Overview

URLsunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php
IP 107.172.154.9 (United States)
ASN#36352 AS-COLOCROSSING
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-11-24 14:05:27 UTC
StatusLoading report..
IDS alerts0
Blocklist alert19
urlquery alerts
16
Phishing - UPS
Phishing - UPS
Tags None

Domain Summary (11)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
sunbeamfarms.com (13) 0 2017-01-20 09:37:41 UTC 2022-11-24 05:33:32 UTC 107.172.154.9 Unknown ranking
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-11-24 05:30:55 UTC 34.117.237.239
ocsp.pki.goog (5) 175 2018-07-01 06:43:07 UTC 2020-05-02 20:58:16 UTC 142.250.74.3
www.gstatic.com (2) 0 2016-07-26 09:37:06 UTC 2022-11-24 11:10:32 UTC 142.250.74.163 Domain (gstatic.com) ranked at: 540
r3.o.lencr.org (5) 344 No data No data 23.36.77.32
ocsp.digicert.com (2) 86 2012-05-21 07:02:23 UTC 2020-05-02 20:58:10 UTC 93.184.220.29
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-11-24 05:36:55 UTC 34.102.187.140
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
translate.googleapis.com (1) 1005 2014-07-21 13:19:59 UTC 2022-11-24 10:42:00 UTC 142.250.74.10
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2020-05-03 10:09:39 UTC 35.161.136.21
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-21 23:36:00 UTC 2020-02-19 04:43:25 UTC 34.120.237.76

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-11-24 2 sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requeste (...) Phishing
2022-11-24 2 sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requeste (...) Phishing
2022-11-24 2 sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requeste (...) Phishing
2022-11-24 2 sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requeste (...) Phishing
2022-11-24 2 sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requeste (...) Phishing
2022-11-24 2 sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requeste (...) Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed
2022-11-24 2 sunbeamfarms.com Sinkholed


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 107.172.154.9
Date UQ / IDS / BL URL IP
2023-01-06 08:20:34 +0000 10 - 0 - 17 sunbeamfarms.com/.private/.www.canadapost-pos (...) 107.172.154.9
2023-01-06 08:17:11 +0000 10 - 0 - 19 sunbeamfarms.com/.private/.www.canadapost-pos (...) 107.172.154.9
2023-01-03 23:31:12 +0000 25 - 0 - 7 sunbeamfarms.com/.ups.canada/.www.ups.com-tra (...) 107.172.154.9
2023-01-03 21:51:58 +0000 25 - 0 - 7 sunbeamfarms.com/.ups.canada/.www.ups.com-tra (...) 107.172.154.9
2022-12-21 19:54:24 +0000 13 - 0 - 0 sunbeamfarms.com/.private.shipments/.www.ups. (...) 107.172.154.9


Last 5 reports on ASN: AS-COLOCROSSING
Date UQ / IDS / BL URL IP
2023-02-04 01:17:40 +0000 0 - 0 - 2 192.210.194.209/ 192.210.194.209
2023-02-04 00:01:37 +0000 0 - 1 - 0 zhoumoo.top/ 172.245.139.201
2023-02-03 20:53:30 +0000 0 - 3 - 1 198.46.174.165/88/VBC.EXE 198.46.174.165
2023-02-03 20:02:54 +0000 0 - 3 - 2 23.94.99.119/discord.exe 23.94.99.119
2023-02-03 19:33:40 +0000 0 - 3 - 2 23.94.99.119/discord.exe 23.94.99.119


Last 5 reports on domain: sunbeamfarms.com
Date UQ / IDS / BL URL IP
2023-01-06 08:20:34 +0000 10 - 0 - 17 sunbeamfarms.com/.private/.www.canadapost-pos (...) 107.172.154.9
2023-01-06 08:17:11 +0000 10 - 0 - 19 sunbeamfarms.com/.private/.www.canadapost-pos (...) 107.172.154.9
2023-01-03 23:31:12 +0000 25 - 0 - 7 sunbeamfarms.com/.ups.canada/.www.ups.com-tra (...) 107.172.154.9
2023-01-03 21:51:58 +0000 25 - 0 - 7 sunbeamfarms.com/.ups.canada/.www.ups.com-tra (...) 107.172.154.9
2022-12-21 19:54:24 +0000 13 - 0 - 0 sunbeamfarms.com/.private.shipments/.www.ups. (...) 107.172.154.9


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-01-23 18:02:32 +0000 8 - 0 - 5 www.mysmiledentistry.ca/.www.ups.com-track-lo (...) 151.106.40.20
2023-01-23 14:11:45 +0000 8 - 0 - 5 www.mysmiledentistry.ca/.www.ups.com-track-lo (...) 151.106.40.20
2023-01-23 08:45:30 +0000 19 - 0 - 7 application.kurskmed.com/server/status-site-t (...) 77.241.23.26
2023-01-20 22:06:59 +0000 19 - 0 - 6 application.kurskmed.com/server/status-site-t (...) 77.241.23.26
2023-01-20 09:19:10 +0000 23 - 0 - 6 s3.amazonaws.com/globlashippandlogi-3cbd62f9/ (...) 52.216.250.206

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (39)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F3EBA265EE64870B2F822F1511B36C747D763C382557789CDAD8BE1D3B52D1F5"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2574
Expires: Thu, 24 Nov 2022 14:48:10 GMT
Date: Thu, 24 Nov 2022 14:05:16 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6209
Cache-Control: 'max-age=158059'
Date: Thu, 24 Nov 2022 14:05:16 GMT
Last-Modified: Thu, 24 Nov 2022 12:21:47 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C9951A909F354174F0075A01C01C3C3AA6960983040E328BFBBBEA81AEB405C2"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13994
Expires: Thu, 24 Nov 2022 17:58:30 GMT
Date: Thu, 24 Nov 2022 14:05:16 GMT
Connection: keep-alive

                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:16 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Cache-Status: MISS
X-Server-Powered-By: Engintron
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2042), with CRLF line terminators
Size:   4063
Md5:    6ae14d198674267527dc7a73032f0fa4
Sha1:   942a895c741b91b1cb29e53f783f9d0333522193
Sha256: 125beffe46e0f40058481e6080eb99aaa28823f78d9e4a92ad656d1aa2daa61f

Alerts:
  Blocklists:
    - fortinet: Phishing
    - quad9: Sinkholed
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 24 Nov 2022 13:18:58 GMT
cache-control: public,max-age=3600
age: 2778
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    d130218d0e2841f39c99610fe1a2ab90
Sha1:   29fbe1e177ee55c7a61ae0a206afff271cf5f945
Sha256: 6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: gf91++sfGqZgd92JaRraFdcgRkh4G8WQWQcGGQ2bOOHDV960DxSRq9YPa/F4+Jp5LfrOf4OiDwM=
x-amz-request-id: F0F7GM8MV8GH0XPE
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 24 Nov 2022 13:40:25 GMT
age: 1491
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Thu, 24 Nov 2022 14:05:16 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 24 Nov 2022 14:05:16 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /translate_static/css/translateelement.css HTTP/1.1 
Host: translate.googleapis.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://sunbeamfarms.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.10
HTTP/2 200 OK
content-type: text/css
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="rosetta"
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-length: 3619
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 13:52:35 GMT
expires: Thu, 24 Nov 2022 14:52:35 GMT
cache-control: public, max-age=3600
age: 761
last-modified: Wed, 17 Aug 2022 23:38:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (18670)
Size:   3619
Md5:    897ba9a21d9625286674da769dacc2e2
Sha1:   84b4923ab7dee562395160824d53496314499b77
Sha256: 696cbf5c2f3f1efae555562b72abbbb22bed02eff03d62074555cab241190ae0
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 24 Nov 2022 14:05:16 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/styles.d030702f49bd6d6a9088.css HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:16 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Fri, 24 Jun 2022 19:12:40 GMT
Expires: Sat, 24 Dec 2022 14:05:16 GMT
Cache-Control: max-age=2592000
Pragma: public
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (409), with CRLF line terminators
Size:   38595
Md5:    8f48a74f5de7446701943031d7f68260
Sha1:   a13a27ad2f590b7303a3428f89449b54d5bae3c0
Sha256: dc34396beff4b261972fd8aa97d8d53ee92c68601c4e400f9a961acd581c6de2

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/logo2.png HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 1889
Connection: keep-alive
Last-Modified: Sun, 03 Jul 2022 13:38:14 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 99 x 100, 8-bit/color RGB, non-interlaced\012- data
Size:   1889
Md5:    1355e697b24cfd3acc218be8b00b4249
Sha1:   e9727504850157142558d84ccd22ec85fc1257fb
Sha256: b7c96038597070153231b0f4f19198cd96fefc22b936bdb3002dc3cd3aa1b545

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/jos.png HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 1570
Connection: keep-alive
Last-Modified: Sun, 03 Jul 2022 13:44:02 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 211 x 17, 8-bit/color RGBA, non-interlaced\012- data
Size:   1570
Md5:    716dc947d4012a4d9517501ec94d3075
Sha1:   6835cd13cce862b265db681650a399b421fe6675
Sha256: 3b09c51249fdccb97a8b498bf7bbfcceb024430cc8eaeaec8400470bf5418632

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 24 Nov 2022 13:11:11 GMT
cache-control: public,max-age=3600
age: 3246
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/s01.png HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 1912
Connection: keep-alive
Last-Modified: Sun, 03 Jul 2022 13:40:26 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 292 x 26, 8-bit/color RGBA, non-interlaced\012- data
Size:   1912
Md5:    bd4b7f8cbde070894ec895cdf6be2d21
Sha1:   4c5b3086dd50ebb435767659f8eb40aec82873e5
Sha256: 651409d16d0ea9a9a632050efd871444bd0778a86303c2f96abc849781ac299c

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/prepare_active.svg HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 09 Jun 2022 05:00:26 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Content-Encoding: gzip


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size:   773
Md5:    927b150d3150eddb27362a450614c60d
Sha1:   d13dcf94713bc3f43c48033d46d7f4db3fd1b841
Sha256: ad432e19f78316b2e762b509f008f276d9aaa294ea52c09c864d51c15d699005

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - fortinet: Phishing
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/s02.png HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 1583
Connection: keep-alive
Last-Modified: Sun, 03 Jul 2022 13:41:50 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 283 x 26, 8-bit/color RGBA, non-interlaced\012- data
Size:   1583
Md5:    b6059bb2b4f34563aff04d7b191af7a3
Sha1:   a6b3ba6430a4a30a12c273153323d17108632fb2
Sha256: aeceeb3c033be1093daf0eeacfd1d7adb42f99f5d1ed27e199b8ab26f184318f

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/chevron-right.df09c3e8cf1fd04c4a2f.png HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/styles.d030702f49bd6d6a9088.css

search
                                         107.172.154.9
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   238
Md5:    520f4af4fa2a221f0fcaf2bd8dd91190
Sha1:   ff7f6ecdcec4d56428d84c9380c81ede0f33fa4c
Sha256: e4af90c52865b7203efde020d8d7ca02b5b99f50b435770b37a34766772744a7

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5723
Cache-Control: 'max-age=158059'
Date: Thu, 24 Nov 2022 14:05:17 GMT
Last-Modified: Thu, 24 Nov 2022 12:29:54 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/Ubuntu-Medium.6f623532e9e45ad985fd.woff HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/styles.d030702f49bd6d6a9088.css

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: font/woff
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 120252
Connection: keep-alive
Last-Modified: Thu, 09 Jun 2022 05:17:32 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 120252, version 0.83\012- data
Size:   120252
Md5:    49472412d613efd7ded4657791e9b7b6
Sha1:   4f8da6b194df54b60a47919ebcf4bdfbe49276ae
Sha256: ba314ddb395f0f0b7d568163ee636ef4312dcaa4a1ace2163c9839189491ffe5

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - fortinet: Phishing
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/glyphicons-halflings-regular.448c34a56d699c29117a.woff2 HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/styles.d030702f49bd6d6a9088.css

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: font/woff2
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 18028
Connection: keep-alive
Last-Modified: Thu, 09 Jun 2022 05:36:12 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 18028, version 1.589\012- data
Size:   18028
Md5:    448c34a56d699c29117adc64c43affeb
Sha1:   ca35b697d99cae4d1b60f2d60fcd37771987eb07
Sha256: fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - fortinet: Phishing
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/Ubuntu.3f5f30c75db82d447a41.woff HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/styles.d030702f49bd6d6a9088.css

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: font/woff
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 130652
Connection: keep-alive
Last-Modified: Thu, 09 Jun 2022 05:33:12 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 130652, version 0.83\012- data
Size:   130652
Md5:    3f5f30c75db82d447a4128e420cc4409
Sha1:   e55775ec5d394cd8e0ee6a1fdf4de967ccb9aad4
Sha256: 86b4ddf74e754d1049a67e0891f5b91b8c73f9e0e43386f6fe9ff379c882c367

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - fortinet: Phishing
    - quad9: Sinkholed
                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/Ubuntu-Regular.c1d4d43f824ea31feaba.woff HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/styles.d030702f49bd6d6a9088.css

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: font/woff
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Content-Length: 160460
Connection: keep-alive
Last-Modified: Thu, 09 Jun 2022 05:15:24 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format, CFF, length 160460, version 0.0\012- data
Size:   160460
Md5:    031d476d2a233bfc7a108a027f6fb614
Sha1:   cb110a4bc539a117120cf794a3a82c8b29c54887
Sha256: 77866a2a2e2fd457f07074daf2a33fe25ca645b80416b4f0ad5a82776f19db1c

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - fortinet: Phishing
    - quad9: Sinkholed
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 24 Nov 2022 14:05:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /images/branding/product/1x/translate_24dp.png HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://sunbeamfarms.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.163
HTTP/2 200 OK
content-type: image/png
                                        
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 846
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 13:47:22 GMT
expires: Fri, 24 Nov 2023 13:47:22 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
age: 1075
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size:   846
Md5:    e9cd262114358f26b7608b56905185dc
Sha1:   6dbde0a96deaab2b529723ce26c62043cf9180ab
Sha256: 5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

Alerts:
  urlquery:
    - Phishing - UPS
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 24 Nov 2022 14:05:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /images/branding/product/2x/translate_24dp.png HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://translate.googleapis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         142.250.74.163
HTTP/2 200 OK
content-type: image/png
                                        
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1842
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 24 Nov 2022 13:05:53 GMT
expires: Fri, 24 Nov 2023 13:05:53 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
age: 3564
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Size:   1842
Md5:    c69c796362406f9e11c7f4bf5bb628da
Sha1:   e489ce95ab56208090868882113d7416abf46775
Sha256: 4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Alerts:
  urlquery:
    - Phishing - UPS
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Yw2eTxC1ReBKEhauVbt4jQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         35.161.136.21
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: o90ParcYgN3xMa6Hk+fr8+YaE1Y=

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Thu, 24 Nov 2022 14:05:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking/favicon.ico HTTP/1.1 
Host: sunbeamfarms.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://sunbeamfarms.com/js/.www.ups.com-tracking.private-parcel-loc-en_CA-requester/tracking.php

search
                                         107.172.154.9
HTTP/1.1 200 OK
Content-Type: image/x-icon
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:05:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Tue, 12 Jul 2022 13:44:22 GMT
Expires: Mon, 23 Jan 2023 14:05:17 GMT
Cache-Control: max-age=5184000
Pragma: public
Content-Encoding: gzip


--- Additional Info ---
Magic:  PNG image data, 99 x 100, 8-bit/color RGB, non-interlaced\012- data
Size:   1912
Md5:    319ef9a184352dff645777e31b10fa27
Sha1:   403a1197c0450d4b96cf32a10fe05e8181d8e2c5
Sha256: 4992b644a99871bbeab3993db45ae7f2dffd29d219a2df5142dc3c5ff70a948f

Alerts:
  urlquery:
    - Phishing - UPS
  Blocklists:
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17295
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:05:18 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17295
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:05:18 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17295
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:05:18 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F433fbaf5-7c54-485b-af70-542e1e788832.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5070
x-amzn-requestid: d86d95ad-9b78-4047-82e7-04e83a97e330
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEwViF1GIAMF_PQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9423-10809ba1634776171cf79cb8;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:44:03 GMT
x-amz-cf-pop: SFO5-P2, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: rrs7G6Wto6iY0rT6KsKwKAOPJjehXqD0jHZrR_eaiqpepQILFr7Dtw==
via: 1.1 0dc4feb22bb4657ce2bb95fd05ec7122.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:49:07 GMT
age: 58571
etag: "89accd230fba95fe0049678070817b36ead015fa"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5070
Md5:    0856fdb55f19f03a1bec38b3d6e0ac77
Sha1:   89accd230fba95fe0049678070817b36ead015fa
Sha256: 17c6e6f9bb8f4261fff2dc2a43ed994986418761624b8afead768e89927594f2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3d85d03d-8fcf-42f4-bada-e7f488f04307.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7462
x-amzn-requestid: 1f6fb14d-83e0-43d3-9dab-5bc83af1a7c4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEwV3HV9oAMFs9w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9425-634d43db6308e0be596aa5a0;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:44:05 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GW5UTfY7-TwPWTno9z1e21a2cA9fmU7GfHFYWdL-zQvMLxeq-S9Trg==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 22:08:16 GMT
age: 57422
etag: "a7d9135f9d01ba13c3cdaf8b038c70212f159297"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7462
Md5:    b4157f2c5c3c77ce699324ecb08f47c7
Sha1:   a7d9135f9d01ba13c3cdaf8b038c70212f159297
Sha256: 2305f7afee95bb34d9e8dbff571c6b146ba7b694be96e9e925c32d1f41785916
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81517ad5-7c1b-49aa-9ba9-dbfa36fbb071.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13882
x-amzn-requestid: 9022b0b3-31d5-4149-a969-02514f11b95a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvzNHjMoAMFWMg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9347-0e8354a02bef623644714e31;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: DYBcunpyI0FBJsJGh1kKpFI3X8kzCkO3mCxzUtWnaMKBT-Bv-zkq3Q==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:59:18 GMT
age: 57960
etag: "1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13882
Md5:    64d79191f005c9876b952c5f948aa0f7
Sha1:   1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a
Sha256: 00fb36c3d322e8302c5ce202d6d4119d637510cd6f3b63e1347781ec3bb9d7fc
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F50d7d834-f80d-4fd9-a728-24643ed00c45.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6789
x-amzn-requestid: 4d94ce1b-d18f-43b8-bb4d-e7093f9bea42
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cCvd2G9UIAMFrEg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637dc5f2-64a570135be59b83031811da;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 07:04:18 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: JygkDI7XSvlgurUTot874ZAXlOIqnv4cntMQ55IvHVqw93JBcksZjQ==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 07:10:24 GMT
age: 24894
etag: "303c571b13b05fcf27ee1159d8fdf6369aaef0a2"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6789
Md5:    d9d93b2a6875d446c3467eb49767eef5
Sha1:   303c571b13b05fcf27ee1159d8fdf6369aaef0a2
Sha256: 2a2345a925e0187979930a7f2de8548957ad9f2baae77364dcb157286e2b3fcf
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca5cb469-21a0-420a-875c-a81635b33f53.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7993
x-amzn-requestid: 9f0ff853-4819-47cd-959d-658401ea5748
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvCsG5mIAMFqAQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9211-1c48b9223684f2942f8dd42d;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:35:13 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YJuHCuUgkLuFFiQUlrPWgv9grHznufMTU08hi4ZMpQTBmou6BGWrhQ==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:47:52 GMT
age: 58646
etag: "43d1dec7fc06879988c9c3cadd800cc8145df988"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7993
Md5:    92c78302bcce1568eb6a5563100b932c
Sha1:   43d1dec7fc06879988c9c3cadd800cc8145df988
Sha256: 0dda9914306c8e3a7ea75eade8e762652d93907dd6c5a8cc81707d6d8098b60a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4309
x-amzn-requestid: 47c2739d-73c5-4d91-914c-fe635cb09772
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b1U8xGxgIAMF-qQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63786851-6fbe19dc5c4c20dd657604e3;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 05:23:29 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: j_8oVo464QMWMnmkxQJIDRhaIVmwhzCTHe4A57OdmaUr9HcyTtBUjg==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 2750b94b402c92287d764b5fa115a042.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 05:04:28 GMT
age: 32450
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    841a4b110022a99ddea6f7bf66df0fa1
Sha1:   126771b86638108050cf57c0d12faa27f80f0edb
Sha256: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db