Report - cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0

Report Overview

Submitted URL
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0
IP
192.169.219.127
ASN
#26496 AS-26496-GO-DADDY-COM-LLC
Submitted
2023-01-09 18:42:12
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
5
Threat Detection Systems
18

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
cgi.papersmiths.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	9.2 kB	168 kB	192.169.219.127
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	341 B	737 B	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.25.78.204
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	57 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.76.226
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-01-09 18:41:49	medium	192.169.219.127	Client IP	ET PHISHING Possible Google Docs Phishing Landing - Title over non SSL
2023-01-09 18:41:49	medium	192.169.219.127	Client IP	ET PHISHING Suspicious Google Docs Page - Possible Phishing Landing
2023-01-09 18:41:49	medium	192.169.219.127	Client IP	ET PHISHING Google Drive Phishing Landing Nov 6 2015 M1
2023-01-09 18:41:49	medium	192.169.219.127	Client IP	ET PHISHING Google Docs Phishing Landing 2018-08-30
2023-01-09 18:41:49	medium	192.169.219.127	Client IP	ET PHISHING Google Drive Phishing Landing 2015-11-06

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-12-03	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0	Google Inc.

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0	Phishing
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/	Phishing
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.js	Phishing
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.ddslick.min.js	Phishing
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.js	Phishing
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.min.js	Phishing
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff	Phishing
2023-01-09	medium	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.js	78 kB	2023-03-07	2024-04-22
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-22 10:37:56 Times Seen159 Hash 7947cb5a92373e747f786adfe1d49356 51165a72a6437ea17dda2afc64dbd7624cf46a36 69e875128adeedbc8aa1221b7ebffb20b484685964f4ab9a9772ce2146e52d48 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.min.js	95 kB	2023-03-07	2024-04-22
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.min.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-22 10:37:56 Times Seen697 Hash a13f7f208ba534681deadb1ec7a2e54a 3f51e2eecfa88c61e1200a48ed14f2cdda98ed87 d72fcb8924d1e14dbd4b04aff994c1183ee86c620f0aaac034f75fc508548220 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/	384 B	2023-03-07	2024-01-14
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/ IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-01-14 14:11:28 Times Seen17 Hash 5e0c5d5fd20071b8dddddebec0750dd0 73acbd4b4f963934174c263cd92dd3059215969f 93ea414cf314b95062256726481dcf795bb566accd72c9d7fbf45bc7d6461150 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.js	21 kB	2023-03-07	2024-04-22
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-22 10:37:56 Times Seen153 Hash d6be38fb42c2e9618c9d5f2664078c19 77f553236f588cece0fe2be4859e8f3220231a1f 3df1b7719a1aa90d70ae337b76b6253b01ede9afa038b290498c3abf4ab54027 Loading...

	cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.ddslick.min.js	7.2 kB	2023-03-07	2024-04-19
Pretty URL cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.ddslick.min.js IP 192.169.219.127 ASN #26496 AS-26496-GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:34:33 Last Seen2024-04-19 02:11:18 Times Seen122 Hash d04d05b0ff957ffe696a978c851adf14 b97757fa25c5e1762c5812e427e8c59e0bd9436f 970882d4a7e6a84819f31de8d238cb3ada20bf0a4ea307b45bf44988bbfc4602 Loading...

HTTP Transactions (38)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b782882bdabaf3b08e64120922b4a4b7
2035ed7fc9fb5b6ee9715601ba43de5f94d0c0e9
3fe7d1a9a55b86ec25d02634749ccfae11f3477033ba8cd7ac4131b7948ba619

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3FE7D1A9A55B86EC25D02634749CCFAE11F3477033BA8CD7AC4131B7948BA619"
Last-Modified: Sat, 07 Jan 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19161
Expires: Tue, 10 Jan 2023 00:01:22 GMT
Date: Mon, 09 Jan 2023 18:42:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
eecebe0566883e33558e8e67beaccb29
acdd8fd09e2066ed5ecfbc3f11c4a2d61218ecc7
65e21170242bf41eb529fa422385dbe5af65a61e374e6dd5669e7e5f927948af

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65E21170242BF41EB529FA422385DBE5AF65A61E374E6DD5669E7E5F927948AF"
Last-Modified: Mon, 09 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2732
Expires: Mon, 09 Jan 2023 19:27:33 GMT
Date: Mon, 09 Jan 2023 18:42:01 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Content-Type, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 09 Jan 2023 17:48:25 GMT
content-type: application/json
age: 3216
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
89a058935fd04697c87e9441fbb466a9
59b5b08119374b1da34cff7e43a7c6dc80103f6e
3a3261f495323ff0f60067b2930b8d0e5e4e5cd6ae9b14929a88047587b735da

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3A3261F495323FF0F60067B2930B8D0E5E4E5CD6AE9B14929A88047587B735DA"
Last-Modified: Sat, 07 Jan 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20446
Expires: Tue, 10 Jan 2023 00:22:47 GMT
Date: Mon, 09 Jan 2023 18:42:01 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: jNbNT4R8eIaEaalAxTubodEwZJ8MrOWv1CSUyOfQe327k8YFGK5U/xdWrJXVGGYTqnja12Uj5Wg=
x-amz-request-id: 3MJ4KSH35KN8AJ3Z
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 09 Jan 2023 18:16:19 GMT
age: 1542
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0

192.169.219.127

301 Moved Permanently

370 B

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
370 B (370 bytes)
Hash
e37ee5af6b7662a5ef4fba404969b0cd
86f580cc2ded4ab366988f5579449638a253fd79
6561b78d81bd94d0d03212a46fe5137de62cc252536c208254fbb0408038ef1d

Detections

Analyzer	Verdict	Alert
openphish	Google Inc.
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0 HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Mon, 09 Jan 2023 18:42:01 GMT
Server: Apache
Location: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/
Content-Length: 370
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Mon, 09 Jan 2023 18:42:01 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

192.169.219.127

200 OK

7.0 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text
Size
7.0 kB (6966 bytes)
Hash
33788b1b5641e586c8292939dc6428e3
a20be88178f6c1fae021658ba6f23ff5ef531a68
3c71cf9e1ad90ffafac459f02356ba1302f44fb1a31cb01c5fcfad67827215fa

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

NIDS	Severity	Alert
suricata	medium	ET PHISHING Possible Google Docs Phishing Landing - Title over non SSL
suricata	medium	ET PHISHING Suspicious Google Docs Page - Possible Phishing Landing
suricata	medium	ET PHISHING Google Drive Phishing Landing Nov 6 2015 M1
suricata	medium	ET PHISHING Google Docs Phishing Landing 2018-08-30
suricata	medium	ET PHISHING Google Drive Phishing Landing 2015-11-06

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/ HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 6966
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Pragma, Content-Length, Alert, Expires, ETag, Last-Modified, Backoff, Content-Type, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 09 Jan 2023 18:17:22 GMT
age: 1480
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.css

192.169.219.127

200 OK

878 B

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.css
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
ASCII text, with CRLF line terminators
Size
878 B (878 bytes)
Hash
76be30dfd9c602c42308f7f612670278
823757f63f91f30d4fb554e9c400491e85a44b22
6448513cf59ee1d69d3ac8ff3e7ab35ee930a1dd3e9ad53a791147d61d3cd947

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.css HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 878
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.css

192.169.219.127

200 OK

1.1 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.css
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
assembler source, ASCII text, with CRLF line terminators
Size
1.1 kB (1068 bytes)
Hash
9aece729e5c01e567ac1cd247580f6b5
055df5132f4e7099006472864f2c9c97b305ac50
23528c3a34e29cc89c18f30133e5ed0f8e9740338952e7396ee69455f0b35985

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.css HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1068
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
e8e0c910ffff02061a1806b1aa8cf9d2
c5bf0e7ad96e89b17a657fcb1e1cd1aa6d15ab89
896f08fa0030a1313df1f05ef47c5d1f11caa9094380fc026b95193164005448

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2862
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 18:42:02 GMT
Last-Modified: Mon, 09 Jan 2023 17:54:20 GMT
Server: ECS (ska/F710)
X-Cache: HIT
Content-Length: 471

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.js

192.169.219.127

200 OK

4.9 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
ASCII text, with CRLF line terminators
Size
4.9 kB (4884 bytes)
Hash
297b1612482f97c42812bd4e247aae5e
e795e2cab0a344cdb9b4636c1d537ce82079229f
e00fc88789e5ff36b9b029b4f422c7f04f6a06eafe74c3664349920b86f7f7f5

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationPassword.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 4884
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.ddslick.min.js

192.169.219.127

200 OK

2.4 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.ddslick.min.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (7149), with no line terminators
Size
2.4 kB (2365 bytes)
Hash
f8f1048858f981b77d6301fe7d792e38
2dd7cd336d6f5c4bd9bb7b4ca8788dbc56cf3ecd
55e3fbee508044c3fb516a06f93e6b47325176844f3ea07d7d95d302dd15e1fe

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.ddslick.min.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 2365
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.js

192.169.219.127

200 OK

17 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
ASCII text, with very long lines (430), with CRLF line terminators
Size
17 kB (17183 bytes)
Hash
0045751a5ff88bc5481e1dc55155e45d
848b97e588420a0b3bd3f36914f160e612574a36
4061eb93e539cc7dd4a71be9a385b40c59f9c1be360cebca8d28cf32f3dba6eb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/SpryAssets/SpryValidationTextField.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 17183
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.min.js

192.169.219.127

200 OK

34 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.min.js
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (32769), with CRLF line terminators
Size
34 kB (33632 bytes)
Hash
646ccca432fef5e5234280ee44eb7c66
19162421a16d8165ea940f51a79c03553cc4637a
953c5bbaf62076a94a1f6c1ec1a0ee3a5363856ef9317dc4366c80b7318e0ee0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/jquery.min.js HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 33632
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

push.services.mozilla.com/

52.25.78.204

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.25.78.204:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 0BXOdyqucpkuchZdgbw2QQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: HB4IvcL4nppNsW6PJVPgAwJzbpY=

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/universal_language_settings-21.png

192.169.219.127

200 OK

199 B

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/universal_language_settings-21.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced\012- data
Size
199 B (199 bytes)
Hash
4a2d1168a691747daf4d22e0dc483958
e556fed18aff83a117f173960c66d42d57cbc4b4
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/universal_language_settings-21.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 199
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/avatar_2x.png

192.169.219.127

200 OK

2.2 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/avatar_2x.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 192 x 192, 8-bit/color RGB, non-interlaced\012- data
Size
2.2 kB (2195 bytes)
Hash
17540f255f86c00bde81020fcc165989
33917cf0c146e88f8aca5b60c93437a4d31b84e8
8b2e5ba8089dccceb66536831349b5f34730da240c7a7331a68b2572865d8335

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/avatar_2x.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 2195
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/logo_strip_2x.png

192.169.219.127

200 OK

11 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/logo_strip_2x.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 420 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
11 kB (11156 bytes)
Hash
384a868cf5a995d033c4ac6e30c60355
33973ebe05a7bc3660a594c41d48a709e64a013d
a97200185f4992c536e4b269f2b8a727c65a25795b99805d80e61bf135f2d4ca

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/logo_strip_2x.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 11156
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff

192.169.219.127

200 OK

23 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 22656, version 1.1\012- data
Size
23 kB (22656 bytes)
Hash
7c5d9f078bea8c1fc0b21a764b832138
2505fe5f361045be53fb71afb8b105e319393389
7e7fd69ff0a1671b508800f38f6ad3690650c27c0a1f3f505629ecbe6ba51942

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 22656
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/logo_strip.png

192.169.219.127

200 OK

27 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/logo_strip.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 405 x 72, 8-bit/color RGBA, non-interlaced\012- data
Size
27 kB (26647 bytes)
Hash
a6dd956e0a1b11991ac93335bbf4b4cc
0e470f11b69b0468b2d90366769891cace69f5d9
000da3616519f393f1d7450839c1dbda356053087d0191bd2d25a83e5fc63e8c

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/logo_strip.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 26647
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/mail_gmail.png

192.169.219.127

200 OK

1.5 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/mail_gmail.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 26, 8-bit/color RGBA, non-interlaced\012- data
Size
1.5 kB (1528 bytes)
Hash
5d2f329d5813e9ad215d0117610a58c5
dc79b83740707c383ee1eff430223a9d5ea6ff2d
0e95cbf733f41b43a1e2716643ad7ea8cd5fdfcb2eee2d038f4618c579bcaff7

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/mail_gmail.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 1528
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/live_hotmail.png

192.169.219.127

200 OK

517 B

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/live_hotmail.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data
Size
517 B (517 bytes)
Hash
8dccdb0f930ec8ff6c62dd13474fa9f4
f8261ea396e36539b67a8a8ecb5290455f8f61af
c7b07a0440ecfbd1f32110a6a5c7e92ecfe0200a65ba5fdd5660a98cf2294c09

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/live_hotmail.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 517
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/yahoo.png

192.169.219.127

200 OK

2.8 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/yahoo.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
2.8 kB (2830 bytes)
Hash
fda2a0cac8b16568eed32edbc85b5db8
c5783560af0df9ff43f1320645c773a7b58b7795
0b6c1e1b33c085efad5bdc32654ec90b4ddc934eb1c1aca71a439ff89867f468

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/yahoo.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 2830
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff

192.169.219.127

200 OK

22 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 21956, version 1.1\012- data
Size
22 kB (21956 bytes)
Hash
3eb14f3838ada50e10f062a895c3b9cf
f570b2fe0688332cf8c4a9127db25433d9a1ebaa
90556675373ea9ed1d0e9b5678426d69296b6801c906ca378bb426aa3d6acdc3

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 21956
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/aol.png

192.169.219.127

200 OK

1.2 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/aol.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
1.2 kB (1183 bytes)
Hash
1db15cc5ad50540b10cde2d733efd2a4
3526d7089c8e1bca74d31b827ecd91d26c04deb9
1b5fe12e21a9d8ff78e007ecf9fa5a819947dc3e6ba7a0ca4951760d1c006adf

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/aol.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:02 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 1183
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/email.png

192.169.219.127

200 OK

2.9 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/email.png
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data
Size
2.9 kB (2921 bytes)
Hash
f093ed003976ef8aa9d299051c06f26b
6072eb6be0da0dea159ce919c634e78fcefb7047
73b1ce58fa539aab1d6d1424607c5ff60fc5e2f2c0becd3a776f7f4f8f3664b0

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/email.png HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:03 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Content-Length: 2921
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png

cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/favicon.ico

192.169.219.127

200 OK

1.2 kB

URL HTTP/1.1
cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/favicon.ico
IP
192.169.219.127:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
1.2 kB (1220 bytes)
Hash
36d8bb1e0b38f25263661ae4ba5fb322
8b65c1a9d7ef974ed08f8b95758691e77d6b0979
ffd651558fb9cf7ac0c6b9c61298e48d6adc93be20bf5de27fceee8683c00597

HTTP Headers

GET /b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/Google_docs_files/favicon.ico HTTP/1.1
Host: cgi.papersmiths.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cgi.papersmiths.com/b284dc80ec6386d139a9ac00ca2a3f9a/c8b08105853c415d6b54404b1f893ef0/

HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 18:42:03 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 10:49:53 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1220
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/x-icon

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7172ba8ac61060c9f94ad799db6af44
253917924d50c99a5b2fd83a816135846f7a9b80
3c2eee988ef973aca8d53e8c23e6475f9eb8311dff948fbe64106fd20b217d81

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C2EEE988EF973ACA8D53E8C23E6475F9EB8311DFF948FBE64106FD20B217D81"
Last-Modified: Mon, 09 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10932
Expires: Mon, 09 Jan 2023 21:44:15 GMT
Date: Mon, 09 Jan 2023 18:42:03 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7172ba8ac61060c9f94ad799db6af44
253917924d50c99a5b2fd83a816135846f7a9b80
3c2eee988ef973aca8d53e8c23e6475f9eb8311dff948fbe64106fd20b217d81

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C2EEE988EF973ACA8D53E8C23E6475F9EB8311DFF948FBE64106FD20B217D81"
Last-Modified: Mon, 09 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10932
Expires: Mon, 09 Jan 2023 21:44:15 GMT
Date: Mon, 09 Jan 2023 18:42:03 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f7172ba8ac61060c9f94ad799db6af44
253917924d50c99a5b2fd83a816135846f7a9b80
3c2eee988ef973aca8d53e8c23e6475f9eb8311dff948fbe64106fd20b217d81

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3C2EEE988EF973ACA8D53E8C23E6475F9EB8311DFF948FBE64106FD20B217D81"
Last-Modified: Mon, 09 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10932
Expires: Mon, 09 Jan 2023 21:44:15 GMT
Date: Mon, 09 Jan 2023 18:42:03 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f66a423-2d06-442e-9b60-52f1638487d5.jpeg

34.120.237.76

200 OK

4.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f66a423-2d06-442e-9b60-52f1638487d5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.7 kB (4687 bytes)
Hash
f0defc5fd929d3ca7df12b102b551453
f44e4ac4a10991e12994e3b5d6f3cc1b1658967a
f551a1c156ec30405668d66bff9e1359805b773457602e44748be80cbb1f8a23

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f66a423-2d06-442e-9b60-52f1638487d5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4687
x-amzn-requestid: 18bf71d4-030e-4a08-ae18-48fe037e6e0d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eWhZ7GzXIAMFnFQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b8e2a5-710f414a2d1b239f6d59d73a;Sampled=0
x-amzn-remapped-date: Sat, 07 Jan 2023 03:10:29 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: BH9GqW4F8x5-alQC2mwF8cXT20caU3Tn8jI1e3tuhDMYtKnrH3BBpQ==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Mon, 09 Jan 2023 03:30:17 GMT
age: 54706
etag: "f44e4ac4a10991e12994e3b5d6f3cc1b1658967a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fab696bdd-92ae-4c01-855b-6bbe0e8165ad.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.9 kB (8866 bytes)
Hash
e0189748e9478c37ab22a71c0826ca99
08186f7c9717eb7165ee8b9b803760da967b82e7
40a9b3a38f6799c2005bc7cc2716104b175a2178efc8029188b9aff19e598483

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fab696bdd-92ae-4c01-855b-6bbe0e8165ad.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8866
x-amzn-requestid: b4a6c607-98b7-4689-96c3-646756db23df
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eZblsHkmIAMFzKw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ba0c8a-02beb65706f8d3d44a812788;Sampled=0
x-amzn-remapped-date: Sun, 08 Jan 2023 00:21:30 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: SvWUcXyAY8ibl7_52JUaFjTAaTj80eZPR0Cx7rcLG27R58WoH36IIg==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 09 Jan 2023 09:02:48 GMT
age: 34755
etag: "08186f7c9717eb7165ee8b9b803760da967b82e7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c35b6f8-ae25-4552-b3cc-44e57542d5ec.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.4 kB (9407 bytes)
Hash
210f951bd43cd838048f3568adb84c8c
db87b6eeaad681f1232c104dd4d0a902a921ed6d
b0d21c80c6c53ba04c8b216f6428a0e8b8eff4ca16f44c31782857d4a2749c39

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5c35b6f8-ae25-4552-b3cc-44e57542d5ec.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9407
x-amzn-requestid: 08f125d6-46ed-4a83-98bc-94f688def00c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eP6aMG3loAMFU5Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b63dda-06f1fa975f43a24564b86524;Sampled=0
x-amzn-remapped-date: Thu, 05 Jan 2023 03:02:50 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: JGCcqqJcMEq8Q_Ahhr8WO1OsuLLCGJez-l5GRzZuPE3H2ljsztTrIw==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Mon, 09 Jan 2023 05:39:19 GMT
age: 46964
etag: "db87b6eeaad681f1232c104dd4d0a902a921ed6d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f37a3ca-5b31-4876-bbcd-442c1f718b3c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.6 kB (5578 bytes)
Hash
e832123ea0c92a446b5894e75efc86ae
bb438ca635b43819701067ef07a3d910ad29a0c7
e1b0c6cd873f304de15664f96af6b6914e13fbbfb3e2179ba43369e116446773

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f37a3ca-5b31-4876-bbcd-442c1f718b3c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5578
x-amzn-requestid: 405085aa-d0f5-4786-8fd7-46d74a6e8d1e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ecaIxGdkIAMFaBQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bb3d6b-07f34cbf7e1df2fa7a4d8982;Sampled=0
x-amzn-remapped-date: Sun, 08 Jan 2023 22:02:19 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mRyiYL1hTv7MvjLg92gwPBszcW1mqdKadIcQVG_rsQ6b15uyGkyZbQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Mon, 09 Jan 2023 09:56:36 GMT
age: 31527
etag: "bb438ca635b43819701067ef07a3d910ad29a0c7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca7956cf-b613-4307-88cb-8cc1a3fda11c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.6 kB (9594 bytes)
Hash
aa9ed964b2f5f08ec571b525992f1566
9de0dfe9d1018726f1504b26964629f419700a49
d75747ac8726cbbe7583c48c2522cecc0c3ed6a0fa3694513c694876847b5944

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca7956cf-b613-4307-88cb-8cc1a3fda11c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9594
x-amzn-requestid: 7844d69e-b683-47ed-8ad8-a26f67916de1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eJ4BbFjnIAMFhSA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b3d3a2-6da6fede0b33969b774aab38;Sampled=0
x-amzn-remapped-date: Tue, 03 Jan 2023 07:05:06 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1h_UiB89mG6qQdHyosgLG4MYT3KBOyDxLsBCuKuK7smmTWAiEsncxw==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Mon, 09 Jan 2023 10:43:55 GMT
age: 28688
etag: "9de0dfe9d1018726f1504b26964629f419700a49"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46239df3-17a1-48a0-95bc-7ac540c3def6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (12971 bytes)
Hash
0b75a93b9f0106516f046eb424b0c8d9
c9509f976390441bbd3bd7521cb1848f4f481fd0
0b69fd368ef68510387a871acfffe82afc4414163c661f76e574dffdcc94104a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46239df3-17a1-48a0-95bc-7ac540c3def6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12971
x-amzn-requestid: ed6346eb-d3ae-4343-8eab-b4321aad3135
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eXEBqG97IAMF3Kg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b91a0a-4eb212756fcc0d3175dd0225;Sampled=0
x-amzn-remapped-date: Sat, 07 Jan 2023 07:06:50 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: piVacwljJRw0mj4FKxVcPcOyoIpQURO35i2_t8-y5hthIyoQshGB-Q==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 2c6b5dd77f1abe60653ce0454f344b64.cloudfront.net (CloudFront), 1.1 google
date: Mon, 09 Jan 2023 05:34:35 GMT
age: 47248
etag: "c9509f976390441bbd3bd7521cb1848f4f481fd0"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (38)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size