Report - www.takingyounow.com/c/3f366fa4c91b7a95

Report Overview

Submitted URL
www.takingyounow.com/c/3f366fa4c91b7a95
IP
104.21.82.155
ASN
#13335 CLOUDFLARENET
Submitted
2022-09-19 03:18:10
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	143.204.55.27
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	143.204.55.25
www.youknowbest.net	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.1 kB	355 B	52.19.101.114
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	52.13.69.101
d0zi.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	746 kB	162.55.4.52
www.takingyounow.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	814 B	2.7 kB	172.67.158.240
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.76.226
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
track.newlifebuzz.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.3 kB	4.3 kB	216.104.36.157
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	60 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-09-19	medium	www.takingyounow.com/c/3f366fa4c91b7a95	Phishing
2022-09-19	medium	www.takingyounow.com/c/3f366fa4c91b7a95	Phishing
2022-09-19	medium	track.newlifebuzz.com/sw.js?v=1663557462486	Phishing
2022-09-19	medium	track.newlifebuzz.com/sw.js?v=1663557462486	Phishing
2022-09-19	medium	track.newlifebuzz.com/proc.php?6d36a447a352e77ffb666686072407753538d6f7	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89#0	135 B	2023-03-07	2023-03-07
Pretty URL track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89#0 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:26:17 Last Seen2023-03-07 18:26:17 Times Seen1 Hash e7d687f6965c1dce10de81c96060b8a7 aca148adf90302372cd9563ae8d0d108787b046f 45b9493a5f3733fb9f2200228b55c69a05a2ffd290bbb5ffb8eefd7e384620b6 Loading...

	track.newlifebuzz.com/proc.php?6d36a447a352e77ffb666686072407753538d6f7	3.0 kB	2023-03-07	2023-03-07
Pretty URL track.newlifebuzz.com/proc.php?6d36a447a352e77ffb666686072407753538d6f7 IP 216.104.36.157 ASN #32475 SINGLEHOP-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:26:17 Last Seen2023-03-07 18:26:17 Times Seen1 Hash b2d0ae2524359082117aa2f87bdabcff b80d23e54360fb6220121e1059cfc573d1e19fbf 8f964e264ab6bae261fb1bcc5f620044d9fc5b17061a7a4962087abc280e874d Loading...

	www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_tmp	342 B	2023-03-07	2023-03-07
Pretty URL www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_tmp IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:26:17 Last Seen2023-03-07 18:26:17 Times Seen1 Hash 8a5445854a3e732644740520520387fe 32688241e8ac0986e2ce18b302df1d34a32fab84 80879645a311c9b16b07c81f585860bf490589fdd9dceb5444d4307714b219d9 Loading...

	www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_final	190 B	2023-03-07	2023-03-07
Pretty URL www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_final IP 52.19.101.114 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:26:17 Last Seen2023-03-07 18:26:17 Times Seen1 Hash 6b28180a46aa13131fb3e4ac6bb49541 6d273649b98386964c3cf941ddcea3b137a0f25e 8215df142a0acf3c354a2ffecf5e289a30d29a4f6c2947b8121fc977c97d91b2 Loading...

	track.newlifebuzz.com/?activity=&banner=&cid=epnuu6327df68000d8c7d&utm_campaign=Mainstream&utm_medium=0650cfa26a24c95a0930f85a377ff859b0c20474&zone_type=&zoneid=	2.6 kB	2023-03-07	2023-03-07
Pretty URL track.newlifebuzz.com/?activity=&banner=&cid=epnuu6327df68000d8c7d&utm_campaign=Mainstream&utm_medium=0650cfa26a24c95a0930f85a377ff859b0c20474&zone_type=&zoneid= IP 216.104.36.157 ASN #32475 SINGLEHOP-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:26:17 Last Seen2023-03-07 18:26:17 Times Seen1 Hash 01782cb617e7e73f844aa83e591a1de2 dab8f80de9e2f2e6fd86b4fe80081f28b17a27e8 0e10c11c40e303d666bc0e469ecd21d6dc2d72e6e1c45e3d49bf2fe54f9d4354 Loading...

	track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89	324 B	2023-03-07	2023-03-07
Pretty URL track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:26:17 Last Seen2023-03-07 18:26:17 Times Seen1 Hash 6fc2ce39746c7a48fccba5ebb467a9c0 33446dae43bae105083edad57ffce9424c492f22 744ac412664f74339345baf4f62fe73f954732e67d58392588b94ce131bb3646 Loading...

	track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89#0	3.2 kB	2023-03-07	2023-03-07
Pretty URL track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89#0 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:26:17 Last Seen2023-03-07 18:26:17 Times Seen1 Hash 8b1d5f1660b438abdb4f505b4ded414e f8b4a1ef13676bc183269d7ca038bc5f807a59ea 0770a0f9d2865d06057a41879bad8d4c5e598ac2391b81052f2e873dc7b26851 Loading...

HTTP Transactions (28)

URL IP Response Size

www.takingyounow.com/c/3f366fa4c91b7a95

172.67.158.240

301 Moved Permanently

0 B

URL HTTP/1.1
www.takingyounow.com/c/3f366fa4c91b7a95
IP
172.67.158.240:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /c/3f366fa4c91b7a95 HTTP/1.1
Host: www.takingyounow.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Mon, 19 Sep 2022 03:17:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Mon, 19 Sep 2022 04:17:59 GMT
Location: https://www.takingyounow.com/c/3f366fa4c91b7a95
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dkOy0xCS1ZkTFtJx0ZEpsy5pTS3MCNf8A4fDL56ykf2R9vvCemKglPCbtJLPSccoYwe3ZB0r9bBcyL%2Fm1ECmtoql5yyNawvaAjbnFMB3qLk7DgN%2BnjCcbZWnJgWzTQnDQVNwrtrgHw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 74cf2be89e3f72f6-LHR
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/

143.204.55.27

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
143.204.55.27:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
91dd975a7b17b2922dd23c0e49314e40
57a2ece1e3cee7c4ebf927f2ba92f52cac395fe2
09966873bbf317f8910c59544cfde2a6d46e8acd2905797cc7c85c6b4d18ea8a

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Content-Type, Alert, Backoff, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Mon, 19 Sep 2022 03:12:37 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 aa34a836095df9de9d246a53dd63f1d6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: fVajku54VT0a6kD21loSZoH6_GYHye_AvIKeM9_wxsJx3-eBkqt4AQ==
Age: 322

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
861cfa99de956423d917ed0ddbea4b9c
ad65dbc394b48b04a45c205f56af296c8d008db4
5c706b2718b1698995f4feb91223779aef4bf6dc967c31f9ef9a93873197d5f9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5C706B2718B1698995F4FEB91223779AEF4BF6DC967C31F9EF9A93873197D5F9"
Last-Modified: Sun, 18 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8842
Expires: Mon, 19 Sep 2022 05:45:21 GMT
Date: Mon, 19 Sep 2022 03:17:59 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

143.204.55.25

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
143.204.55.25:0
ASN
#16509 AMAZON-02

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 18 Sep 2022 04:35:14 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 f00e3524edcdf61801454f2bb21e71ce.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: d2BfssBaNDR9jURxVRiA8-pkqTffettNBQq1i7Bl1-yZQVHBxa5dgw==
age: 81767
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Mon, 19 Sep 2022 03:18:00 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b69c05b490b26782a796576bed3d9299
3e534cc10a68b7c51337a56c0589f6007404a6bb
8d3cad5450179de4ce835d765101ef557f672155a8f0c9ebd0a16f37785f3e05

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8D3CAD5450179DE4CE835D765101EF557F672155A8F0C9EBD0A16F37785F3E05"
Last-Modified: Sun, 18 Sep 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Mon, 19 Sep 2022 09:18:00 GMT
Date: Mon, 19 Sep 2022 03:18:00 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

143.204.55.27

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
143.204.55.27:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Mon, 19 Sep 2022 03:03:23 GMT
Cache-Control: max-age=3600
Expires: Mon, 19 Sep 2022 03:57:34 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 a034aae43a19aef875fa395182990970.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 9O5iEViJJt701xaFcYzijYeTlxPrhtroVZnWQnO4EZDQmw-eU5CIaw==
Age: 878

www.takingyounow.com/c/3f366fa4c91b7a95

104.21.82.155

302 Found

740 B

URL HTTP/2
www.takingyounow.com/c/3f366fa4c91b7a95
IP
104.21.82.155:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document, ASCII text, with very long lines (379)
Size
740 B (740 bytes)
Hash
9712704b1fdce7a86fa9864e3372f8e7
8abdba0567129fd22d6ee8b020e48ac30e6c57f4
05bd1b289222877bc4a004fb647251c9498aa1f47536e0cc2dfba5c4d5ee3e01

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /c/3f366fa4c91b7a95 HTTP/1.1
Host: www.takingyounow.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 302 Found
date: Mon, 19 Sep 2022 03:18:00 GMT
content-type: text/html; charset=utf-8
location: https://www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_tmp
set-cookie: unique_id=6327df68000c8188; Path=/; Expires=Fri, 18 Nov 2022 03:18:00 GMT
unique_id2=6327df68000c89fc; Path=/; Expires=Sun, 18 Dec 2022 03:18:00 GMT
impression=; Path=/; Expires=Mon, 19 Sep 2022 03:18:00 GMT
tid=epnuu6327df68000d8c7d; Path=/; Expires=Tue, 24 Aug 2027 03:18:00 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BCVob8BZ%2BKM1aM47MWiorVaBrZ2fhXbfHYROsxhpzaLKP1H5eXUkqE%2FOw6EuOF%2BrJGnjgzH6Mmx2ZgG5DwXYhlAkw7QKeICA4oxCZmPI03WlJGMHc%2BD2rQz9X6MdbKgfI39EyygM0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 74cf2bea8816dd4c-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_final

52.19.101.114

200 OK

207 B

URL HTTP/2
www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_final
IP
52.19.101.114:0
ASN
#16509 AMAZON-02

File type
HTML document, ASCII text, with no line terminators
Size
207 B (207 bytes)
Hash
b2c316b5f1b0ab1a4204a00f76839b41
17116903ae9c6a307dca52f597baff063d4e3144
1acd494dda87893e3f55d540e340828390eb15ea2b42b6156fa70555a12df0da

HTTP Headers

GET /redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_final HTTP/1.1
Host: www.youknowbest.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youknowbest.net/redirect/index?type=script&to=aHR0cHM6Ly93d3cueW91a25vd2Jlc3QubmV0&data=aHR0cHM6Ly90cmFjay5uZXdsaWZlYnV6ei5jb20vP2FjdGl2aXR5PSZiYW5uZXI9JmNpZD1lcG51dTYzMjdkZjY4MDAwZDhjN2QmdXRtX2NhbXBhaWduPU1haW5zdHJlYW0mdXRtX21lZGl1bT0wNjUwY2ZhMjZhMjRjOTVhMDkzMGY4NWEzNzdmZjg1OWIwYzIwNDc0JnpvbmVfdHlwZT0mem9uZWlkPQ==&action=action_tmp
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Mon, 19 Sep 2022 03:18:00 GMT
content-type: text/html; charset=utf-8
content-length: 207
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
5fd1174f35b25298fc44a6de1af3f3d6
d45a47995ec34c7df480b3efafb13f55d9df7eb8
f60573eff255ef3d7603ca813f410c30588931b4018ffa0e07fa0bb2653c47af

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4665
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 19 Sep 2022 03:18:00 GMT
Last-Modified: Mon, 19 Sep 2022 02:00:16 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

52.13.69.101

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.13.69.101:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: S9SmXkheF8w2GdBPwAtJbQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: gzEAG4G28QeHx193sI0DJpyWmAk=

track.newlifebuzz.com/favicon.ico

216.104.36.157

200 OK

1.2 kB

URL HTTP/2
track.newlifebuzz.com/favicon.ico
IP
216.104.36.157:0
ASN
#32475 SINGLEHOP-LLC

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Size
1.2 kB (1150 bytes)
Hash
91abe01116ab422c598e9c8af72cf4da
0f2815fe8e067d48537ad168225ab4674271fa27
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: track.newlifebuzz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89
Cookie: u=5d7643541235892aa6f85e9946482783
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Mon, 19 Sep 2022 03:18:01 GMT
content-type: image/x-icon
content-length: 1150
last-modified: Wed, 31 Jul 2019 07:48:51 GMT
etag: "5d4147e3-47e"
expires: Tue, 20 Sep 2022 03:18:01 GMT
cache-control: max-age=86400
strict-transport-security: max-age=31536000; includeSubdomains;
accept-ranges: bytes
X-Firefox-Spdy: h2

track.newlifebuzz.com/sw.js?v=1663557462486

216.104.36.157

200 OK

776 B

URL HTTP/2
track.newlifebuzz.com/sw.js?v=1663557462486
IP
216.104.36.157:0
ASN
#32475 SINGLEHOP-LLC

File type
ASCII text
Size
776 B (776 bytes)
Hash
748323ec55a26b139323eeb0d1b655a4
3c0e2fbe4db7347921e2913d4de0a2a8e2efd9b8
324690e1e87036c9c8eedfb58924d2c34468583a42914b7a7b75e630c20f403d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /sw.js?v=1663557462486 HTTP/1.1
Host: track.newlifebuzz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: u=5d7643541235892aa6f85e9946482783
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Mon, 19 Sep 2022 03:18:01 GMT
content-type: application/javascript
content-length: 776
last-modified: Sun, 18 Sep 2022 08:17:18 GMT
vary: Accept-Encoding
etag: "6326d40e-308"
content-encoding: gzip
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5e0d4379f6517fd75a29a3d94d9199eb
0d383b811ebe839400f04333d16a5c9d4d78f802
e64c0c03925bdfaa2520d90339c90d1f8d98c432441adb771dfe1e818220f06f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E64C0C03925BDFAA2520D90339C90D1F8D98C432441ADB771DFE1E818220F06F"
Last-Modified: Sun, 18 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16147
Expires: Mon, 19 Sep 2022 07:47:09 GMT
Date: Mon, 19 Sep 2022 03:18:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5e0d4379f6517fd75a29a3d94d9199eb
0d383b811ebe839400f04333d16a5c9d4d78f802
e64c0c03925bdfaa2520d90339c90d1f8d98c432441adb771dfe1e818220f06f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E64C0C03925BDFAA2520D90339C90D1F8D98C432441ADB771DFE1E818220F06F"
Last-Modified: Sun, 18 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16147
Expires: Mon, 19 Sep 2022 07:47:09 GMT
Date: Mon, 19 Sep 2022 03:18:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5e0d4379f6517fd75a29a3d94d9199eb
0d383b811ebe839400f04333d16a5c9d4d78f802
e64c0c03925bdfaa2520d90339c90d1f8d98c432441adb771dfe1e818220f06f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E64C0C03925BDFAA2520D90339C90D1F8D98C432441ADB771DFE1E818220F06F"
Last-Modified: Sun, 18 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16147
Expires: Mon, 19 Sep 2022 07:47:09 GMT
Date: Mon, 19 Sep 2022 03:18:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5e0d4379f6517fd75a29a3d94d9199eb
0d383b811ebe839400f04333d16a5c9d4d78f802
e64c0c03925bdfaa2520d90339c90d1f8d98c432441adb771dfe1e818220f06f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E64C0C03925BDFAA2520D90339C90D1F8D98C432441ADB771DFE1E818220F06F"
Last-Modified: Sun, 18 Sep 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16147
Expires: Mon, 19 Sep 2022 07:47:09 GMT
Date: Mon, 19 Sep 2022 03:18:02 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c4bd4cc-8de2-4b7d-a032-51bb3bb2b62b.jpeg

34.120.237.76

200 OK

5.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c4bd4cc-8de2-4b7d-a032-51bb3bb2b62b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.4 kB (5382 bytes)
Hash
675954666fb740ffa9ac63de5b6ec7a2
372d71d42ba1e17f23f581bd5bba446b642ff194
220d4ec963e30345d7a9ed4a8bc8e0d7583ea030ed56a55b8279c30e0be9b6d4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c4bd4cc-8de2-4b7d-a032-51bb3bb2b62b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5382
x-amzn-requestid: d6368fc6-4cdf-4220-bf14-47fddd766c53
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YrN-nERgIAMF8rQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6327905d-59affa373e8b5be3522bacf3;Sampled=0
x-amzn-remapped-date: Sun, 18 Sep 2022 21:40:45 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 2AbUBl3vtA-6U2GBeHGsqMDlP6fEYPLYjmxVLDZ3OvWNsN7j68kU_w==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 21:52:21 GMT
age: 19541
etag: "372d71d42ba1e17f23f581bd5bba446b642ff194"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2922a3a3-ae10-495b-ac9a-220b799dc3d4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.9 kB (7920 bytes)
Hash
29912dedc89a817a56f47d9e4efa9e76
a092fbc76b84bda659d7ae0b0d9aedd476927f9b
090f90c3bdffdd666ff1dca07aadb1147b315d6e37e4d6ac1b320730b772657f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2922a3a3-ae10-495b-ac9a-220b799dc3d4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7920
x-amzn-requestid: 9532b1cd-deb5-4886-b57c-acd7bbd83dc9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YrODcHgCoAMFtiQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6327907c-763d15bb1bc85124029187f9;Sampled=0
x-amzn-remapped-date: Sun, 18 Sep 2022 21:41:16 GMT
x-amz-cf-pop: SEA73-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: oWuukEJgxSedGHum49XySBoMUv9wMG_P3saC2dVe6jaaMgcyYRqe7A==
via: 1.1 583992e175976bd59a21b4416890271e.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 21:51:43 GMT
age: 19579
etag: "a092fbc76b84bda659d7ae0b0d9aedd476927f9b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc97d270b-72af-4a6b-ae64-123f7b52851e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.7 kB (8735 bytes)
Hash
3d9fd171b51b27aa84e06e7d5a40116e
a81660dcace8f232018ce9a6d027b271d1f8a863
2c80ffd2c0c451c61623a677d1b17e8e58a40a0a7bdb5ef1cac2610bb0a7e0a8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc97d270b-72af-4a6b-ae64-123f7b52851e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8735
x-amzn-requestid: 8af37b3f-bacb-4f13-a539-0a8a1e2c7fe8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YrN_VHdooAMF8cQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63279061-083f90a5264568d85ce86e5a;Sampled=0
x-amzn-remapped-date: Sun, 18 Sep 2022 21:40:49 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: tPeWvkV7t7BSrnTA0G2Sf_KmuH5M4azBRhaeNuuaeiOW7zB4RhM_mw==
via: 1.1 42ef990e439ae115ff739f04e3945234.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 21:51:50 GMT
age: 19572
etag: "a81660dcace8f232018ce9a6d027b271d1f8a863"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45d6cb12-076a-432f-9153-165d4ddfa7b8.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11345 bytes)
Hash
2f2b49224f40b4ea819e0c66fc155eec
d37b9b044bdb469678433766470ed36a2384817f
b94b1d4e0df0bac9b4a2b5c86bee900248614756fb24e2b7b182a871b425b2ce

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45d6cb12-076a-432f-9153-165d4ddfa7b8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11345
x-amzn-requestid: 975904ee-c5b8-47bc-a65b-143c46de6d57
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yin9EESuIAMF_gw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63242053-7498357c7466b7266ccc671f;Sampled=0
x-amzn-remapped-date: Fri, 16 Sep 2022 07:05:55 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: w7WVhLaU-EYkoQLOi-G4WhN-VlbwgBL-k_bbdKIxMl7mBzBvL_R1pQ==
via: 1.1 95b0ac620fa3a80ee590ecf1cda1c698.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 07:21:41 GMT
age: 71781
etag: "d37b9b044bdb469678433766470ed36a2384817f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ccc0366-1136-421b-87fa-f9dcd1599fc9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10794 bytes)
Hash
fa12988120db56daccc3048e3abbaae6
29f28271148c46e2abb95db8be0b942f2f1c9388
f9e7884e04cce0a312bbaa00c609f21eebe1d74fa1d38ac7ecc45a4369c765de

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ccc0366-1136-421b-87fa-f9dcd1599fc9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10794
x-amzn-requestid: c86cdd40-854b-495f-bb84-0b408fa24440
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YrN_gHMcIAMFWPw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63279063-055c553a561ffa1558e63245;Sampled=0
x-amzn-remapped-date: Sun, 18 Sep 2022 21:40:51 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: u-NbDjp5yEAVPC-_sdoWMIYzkA6PZmdfK6ZDRUmON3yleRdce5zdwg==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 21:51:54 GMT
age: 19568
etag: "29f28271148c46e2abb95db8be0b942f2f1c9388"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd3d8aaa4-a2c1-416d-a396-a4c00758ba53.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.4 kB (9426 bytes)
Hash
febaa50825802847e9cbc0479e7121ba
36355214d6f866681edc3eacd5f1af87b16bdcc2
7a808fbeb6ce87490299fb3d5de52ec450c9161d9098254f1b54a0d4a97b645c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd3d8aaa4-a2c1-416d-a396-a4c00758ba53.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9426
x-amzn-requestid: 6569d647-e17c-4456-8d54-b093e1cc1d7e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yl9trEPNoAMFteg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63257657-7bba0e970a8114a11fd6bf32;Sampled=0
x-amzn-remapped-date: Sat, 17 Sep 2022 07:25:11 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: sO0jibO4hXSxONHRYPgA2WA9U9GBFbVhCGy9F3RwrJqZoAzU90Tpsg==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 3cd7af07832481c336aa1c93c9b4a6fe.cloudfront.net (CloudFront), 1.1 google
date: Sun, 18 Sep 2022 07:57:45 GMT
age: 69617
etag: "36355214d6f866681edc3eacd5f1af87b16bdcc2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7144924975927918603&pub=900&pid=900-1674189z&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85

162.55.4.52

302 Found

746 kB

URL HTTP/1.1
d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7144924975927918603&pub=900&pid=900-1674189z&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85
IP
162.55.4.52:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text\012- HTML document, ASCII text, with very long lines (65210), with CRLF line terminators
Size
746 kB (745589 bytes)
Hash
6ba023703f7011d5fb117529f1454ec1
264bbc9919ed603b55195ea12ff47ee33bc01d8d
da15f86e10396469758e1ab3e98e13d3bfa1454df83528f2fc3fb43144f47eef

HTTP Headers

GET /go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7144924975927918603&pub=900&pid=900-1674189z&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85 HTTP/1.1
Host: d0zi.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://track.newlifebuzz.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/1.1 302 Found
Server: nginx/1.20.1
Date: Mon, 19 Sep 2022 03:18:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000

d0zi.com/favicon.ico

162.55.4.52

200 OK

20 B

URL HTTP/1.1
d0zi.com/favicon.ico
IP
162.55.4.52:0
ASN
#24940 Hetzner Online GmbH

File type
data
Size
20 B (20 bytes)
Hash
a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: d0zi.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7144924975927918603&pub=900&pid=900-1674189z&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b380b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b85
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 19 Sep 2022 03:18:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip

track.newlifebuzz.com/sw.js?v=1663557462486

216.104.36.157

304 Not Modified

0 B

URL HTTP/2
track.newlifebuzz.com/sw.js?v=1663557462486
IP
216.104.36.157:0
ASN
#32475 SINGLEHOP-LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /sw.js?v=1663557462486 HTTP/1.1
Host: track.newlifebuzz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: u=5d7643541235892aa6f85e9946482783
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
If-Modified-Since: Sun, 18 Sep 2022 08:17:18 GMT
If-None-Match: "6326d40e-308"
Cache-Control: max-age=0
TE: trailers

HTTP/2 304 Not Modified
server: nginx
date: Mon, 19 Sep 2022 03:18:02 GMT
last-modified: Sun, 18 Sep 2022 08:17:18 GMT
vary: Accept-Encoding
etag: "6326d40e-308"
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
X-Firefox-Spdy: h2

track.newlifebuzz.com/?activity=&banner=&cid=epnuu6327df68000d8c7d&utm_campaign=Mainstream&utm_medium=0650cfa26a24c95a0930f85a377ff859b0c20474&zone_type=&zoneid=

216.104.36.157

200 OK

0 B

URL HTTP/2
track.newlifebuzz.com/?activity=&banner=&cid=epnuu6327df68000d8c7d&utm_campaign=Mainstream&utm_medium=0650cfa26a24c95a0930f85a377ff859b0c20474&zone_type=&zoneid=
IP
216.104.36.157:0
ASN
#32475 SINGLEHOP-LLC

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /?activity=&banner=&cid=epnuu6327df68000d8c7d&utm_campaign=Mainstream&utm_medium=0650cfa26a24c95a0930f85a377ff859b0c20474&zone_type=&zoneid= HTTP/1.1
Host: track.newlifebuzz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youknowbest.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Mon, 19 Sep 2022 03:18:01 GMT
content-type: text/html; charset=UTF-8
location: https://track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo
vary: Accept-Encoding
x-powered-by: PHP/8.1.9
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: u=5d7643541235892aa6f85e9946482783; expires=Tue, 19-Sep-2023 03:18:01 GMT; Max-Age=31536000; path=/
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip
X-Firefox-Spdy: h2

track.newlifebuzz.com/proc.php?6d36a447a352e77ffb666686072407753538d6f7

216.104.36.157

200 OK

0 B

URL HTTP/2
track.newlifebuzz.com/proc.php?6d36a447a352e77ffb666686072407753538d6f7
IP
216.104.36.157:0
ASN
#32475 SINGLEHOP-LLC

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /proc.php?6d36a447a352e77ffb666686072407753538d6f7 HTTP/1.1
Host: track.newlifebuzz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://track.newlifebuzz.com/?utm_term=7144924975927918603&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b780b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b89
Cookie: u=5d7643541235892aa6f85e9946482783
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Mon, 19 Sep 2022 03:18:01 GMT
content-type: text/html; charset=UTF-8
location: https://d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7144924975927918603&pub=900&pid=900-1674189z&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0
vary: Accept-Encoding
x-powered-by: PHP/8.1.9
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubdomains;
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (28)

URL HTTP/1.1

IP

ASN

File type

Size