libs/common/o_load_responsive.js HTTP/1.1
Host: c.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: text/javascript
Content-Length: 14937
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 11:17:56 GMT
X-Timestamp: 1675768675.37231
Cache-Control: s-maxage=60, max-age=0
X-Trans-Id: tx945737ac56ed4410aec83-0063e2f3fd
ETag: W/89eaff7585b1453d4628ceff79ec78c4
Vary: Origin, Accept-Encoding
Content-Encoding: gzip
Age: 0
X-Mid: pr1s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
c.woopic.com/fonts/o-icomoon.woff2?20191115
200 OK 14 kB URL HTTP/1.1 c.woopic.com/fonts/o-icomoon.woff2?20191115
IP
File type Web Open Font Format (Version 2), TrueType, length 13644, version 1.0\012- data
Hash 9e0847145553460e0d4332843fdaf7b4
f0e1604dc368564192d3990a4bf7b94baabd5d00
bc29b9fbbe5fd57e9cd50049aaff479f15a236cd156e2a840d4f57594a097301
GET /fonts/o-icomoon.woff2?20191115 HTTP/1.1
Host: c.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: application/octet-stream
Content-Length: 13644
Connection: keep-alive
Access-Control-Expose-Headers: cache-control, content-language, content-type, expires, last-modified, pragma, etag, x-timestamp, x-trans-id, x-object-meta-cache-control-max-age
Last-Modified: Tue, 04 Oct 2022 07:32:35 GMT
Etag: 9e0847145553460e0d4332843fdaf7b4
X-Timestamp: 1664868754.31878
Access-Control-Allow-Origin: *
X-Trans-Id: tx6895e01ab22841d393737-0063e2e561
Cache-Control: max-age=15552000
Vary: Origin
Age: 3739
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
c.woopic.com/fonts/HelvNeue75_W1G.woff2?20191115
200 OK 18 kB URL HTTP/1.1 c.woopic.com/fonts/HelvNeue75_W1G.woff2?20191115
IP
File type Web Open Font Format (Version 2), TrueType, length 18520, version 1.0\012- data
Hash e54a5770b5f82d8d6d9a1727e440bd79
057464047783bfe4b217c9e81e48b71aab7b0082
9d091f8ac8f622ef32b06ef1d72e296675b8ac7a0eedb132e089d8a4d61ce5dd
GET /fonts/HelvNeue75_W1G.woff2?20191115 HTTP/1.1
Host: c.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: application/octet-stream
Content-Length: 18520
Connection: keep-alive
Access-Control-Expose-Headers: cache-control, content-language, content-type, expires, last-modified, pragma, etag, x-timestamp, x-trans-id, x-object-meta-cache-control-max-age
Last-Modified: Tue, 04 Oct 2022 07:32:33 GMT
Etag: e54a5770b5f82d8d6d9a1727e440bd79
X-Timestamp: 1664868752.20950
Access-Control-Allow-Origin: *
X-Trans-Id: tx558db38d6d0749789f6f4-0063e2f20e
Cache-Control: max-age=15552000
Vary: Origin
Age: 495
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
c.woopic.com/fonts/HelvNeue55_W1G.woff2?20191115
200 OK 19 kB URL HTTP/1.1 c.woopic.com/fonts/HelvNeue55_W1G.woff2?20191115
IP
File type Web Open Font Format (Version 2), TrueType, length 18684, version 1.0\012- data
Hash 7cacf6f3f310565b41c6b3f536419773
b3bfd7ddfe2b3c908b2c25d739bc710d24494cb8
a84ca6b96b545a4df7413f3bbe30dc209af87adff480ee3a5cd0ff73e94ebbbb
GET /fonts/HelvNeue55_W1G.woff2?20191115 HTTP/1.1
Host: c.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:41 GMT
Content-Type: application/octet-stream
Content-Length: 18684
Connection: keep-alive
Access-Control-Expose-Headers: cache-control, content-language, content-type, expires, last-modified, pragma, etag, x-timestamp, x-trans-id, x-object-meta-cache-control-max-age
Last-Modified: Tue, 04 Oct 2022 07:32:34 GMT
Etag: 7cacf6f3f310565b41c6b3f536419773
X-Timestamp: 1664868753.39009
Access-Control-Allow-Origin: *
X-Trans-Id: tx5458851b2aed4f7e9a5cb-0063e2f363
Cache-Control: max-age=15552000
Vary: Origin
Age: 154
X-Mid: pr4s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
tags.tiqcdn.com/utag/orange/abtesting/prod/utag.sync.js
200 OK 1.5 kB URL HTTP/2 tags.tiqcdn.com/utag/orange/abtesting/prod/utag.sync.js
IP
File type HTML document, ASCII text, with very long lines (2488)
Hash d8e425f237ff61752dee9f3682841e5c
73e43bfc233460dec32f4ce44b94f4a5933dd860
62aec75c44c57dedf3fa4ded2aa9be05246fad0d665ee95c193691efb3bb5888
GET /utag/orange/abtesting/prod/utag.sync.js HTTP/1.1
Host: tags.tiqcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "af0bcf7b4d7cedffc4b651019c5b5d06:1673365892.351167"
last-modified: Tue, 10 Jan 2023 15:51:32 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=300
expires: Wed, 08 Feb 2023 01:04:41 GMT
date: Wed, 08 Feb 2023 00:59:41 GMT
content-length: 1474
X-Firefox-Spdy: h2
gp.cdn.woopic.com/magic/o_tealium.js?update
200 OK 283 B URL HTTP/1.1 gp.cdn.woopic.com/magic/o_tealium.js?update
IP
File type exported SGML document, ASCII text
Hash 261b2c37b27d1d998ca2e4ca77dcebe0
3331baea9ae7c836d2cf793b0b1fd74fd5755157
86b322f402eb14d9b481a29b96d66afe112d4940ba01377cf93aa45e513b9496
GET /magic/o_tealium.js?update HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 28 Feb 2022 14:20:12 GMT
X-Timestamp: 1646058011.46068
X-Trans-Id: tx0b7f779f02514915ba2e2-0063e2f3c1
Vary: Accept-Encoding, Origin
Age: 60
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
gp.cdn.woopic.com/libs/UrOPW3lz/common/css/common.css
200 OK 318 B URL HTTP/1.1 gp.cdn.woopic.com/libs/UrOPW3lz/common/css/common.css
IP
File type ASCII text, with very long lines (1270), with no line terminators
Hash a8e4dbb8fd60c3dad458567a4cd75048
71e547f9fc028a56948feae55c54b68da893c12c
19d508f9a42fd0e627e5f92ad85a5079a8fdcbde4874e568760bd20dcc340524
GET /libs/UrOPW3lz/common/css/common.css HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: text/css
Content-Length: 318
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 11:17:14 GMT
X-Timestamp: 1675768633.04916
Cache-Control: max-age=15552000
X-Trans-Id: txfc16762b26a64a74a1576-0063e23346
ETag: W/adf9b849879d64823051612b3d9d4b04
Content-Encoding: gzip
Vary: Origin, Accept-Encoding
Age: 49336
X-Mid: pr1s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
ocsp.usertrust.com/
200 OK 471 B IP
Hash 7c9c9a991db308fe6661dc9943439994
8219f5fa3c11d50d690f6d59a3b02a53a83e9d71
0c4257620cd44e38d5c1d2d12c3f4b5de05de033f566bd9ad12ff9c42a15fc99
POST / HTTP/1.1
Host: ocsp.usertrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 13:51:18 GMT
Expires: Tue, 14 Feb 2023 13:51:17 GMT
Etag: "8219f5fa3c11d50d690f6d59a3b02a53a83e9d71"
Cache-Control: max-age=601777,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 1011
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 79606c93ab74fac0-OSL
gp.cdn.woopic.com/magic/configuration.tgif.json
200 OK 372 B URL HTTP/1.1 gp.cdn.woopic.com/magic/configuration.tgif.json
IP
Hash 54e3802aa8e574e5464ad86f0a02b0db
3bda1616bdd79394ba45f1805de36105442c0eb7
ad0d69eb9b6dc718c27cb5f58b5f16491aae3c38823f54d271a4b62e87c90c00
GET /magic/configuration.tgif.json HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 25 Feb 2022 14:56:54 GMT
X-Timestamp: 1645801013.83939
X-Trans-Id: tx09ec2d69bb284454ba2e6-0063e2f143
Vary: Accept-Encoding, Origin
Cache-Control: max-age=3600
Age: 698
X-Mid: pr4s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
api-js.datadome.co/js/
200 OK 238 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash dbe1b239dd8758ddab9f1e04c7d2cb01
3ee6d3365850324300a75f979af223e2ed6cb66a
e6be0d030a7f9b63af545071910b127e2b5c87d75d9602a27f1a99130db3fd8f
POST /js/ HTTP/1.1
Host: api-js.datadome.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 2963
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:42 GMT
content-type: application/json;charset=utf-8
content-length: 238
server: DataDome
access-control-allow-origin: *
pragma: no-cache
cache-control: no-cache, no-store, must-revalidate
expires: 0
X-Firefox-Spdy: h2
gp.cdn.woopic.com/libs/UrOPW3lz/common/js/common.js
200 OK 21 kB URL HTTP/1.1 gp.cdn.woopic.com/libs/UrOPW3lz/common/js/common.js
IP
File type Unicode text, UTF-8 text, with very long lines (32000)
Hash b04772a03c457f14a739fe3f75668bee
5b736be620cb19b1fbea49d3b60d78454a8f4e89
8ae64431120bc542d12a1e6ed418cf5bd1a33aee4c39b96d3144e21f60454e93
GET /libs/UrOPW3lz/common/js/common.js HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: text/javascript
Content-Length: 21333
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 11:17:23 GMT
X-Timestamp: 1675768642.47491
Cache-Control: max-age=15552000
X-Trans-Id: txbd46b766a5844e198c589-0063e23348
ETag: W/249439dd1a946d23448ce08934e527d2
Content-Encoding: gzip
Vary: Origin, Accept-Encoding
Age: 49333
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
all.orfr.adgtw.orangeads.fr/js/ora_authen.identification
301 Moved Permanently 178 B URL HTTP/1.1 all.orfr.adgtw.orangeads.fr/js/ora_authen.identification
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
GET /js/ora_authen.identification HTTP/1.1
Host: all.orfr.adgtw.orangeads.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://cdn.adgtw.orangeads.fr/mediation/ora_authen.identification.js
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue75_W1G.woff
404 Not Found 90 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue75_W1G.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (8047)
Hash 7f4485e17d06096c36731b9e9dbc84f1
63a76af08c348227537ca5e7efa956f6bbf5b44d
b50187a5ee33b619696512e8319b4b05a7d5db0fde48a49f1148f279b39aeed3
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue75_W1G.woff HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/bundle.min.css
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://wordpress-105593-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue55_W1G.woff
404 Not Found 90 kB URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue55_W1G.woff
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (8047)
Hash 7f4485e17d06096c36731b9e9dbc84f1
63a76af08c348227537ca5e7efa956f6bbf5b44d
b50187a5ee33b619696512e8319b4b05a7d5db0fde48a49f1148f279b39aeed3
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue55_W1G.woff HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/bundle.min.css
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://wordpress-105593-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
gp.cdn.woopic.com/libs/UrOPW3lz/common/css/o_onei_responsive.css
200 OK 27 kB URL HTTP/1.1 gp.cdn.woopic.com/libs/UrOPW3lz/common/css/o_onei_responsive.css
IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash 8da05fe194ce54f961ad0100cba3d95d
3e4a9efc9867cd889018efc8a07bcea9b8a21724
163b1e9fa13f8242dbbd6ceb7544a8fd7c7bdccaa828f8fe0c4e44b61eddcf0b
GET /libs/UrOPW3lz/common/css/o_onei_responsive.css HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: text/css
Content-Length: 27182
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 11:17:16 GMT
X-Timestamp: 1675768635.19453
Cache-Control: max-age=15552000
X-Trans-Id: tx24089a5bc8f543d9adc2d-0063e23346
ETag: W/d18d752d9e18ebc83c06b17bd78e63a6
Content-Encoding: gzip
Vary: Origin, Accept-Encoding
Age: 49336
X-Mid: pr1s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
gp.cdn.woopic.com/libs/UrOPW3lz/common/js/o_onei_desktop.js
200 OK 15 kB URL HTTP/1.1 gp.cdn.woopic.com/libs/UrOPW3lz/common/js/o_onei_desktop.js
IP
File type Unicode text, UTF-8 text, with very long lines (31990)
Hash 98264e6e19a4b54ecb0c9b746eba6fde
faa6f4c2c94d6e906d58f82805f2b6ac2fc65bf3
df70d34f46cba8da632787556925320355362895b088a9bf5f0a2b291fe25b1a
GET /libs/UrOPW3lz/common/js/o_onei_desktop.js HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: text/javascript
Content-Length: 15190
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 11:17:25 GMT
X-Timestamp: 1675768644.49000
Cache-Control: max-age=15552000
X-Trans-Id: tx69f4d5c4951b47428d7cb-0063e23349
ETag: W/0ae2735cc6220887dd77c224e5ac75a6
Content-Encoding: gzip
Vary: Origin, Accept-Encoding
Age: 49333
X-Mid: pr4s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
gp.cdn.woopic.com/libs/UrOPW3lz/common/js/o_completion.js
200 OK 26 kB URL HTTP/1.1 gp.cdn.woopic.com/libs/UrOPW3lz/common/js/o_completion.js
IP
File type ASCII text, with very long lines (31992)
Hash 652b4d746a95b3b5f18dd31e8ecb4b94
c9ec943c938fea84eab65197151e470a15de1c58
878910e0267c9106efce0778f139f7260692791d6751b83b0509c1c8653ee480
GET /libs/UrOPW3lz/common/js/o_completion.js HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: text/javascript
Content-Length: 26314
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 11:17:23 GMT
X-Timestamp: 1675768642.97440
Cache-Control: max-age=15552000
X-Trans-Id: tx5474ac4ce2d8457388a28-0063e23348
ETag: W/198322b5cdb62d03d2f10dda59e3d417
Content-Encoding: gzip
Vary: Origin, Accept-Encoding
Age: 49333
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
gp.cdn.woopic.com/fonts/HelvNeue75_W1G.woff2?20201014
200 OK 18 kB URL HTTP/1.1 gp.cdn.woopic.com/fonts/HelvNeue75_W1G.woff2?20201014
IP
File type Web Open Font Format (Version 2), TrueType, length 18520, version 1.0\012- data
Hash e54a5770b5f82d8d6d9a1727e440bd79
057464047783bfe4b217c9e81e48b71aab7b0082
9d091f8ac8f622ef32b06ef1d72e296675b8ac7a0eedb132e089d8a4d61ce5dd
GET /fonts/HelvNeue75_W1G.woff2?20201014 HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://gp.cdn.woopic.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/octet-stream
Content-Length: 18520
Connection: keep-alive
Access-Control-Expose-Headers: cache-control, content-language, content-type, expires, last-modified, pragma, etag, x-timestamp, x-trans-id, x-object-meta-cache-control-max-age
Last-Modified: Tue, 04 Oct 2022 07:32:33 GMT
Etag: e54a5770b5f82d8d6d9a1727e440bd79
X-Timestamp: 1664868752.20950
Access-Control-Allow-Origin: *
X-Trans-Id: txe22a58b413d3436694b54-0063e2c5bd
Cache-Control: max-age=15552000
Vary: Origin
Age: 11840
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
gp.cdn.woopic.com/libs/UrOPW3lz/common/js/o_onei_core.all.desktop.VaMmWLxq.js
200 OK 82 kB URL HTTP/1.1 gp.cdn.woopic.com/libs/UrOPW3lz/common/js/o_onei_core.all.desktop.VaMmWLxq.js
IP
File type Unicode text, UTF-8 text, with very long lines (33843), with NEL line terminators
Hash 646ccdd71e99ec832ab98f32ec4d6847
2c15bc0a50be019ca7c42da9fbf05b9af440b68d
c833b39a68b6e1adba88fc8a0f68d13639caa4eb3d4c338d418de16928cb9ffc
GET /libs/UrOPW3lz/common/js/o_onei_core.all.desktop.VaMmWLxq.js HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: text/javascript
Content-Length: 82183
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 11:17:24 GMT
X-Timestamp: 1675768643.57611
Cache-Control: max-age=15552000
X-Trans-Id: txd8a84ba131834f459a4d1-0063e23349
ETag: W/6526e8fc5eb61d925e2f24ba66ca17e7
Content-Encoding: gzip
Vary: Origin, Accept-Encoding
Age: 49333
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
cdn.adgtw.orangeads.fr/mediation/ora_authen.identification.js
200 OK 561 B URL HTTP/1.1 cdn.adgtw.orangeads.fr/mediation/ora_authen.identification.js
IP
Hash c27e1a59d5aa6b6f964c94ccc5ffd674
16d8ddb284d15249b02a1814f7d1ff882a762ce5
82cc5c9fb18c15c690caa8d7fcf81b2941e302b8b8fe5231df277c9048938175
GET /mediation/ora_authen.identification.js HTTP/1.1
Host: cdn.adgtw.orangeads.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://wordpress-105593-0.cloudclusters.net/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Tue, 31 Jan 2023 10:02:28 GMT
X-Timestamp: 1675159347.72583
Cache-Control: s-maxage=900
X-Trans-Id: txea3561e5bff2454f9682a-0063e2f3e7
Age: 22
X-Mid: pr3s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
gp.cdn.woopic.com/fonts/HelvNeue55_W1G.woff2?20201014
200 OK 19 kB URL HTTP/1.1 gp.cdn.woopic.com/fonts/HelvNeue55_W1G.woff2?20201014
IP
File type Web Open Font Format (Version 2), TrueType, length 18684, version 1.0\012- data
Hash 7cacf6f3f310565b41c6b3f536419773
b3bfd7ddfe2b3c908b2c25d739bc710d24494cb8
a84ca6b96b545a4df7413f3bbe30dc209af87adff480ee3a5cd0ff73e94ebbbb
GET /fonts/HelvNeue55_W1G.woff2?20201014 HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://gp.cdn.woopic.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/octet-stream
Content-Length: 18684
Connection: keep-alive
Access-Control-Expose-Headers: cache-control, content-language, content-type, expires, last-modified, pragma, etag, x-timestamp, x-trans-id, x-object-meta-cache-control-max-age
Last-Modified: Tue, 04 Oct 2022 07:32:34 GMT
Etag: 7cacf6f3f310565b41c6b3f536419773
X-Timestamp: 1664868753.39009
Access-Control-Allow-Origin: *
X-Trans-Id: tx25b79d230d3b46f997a1c-0063e2c5be
Cache-Control: max-age=15552000
Vary: Origin
Age: 11840
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
gp.cdn.woopic.com/fonts/o-icomoon.woff2?20201014
200 OK 14 kB URL HTTP/1.1 gp.cdn.woopic.com/fonts/o-icomoon.woff2?20201014
IP
File type Web Open Font Format (Version 2), TrueType, length 13644, version 1.0\012- data
Hash 9e0847145553460e0d4332843fdaf7b4
f0e1604dc368564192d3990a4bf7b94baabd5d00
bc29b9fbbe5fd57e9cd50049aaff479f15a236cd156e2a840d4f57594a097301
GET /fonts/o-icomoon.woff2?20201014 HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://gp.cdn.woopic.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/octet-stream
Content-Length: 13644
Connection: keep-alive
Access-Control-Expose-Headers: cache-control, content-language, content-type, expires, last-modified, pragma, etag, x-timestamp, x-trans-id, x-object-meta-cache-control-max-age
Last-Modified: Tue, 04 Oct 2022 07:32:35 GMT
Etag: 9e0847145553460e0d4332843fdaf7b4
X-Timestamp: 1664868754.31878
Access-Control-Allow-Origin: *
X-Trans-Id: tx211a6cf31f7142e084aa0-0063e2c6b7
Cache-Control: max-age=15552000
Vary: Origin
Age: 11590
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.10.0/icons/favicon-194x194.png
200 OK 680 B URL HTTP/1.1 cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.10.0/icons/favicon-194x194.png
IP
File type PNG image data, 194 x 194, 8-bit/color RGBA, non-interlaced\012- data
Hash 5608b8bfdb3b2102d558f69f2aede778
8844295cf7a92af84a35fe7711fb1b99c8e8e860
40613807e3b07197817a58c12d4c46ea117d76e3338a2cc995c7c4c88844882d
Analyzer Verdict Alert urlquery phishing Phishing - Orange
GET /c15d9d8fc98141b084d96f795046449b/auth-2.10.0/icons/favicon-194x194.png HTTP/1.1
Host: cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: image/png
Content-Length: 680
Connection: keep-alive
Vary: Origin,Accept-Encoding
Last-Modified: Tue, 14 Jan 2020 13:29:53 GMT
Etag: 5608b8bfdb3b2102d558f69f2aede778
X-Timestamp: 1579008592.74132
X-Object-Meta-Mtime: 1576674392.000000
X-Trans-Id: txde0422eb6108475db2d45-0063e2f1bf
Cache-Control: max-age=31536000
Age: 575
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.10.0/icons/favicon-16x16.png
200 OK 156 B URL HTTP/1.1 cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-2.10.0/icons/favicon-16x16.png
IP
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash 626f69e7786315605b8ded76e6fcbc8b
b35aacdb793e2aecfbf1200804419130db0735c9
62a86ea8519b47dc4f5dcfc10ba55e26c34065a64f1a34ec2e6edd52c16b803d
Analyzer Verdict Alert urlquery phishing Phishing - Orange
GET /c15d9d8fc98141b084d96f795046449b/auth-2.10.0/icons/favicon-16x16.png HTTP/1.1
Host: cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: image/png
Content-Length: 156
Connection: keep-alive
Vary: Origin,Accept-Encoding
Last-Modified: Tue, 14 Jan 2020 13:29:53 GMT
Etag: 626f69e7786315605b8ded76e6fcbc8b
X-Timestamp: 1579008592.56381
X-Object-Meta-Mtime: 1576674392.000000
X-Trans-Id: txc57931d1cb974cc5a75f1-0063e2f1bf
Cache-Control: max-age=31536000
Age: 575
X-Mid: pr1s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
gp.cdn.woopic.com/magic/oneI.res.desktop.5.0.3.json
200 OK 25 kB URL HTTP/1.1 gp.cdn.woopic.com/magic/oneI.res.desktop.5.0.3.json
IP
File type Unicode text, UTF-8 text, with very long lines (1337)
Hash 8b326c397377a1bea32060d753b483a6
7aa0c9ba9638593ecba0c06eda216f43a3e8203c
d63fc7a47ec8f86ce3207c2a7f766d122bd5e5e7772a7912c019acca95245611
GET /magic/oneI.res.desktop.5.0.3.json HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 02 Feb 2023 09:05:08 GMT
X-Timestamp: 1675328707.31596
X-Trans-Id: tx4ada9d64f92c499bbf424-0063e2f159
Vary: Accept-Encoding, Origin
Cache-Control: max-age=3600
Age: 676
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
cdn.adgtw.orangeads.fr/build/oan_common-async-3.2.min.js?1675158902271
200 OK 61 kB URL HTTP/1.1 cdn.adgtw.orangeads.fr/build/oan_common-async-3.2.min.js?1675158902271
IP
File type Unicode text, UTF-8 text, with very long lines (65465)
Hash 0a20cc0b2a9528de9bebd84204818c05
6c99a957139be5edb28675289f646f526657f4af
0fab55cabf4c543fbdcbaeb65f0370f0a87e92080aaa8409881b35727b00a8c4
GET /build/oan_common-async-3.2.min.js?1675158902271 HTTP/1.1
Host: cdn.adgtw.orangeads.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 19 Jan 2023 06:26:24 GMT
X-Timestamp: 1674109583.09050
Cache-Control: public, max-age=604800
X-Trans-Id: tx63273e9b9967459c84530-0063e248d1
Age: 43821
X-Mid: pr3s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
cdn.adgtw.orangeads.fr/build/lib/px.js?ch=2
200 OK 242 B URL HTTP/1.1 cdn.adgtw.orangeads.fr/build/lib/px.js?ch=2
IP
File type ASCII text, with very long lines (346), with no line terminators
Hash 0c6c0ee60b6ec116b9ba3cd7b7fd38d3
cee6909aa5160a4ff369083f3e9ad8222c207561
2b57181f82baaa76c05be51ccd06b0fb4b90975be8e4f57e3e07749992257dcd
GET /build/lib/px.js?ch=2 HTTP/1.1
Host: cdn.adgtw.orangeads.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 19 Jan 2023 06:26:51 GMT
X-Timestamp: 1674109610.24968
Cache-Control: public, max-age=604800
X-Trans-Id: tx2fe53ff70ca94acf8717e-0063db57cc
Age: 498738
X-Mid: pr3s
X-Cache: HIT
x-server: sph
Content-Encoding: gzip
tags.tiqcdn.com/utag/orange/identite/prod/utag.js
200 OK 11 kB URL HTTP/2 tags.tiqcdn.com/utag/orange/identite/prod/utag.js
IP
File type HTML document, ASCII text, with very long lines (3940)
Hash adaec13ce0f28d69c19a194c068a7d41
3055cc3bf5fea8ba4701fc533854ffb267bf2b31
ad4d7c0f0bef2cf495c161c9592a7bdc2955ac16308ac61c4526eea83cf7c043
GET /utag/orange/identite/prod/utag.js HTTP/1.1
Host: tags.tiqcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "bc66ee7e50ce90af95a07b08548690eb:1674735469.64172"
last-modified: Thu, 26 Jan 2023 12:17:49 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=300
expires: Wed, 08 Feb 2023 01:04:42 GMT
date: Wed, 08 Feb 2023 00:59:42 GMT
content-length: 10616
X-Firefox-Spdy: h2
c.woopic.com/z.gif?APP=elco&access=desktop&loaderLoaded=2140&coreLoading=2140&coreLoaded=2148&libLoading=2808&libLoaded=2809&rendered=3098&end=3098
200 OK 43 B URL HTTP/1.1 c.woopic.com/z.gif?APP=elco&access=desktop&loaderLoaded=2140&coreLoading=2140&coreLoaded=2148&libLoading=2808&libLoaded=2809&rendered=3098&end=3098
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
GET /z.gif?APP=elco&access=desktop&loaderLoaded=2140&coreLoading=2140&coreLoaded=2148&libLoading=2808&libLoaded=2809&rendered=3098&end=3098 HTTP/1.1
Host: c.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:42 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Cache-Control: no-cache
X-Mid: N-pr1s
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
tags.tiqcdn.com/utag/orange/identite/prod/utag.33.js?utv=ut4.47.202105040940
200 OK 3.5 kB URL HTTP/2 tags.tiqcdn.com/utag/orange/identite/prod/utag.33.js?utv=ut4.47.202105040940
IP
File type ASCII text, with very long lines (1706)
Hash 13677f112e273114b41e7256fb8528b0
6105d33f27aba8162724d661bfb97d5759964685
c4fd1c695cd90b7615ec264488b4e84e38e4bf6a600e1a244b67e117f43d82fe
GET /utag/orange/identite/prod/utag.33.js?utv=ut4.47.202105040940 HTTP/1.1
Host: tags.tiqcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "a828fd6b0717088b73a194b9beaab918:1620121228.746471"
last-modified: Tue, 04 May 2021 09:40:28 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=1296000
expires: Thu, 23 Feb 2023 00:59:42 GMT
date: Wed, 08 Feb 2023 00:59:42 GMT
content-length: 3460
X-Firefox-Spdy: h2
tags.tiqcdn.com/utag/orange/identite/prod/utag.29.js?utv=ut4.47.202212071609
200 OK 5.6 kB URL HTTP/2 tags.tiqcdn.com/utag/orange/identite/prod/utag.29.js?utv=ut4.47.202212071609
IP
File type ASCII text, with very long lines (1204)
Hash da832fa3919986973572680b9ae2399b
60c6acd391d4ab69285200e9e75fc2e3b5be2aa4
3804bfa896927cabe3e6fc9a0c0c00408fb63e0bb9982eaef0a48853073424ad
GET /utag/orange/identite/prod/utag.29.js?utv=ut4.47.202212071609 HTTP/1.1
Host: tags.tiqcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "df3655216296cd975678739cf019d210:1658736609.419389"
last-modified: Mon, 25 Jul 2022 08:10:09 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=1296000
expires: Thu, 23 Feb 2023 00:59:42 GMT
date: Wed, 08 Feb 2023 00:59:42 GMT
content-length: 5627
X-Firefox-Spdy: h2
tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=orange/identite/202301261217&cb=1675818034934
200 OK 2 B URL HTTP/2 tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=orange/identite/202301261217&cb=1675818034934
IP
File type ASCII text, with no line terminators
Hash 7bc0ee636b3b83484fc3b9348863bd22
ebbffb7d7ea5362a22bfa1bab0bfdeb1617cd610
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
GET /utag/tiqapp/utag.v.js?a=orange/identite/202301261217&cb=1675818034934 HTTP/1.1
Host: tags.tiqcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
content-length: 2
cache-control: max-age=600
expires: Wed, 08 Feb 2023 01:09:42 GMT
date: Wed, 08 Feb 2023 00:59:42 GMT
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash e83d16bd5270248fb1c89777e7590133
b7de4088bd8b305f7b9323a1734dae190ce51ab0
cd4536029d020c04e871a1924336c6c6c638cd7e5f5094455f1da89638a2ac85
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4452
Cache-Control: max-age=127299
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 00:59:42 GMT
Etag: "63e230dd-1d7"
Expires: Thu, 09 Feb 2023 12:21:21 GMT
Last-Modified: Tue, 07 Feb 2023 11:07:09 GMT
Server: ECS (amb/6B7A)
X-Cache: HIT
Content-Length: 471
sdk.privacy-center.org/3e6e3e05-9201-4614-a13e-b9649d1fa0e4/loader.js?target_type=notice&target=mz4pRBcF
200 OK 8.3 kB URL HTTP/2 sdk.privacy-center.org/3e6e3e05-9201-4614-a13e-b9649d1fa0e4/loader.js?target_type=notice&target=mz4pRBcF
IP
File type Unicode text, UTF-8 text, with very long lines (36922), with no line terminators
Hash 9e6ac3cdab5bfeee7d21729ddc54cfa4
f221768adde81b978a9bca5cdee982364372d4e2
e9598de04f2f1694c324d1fba77168f894a4902db82a5a065f4743677e28a954
GET /3e6e3e05-9201-4614-a13e-b9649d1fa0e4/loader.js?target_type=notice&target=mz4pRBcF HTTP/1.1
Host: sdk.privacy-center.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
content-length: 8290
server: CloudFront
date: Wed, 08 Feb 2023 00:24:53 GMT
x-didomi-remote-config-source: Lambda
content-encoding: gzip
cache-control: max-age=7200, public
etag: "ea0555332960c6cd3888e2a0b5b027ae"
x-cache: Hit from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: ZBQQK4XOr8yxI4VpK4lmkrA7yW41l09qhBO81V1fjTY9hJONY5NRpA==
age: 2089
X-Firefox-Spdy: h2
sso.orange.fr/pushms/advise/1.1/proposal?targets=TOP[orangefr_megamenu_mof_seg:1,orangefr_megamenu_mof_perso:99,orangefr_megamenu_int_seg:1,orangefr_megamenu_int_perso:99,orangefr_megamenu_pim_seg:1,orangefr_megamenu_pim_perso:99,orangefr_megamenu_corner_event:1]&canal=06o&canalPhysique=web
200 OK 3.6 kB URL HTTP/1.1 sso.orange.fr/pushms/advise/1.1/proposal?targets=TOP[orangefr_megamenu_mof_seg:1,orangefr_megamenu_mof_perso:99,orangefr_megamenu_int_seg:1,orangefr_megamenu_int_perso:99,orangefr_megamenu_pim_seg:1,orangefr_megamenu_pim_perso:99,orangefr_megamenu_corner_event:1]&canal=06o&canalPhysique=web
IP
File type JSON data\012- , ASCII text, with very long lines (8728), with no line terminators
Hash d6804d0579cbe2a3ab1a0e1c8f608b72
0a3fb1f5737a598480640d5807c9ef6446fd2dfa
1e3d8c2899e0a1c8ed4838e61ea36ba94bb93b71c0ee8e6634300fbef45dc0a9
GET /pushms/advise/1.1/proposal?targets=TOP[orangefr_megamenu_mof_seg:1,orangefr_megamenu_mof_perso:99,orangefr_megamenu_int_seg:1,orangefr_megamenu_int_perso:99,orangefr_megamenu_pim_seg:1,orangefr_megamenu_pim_perso:99,orangefr_megamenu_corner_event:1]&canal=06o&canalPhysique=web HTTP/1.1
Host: sso.orange.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Wed, 08 Feb 2023 00:59:42 GMT
X-Request-Id: Y@Lz-htTlpd1h0stv8XeiQAAAFI
UNIQUE_ID: Y@Lz-htTlpd1h0stv8XeiQAAAFI
X-Adv-Status: 213
X-Adv-Med-et: 2215
X-Adv-RE-rtt: 7616
Vary: Origin,User-Agent,Accept-Encoding,Accept
Last-Modified: Wed, 08 Feb 2023 00:59:42 GMT
Content-Encoding: gzip
ETag: "-"
Cache-Control: private,max-age=0,s-maxage=0,must-revalidate
Content-Length: 3561
Content-Type: application/json
P3P: CP="NOI"
Connection: close
Set-Cookie: cookie_wt=!QQQE9npEmPmg37VblkYjHWOSs3H16uURpN0MjUGqTnkTe3DvCBVR8sAn4dSYGlgYishyRlLd9oJfeI3IT7SsZXVSKRlc26NlvSSzOtKu+KZPj/Sgsuur5CJOAeevLc+tB66fdeZ537N/2Jl9q0/ZBFjXrdpk38A=; path=/; Httponly; Secure ; SameSite=None
TS011e2867=0120e2f114a63dee9ee2d4d3fb2622e622620871a26f6dc8fa8c1b9504708928448f5646bc4b20bd2cd0dc7f59c71c53560d250824; Path=/ ; Secure ; SameSite=None
c.woopic.com/logo-orange.png
200 OK 3.4 kB URL HTTP/1.1 c.woopic.com/logo-orange.png
IP
File type PNG image data, 250 x 250, 8-bit colormap, non-interlaced\012- data
Hash ba58c4c13a8cce3745d4891ece04159e
f06787352d2f6c0a8ae701ff27a066d4ba646a6c
b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472
GET /logo-orange.png HTTP/1.1
Host: c.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:43 GMT
Content-Type: image/png
Content-Length: 3354
Connection: keep-alive
Last-Modified: Tue, 01 Mar 2022 10:11:08 GMT
Etag: ba58c4c13a8cce3745d4891ece04159e
X-Timestamp: 1646129467.21732
X-Object-Meta-Mtime: 1646129461.489712
X-Trans-Id: tx64d3197b4f284e0eb5045-0063e2f39b
Vary: Origin
Age: 99
X-Mid: pr1s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
gp.cdn.woopic.com/zema/1.0.0/assets/Image-megamenu-banque-300123.c60297e301.png
200 OK 80 kB URL HTTP/1.1 gp.cdn.woopic.com/zema/1.0.0/assets/Image-megamenu-banque-300123.c60297e301.png
IP
File type JPEG image data, baseline, precision 8, 567x302, components 3\012- data
Hash 021b5026900aee57f5db9ee06a07d00f
227dd5f4224d0913ec6dceec572d2cc5eaf9a176
83cc5d6a3b32a5d7fbd23cb7b30e492a40558327201a2aec1cf9bc440abbf824
GET /zema/1.0.0/assets/Image-megamenu-banque-300123.c60297e301.png HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:43 GMT
Content-Type: image/png
Content-Length: 79993
Connection: keep-alive
Last-Modified: Thu, 02 Feb 2023 13:29:05 GMT
Etag: 021b5026900aee57f5db9ee06a07d00f
X-Timestamp: 1675344544.35525
Cache-Control: max-age=15552000
X-Trans-Id: txed2e3496ccd04bb98cf98-0063e20749
Vary: Origin
Age: 60597
X-Mid: pr1s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
gp.cdn.woopic.com/magic/img_fixe_maisonProtegee270123.png
200 OK 189 kB URL HTTP/1.1 gp.cdn.woopic.com/magic/img_fixe_maisonProtegee270123.png
IP
File type PNG image data, 567 x 302, 8-bit/color RGBA, non-interlaced\012- data
Size 189 kB (188727 bytes)
Hash 7eaef42c7ea4e2d7b2e48318a0bb2db0
246fbdc6d399b9f13b7587750b6dfa497b93ade2
3149fa0327e03275f0eadd007f93775d88de06dbb781e5fb45e38cd137805438
GET /magic/img_fixe_maisonProtegee270123.png HTTP/1.1
Host: gp.cdn.woopic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 08 Feb 2023 00:59:43 GMT
Content-Type: image/png
Content-Length: 188727
Connection: keep-alive
Last-Modified: Thu, 02 Feb 2023 09:05:06 GMT
Etag: 7eaef42c7ea4e2d7b2e48318a0bb2db0
X-Timestamp: 1675328705.71794
X-Trans-Id: tx6ed73766c7c7496eb15a4-0063e2f15c
Vary: Origin
Cache-Control: max-age=3600
Age: 674
X-Mid: pr2s
X-Cache: HIT
x-server: sph
Accept-Ranges: bytes
ocsp.digicert.com/
200 OK 471 B IP
Hash 16589a63f35dd6fb0c6b1be379d9116b
8e89d89bf1c343b9dc871e1b47ba7f6add820b22
99200f4e4fff33326ae65fd1d5fe1cabf3956b84619878244b3b2914648af458
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=95126
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 00:59:43 GMT
Etag: "63e1c495-1d7"
Expires: Thu, 09 Feb 2023 03:25:09 GMT
Last-Modified: Tue, 07 Feb 2023 03:25:09 GMT
Server: nginx
Content-Length: 471
sdk.privacy-center.org/sdk.9ea189c7a2f62ebf389797323cb5cd68bd990dc0.js
200 OK 93 kB URL HTTP/2 sdk.privacy-center.org/sdk.9ea189c7a2f62ebf389797323cb5cd68bd990dc0.js
IP
File type Unicode text, UTF-8 text, with very long lines (65400)
Hash c6755eb72ab231ca9e12fbce67b5aca5
eb6c44802d08670db208a79ac05261898e6d9a06
1590a19bcb64374c30df0546d17e4859f1018933210ab2c1be3ea2a8336987a6
GET /sdk.9ea189c7a2f62ebf389797323cb5cd68bd990dc0.js HTTP/1.1
Host: sdk.privacy-center.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Tue, 07 Feb 2023 07:23:06 GMT
last-modified: Tue, 07 Feb 2023 07:18:43 GMT
etag: W/"eb652dcfac73ddf0dfd1161683a187a3"
x-amz-server-side-encryption: AES256
x-amz-meta-s3cmd-attrs: atime:1675753991/ctime:1675753991/gid:0/gname:root/md5:eb652dcfac73ddf0dfd1161683a187a3/mode:33188/mtime:1675753991/uid:0/uname:root
cache-control: public, max-age=31536000
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: sJhSuKyEOK4XH0MM1zhIQPfOivn8xdZGO7i2lM1G_jZ3JOEwcTbV7w==
age: 63397
X-Firefox-Spdy: h2
tags.tiqcdn.com/utag/orange/identite/prod/utag.37.js?utv=ut4.47.202301261217
200 OK 1.0 kB URL HTTP/2 tags.tiqcdn.com/utag/orange/identite/prod/utag.37.js?utv=ut4.47.202301261217
IP
File type ASCII text, with very long lines (1048)
Hash ce4c0c4b5ce861b6299734e1ee083006
235cf0be93c4b3603d04a69874f11f82ea1a79d5
96c8ddec8c98ca30144da21d6a4f3b20733417d8f3cd84e4014817133af4caf5
GET /utag/orange/identite/prod/utag.37.js?utv=ut4.47.202301261217 HTTP/1.1
Host: tags.tiqcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/x-javascript
etag: "a9cf8e81bb6f93861c71a5f86f06669e:1620121307.576262"
last-modified: Tue, 04 May 2021 09:41:47 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=1296000
expires: Thu, 23 Feb 2023 00:59:47 GMT
date: Wed, 08 Feb 2023 00:59:47 GMT
content-length: 1029
X-Firefox-Spdy: h2
api-js.datadome.co/js/
200 OK 238 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash f633e3709e3f777c6931a7a2ee7237a7
005334a885a63e596a164465117f570a7cc21bc1
91135421b7ded0fcd544fc565e605395fbe279b5c1a08aefd6203b25c305c691
POST /js/ HTTP/1.1
Host: api-js.datadome.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 3272
Origin: https://wordpress-105593-0.cloudclusters.net
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 08 Feb 2023 00:59:47 GMT
content-type: application/json;charset=utf-8
content-length: 238
server: DataDome
access-control-allow-origin: *
pragma: no-cache
cache-control: no-cache, no-store, must-revalidate
expires: 0
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue55_W1G.woff2
404 Not Found 0 B URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue55_W1G.woff2
IP
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue55_W1G.woff2 HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/bundle.min.css
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://wordpress-105593-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
sdk.privacy-center.org/ui-gdpr-fr-web.9ea189c7a2f62ebf389797323cb5cd68bd990dc0.js
200 OK 0 B URL HTTP/2 sdk.privacy-center.org/ui-gdpr-fr-web.9ea189c7a2f62ebf389797323cb5cd68bd990dc0.js
IP
GET /ui-gdpr-fr-web.9ea189c7a2f62ebf389797323cb5cd68bd990dc0.js HTTP/1.1
Host: sdk.privacy-center.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Tue, 07 Feb 2023 07:23:18 GMT
last-modified: Tue, 07 Feb 2023 07:18:56 GMT
etag: W/"6803c2448f3e48b1a4febb7fba2bdb08"
x-amz-server-side-encryption: AES256
x-amz-meta-s3cmd-attrs: atime:1675753991/ctime:1675753991/gid:0/gname:root/md5:6803c2448f3e48b1a4febb7fba2bdb08/mode:33188/mtime:1675753991/uid:0/uname:root
cache-control: public, max-age=31536000
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 5vIYlXr-Wwvi9khgJx69R1U2Xtb0qZHTan6LU-57RVxUz2tfrb984w==
age: 63390
X-Firefox-Spdy: h2
wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue75_W1G.woff2
404 Not Found 0 B URL HTTP/2 wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue75_W1G.woff2
IP
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /orangecorrespondant/ecout/e1fb812efb16369/fonts/HelvNeue75_W1G.woff2 HTTP/1.1
Host: wordpress-105593-0.cloudclusters.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://wordpress-105593-0.cloudclusters.net/orangecorrespondant/ecout/e1fb812efb16369/src/bundle.min.css
Cookie: PHPSESSID=idq04gle2icqlvik7c5gfairin
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Wed, 08 Feb 2023 00:59:41 GMT
content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://wordpress-105593-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
vary: Accept-Encoding
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2
172.217.21.161
23.36.76.226
193.252.148.247
80.12.255.65
16.16.23.169
93.184.220.29
104.18.32.68