| www.nocowinterwonderland.com/ |  104.207.254.173 | 301 Moved Permanently | 0 B |
URL HTTP/1.1www.nocowinterwonderland.com/ IP104.207.254.173:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET / HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 29 Nov 2022 16:07:20 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Redirect-By: WordPress
Location: https://www.nocowinterwonderland.com/
X-Cache-NxAccel: BYPASS
|
|
| r3.o.lencr.org/ |  23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hasha5daf4dc99951793ae2315d4795e8146 4427507ca4d3a5632cc8f598afbc85e2195d00bd 94fb64c1c826ed7099283c0bedb3cea7ac7e1d9526794cb9fad6e761f5989d32
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94FB64C1C826ED7099283C0BEDB3CEA7AC7E1D9526794CB9FAD6E761F5989D32"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9949
Expires: Tue, 29 Nov 2022 18:53:09 GMT
Date: Tue, 29 Nov 2022 16:07:20 GMT
Connection: keep-alive
|
|
| ocsp.digicert.com/ |  93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hash4ed065cb23b5fca1a179dd73b3c5b7b2 4422eb24688f5e056fc1b18b127c7f63b1dbf5e0 b723d770d0dec7441d8505dc5a4e7d34f55c9f564ec52f20d9b70c7c3a0d9d35
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5647
Cache-Control: max-age=158278
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:20 GMT
Etag: "6385df6f-1d7"
Expires: Thu, 01 Dec 2022 12:05:18 GMT
Last-Modified: Tue, 29 Nov 2022 10:31:11 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
|
|
| firefox.settings.services.mozilla.com/v1/ | 34.102.187.140 | 200 OK | 939 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/ IP34.102.187.140:0
File typeJSON data\012- , ASCII text, with very long lines (939), with no line terminators Hash14cd9a0afb6ba9a763651d5112760d1e 75d7b104ab9ab11fbb73c3f348b43b0119b5adfa 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 29 Nov 2022 15:19:38 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2862
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash9fce5679881bf302a8978a0b462f01a9 b699fe030ea13ac73813e655c42ed9b531925e2b a3ec545a8f9364ac9062eddb41279e1465687a1b60f9c1dec6b3a3df8b033eb3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A3EC545A8F9364AC9062EDDB41279E1465687A1B60F9C1DEC6B3A3DF8B033EB3"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4400
Expires: Tue, 29 Nov 2022 17:20:40 GMT
Date: Tue, 29 Nov 2022 16:07:20 GMT
Connection: keep-alive
|
|
| content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain | 34.160.144.191 | 200 OK | 5.3 kB |
URL HTTP/2content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain IP34.160.144.191:0
File typePEM certificate\012- , ASCII text Hash9ebddc2b260d081ebbefee47c037cb28 492bad62a7ca6a74738921ef5ae6f0be5edebf39 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 4PpuUIaO06hPiXCWS61qCbTLwapbsirHZgGXhDmyYbznimZ/cV9ihVlFLoBIsK3KA0HHIE/4CrQ=
x-amz-request-id: RP5ANQG4G1ZPD2Y9
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 29 Nov 2022 15:45:31 GMT
age: 1309
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| contile.services.mozilla.com/v1/tiles | 34.117.237.239 | 200 OK | 12 B |
URL HTTP/2contile.services.mozilla.com/v1/tiles IP34.117.237.239:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23e88fb7b99543fb33315b29b1fad9d6 a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US | 34.102.187.140 | 200 OK | 329 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US IP34.102.187.140:0
File typeJSON data\012- , ASCII text, with very long lines (329), with no line terminators Hash0333b0655111aa68de771adfcc4db243 63f295a144ac87a7c8e23417626724eeca68a7eb 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 29 Nov 2022 15:11:13 GMT
cache-control: public,max-age=3600
age: 3367
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ocsp.digicert.com/ | 93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hash3c8c689bd654417640d85f3da51af313 85123b6d46230a23d03768bf304b386e5d301305 516138ca79703b45e904d32d7dde1c1e9fd35995b9f1bb1331c547542745676d
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4926
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:20 GMT
Last-Modified: Tue, 29 Nov 2022 14:45:14 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash07b8296613be09905e34b09dce4a203f c97c67e8c4b1247423d089c028c31e05734f124e c8c7b7cd00d5818bbe4a4ddb1b734a1b766dc6474cce300171bd5a0947adc6b2
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash07b8296613be09905e34b09dce4a203f c97c67e8c4b1247423d089c028c31e05734f124e c8c7b7cd00d5818bbe4a4ddb1b734a1b766dc6474cce300171bd5a0947adc6b2
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash07b8296613be09905e34b09dce4a203f c97c67e8c4b1247423d089c028c31e05734f124e c8c7b7cd00d5818bbe4a4ddb1b734a1b766dc6474cce300171bd5a0947adc6b2
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/25-layout.js?ver=0a325602f443f22704d8ced3275c69cc | 104.207.254.173 | 200 OK | 5.9 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/25-layout.js?ver=0a325602f443f22704d8ced3275c69cc IP104.207.254.173:0
File typeASCII text, with very long lines (2312) Hashb7c80306e2fb99a2725c0d5ecf27174d d57bcd10663a216f690ab35e24051a03ae2a442c 54469c571e09fc45763670c64f2da4575c68dad688478d59ae6099f6353af0f7
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/uploads/bb-plugin/cache/25-layout.js?ver=0a325602f443f22704d8ced3275c69cc HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 02:32:11 GMT
etag: W/"54fa-5ecec58e76be2"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| push.services.mozilla.com/ | 52.39.57.61 | 101 Switching Protocols | 0 B |
URL HTTP/1.1push.services.mozilla.com/ IP52.39.57.61:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: pdQ1DYw5uSq0Y8mNxJdirw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 7oIGvl1kSgb0Jw8hyVwRXCUhQfg=
|
|
| conversions.marketing360.com/wc/M360.js | 52.204.104.192 | 200 OK | 2.6 kB |
URL HTTP/1.1conversions.marketing360.com/wc/M360.js IP52.204.104.192:0
File typeHTML document, ASCII text, with very long lines (2435) Hash0d78f0e305c06f13beaf228d9414f4a6 74749e5167bf86e05912b280ecbb313a747a1b8c eceeb65b6540ae42f64fe27cf9f7579437b761b25919643553003640f1c06efe
GET /wc/M360.js HTTP/1.1
Host: conversions.marketing360.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 05 Jan 2018 17:16:58 GMT
ETag: W/"a4b-160c7535f10"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 2635
Date: Tue, 29 Nov 2022 16:07:21 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Strict-Transport-Security: max-age=31536000;
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hashabd55ecd24d357a9f02612558f723a90 6a1e6963864f0b53ddc6205d35225e6cf0bcbeec 195fa531e0462be58d5c62ebbe6060e147c94bdb1d38ff46c341c74e0ab2671a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash49eee25f3ccd585a29e34e80cf5bb160 73eca8be91deedd049304862759a3d8084c0b07e 531e5685527861b3ed7e8e3865c5a6a40d3f92f5c9d89df3f385dab72406fb56
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash49eee25f3ccd585a29e34e80cf5bb160 73eca8be91deedd049304862759a3d8084c0b07e 531e5685527861b3ed7e8e3865c5a6a40d3f92f5c9d89df3f385dab72406fb56
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash49eee25f3ccd585a29e34e80cf5bb160 73eca8be91deedd049304862759a3d8084c0b07e 531e5685527861b3ed7e8e3865c5a6a40d3f92f5c9d89df3f385dab72406fb56
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash49eee25f3ccd585a29e34e80cf5bb160 73eca8be91deedd049304862759a3d8084c0b07e 531e5685527861b3ed7e8e3865c5a6a40d3f92f5c9d89df3f385dab72406fb56
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=4.8.0 | 104.207.254.173 | 200 OK | 32 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=4.8.0 IP104.207.254.173:0
File typeHTML document, ASCII text, with very long lines (3037), with no line terminators Hash3719d0c90d6d0e1f826782fa89b4b134 7eceb87faafb423477cf067457b1e55259b0471f 828ab8100a36de9fda1704ba675bc1adda088b753d66cef84ef59083dd8c0c5a
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=4.8.0 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"bdd-5b61e76643a54"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6.7 | 104.207.254.173 | 200 OK | 26 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6.7 IP104.207.254.173:0
File typeASCII text, with very long lines (11272) Hash2c4183a102ecb6241825dff0173bdb2d 314979f72cb9299aaa13ece5d3d14a57b18e7782 e349f8a1692e6d99f53233c97abb6cb72c16524f25de8a7162a2458fddb0337e
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-includes/js/wp-emoji-release.min.js?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 11 Feb 2022 03:57:33 GMT
etag: W/"3795-5d7b611099417"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.magnificpopup.min.js?ver=2.4.1.2 | 104.207.254.173 | 200 OK | 21 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.magnificpopup.min.js?ver=2.4.1.2 IP104.207.254.173:0
File typeASCII text, with very long lines (20154), with no line terminators Hash7452a69047320065a033a5238596083d e4434453584def01b6c84d88ef363c1f19b28fde 67b96f25828097a350cec031801ad800add0a9e89b7470b47786b0405ca3dc75
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/bb-plugin/js/jquery.magnificpopup.min.js?ver=2.4.1.2 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:48 GMT
etag: W/"4eba-5b61e75ffb3ea"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw5aXo.woff2 | 216.58.207.227 | 200 OK | 13 kB |
URL HTTP/2fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw5aXo.woff2 IP216.58.207.227:0
File typeWeb Open Font Format (Version 2), TrueType, length 12820, version 1.0\012- data Hash3f2f6d9e64a95a40ea5dedfc91f42a95 9cd9f5a2f86f1d42390141d91619a0aa41a276b7 ed121b1a8fbf30998a4ed0a7c8343abe9091ac4744f1c24b602b5d3f962bdb78
GET /s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw5aXo.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.nocowinterwonderland.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 12820
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 25 Nov 2022 03:16:27 GMT
expires: Sat, 25 Nov 2023 03:16:27 GMT
cache-control: public, max-age=31536000
age: 391854
last-modified: Mon, 11 Jul 2022 18:56:10 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash49eee25f3ccd585a29e34e80cf5bb160 73eca8be91deedd049304862759a3d8084c0b07e 531e5685527861b3ed7e8e3865c5a6a40d3f92f5c9d89df3f385dab72406fb56
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/css/woocommerce-smallscreen.css?ver=4.8.0 | 104.207.254.173 | 200 OK | 51 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/css/woocommerce-smallscreen.css?ver=4.8.0 IP104.207.254.173:0
File typeASCII text, with very long lines (6758), with no line terminators Hash1cbb16c64c21e7599bbb0cc1eccfc86b 5ab35b2c1266b69e50502037fd9eef93b43831e1 b95a2af95b69b4d28690a33d18c1b6f0a4a9446bb4f32836f51b22f15804eac3
GET /wp-content/plugins/woocommerce/assets/css/woocommerce-smallscreen.css?ver=4.8.0 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"1a66-5b61e7663d8ac"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/4b1082f330bf45021c1e34796ab6dfa9-layout-bundle.js?ver=2.4.1.2-1.3.2.3 | 104.207.254.173 | 200 OK | 46 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/4b1082f330bf45021c1e34796ab6dfa9-layout-bundle.js?ver=2.4.1.2-1.3.2.3 IP104.207.254.173:0
File typeASCII text, with very long lines (1210) Hasha01a9a605fe7dad33dc51fcdd6f76d0c 5fc13376a803c1657d3d0f4100424007b50fa4d4 3bb4972cd4d5be9abfa8087efa7cca11281247a4940c923049312e4216e82315
GET /wp-content/uploads/bb-plugin/cache/4b1082f330bf45021c1e34796ab6dfa9-layout-bundle.js?ver=2.4.1.2-1.3.2.3 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 02:45:57 GMT
etag: W/"4075-5ecec8a29a878"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/javascript/wpmenucart-ajax-assist.js?ver=2.9.6 | 104.207.254.173 | 200 OK | 914 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/javascript/wpmenucart-ajax-assist.js?ver=2.9.6 IP104.207.254.173:0
Hash53f114a3d1177e5af93b179c3963d532 0e6fa51e73c9f25322bea0bf0efacdeb5d93d53e 32f7021e4bb4c308840b4ac17c45537ff7f382a09b209cea189e1b7c9fd8923f
GET /wp-content/plugins/woocommerce-menu-bar-cart/javascript/wpmenucart-ajax-assist.js?ver=2.9.6 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 15 Oct 2020 18:39:08 GMT
etag: W/"47a-5b1b9f69ef5b4"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/bb-theme/skin-5f7df696a3376.css?ver=1.7.7 | 104.207.254.173 | 200 OK | 110 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/bb-theme/skin-5f7df696a3376.css?ver=1.7.7 IP104.207.254.173:0
File typeASCII text, with very long lines (65536), with no line terminators Size110 kB (110421 bytes) Hash049430424c0fb0e83a761e5fab0537c9 5271b56f632b0ac2249c4451afd4b1cccca9c117 9282ef547c4e5c60ac41a56c6f6a7ac690a6637d1ff3ee8bbca68a7570789817
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/uploads/bb-theme/skin-5f7df696a3376.css?ver=1.7.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Wed, 07 Oct 2020 17:10:46 GMT
etag: W/"168d0-5b117cbe615b7"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL HTTP/2fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 IP216.58.207.227:0
File typeWeb Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data Hash285467176f7fe6bb6a9c6873b3dad2cc ea04e4ff5142ddd69307c183def721a160e0a64e 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 16:40:43 GMT
expires: Fri, 24 Nov 2023 16:40:43 GMT
cache-control: public, max-age=31536000
age: 429998
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/css/shortcodes.css?ver=5.6.7 | 104.207.254.173 | 200 OK | 4.6 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/css/shortcodes.css?ver=5.6.7 IP104.207.254.173:0
Hashbc5926554b4431074bf47dfa345ab9fc 66c28da9bd679d2bf34e1a0a7c37262db93356cb ec6cb37789b08eea82f0ef2480a39fb3245a1caafe0fc88c66390febb9683235
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/bootstrap-shortcodes/css/shortcodes.css?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 08 Nov 2018 18:13:18 GMT
etag: W/"284d-57a2b306a2b80"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.youtube.com/s/player/4eb6b35d/player_ias.vflset/en_US/base.js | 142.250.74.174 | 200 OK | 592 kB |
URL HTTP/2www.youtube.com/s/player/4eb6b35d/player_ias.vflset/en_US/base.js IP142.250.74.174:0
File typeASCII text, with very long lines (517) Size592 kB (592489 bytes) Hashc740b1903f51ecd2b32decf2a4b39ce1 50dc029c1d7cca728c9313ebe98e0d700ad6a36e 283d481df642787ffb565d6a7554d44b9b0cba77d21b59d9d85defe06e9c9399
GET /s/player/4eb6b35d/player_ias.vflset/en_US/base.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/ifprf_uffmw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
vary: Accept-Encoding, Origin
content-encoding: br
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 592489
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Nov 2022 15:53:01 GMT
expires: Tue, 28 Nov 2023 15:53:01 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Nov 2022 01:17:16 GMT
content-type: text/javascript
age: 87260
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=4.8.0 | 104.207.254.173 | 200 OK | 94 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=4.8.0 IP104.207.254.173:0
File typeASCII text, with very long lines (2938), with no line terminators Hashdd929467cdb516b1a385c3ab58fd3946 541ff8786f182a58056c8b242d4343a0398689e7 4181dfde1442f664bdd03604d27ae1e17fe960e39b24410670a054a86c13d3cc
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=4.8.0 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"b7a-5b61e76643e3c"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/2020/10/hero-fg.png | 104.207.254.173 | 200 OK | 119 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/2020/10/hero-fg.png IP104.207.254.173:0
File typePNG image data, 921 x 740, 8-bit/color RGBA, non-interlaced\012- data Size119 kB (118936 bytes) Hash02cb5b29b5ebd53d084fe73ce1ac815f ae4ce05403230aee422bf4a5c0be3cebb92e7143 9015db5297f8ff87ce414a16e42578f76ea09ad0d026be6186e4d3d4008aaac5
GET /wp-content/uploads/2020/10/hero-fg.png HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: image/png
content-length: 118936
last-modified: Wed, 07 Oct 2020 16:44:59 GMT
etag: "1d098-5b1176fb2bfbd"
x-cache-nxaccel: STALE
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/themes/bb-theme/js/theme.min.js?ver=1.7.7 | 104.207.254.173 | 200 OK | 373 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/themes/bb-theme/js/theme.min.js?ver=1.7.7 IP104.207.254.173:0
File typeASCII text, with very long lines (22000), with no line terminators Size373 kB (372772 bytes) Hash1ecc7b9958f9aaaa46b701dde62c36ec 9fc1bac4d6f71c9e40e407ff3b69ebb3866dacaf 0e32aa65f455b8a4b4abc7c227268edc1082f6aa1630db451844f2649a276fd3
GET /wp-content/themes/bb-theme/js/theme.min.js?ver=1.7.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Sep 2020 03:03:53 GMT
etag: W/"55f0-5af8dc03541b7"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-includes/js/wp-embed.min.js?ver=5.6.7 | 104.207.254.173 | 200 OK | 192 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-includes/js/wp-embed.min.js?ver=5.6.7 IP104.207.254.173:0
File typeASCII text, with very long lines (1391) Size192 kB (191666 bytes) Hash125bb06fef52db70a908ffc49ffcdcb3 f66780eebcd6f81d80805bc8b2e2b7ae3d678ff8 983ffca8fddbcfc00245e4d9b95abf80300322a758f6e507c1bb020846915b17
GET /wp-includes/js/wp-embed.min.js?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 11 Feb 2022 03:57:33 GMT
etag: W/"592-5d7b61109902f"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/side-cart-woocommerce/public/js/xoo-wsc-public.js?ver=2.1 | 104.207.254.173 | 200 OK | 523 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/side-cart-woocommerce/public/js/xoo-wsc-public.js?ver=2.1 IP104.207.254.173:0
Size523 kB (523099 bytes) Hash05ab32234a690e85e06e13e2f8c45b77 f4a10c2596e6c29bac60cf78738cc41235829eda 04ac5768248150fb69f6e7431d19e7a9f9aad1c4cafb86b12e059489d4698154
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/side-cart-woocommerce/public/js/xoo-wsc-public.js?ver=2.1 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 09 Jul 2020 19:29:30 GMT
etag: W/"20b8-5aa073e48ba80"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/2018/06/Winter-Wonderland-Logo-Compact.png | 104.207.254.173 | 200 OK | 793 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/2018/06/Winter-Wonderland-Logo-Compact.png IP104.207.254.173:0
File typePNG image data, 966 x 1310, 8-bit/color RGBA, non-interlaced\012- data Size793 kB (793236 bytes) Hashf0bfe670e01f291f4c2d89a4da857e71 08d7bea352a60906a3fc88f91c6820040f395c47 9ad3cb4bcc91f86c687e3dc2a9aadac585f138058b08b4ae0b610a2297240c94
GET /wp-content/uploads/2018/06/Winter-Wonderland-Logo-Compact.png HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: image/png
content-length: 793236
last-modified: Thu, 07 Oct 2021 21:10:30 GMT
etag: "c1a94-5cdc9b149dbe3"
x-cache-nxaccel: STALE
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/2020/10/cropped-favicon-192x192.png | 104.207.254.173 | 200 OK | 36 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/2020/10/cropped-favicon-192x192.png IP104.207.254.173:0
File typePNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data Hash12446d7cfb8fc30fc8835d97a7fe1e21 f7166c1ffdfcc08a2c3672a10be111e3a17333fb 06402538a9303885407c7be9dbd2e68cb5bd5d20b195ba95332a6e8778af60fc
GET /wp-content/uploads/2020/10/cropped-favicon-192x192.png HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:22 GMT
content-type: image/png
content-length: 35476
last-modified: Wed, 07 Oct 2020 17:10:37 GMT
etag: "8a94-5b117cb5cf04a"
x-cache-nxaccel: MISS
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6.7 | 104.207.254.173 | 200 OK | 7.8 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6.7 IP104.207.254.173:0
File typeASCII text, with very long lines (27525) Hash78a7ce6e90550e521807fb665327f870 af892efcea0af1c894a3be7a5f6852e36da2d7ad 78c1051b5c95aafa1d33477603b8f9a3a6f9ced404864c473f565bef890a8a88
GET /wp-includes/css/dist/block-library/style.min.css?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Fri, 11 Feb 2022 03:57:33 GMT
etag: W/"c88a-5d7b61108f3ee"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hasha97c452e75cf1d4833e777d7ba7f2c47 58f15763fd33f742ce870f49f1c2dbed5b41205f 39bb874a415db37a81432942eb84151b0134d1aacaa31d364b6dadae4388c6a1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39BB874A415DB37A81432942EB84151B0134D1AACAA31D364B6DADAE4388C6A1"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7608
Expires: Tue, 29 Nov 2022 18:14:10 GMT
Date: Tue, 29 Nov 2022 16:07:22 GMT
Connection: keep-alive
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-main.css?ver=2.9.6 | 104.207.254.173 | 200 OK | 941 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-main.css?ver=2.9.6 IP104.207.254.173:0
Hash2ed9d96b5e8bf45cbac84988ed9ce76c 4f3944df264eb4572a2b46c72d41712562d5ab83 2edde2594cd26821d3b822d097aad5f150ff5d12eeb71850f2fd898a5cd44af1
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-main.css?ver=2.9.6 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 15 Oct 2020 18:39:08 GMT
etag: W/"4ed-5b1b9f69ec2ec"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/side-cart-woocommerce/public/css/fonts/Woo-Side-Cart.ttf?79hb0k | 104.207.254.173 | 200 OK | 3.7 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/side-cart-woocommerce/public/css/fonts/Woo-Side-Cart.ttf?79hb0k IP104.207.254.173:0
File typeTrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, Woo-Side-Cart\012- data Hash5ea8c8fbd99756fb608351481eaad71f 27c5b49a2a2cf88b33149cdc39fcf0c2ba9c4180 89b3f80ec38b1191510247854454becb11a041b1fdc03daea97569a004d84c58
GET /wp-content/plugins/side-cart-woocommerce/public/css/fonts/Woo-Side-Cart.ttf?79hb0k HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/wp-content/plugins/side-cart-woocommerce/public/css/xoo-wsc-public.css?ver=2.1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:22 GMT
content-type: application/font-sfnt
content-length: 3712
last-modified: Thu, 09 Jul 2020 19:29:30 GMT
etag: "e80-5aa073e48ba80"
x-cache-nxaccel: STALE
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-icons.css?ver=2.9.6 | 104.207.254.173 | 200 OK | 10 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-icons.css?ver=2.9.6 IP104.207.254.173:0
Hashb8499562e9d1a63b81c61b54fbf9cdd6 3ca50d27ecfb865fb220ce904ba69b55f969970d 678e650e44b6dcd2a86b266f33f10c365a874fca3dabf1c2377f6ddca5e7f7d1
GET /wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-icons.css?ver=2.9.6 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 15 Oct 2020 18:39:08 GMT
etag: W/"1f3-5b1b9f69ec2ec"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/25-layout.css?ver=911732e0659ab5e41b72ad4e76ab34d0 | 104.207.254.173 | 200 OK | 14 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/25-layout.css?ver=911732e0659ab5e41b72ad4e76ab34d0 IP104.207.254.173:0
File typeUnicode text, UTF-8 text, with very long lines (33254), with no line terminators Hash0bc1f908e4dd1bf421226c9537721107 34bf0f917ac8e45cf489d69a4c0de4fd4f9a65b4 34198d356a9c4d1b4d95d4ee8380a08c634737e2990989b0f971c3bf7fc64651
GET /wp-content/uploads/bb-plugin/cache/25-layout.css?ver=911732e0659ab5e41b72ad4e76ab34d0 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 02:32:11 GMT
etag: W/"81e7-5ecec58e70e22"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-includes/css/dist/block-library/theme.min.css?ver=5.6.7 | 104.207.254.173 | 200 OK | 10 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-includes/css/dist/block-library/theme.min.css?ver=5.6.7 IP104.207.254.173:0
File typeASCII text, with very long lines (2297), with no line terminators Hasheded8db02f532a6cde17de2f2f5ce120 7aac8cbcd176d45174bcb11cb81f9869657f88da 4def67d1e00cc286f4041d7c616a4bc21c54ca1477201fda4f97c1f9324ac5ac
GET /wp-includes/css/dist/block-library/theme.min.css?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:16:36 GMT
etag: W/"8f9-5b61e800a6e5b"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-style.css?ver=3.8.1 | 104.207.254.173 | 200 OK | 5.8 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-style.css?ver=3.8.1 IP104.207.254.173:0
File typeASCII text, with very long lines (2967), with no line terminators Hash0a14c22f54b918de09a134d2d0c21cbf a9bc09e1ed7fae2c0a71b3272262c526a5223350 499ff7a91fd83b25c306a75e1cd615e0a29f3e45283db85cc90426ba57953998
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-style.css?ver=3.8.1 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"b97-5b61e76699d3c"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-font.css?ver=2.9.6 | 104.207.254.173 | 200 OK | 9.6 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-font.css?ver=2.9.6 IP104.207.254.173:0
Hash9693bbe8d776b34bb1734977028cee35 782cbc67e8b2507ca5d509530a7983b7e9112871 68bf222a956a93df5d535632675af12854882c5d82b264eeadfbcc5eda7ab75b
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce-menu-bar-cart/css/wpmenucart-font.css?ver=2.9.6 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 15 Oct 2020 18:39:08 GMT
etag: W/"1cd-5b1b9f69ec2ec"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ver=3.8.1 | 104.207.254.173 | 200 OK | 21 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ver=3.8.1 IP104.207.254.173:0
File typeUnicode text, UTF-8 text, with very long lines (65534), with no line terminators Hash1d1fff657df61b5157f809cd264a77cc e1f9f8e425587a264a9f3bb6894f858f38291b5d 5873656132dd4ce9e1fe7ef11da55acfac3c29dd92819aa88f60e319754c78f4
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ver=3.8.1 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"29179-5b61e76699954"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash30462b52571c91f089bed4de98462a46 7e2b322ea5b8f97b2fa76751bcffe2a420f872eb c5403dfefa9d043ac501963ff09a6d3d70e21f6e6a1b9728183a3490060a4bfc
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hashf1cfa609ebdf236e2f3e3ff25dd05caf c8117b0187d4d9021ed1a42907bd93d24ed4ebf0 7a2761aa36168d4f2c9034486777f5588aaf0fa1f7d1e55006db7320259303b3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| static.doubleclick.net/instream/ad_status.js | 142.250.74.134 | 200 OK | 29 B |
URL HTTP/2static.doubleclick.net/instream/ad_status.js IP142.250.74.134:0
Hash1fa71744db23d0f8df9cce6719defcb7 e4be9b7136697942a036f97cf26ebaf703ad2067 eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
GET /instream/ad_status.js HTTP/1.1
Host: static.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 29
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 29 Nov 2022 16:06:04 GMT
expires: Tue, 29 Nov 2022 16:21:04 GMT
cache-control: public, max-age=900
age: 78
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| googleads.g.doubleclick.net/pagead/id | 172.217.21.162 | 302 Found | 0 B |
URL HTTP/2googleads.g.doubleclick.net/pagead/id IP172.217.21.162:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pagead/id HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
access-control-allow-credentials: true
access-control-allow-origin: https://www.youtube.com
date: Tue, 29 Nov 2022 16:07:22 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/c70cc82f197163a0e481acd0060ce02a-layout-bundle.css?ver=2.4.1.2-1.3.2.3 | 104.207.254.173 | 200 OK | 11 kB |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/cache/c70cc82f197163a0e481acd0060ce02a-layout-bundle.css?ver=2.4.1.2-1.3.2.3 IP104.207.254.173:0
File typeASCII text, with very long lines (21309), with no line terminators Hash6849e735dcb6298f2dda2ab1849ee009 fa2aa8ef545041cf011ac25faf2c3b34e25506a5 450461c86406064d54e81bed0ee40d72b1ef31908bcc0f6c34f7b8fe9096b6a5
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/uploads/bb-plugin/cache/c70cc82f197163a0e481acd0060ce02a-layout-bundle.css?ver=2.4.1.2-1.3.2.3 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 02:45:57 GMT
etag: W/"533d-5ecec8a29a878"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create | 142.250.74.74 | 200 OK | 0 B |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create IP142.250.74.74:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://www.youtube.com
vary: origin, referer, x-origin
access-control-allow-credentials: true
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-max-age: 3600
date: Tue, 29 Nov 2022 16:07:22 GMT
content-type: text/html
server: ESF
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hasha0fe20d41a043db700a84924cd9793f3 c0da481fef6cd00558f6e68b074acb34bef8292f 03caeb65ab9e22f6d6fe0d344d327950d20ee9ed144e2da0e5e062943a03fc56
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash30462b52571c91f089bed4de98462a46 7e2b322ea5b8f97b2fa76751bcffe2a420f872eb c5403dfefa9d043ac501963ff09a6d3d70e21f6e6a1b9728183a3490060a4bfc
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| www.google.com/js/th/_mW_2QmsfiHfHQzuwJJjeV3lvrJQS7bChqYqZLie29Q.js | 142.250.74.132 | 200 OK | 14 kB |
URL HTTP/2www.google.com/js/th/_mW_2QmsfiHfHQzuwJJjeV3lvrJQS7bChqYqZLie29Q.js IP142.250.74.132:0
File typeASCII text, with very long lines (36106) Hash7fc7e22ecccb0cfd0ae897bb40a58efe 5d46470a711120793c362235105836fe49e699a4 1907005cab41fbd6d1d67df3b25586f3232e053a261c9e2b2503459f4980b1c5
GET /js/th/_mW_2QmsfiHfHQzuwJJjeV3lvrJQS7bChqYqZLie29Q.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-length: 14302
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 27 Nov 2022 10:09:03 GMT
expires: Mon, 27 Nov 2023 10:09:03 GMT
cache-control: public, max-age=31536000
age: 194299
last-modified: Thu, 03 Nov 2022 10:00:00 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| googleads.g.doubleclick.net/pagead/id?slf_rd=1 | 172.217.21.162 | 200 OK | 120 B |
URL HTTP/2googleads.g.doubleclick.net/pagead/id?slf_rd=1 IP172.217.21.162:0
Hash641732f4296efddec3d2ffcd454e83aa 240a2c2d2bcfc5e16c198be5b58dab0834865b59 dd0e70a30ff8cbe28b585bee28e058d3a131079f34b34107d6b6d865389d443d
GET /pagead/id?slf_rd=1 HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.youtube.com
Referer: https://www.youtube.com/
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.youtube.com
content-type: application/json; charset=UTF-8
date: Tue, 29 Nov 2022 16:07:22 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 120
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create | 142.250.74.74 | 200 OK | 31 kB |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create IP142.250.74.74:0
File typeJSON data\012- , ASCII text, with very long lines (65536), with no line terminators Hash46fd974016b92e8a3e1cb6ec46b021d3 c0aa9592b58179633dab2b735fa9e07e12d3e499 18397944eb9d3ff2ef83605cede5645fec18c4cb3f6ed5db9eb7096fc15e8212
POST /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Content-Length: 24
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Tue, 29 Nov 2022 16:07:22 GMT
server: ESF
cache-control: private
content-length: 30923
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
access-control-allow-credentials: true
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hashf1cfa609ebdf236e2f3e3ff25dd05caf c8117b0187d4d9021ed1a42907bd93d24ed4ebf0 7a2761aa36168d4f2c9034486777f5588aaf0fa1f7d1e55006db7320259303b3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash79840cac9f5ae1a38c0faaaf59e7fe82 f76a3e50f566269c574e7f8904021640366dcc56 1f39ccbd6ad4a9c8fcc3e4d7d83c4c21f9e9fd9fd0d98c6b70cd1bbbdfeb7798
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 471 B |
IP142.250.74.131:0
Hash998e0b25e77b8c23e52ea918d3fc2a29 0f684f95e3c60ef17ff082bfda21de480eff9fb4 360e9b02287b38174bb5bfb64862d049d9e4f998ef8aba036a1bc97bbf30d606
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| yt3.ggpht.com/ytc/AMLnZu8Fsct5062qzkZHM6hIkIa71rqxTOV1C2KM4yqGPA=s68-c-k-c0x00ffffff-no-rj | 142.250.74.161 | 200 OK | 3.1 kB |
URL HTTP/2yt3.ggpht.com/ytc/AMLnZu8Fsct5062qzkZHM6hIkIa71rqxTOV1C2KM4yqGPA=s68-c-k-c0x00ffffff-no-rj IP142.250.74.161:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3\012- data Hash39d24a48e7472011bc25320610e53062 3d6fce8fc932bf6076adf6090bc403874d5016cc cfc00d8433dd1f34e6cc8f43d48b342d91782fc9e3c3a56ec43d4f4a20a0728f
GET /ytc/AMLnZu8Fsct5062qzkZHM6hIkIa71rqxTOV1C2KM4yqGPA=s68-c-k-c0x00ffffff-no-rj HTTP/1.1
Host: yt3.ggpht.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="unnamed.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 3106
x-xss-protection: 0
date: Tue, 29 Nov 2022 12:21:36 GMT
expires: Wed, 30 Nov 2022 12:21:36 GMT
cache-control: public, max-age=86400, no-transform
etag: "v8c"
content-type: image/jpeg
age: 13546
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash79840cac9f5ae1a38c0faaaf59e7fe82 f76a3e50f566269c574e7f8904021640366dcc56 1f39ccbd6ad4a9c8fcc3e4d7d83c4c21f9e9fd9fd0d98c6b70cd1bbbdfeb7798
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 471 B |
IP142.250.74.131:0
Hash998e0b25e77b8c23e52ea918d3fc2a29 0f684f95e3c60ef17ff082bfda21de480eff9fb4 360e9b02287b38174bb5bfb64862d049d9e4f998ef8aba036a1bc97bbf30d606
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 16:07:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT | 142.250.74.74 | 200 OK | 0 B |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT IP142.250.74.74:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://www.youtube.com
vary: origin, referer, x-origin
access-control-allow-credentials: true
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-max-age: 3600
date: Tue, 29 Nov 2022 16:07:23 GMT
content-type: text/html
server: ESF
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT | 142.250.74.74 | 200 OK | 114 B |
URL HTTP/2jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT IP142.250.74.74:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23b4d6d674972a1a2f287014f1b8a0be cf98d84dba09aaa0e4c72d99bd8a8fd4ae7deeac 0124657a0aece2d4964b95f25e41fbde3982265302011c59f7a40c2d3b62f254
POST /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Content-Length: 899
Origin: https://www.youtube.com
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Tue, 29 Nov 2022 16:07:23 GMT
server: ESF
cache-control: private
content-length: 114
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
access-control-allow-credentials: true
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Montserrat%3A500&ver=5.6.7 | 142.250.74.138 | 200 OK | 0 B |
URL HTTP/2fonts.googleapis.com/css?family=Montserrat%3A500&ver=5.6.7 IP142.250.74.138:0
GET /css?family=Montserrat%3A500&ver=5.6.7 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 29 Nov 2022 16:07:20 GMT
date: Tue, 29 Nov 2022 16:07:20 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| i.ytimg.com/vi_webp/ifprf_uffmw/maxresdefault.webp | 142.250.74.150 | 200 OK | 0 B |
URL HTTP/2i.ytimg.com/vi_webp/ifprf_uffmw/maxresdefault.webp IP142.250.74.150:0
GET /vi_webp/ifprf_uffmw/maxresdefault.webp HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/webp
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 140792
date: Tue, 29 Nov 2022 16:07:22 GMT
expires: Tue, 29 Nov 2022 18:07:22 GMT
cache-control: public, max-age=7200
etag: "1605819649"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/side-cart-woocommerce/public/css/xoo-wsc-public.css?ver=2.1 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/side-cart-woocommerce/public/css/xoo-wsc-public.css?ver=2.1 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/side-cart-woocommerce/public/css/xoo-wsc-public.css?ver=2.1 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 09 Jul 2020 19:29:30 GMT
etag: W/"1b1d-5aa073e48ba80"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/themes/bb-theme/css/base.min.css?ver=1.7.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/themes/bb-theme/css/base.min.css?ver=1.7.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/themes/bb-theme/css/base.min.css?ver=1.7.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Fri, 18 Sep 2020 03:03:53 GMT
etag: W/"bd2a-5af8dc034824f"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-includes/js/jquery/jquery.min.js?ver=3.5.1 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:16:37 GMT
etag: W/"15d98-5b61e800b608c"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:16:37 GMT
etag: W/"2bd8-5b61e800b608c"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/ | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/ IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET / HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
link: <https://www.nocowinterwonderland.com/wp-json/>; rel="https://api.w.org/", <https://www.nocowinterwonderland.com/wp-json/wp/v2/pages/25>; rel="alternate"; type="application/json", <https://www.nocowinterwonderland.com/>; rel=shortlink
x-cache-nxaccel: BYPASS
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/css/woocommerce.css?ver=4.8.0 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/css/woocommerce.css?ver=4.8.0 IP104.207.254.173:0
GET /wp-content/plugins/woocommerce/assets/css/woocommerce.css?ver=4.8.0 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"f42f-5b61e7663d4c4"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/js/bootstrap.js?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/js/bootstrap.js?ver=5.6.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/bootstrap-shortcodes/js/bootstrap.js?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 19 Dec 2019 15:28:06 GMT
etag: W/"8fd0-59a10352f4d80"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.ba-throttle-debounce.min.js?ver=2.4.1.2 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.ba-throttle-debounce.min.js?ver=2.4.1.2 IP104.207.254.173:0
GET /wp-content/plugins/bb-plugin/js/jquery.ba-throttle-debounce.min.js?ver=2.4.1.2 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:48 GMT
etag: W/"2db-5b61e75ffb002"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"736-5b61e766455ac"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/css/bootstrap.css?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/css/bootstrap.css?ver=5.6.7 IP104.207.254.173:0
GET /wp-content/plugins/bootstrap-shortcodes/css/bootstrap.css?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:20 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 19 Dec 2019 15:28:08 GMT
etag: W/"1dead-59a10354dd200"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.fitvids.min.js?ver=1.2 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.fitvids.min.js?ver=1.2 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/bb-plugin/js/jquery.fitvids.min.js?ver=1.2 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:48 GMT
etag: W/"6f6-5b61e75ffb3ea"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.70 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.70 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.70 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"255e-5b61e7664460c"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/js/init.js?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bootstrap-shortcodes/js/init.js?ver=5.6.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/bootstrap-shortcodes/js/init.js?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 08 Nov 2018 18:13:18 GMT
etag: W/"155-57a2b306a2b80"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Montserrat%3A500%2C300%2C400%2C700%7CAlegreya%3A700%7CQuicksand%3A600&ver=5.6.7 | 142.250.74.138 | 200 OK | 0 B |
URL HTTP/2fonts.googleapis.com/css?family=Montserrat%3A500%2C300%2C400%2C700%7CAlegreya%3A700%7CQuicksand%3A600&ver=5.6.7 IP142.250.74.138:0
GET /css?family=Montserrat%3A500%2C300%2C400%2C700%7CAlegreya%3A700%7CQuicksand%3A600&ver=5.6.7 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 29 Nov 2022 16:07:21 GMT
date: Tue, 29 Nov 2022 16:07:21 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/css/woocommerce-layout.css?ver=4.8.0 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/css/woocommerce-layout.css?ver=4.8.0 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/assets/css/woocommerce-layout.css?ver=4.8.0 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"44e7-5b61e7663d4c4"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.waypoints.min.js?ver=2.4.1.2 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/js/jquery.waypoints.min.js?ver=2.4.1.2 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/bb-plugin/js/jquery.waypoints.min.js?ver=2.4.1.2 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:48 GMT
etag: W/"2281-5b61e75ffb3ea"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=4.8.0 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=4.8.0 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=4.8.0 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:55 GMT
etag: W/"7ff-5b61e7664460c"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/icons/ultimate-icons/style.css?ver=2.4.1.2 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/bb-plugin/icons/ultimate-icons/style.css?ver=2.4.1.2 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/uploads/bb-plugin/icons/ultimate-icons/style.css?ver=2.4.1.2 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Fri, 27 Apr 2018 22:26:29 GMT
etag: W/"5000-56adbfed04f40"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/css/main.css?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/css/main.css?ver=5.6.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/themes/woo360-theme-child/assets/css/main.css?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:21:21 GMT
etag: W/"197-5b61e91067d93"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/js/m360-dynamic-content.js?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/js/m360-dynamic-content.js?ver=5.6.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/themes/woo360-theme-child/assets/js/m360-dynamic-content.js?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:21:21 GMT
etag: W/"26a-5b61e9106817b"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-includes/js/imagesloaded.min.js?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-includes/js/imagesloaded.min.js?ver=5.6.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-includes/js/imagesloaded.min.js?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:16:37 GMT
etag: W/"15fd-5b61e800bb67c"
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/css/jquery.magnificpopup.min.css?ver=2.4.1.2 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/plugins/bb-plugin/css/jquery.magnificpopup.min.css?ver=2.4.1.2 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/plugins/bb-plugin/css/jquery.magnificpopup.min.css?ver=2.4.1.2 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:13:48 GMT
etag: W/"167e-5b61e75fc411a"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/css/style-mobile.css?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/css/style-mobile.css?ver=5.6.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/themes/woo360-theme-child/assets/css/style-mobile.css?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:21:21 GMT
etag: W/"eb-5b61e91067d93"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/css/gravity-forms.css?ver=5.6.7 | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/themes/woo360-theme-child/assets/css/gravity-forms.css?ver=5.6.7 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/themes/woo360-theme-child/assets/css/gravity-forms.css?ver=5.6.7 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Thu, 10 Dec 2020 16:21:21 GMT
etag: W/"436-5b61e910679ab"
x-cache-nxaccel: STALE
content-encoding: br
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/wp-content/uploads/2020/11/20201028-M30887-CYO-WInter-Wonderland-videoBG.mp4 | 104.207.254.173 | 206 Partial Content | 0 B |
URL HTTP/2www.nocowinterwonderland.com/wp-content/uploads/2020/11/20201028-M30887-CYO-WInter-Wonderland-videoBG.mp4 IP104.207.254.173:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /wp-content/uploads/2020/11/20201028-M30887-CYO-WInter-Wonderland-videoBG.mp4 HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 206 Partial Content
server: nginx
date: Tue, 29 Nov 2022 16:07:21 GMT
content-type: video/mp4
content-length: 8470450
last-modified: Mon, 02 Nov 2020 15:15:06 GMT
etag: "813fb2-5b321361e3044"
content-range: bytes 0-8470449/8470450
x-cache-nxaccel: BYPASS
X-Firefox-Spdy: h2
|
|
| www.nocowinterwonderland.com/?wc-ajax=get_refreshed_fragments | 104.207.254.173 | 200 OK | 0 B |
URL HTTP/2www.nocowinterwonderland.com/?wc-ajax=get_refreshed_fragments IP104.207.254.173:0
POST /?wc-ajax=get_refreshed_fragments HTTP/1.1
Host: www.nocowinterwonderland.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 18
Origin: https://www.nocowinterwonderland.com
Connection: keep-alive
Referer: https://www.nocowinterwonderland.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 16:07:22 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding
access-control-allow-origin: https://www.nocowinterwonderland.com
access-control-allow-credentials: true
x-content-type-options: nosniff
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
x-nocache: 1
content-encoding: br
X-Firefox-Spdy: h2
|
|
0.0.0.0