Report - truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86

Report Overview

Submitted URL
truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86
IP
188.114.96.1
ASN
#13335 CLOUDFLARENET
Submitted
2023-01-14 11:16:18
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
3
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ajax.googleapis.com	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	387 B	32 kB	216.58.207.202
cdn.by.wonderpush.com	34220	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	385 B	1.5 kB	104.18.18.183
roadssign.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	9.9 kB	242 kB	97.107.133.178
www.gstatic.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	415 B	2.7 kB	142.250.74.3
get.geojs.io	17418	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	383 B	917 B	104.26.0.100
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	3.5 kB	142.250.74.131
bik.o7tt.in	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	562 B	12 kB	104.21.4.68
truck-vim.rd8p.in	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	924 B	1.8 kB	188.114.96.1
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	341 B	797 B	93.184.220.29
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.7 kB	9.7 kB	95.101.11.115
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.43.158.219
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	51 kB	34.120.237.76
measurements-api.wonderpush.com	27874	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	468 B	396 B	216.239.36.21

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-01-14 11:15:53	medium	Client IP	Internal IP	ET INFO External IP Address Lookup Domain (get .geojs .io) in DNS Lookup
2023-01-14 11:15:53	medium	Client IP	Internal IP	ET INFO External IP Address Lookup Domain (get .geojs .io) in DNS Lookup
2023-01-14 11:15:53	medium	Client IP	104.26.0.100	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-14	medium	truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86	Phishing
2023-01-14	medium	truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	bik.o7tt.in/gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski]	143 B	2023-03-12	2023-03-12
Pretty URL bik.o7tt.in/gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski] IP 104.21.4.68 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 18:38:08 Last Seen2023-03-12 23:06:23 Times Seen1 Hash bc3584aa1f6eb6b13484da65d0823d0f b6b1eed1a33fdd101c1e3616bad99c7dbbd38507 e7b8508f98548ec658a873068bdfdcb28da37ee1b7c09a48985da1b4a31094cb Loading...

	cdn.by.wonderpush.com/sdk/1.1/wonderpush-loader.min.js	1.3 kB	2023-03-12	2023-03-13
Pretty URL cdn.by.wonderpush.com/sdk/1.1/wonderpush-loader.min.js IP 104.18.18.183 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 21:48:37 Last Seen2023-03-13 01:32:12 Times Seen1 Hash ebd2ac9f5151ab0b28f14d4ac869454e 9f750bfc4105d10b4e5c6c2328c97fb858438e95 bbf3f58bc34201c14c36732ec992294002d3d676410393a438984ccd7bac04c1 Loading...

	cdn.by.wonderpush.com/sdk/1.1.33.12/wonderpush.min.js	475 kB	2023-03-12	2023-03-13
Pretty URL cdn.by.wonderpush.com/sdk/1.1.33.12/wonderpush.min.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 21:48:37 Last Seen2023-03-13 01:32:12 Times Seen1 Hash 60ae69ae9bed5d60f9ea99cfe4143040 629fe421b04a412d3e1420026f6700e204bcd7ac 84957a0c494d32066070d62993ae46699401b0b390d8a2199054a4668727f944 Loading...

	cdn.by.wonderpush.com/plugins/geojs/1.0.2/geojs.js	2.2 kB	2023-03-07	2023-04-17
Pretty URL cdn.by.wonderpush.com/plugins/geojs/1.0.2/geojs.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:20:36 Last Seen2023-04-17 12:29:10 Times Seen26 Hash 1f0fea8081c9fce5fcfd4b63e65481e3 a8fa1b0d3767c102b363a8a0f53c9ad0e79059a0 b877ef66eabd2dd21768d59e2ac26f9c4f48e0ed602e27cbd4d53c0701c7d515 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js	90 kB	2023-03-07	2024-04-26
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js IP 216.58.207.202 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-26 12:00:15 Times Seen139371 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	roadssign.com/eml/PL-Norton-JAN22-eml-avi/js/interactive.js	25 kB	2023-03-10	2023-03-12
Pretty URL roadssign.com/eml/PL-Norton-JAN22-eml-avi/js/interactive.js IP 97.107.133.178 ASN #63949 Linode, LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 12:53:39 Last Seen2023-03-12 23:06:23 Times Seen1 Hash 33771356331cb538ca3a68133ccc82cd e2b7aa73b7f47a5d9876b16fd5ed1fbbaa44957c db5fc2309aa1372423a92a86ed04723a230931056a3dc4b5db5694f68d124577 Loading...

	bik.o7tt.in/gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski]	567 B	2023-03-12	2023-03-12
Pretty URL bik.o7tt.in/gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski] IP 104.21.4.68 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 23:06:23 Last Seen2023-03-12 23:06:23 Times Seen1 Hash 690a4cad35d0b397da80cc92f1d6aaaa 0db444e811437bef46327b81933c702eecf52fa0 b8cf007a941dbe8085e06c90aa8fab722bf9d95630a9d76404c843919c5dd253 Loading...

HTTP Transactions (59)

URL IP Response Size

truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86

188.114.96.1

301 Moved Permanently

0 B

URL HTTP/1.1
truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86 HTTP/1.1
Host: truck-vim.rd8p.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Sat, 14 Jan 2023 11:16:04 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sat, 14 Jan 2023 12:16:04 GMT
Location: https://truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7f7mP8H1TjGw67BwKUQIJC6v%2F7141FDQKJgrVeORNU8OSZHu0SjS%2Fth60uj5JU%2BV27hxEZr9JjBr5kHNazUAYtTa5GlxjcBEkPTNT0CPNLjQHMIaWByoQzKQudEv5ADN%2FxJ73Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7895f5174c5db503-OSL
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a8b4f1afb0e830b797238d34ab9254aa
e011acef3d05c959a65205d53b651ecd18a889fe
f7ceff5b4fda083c7449b7298c232224cf48a632dcb87233b646790de207d49c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F7CEFF5B4FDA083C7449B7298C232224CF48A632DCB87233B646790DE207D49C"
Last-Modified: Thu, 12 Jan 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2718
Expires: Sat, 14 Jan 2023 12:01:22 GMT
Date: Sat, 14 Jan 2023 11:16:04 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
0643dc6b6fed33b3537160b6bb77bcbf
aa43bd1fbb30d2219f3285c1ee4991ffb33562c5
f137438e30e0d69cba77ca2eb736687873e4a9c06cf88d23c6d55ea930fde09f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F137438E30E0D69CBA77CA2EB736687873E4A9C06CF88D23C6D55EA930FDE09F"
Last-Modified: Sat, 14 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5952
Expires: Sat, 14 Jan 2023 12:55:16 GMT
Date: Sat, 14 Jan 2023 11:16:04 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 14 Jan 2023 10:42:01 GMT
content-type: application/json
age: 2043
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
0f4ecf4f26be1ba09e61135b1b488bf4
f16b8277e00033bc990a8bcce54b693cb3c87d62
3018c2a228f0a894d217e8e8b0b8dd060527f06879cd2f469bac6c8766acbbf8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3018C2A228F0A894D217E8E8B0B8DD060527F06879CD2F469BAC6C8766ACBBF8"
Last-Modified: Wed, 11 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4170
Expires: Sat, 14 Jan 2023 12:25:34 GMT
Date: Sat, 14 Jan 2023 11:16:04 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: gQ9TCUkFtQ6vwK8E9bzuIL4kTY/pqbt/uyx6t67dTMqIRcXH+f9rbleIbIhIbgrF0oi0MHwu9kk=
x-amz-request-id: 6WVS3Y4NB40MT912
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 14 Jan 2023 10:43:42 GMT
age: 1942
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 14 Jan 2023 11:16:04 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Pragma, Content-Length, Alert, Expires, ETag, Last-Modified, Backoff, Content-Type, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 14 Jan 2023 10:17:25 GMT
age: 3520
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
c01ec61f7ca77158f474b3ab519c12fa
fc82ae0fcd73a83a980b75709a08e65239894e4a
f533e0fac9b92e79d4fbd6e70b42a83067de95f0a13cc737d7e5fa459baa4c54

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5501
Cache-Control: max-age=170543
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 11:16:05 GMT
Etag: "63c270a7-1d7"
Expires: Mon, 16 Jan 2023 10:38:28 GMT
Last-Modified: Sat, 14 Jan 2023 09:06:47 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

52.43.158.219

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.43.158.219:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Ck9xDAGukhiXkNbM5jTOlg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: RBEiJJgazCIFE1OZhGaydOmyA0s=

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
b5628887325331ad3d660f7208e1995c
9e4bf04468a7aed126488ccb5552a8e02610f6dd
5cd181d6728fc5f0f4d88407b97af61db39c5a38feebdeb2c21335cf4402fca4

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 11:16:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

216.58.207.202

200 OK

31 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
216.58.207.202:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (65451)
Size
31 kB (31021 bytes)
Hash
903bc7a7e510f87aa5d0201eb59a0832
ac9aa4dd94cde1bcba9037e94087138b127e41fc
41a7ac8150cc9f38421451d5143c1ffec7a1f1fafbf7a7fc0f51b98ad699cf8f

HTTP Headers

GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 12 Jan 2023 06:59:13 GMT
expires: Fri, 12 Jan 2024 06:59:13 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
age: 188213
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
b5628887325331ad3d660f7208e1995c
9e4bf04468a7aed126488ccb5552a8e02610f6dd
5cd181d6728fc5f0f4d88407b97af61db39c5a38feebdeb2c21335cf4402fca4

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 11:16:06 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

cdn.by.wonderpush.com/sdk/1.1/wonderpush-loader.min.js

104.18.18.183

200 OK

696 B

URL HTTP/2
cdn.by.wonderpush.com/sdk/1.1/wonderpush-loader.min.js
IP
104.18.18.183:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (1337), with no line terminators
Size
696 B (696 bytes)
Hash
63705797b6d53ce29d4da58a6329400d
ccd3eee5b9a2d07477dcdd043646b88238fe2d3a
6228a25b9cab89103cf5460b19301f18b4d40c6e22974c0afebada440cf5acb6

HTTP Headers

GET /sdk/1.1/wonderpush-loader.min.js HTTP/1.1
Host: cdn.by.wonderpush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 14 Jan 2023 11:16:06 GMT
content-type: application/javascript
content-length: 696
last-modified: Wed, 11 Jan 2023 09:03:04 GMT
cache-control: public,max-age=86400
content-encoding: gzip
access-control-allow-origin: *
access-control-allow-methods: HEAD, GET
access-control-max-age: 86400
etag: "63705797b6d53ce29d4da58a6329400ded6e"
x-cache: Miss from cloudfront
via: 1.1 efe5edfc97620ce0a17f2dafd5991870.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: 4jEDHkCitvaLj4dF6bpWK3fciDrYJ004Tw1JW2gVNWkmuAetDzcxKA==
cf-cache-status: HIT
age: 7955
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 7895f5248842b527-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b5018d9b6496e22ba6ddb39f2509ba97
d833d73654cca44b2f7913fe34bbbada49e12608
c1703534aab2549d5429f6059ac020e1492648c671059c10c03e8195b1e635c2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C1703534AAB2549D5429F6059AC020E1492648C671059C10C03E8195B1E635C2"
Last-Modified: Sat, 14 Jan 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17741
Expires: Sat, 14 Jan 2023 16:11:47 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b5018d9b6496e22ba6ddb39f2509ba97
d833d73654cca44b2f7913fe34bbbada49e12608
c1703534aab2549d5429f6059ac020e1492648c671059c10c03e8195b1e635c2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C1703534AAB2549D5429F6059AC020E1492648C671059C10C03E8195B1E635C2"
Last-Modified: Sat, 14 Jan 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14969
Expires: Sat, 14 Jan 2023 15:25:35 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b5018d9b6496e22ba6ddb39f2509ba97
d833d73654cca44b2f7913fe34bbbada49e12608
c1703534aab2549d5429f6059ac020e1492648c671059c10c03e8195b1e635c2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C1703534AAB2549D5429F6059AC020E1492648C671059C10C03E8195B1E635C2"
Last-Modified: Sat, 14 Jan 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14982
Expires: Sat, 14 Jan 2023 15:25:48 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
405286fed56425fdae43a56406ae5684
e58e5a8294950c081fa7396f976d6084866c474a
6689f9becc7e4901209764d9c80fedb16f050f49992c6edc92b6921688e1c237

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6689F9BECC7E4901209764D9C80FEDB16F050F49992C6EDC92B6921688E1C237"
Last-Modified: Wed, 11 Jan 2023 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11123
Expires: Sat, 14 Jan 2023 14:21:29 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
cece9f7d2b66d2aaebd8d30020a985a5
63b2d270e9727670e2acaba7e5a656dcbf49bb3c
107ff024db54508d07e0ce8c7440d0e82a3f76db1c5ffeaa795b3702ae26cdd9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "107FF024DB54508D07E0CE8C7440D0E82A3F76DB1C5FFEAA795B3702AE26CDD9"
Last-Modified: Wed, 11 Jan 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=360
Expires: Sat, 14 Jan 2023 11:22:06 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6557
Expires: Sat, 14 Jan 2023 13:05:23 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6557
Expires: Sat, 14 Jan 2023 13:05:23 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6557
Expires: Sat, 14 Jan 2023 13:05:23 GMT
Date: Sat, 14 Jan 2023 11:16:06 GMT
Connection: keep-alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/css/translateelement.css

97.107.133.178

200 OK

19 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/css/translateelement.css
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
ASCII text, with very long lines (18670)
Size
19 kB (18724 bytes)
Hash
15ab5dfc566a9a19f6e89a72b7819e43
064aac1e8bc5a26c5986e40659bc328157ec3b53
5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/css/translateelement.css HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:06 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:32 GMT
ETag: "4924-5cdc2aa88e100"
Accept-Ranges: bytes
Content-Length: 18724
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

bik.o7tt.in/gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski]

104.21.4.68

200 OK

11 kB

URL HTTP/2
bik.o7tt.in/gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski]
IP
104.21.4.68:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
11 kB (11275 bytes)
Hash
40c0e8f25032e5c9705e0f370c28bc6e
6decaf36a8b236ee2a4deee8f180bca67d0a9fe0
abbca51bdc723d38039fdfaf9e75a4ec4db9c1315bf00828c3d7d1ad6a1b997e

HTTP Headers

GET /gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski] HTTP/1.1
Host: bik.o7tt.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
date: Sat, 14 Jan 2023 11:16:06 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.30
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KtpYvyb%2BjtUwA%2FZQQ898uhOVyfqDRAxOONiYLhZmJhBzDv%2FcWQqlDBZb%2Brkot%2BkLH9cWuJDBHdj%2FuqxrB3QtH46w7%2FzPvNjHe7ZuWzFRUzA3Cwa4SNgK5c2maranAw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7895f51c4d110afa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F69cd0f59-3b24-4742-958c-e856dc02789f.jpeg

34.120.237.76

200 OK

4.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F69cd0f59-3b24-4742-958c-e856dc02789f.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.0 kB (3955 bytes)
Hash
7055d5db8f2f9c89dfab16c4fe3f11a5
29566fe8eb5c9d12b0584642dac170c93ba80b90
6510cf0eda1d062df3b81b2b797e9bfca73040cac874e80ae9b8ff70b0407302

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F69cd0f59-3b24-4742-958c-e856dc02789f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3955
x-amzn-requestid: 28db68a0-ab23-4bef-b415-54120d187f80
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eZ0gWEF6IAMFT7Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ba3468-23b24e4a2c863aed25e0c81e;Sampled=0
x-amzn-remapped-date: Sun, 08 Jan 2023 03:11:36 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: lkGbybdV4gBs1HNNzdVIBzyA5Akcx2T4YZX9Q1kR847Q33pG8sJ67w==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 21:49:18 GMT
age: 48408
etag: "29566fe8eb5c9d12b0584642dac170c93ba80b90"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78b0d4bc-9eea-491e-9fed-be68e71088e5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9135 bytes)
Hash
64ba27a2f0a3bc61bd325f1fb317b755
c65c58476b66cbb6269ba1d8412d270a0a003ae3
5f7f03752f8a7c8c08d92512ae93b193ea37f59354503c3129d33fd2910f87e0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F78b0d4bc-9eea-491e-9fed-be68e71088e5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9135
x-amzn-requestid: 2c5e9de0-9244-43ac-b7c4-712cbcf7038c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enAnoG6roAMFzgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bf7afd-7fb640b30bab63bc1979a173;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 03:14:05 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: SUGIIWi8jWe9RoRu-3dQXvLAddjwjH05V1ubKzEOEQrFonzVjQdbtw==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 03:33:07 GMT
age: 27779
etag: "c65c58476b66cbb6269ba1d8412d270a0a003ae3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

14 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbd91e555-c9f3-4166-92be-27db2e1919b6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
14 kB (13626 bytes)
Hash
afcc8f4875f4b74ca0640829b689731e
584d0e11665ae89f9a294baf1e9bb4f0e4e9a4df
3e487396389c4330abc99bc99053eecc6aaf56f7afa398d70c30e1f4709577a0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbd91e555-c9f3-4166-92be-27db2e1919b6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 13626
x-amzn-requestid: 4769eaeb-0c78-4054-ad47-eefdd6ab2d03
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eWHMZErbIAMF6sQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b8b8b5-4c7bacfe060899044e361f70;Sampled=0
x-amzn-remapped-date: Sat, 07 Jan 2023 00:11:33 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: uJjDFuqKCZyyAorUVUq9PyCb_8fWukPf6YE3LwqK2FrwMFzDNkftFQ==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 11:16:26 GMT
age: 86380
etag: "584d0e11665ae89f9a294baf1e9bb4f0e4e9a4df"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

roadssign.com/eml/PL-Norton-JAN22-eml-avi/css/translate.css

97.107.133.178

200 OK

655 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/css/translate.css
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
ASCII text
Size
655 B (655 bytes)
Hash
64836db20736f1e7995b43489b4bf0ac
a0db33db05acb39dd01d9f19f5eed634682b0ead
d4d21bac4b13cac53c0b921c3aa69d1e010a32ad3ccb7498821aa6e763e71c87

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/css/translate.css HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:06 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:29 GMT
ETag: "28f-5cdc2aa5b1a40"
Accept-Ranges: bytes
Content-Length: 655
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd34cbb2e-8cd4-4c61-a8c1-a6ab4f223abb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10461 bytes)
Hash
41aec5fd4a5d8bb8cd840f4843d48250
13b3efa7259324d7dca3576a69936b5a7339ecf1
742eb5ccd303bf58c9d7c2288b1d36f2989bd030b69293c74dca463fd8bb6a10

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd34cbb2e-8cd4-4c61-a8c1-a6ab4f223abb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10461
x-amzn-requestid: 2545c321-708a-418a-81a8-0b108fa83dc9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: es0pZEa5oAMF4cA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1ce3b-7544647613db6c4c198145f3;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 21:33:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0bt51kj0PtGNr8Z37lVs7-BoR82dj3clknoURdKFQexK7yV9Pvf_sw==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 21:49:06 GMT
age: 48420
etag: "13b3efa7259324d7dca3576a69936b5a7339ecf1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F917985a1-aa8d-4c0a-860c-0b16c203387e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.2 kB (8181 bytes)
Hash
d24ea1f095f492934a1f1c63f5d8590c
dade37148c9b9a941f93a8535d8ddc5de3952623
2d8e3f90eb347eb3479a6c5d20a1c2ca6a0560f335a6c6800948db2640e4c878

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F917985a1-aa8d-4c0a-860c-0b16c203387e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8181
x-amzn-requestid: 7ada8fbd-58e6-4433-a532-b4a4ef93ac9c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: es0paH-OIAMFg5A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1ce3c-582529522dbb67ee728484f8;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 21:33:48 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AHjOmYxva5avyA3gt9DvYLas_B2ACimer5QRQOi919HDtSjnKq22lw==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 10:27:20 GMT
age: 2926
etag: "dade37148c9b9a941f93a8535d8ddc5de3952623"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

roadssign.com/eml/PL-Norton-JAN22-eml-avi/css/style.css

97.107.133.178

200 OK

15 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/css/style.css
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
ASCII text
Size
15 kB (15403 bytes)
Hash
4e3a55846e684ff90a252acb662f4f0b
8877557d7d84c7bd610b6f7b6e7669f36ba42efd
3204b042a371f19d108be7377ff939cf6ee7af78c7bca8aeeaf8d051f947304b

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/css/style.css HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:06 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:29 GMT
ETag: "3c2b-5cdc2aa5b1a40"
Accept-Ranges: bytes
Content-Length: 15403
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/js/interactive.js

97.107.133.178

200 OK

25 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/js/interactive.js
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
ASCII text, with CRLF line terminators
Size
25 kB (24982 bytes)
Hash
33771356331cb538ca3a68133ccc82cd
e2b7aa73b7f47a5d9876b16fd5ed1fbbaa44957c
db5fc2309aa1372423a92a86ed04723a230931056a3dc4b5db5694f68d124577

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/js/interactive.js HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:06 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:23 GMT
ETag: "6196-5cdc2ad9313c0"
Accept-Ranges: bytes
Content-Length: 24982
Content-Type: application/javascript
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/translate_24dp.png

97.107.133.178

200 OK

825 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/translate_24dp.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
825 B (825 bytes)
Hash
55ff382a8b09329e3230a1797eb8f5fd
026ae089006a674da7dcc9bf6b986c5d59e75478
1bb2279aed6bc1438d2b17a5ffcbac9d37864582aedeeec8d301eab162b2c213

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/translate_24dp.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:07 GMT
ETag: "339-5cdc2ac9eefc0"
Accept-Ranges: bytes
Content-Length: 825
Content-Type: image/png
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_gray2.png

97.107.133.178

200 OK

349 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_gray2.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced\012- data
Size
349 B (349 bytes)
Hash
7454c652e0733d92de6c920c2d646ae0
34a5bd8c7401f95e346895b0e5ccffbf0e9ad638
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_gray2.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:50 GMT
ETag: "15d-5cdc2ab9b8980"
Accept-Ranges: bytes
Content-Length: 349
Content-Type: image/png
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/win_cls.png

97.107.133.178

200 OK

293 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/win_cls.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced\012- data
Size
293 B (293 bytes)
Hash
9eb68d2ce05c151bda542a7a6356e22c
baeeefe4a7ac657c10a5f081841015de1bcf90dd
2d2b7040bc32b397c3c60d800de9aa7d86404f1874862eba61bdaa21f1523eb7

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/win_cls.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:10 GMT
ETag: "125-5cdc2acccb680"
Accept-Ranges: bytes
Content-Length: 293
Content-Type: image/png
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/logo-white.png

97.107.133.178

200 OK

22 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/logo-white.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 415 x 84, 8-bit/color RGBA, non-interlaced\012- data
Size
22 kB (21903 bytes)
Hash
f8b7b6d7ac3da1f79eb3094d49a59c36
288cf97e73b189efa501855b4ddb82393fd1fca5
b34d78e69e6b3b054a090e7d44e68c4a18b5dff904b2f82e68b67dea093d03ba

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/logo-white.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:58 GMT
ETag: "558f-5cdc2ac159b80"
Accept-Ranges: bytes
Content-Length: 21903
Content-Type: image/png
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/beep.mp3

97.107.133.178

206 Partial Content

16 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/beep.mp3
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural\012- data
Size
16 kB (15932 bytes)
Hash
d6040c63cafad92b0c2933569de365c0
6e0782bf850c89a1211cc1ec2ab10373520c834c
e8ef8e78f08ac34193423319b86566a442440ec663d09f26911e9fa10c4c9db7

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/beep.mp3 HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 206 Partial Content
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:42 GMT
ETag: "3e3c-5cdc2ab217780"
Accept-Ranges: bytes
Content-Length: 15932
Content-Range: bytes 0-15931/15932
Content-Type: audio/mpeg
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/logo.png

97.107.133.178

200 OK

7.4 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/logo.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 231 x 172, 8-bit/color RGBA, non-interlaced\012- data
Size
7.4 kB (7350 bytes)
Hash
2fbf57a8ee13dda0c9b05a4ac6c80942
33087546aca94c22e6304d59a959a6970e06c183
b57c846d2cd42f356eb735efaba968a43190cebb8c9b68f4b64a48b8055bae08

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/logo.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:58 GMT
ETag: "1cb6-5cdc2ac159b80"
Accept-Ranges: bytes
Content-Length: 7350
Content-Type: image/png
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_gray1.png

97.107.133.178

200 OK

364 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_gray1.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced\012- data
Size
364 B (364 bytes)
Hash
e144c3378090087c8ce129a30cb6cb4e
59da5466551de941d0215e45c54aa2ceaf436be1
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_gray1.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:50 GMT
ETag: "16c-5cdc2ab9b8980"
Accept-Ranges: bytes
Content-Length: 364
Content-Type: image/png
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/win_min.png

97.107.133.178

200 OK

128 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/win_min.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced\012- data
Size
128 B (128 bytes)
Hash
0bb86caf792dd7d24731c18cd37bb68e
dda1e433a0eaf785b2aa2c6214d5e48cb82a3a25
2ac27821ba64d645f36e2ad197492d30c11b10a032cc474554679555f4604622

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/win_min.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:10 GMT
ETag: "80-5cdc2acccb680"
Accept-Ranges: bytes
Content-Length: 128
Content-Type: image/png
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/pc_green.gif

97.107.133.178

200 OK

723 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/pc_green.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 120 x 97\012- data
Size
723 B (723 bytes)
Hash
ea44081971aed96fbfa38fa187b6df4a
a3ec8cd4c76f517584faef83f96e32683265bdb1
e0f52d9433540bafa2f05fc3c04839b4990c2ce5ef718975a8d4eef9866f06be

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/pc_green.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:03 GMT
ETag: "2d3-5cdc2ac61e6c0"
Accept-Ranges: bytes
Content-Length: 723
Content-Type: image/gif
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/mcafee-total-protection.jpg

97.107.133.178

200 OK

116 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/mcafee-total-protection.jpg
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2806x1200, components 3\012- data
Size
116 kB (116310 bytes)
Hash
e43bfa42e4f3a4d65c0fc03dc5ff16ae
2c42389d3662bdd6408e82651388f832a14696d9
bc1801388fb9ac98053cefbfc0306b1e9a63b683e71c7ea52604d1398f21bd24

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/mcafee-total-protection.jpg HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:01 GMT
ETag: "1c656-5cdc2ac436240"
Accept-Ranges: bytes
Content-Length: 116310
Content-Type: image/jpeg
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/corner.gif

97.107.133.178

200 OK

102 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/corner.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 24 x 9\012- data
Size
102 B (102 bytes)
Hash
ef14d57c065fdbd3c66d017a729ca91f
2e7b72d674361a9c2b41767ccfbed2486e6695dd
6fcbfcda8a36536a0f9b0bc8c4a6ca451d9bafd4a879d56697e48e209691ba36

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/corner.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:42 GMT
ETag: "66-5cdc2ab217780"
Accept-Ranges: bytes
Content-Length: 102
Content-Type: image/gif
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_bl1.gif

97.107.133.178

200 OK

511 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_bl1.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 80 x 65\012- data
Size
511 B (511 bytes)
Hash
af3aca2036675c5979fb535c5d190f15
70c4f17ef1a2afe0477c84c5d209fbe31760b657
aa88fa9731a6021cd8c0f80ef76476fd055a9cf0bff3ad9fbefbedbd255e26fa

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_bl1.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:44 GMT
ETag: "1ff-5cdc2ab3ffc00"
Accept-Ranges: bytes
Content-Length: 511
Content-Type: image/gif
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_bl2.gif

97.107.133.178

200 OK

1.5 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_bl2.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 65 x 80\012- data
Size
1.5 kB (1547 bytes)
Hash
af52e51f42fd0c55bc3cf2c8ece71492
016f83da68ff461a5c6aebcc2a45668317b2f24c
e91f304cf7409723968740e6363dda01b50acb8e94b5ca05b4a4617666ff095c

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_bl2.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:47 GMT
ETag: "60b-5cdc2ab6dc2c0"
Accept-Ranges: bytes
Content-Length: 1547
Content-Type: image/gif
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_bl3.gif

97.107.133.178

200 OK

949 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_bl3.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 78 x 68\012- data
Size
949 B (949 bytes)
Hash
da9d153375da51a616a7663f1504e3a5
bd81fe60fe017bfe79be8c1afed88b659ff166d9
9bb88049c3d3f3c172d97246fa148bb725e727847c37e28c3be156be240a0c04

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_bl3.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:47 GMT
ETag: "3b5-5cdc2ab6dc2c0"
Accept-Ranges: bytes
Content-Length: 949
Content-Type: image/gif
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_tray1.gif

97.107.133.178

200 OK

69 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_tray1.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 16 x 16\012- data
Size
69 B (69 bytes)
Hash
3ae573d079dcd1d2da4086f2c0c72c45
e7c9dabec81379373476ed23168dcecb9b8c56aa
9cce08ab28e94790cf78c87e37f8690acbc6c535e4b43ae7b38506b94538e107

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_tray1.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:53 GMT
ETag: "45-5cdc2abc95040"
Accept-Ranges: bytes
Content-Length: 69
Content-Type: image/gif
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_tray2.gif

97.107.133.178

200 OK

377 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_tray2.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 16 x 16\012- data
Size
377 B (377 bytes)
Hash
c10bdec858cb0cf9e6cc5865d5925746
697c095ed5509e5a5af0c5ebf2380662aeffc531
b65b47a79e32335d9ca35ff59c6975d2b5808f84da0db88d11ce777b33e72ad9

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_tray2.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:53 GMT
ETag: "179-5cdc2abc95040"
Accept-Ranges: bytes
Content-Length: 377
Content-Type: image/gif
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_tray3.gif

97.107.133.178

200 OK

234 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ico_tray3.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 16 x 16\012- data
Size
234 B (234 bytes)
Hash
9ce99ec458daf212f9812a90f3fadd13
9e3041bc91b79a17b52e0fbb6c2d0e2f905d98a1
b0d335401c9fd5fac9991ec92edaf7865ff3a491ebe390120936c69796c3b753

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ico_tray3.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:56 GMT
ETag: "ea-5cdc2abf71700"
Accept-Ranges: bytes
Content-Length: 234
Content-Type: image/gif
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ring.gif

97.107.133.178

200 OK

315 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/ring.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 30 x 29\012- data
Size
315 B (315 bytes)
Hash
c3b64d6515c79193f47b3f6780840578
0edb138e48313bbea641208092d9072cee89652e
275e633fe30013ed09ab33d46f668be82c19c93ed3c66485a5bef53d74eeaa89

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/ring.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:03 GMT
ETag: "13b-5cdc2ac61e6c0"
Accept-Ranges: bytes
Content-Length: 315
Content-Type: image/gif
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/cross.gif

97.107.133.178

200 OK

211 B

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/cross.gif
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
GIF image data, version 89a, 29 x 29\012- data
Size
211 B (211 bytes)
Hash
45b0c8a1e52d91e8cf84eaf75ebca9a9
0e358b8571f9062dedfacd0c31d54179270153cd
4e635bdab7a300d0ccb5aac26b4610a07ee1b33643578c1a4308e677d7eb595d

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/cross.gif HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:47:44 GMT
ETag: "d3-5cdc2ab3ffc00"
Accept-Ranges: bytes
Content-Length: 211
Content-Type: image/gif
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive

roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/nrt_logo.png

97.107.133.178

200 OK

6.0 kB

URL HTTP/1.1
roadssign.com/eml/PL-Norton-JAN22-eml-avi/img/nrt_logo.png
IP
97.107.133.178:0
ASN
#63949 Linode, LLC

File type
PNG image data, 65 x 37, 8-bit/color RGBA, non-interlaced\012- data
Size
6.0 kB (6012 bytes)
Hash
e67b73d0b389134b3f6add1eaa9da099
9050c956cdd4ecef871f233f0062c3fb24a87c64
24b07fa8c00531153979a92e1b51f2b94fefcc3cb3d3b74a70e26060a6b10982

HTTP Headers

GET /eml/PL-Norton-JAN22-eml-avi/img/nrt_logo.png HTTP/1.1
Host: roadssign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Date: Sat, 14 Jan 2023 11:16:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33
Last-Modified: Thu, 07 Oct 2021 12:48:01 GMT
ETag: "177c-5cdc2ac436240"
Accept-Ranges: bytes
Content-Length: 6012
Content-Type: image/png
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
df489559868985b8815baa1cfaaff191
cb804ae84a7d8c2b6580c97caa484cfb515c1435
ecfca9383aa4ff0bc88dc975918610d1406ac9198e68d26a731a589b073b3ead

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 11:16:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.gstatic.com/images/branding/product/2x/translate_24dp.png

142.250.74.3

200 OK

1.8 kB

URL HTTP/2
www.gstatic.com/images/branding/product/2x/translate_24dp.png
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
1.8 kB (1843 bytes)
Hash
e2fc42c5c299d85350b5610ceed59336
aaf7375297a530d6fb9050a3720d8dfd2081291d
ea97ce3744b79448c902473c6eeaa825e477dfbb6ac488a1d1a376e3b8b17e71

HTTP Headers

GET /images/branding/product/2x/translate_24dp.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://roadssign.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1842
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 14 Jan 2023 02:35:39 GMT
expires: Sun, 14 Jan 2024 02:35:39 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
content-type: image/png
age: 31228
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
df489559868985b8815baa1cfaaff191
cb804ae84a7d8c2b6580c97caa484cfb515c1435
ecfca9383aa4ff0bc88dc975918610d1406ac9198e68d26a731a589b073b3ead

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 11:16:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/s/gts1d4/8WZnix3DdCc

142.250.74.131

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1d4/8WZnix3DdCc
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
b319ba044bd1fc043043e26f09feb949
52cba4f69abc8db2bbc691cf7984e5cd265922e6
ad9981d52f435972c6eb4fbda8887e00968c77046374d4d40ed3c68b561068bd

HTTP Headers

POST /s/gts1d4/8WZnix3DdCc HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 11:16:10 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

measurements-api.wonderpush.com/v1/events

216.239.36.21

202 Accepted

94 B

URL HTTP/2
measurements-api.wonderpush.com/v1/events
IP
216.239.36.21:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
94 B (94 bytes)
Hash
ddb947c9a1ea18e8eb17e4519efac0ab
082bebae4db9ca85d3cf0550bb1c417f36696305
89ffd462079a8c3a6d3ebbfa85f6c9f9404cccc832503d9e1b9f0223d5755e5c

HTTP Headers

POST /v1/events HTTP/1.1
Host: measurements-api.wonderpush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 663
Origin: https://bik.o7tt.in
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 202 Accepted
content-type: application/json
access-control-allow-credentials: true
access-control-allow-origin: https://bik.o7tt.in
x-cloud-trace-context: 45859cd3d25de7deb90c9c04da73db24
date: Sat, 14 Jan 2023 11:16:10 GMT
server: Google Frontend
content-length: 94
X-Firefox-Spdy: h2

truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86

188.114.97.1

302 Found

0 B

URL HTTP/2
truck-vim.rd8p.in/ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86
IP
188.114.97.1:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ga/click/2-84614013-6998-16210-31693-31178-8e8f2b281e-0e185f5e86 HTTP/1.1
Host: truck-vim.rd8p.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 302 Found
date: Sat, 14 Jan 2023 11:16:05 GMT
content-type: text/html; charset=utf-8
location: https://bik.o7tt.in/gnpz_WJ?7SM_HY=bHx0j21hpZVhY7F6k2iChWBxqMGwjGtrfZiTZX1zkWZkaKZgY35wkWthh4Y/gach%40poczta.onet.pl&s3=Piotr&s4=Maliszewski]
status: 302 Found
x-rack-cache: miss
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
x-request-id: 253418d6629a6b629b41e0284653e5b8
x-ua-compatible: IE=Edge,chrome=1
x-runtime: 0.034795
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-powered-by: Phusion Passenger 6.0.4
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5SZlpLdTvMqYrVp3x5eZDtd0tCx9vwfJmb4E5GpUI5TmsbIteyYD%2FUwQ07Z%2FHT6HbDVacMQEL25o49fEh3W6YTsw5Qp0ZB8krESokdbfxfIIREViQqQ%2F%2FHBqlvor%2BWKHZRtixg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7895f519bc8f0afe-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

get.geojs.io/v1/ip/geo.json

104.26.0.100

200 OK

0 B

URL HTTP/2
get.geojs.io/v1/ip/geo.json
IP
104.26.0.100:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://bik.o7tt.in
Connection: keep-alive
Referer: https://bik.o7tt.in/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 14 Jan 2023 11:16:10 GMT
content-type: application/json
x-request-id: adf665bdcfab5b7c26b5761469732090-AMS
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
x-geojs-location: AMS
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PlEq%2B65NURnLucs3H9aGLIEtfeWOJAle%2FECl165A2U908TOUz5IEgho7QY54ua9f0CpORJL%2BDVJenmdyJKJFqx6ve3tHLFbExyCvJIdflyXQuriw3zMZH3h8xa0T0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server: cloudflare
cf-ray: 7895f53bde791c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (59)

URL HTTP/1.1

IP

ASN

File type