Overview

URLnyt-ep.com/dfcu/pages/card.php
IP 103.120.66.134 (Indonesia)
ASN#137373 PT. SUITEN INOVASI SUKSES
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2023-01-23 19:32:47 UTC
StatusLoading report..
IDS alerts0
Blocklist alert19
urlquery alerts No alerts detected
Tags None

Domain Summary (22)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
r3.o.lencr.org (6) 344 2020-12-02 08:52:13 UTC 2023-01-22 17:12:27 UTC 23.36.76.226
firefox.settings.services.mozilla.com (2) 867 2020-05-25 20:06:39 UTC 2023-01-22 17:13:48 UTC 35.241.9.150
dpm.demdex.net (3) 204 2012-05-22 05:45:05 UTC 2023-01-22 17:18:46 UTC 52.31.36.191
s3.amazonaws.com (1) 0 2020-05-13 20:55:37 UTC 2023-01-22 23:39:59 UTC 52.217.136.120 Unknown ranking
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2023-01-22 17:21:06 UTC 34.160.144.191
mpsnare.iesnare.com (6) 5723 2016-04-10 11:13:26 UTC 2023-01-23 16:21:24 UTC 54.228.71.178
cdn.plaid.com (1) 17458 2017-02-17 03:25:54 UTC 2023-01-23 14:14:16 UTC 54.230.111.120
ocsp.r2m01.amazontrust.com (1) 0 2022-10-12 20:43:53 UTC 2023-01-23 04:10:43 UTC 54.230.80.227 Domain (amazontrust.com) ranked at: 581
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2023-01-22 04:09:39 UTC 34.120.237.76
nyt-ep.com (32) 0 2019-07-29 18:55:38 UTC 2023-01-23 14:00:04 UTC 103.120.66.134 Unknown ranking
ocsp.digicert.com (6) 86 2012-05-21 07:02:23 UTC 2023-01-23 03:08:17 UTC 93.184.220.29
mpsnare.iesnare.com (6) 5723 2016-04-10 11:13:26 UTC 2023-01-23 16:21:24 UTC 54.195.39.4
us.cobrowse.pega.com (1) 49768 2018-09-27 11:25:31 UTC 2023-01-19 12:34:00 UTC 52.54.239.164
usassets.cobrowse.pega.com (2) 93477 2019-04-29 14:22:06 UTC 2023-01-18 19:42:44 UTC 52.54.239.164
digitalfederalcreditunion.sc.omtrdc.net (2) 158858 2020-04-10 15:09:38 UTC 2023-01-08 15:24:17 UTC 15.236.117.205
ocsp.sca1b.amazontrust.com (1) 1015 2016-02-14 02:37:56 UTC 2019-03-27 04:05:54 UTC 54.230.245.100
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2023-01-22 17:12:51 UTC 34.117.237.239
assets.adobedtm.com (5) 512 2014-01-28 04:51:35 UTC 2023-01-23 04:34:32 UTC 23.38.200.237
ocsp.godaddy.com (3) 698 2012-05-20 19:28:57 UTC 2023-01-22 17:12:44 UTC 192.124.249.22
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2023-01-22 17:22:03 UTC 35.83.201.49
dcu.demdex.net (1) 167443 2019-09-26 13:40:13 UTC 2023-01-08 15:24:17 UTC 52.50.220.58
cm.everesttech.net (1) 996 2017-01-30 04:59:57 UTC 2023-01-23 04:37:07 UTC 54.229.62.148

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2023-01-23 2 nyt-ep.com/dfcu/pages/card.php Generic/Spear Phishing

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-01-23 2 nyt-ep.com/dfcu/pages/sty Phishing
2023-01-23 2 nyt-ep.com/dfcu/pages/iovation/config.js Phishing
2023-01-23 2 nyt-ep.com/dfcu/pages/iovation/loader_only.js Phishing
2023-01-23 2 nyt-ep.com/js/67.08d37c06.js Phishing
2023-01-23 2 nyt-ep.com/js/chunk-common.ee86c272.js Phishing
2023-01-23 2 nyt-ep.com/js/2.eae3d549.js Phishing
2023-01-23 2 nyt-ep.com/iojs/5.5.0/logo.js Phishing
2023-01-23 2 nyt-ep.com/js/vendor.4cab2b63.js Phishing
2023-01-23 2 nyt-ep.com/js/app.2123d633.js Phishing
2023-01-23 2 nyt-ep.com/js/vendor.4cab2b63.js Phishing
2023-01-23 2 nyt-ep.com/dfcu/pages/card.php Phishing
2023-01-23 2 nyt-ep.com/js/app.2123d633.js Phishing
2023-01-23 2 nyt-ep.com/dfcu/pages/style/js/jquery.mask.js Phishing
2023-01-23 2 nyt-ep.com/dfcu/pages/style/js/jquery.validate.min.js Phishing
2023-01-23 2 nyt-ep.com/dfcu/fonts/fa-solid-900.0a037305.woff2 Phishing
2023-01-23 2 nyt-ep.com/dfcu/fonts/fa-solid-900.46457309.ttf Phishing
2023-01-23 2 nyt-ep.com/dfcu/pages/style/js/angular.min.js Phishing
2023-01-23 2 nyt-ep.com/dfcu/pages/style/js/jquery.min.js Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 103.120.66.134
Date UQ / IDS / BL URL IP
2023-03-07 02:21:11 +0000 0 - 0 - 1 nyt-ep.com/dfcu/auth.php?oauth&online_id=5da0 (...) 103.120.66.134
2023-01-24 03:37:50 +0000 0 - 0 - 1 nyt-ep.com/trustmar01.zip 103.120.66.134
2023-01-24 03:37:43 +0000 0 - 0 - 1 nyt-ep.com/dfcu01.zip 103.120.66.134
2023-01-24 02:41:36 +0000 0 - 0 - 19 nyt-ep.com/dfcu/pages/login.php 103.120.66.134
2023-01-23 23:09:41 +0000 0 - 0 - 36 nyt-ep.com/dfcu/auth.php?oauth=&online_id=ac4 (...) 103.120.66.134


Last 5 reports on ASN: PT. SUITEN INOVASI SUKSES
Date UQ / IDS / BL URL IP
2023-03-07 02:21:11 +0000 0 - 0 - 1 nyt-ep.com/dfcu/auth.php?oauth&online_id=5da0 (...) 103.120.66.134
2023-01-24 03:37:50 +0000 0 - 0 - 1 nyt-ep.com/trustmar01.zip 103.120.66.134
2023-01-24 03:37:43 +0000 0 - 0 - 1 nyt-ep.com/dfcu01.zip 103.120.66.134
2023-01-24 02:41:36 +0000 0 - 0 - 19 nyt-ep.com/dfcu/pages/login.php 103.120.66.134
2023-01-23 23:09:41 +0000 0 - 0 - 36 nyt-ep.com/dfcu/auth.php?oauth=&online_id=ac4 (...) 103.120.66.134


Last 5 reports on domain: nyt-ep.com
Date UQ / IDS / BL URL IP
2023-03-07 02:21:11 +0000 0 - 0 - 1 nyt-ep.com/dfcu/auth.php?oauth&online_id=5da0 (...) 103.120.66.134
2023-01-24 03:37:50 +0000 0 - 0 - 1 nyt-ep.com/trustmar01.zip 103.120.66.134
2023-01-24 03:37:43 +0000 0 - 0 - 1 nyt-ep.com/dfcu01.zip 103.120.66.134
2023-01-24 02:41:36 +0000 0 - 0 - 19 nyt-ep.com/dfcu/pages/login.php 103.120.66.134
2023-01-23 23:09:41 +0000 0 - 0 - 36 nyt-ep.com/dfcu/auth.php?oauth=&online_id=ac4 (...) 103.120.66.134


No other reports with similar screenshot

JavaScript

Executed Scripts (15)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (83)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F4BADD1EAE1A255D98877FC4C64053BC84817E21DACBD6E1FB5CD5A838850AC0"
Last-Modified: Mon, 23 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16613
Expires: Tue, 24 Jan 2023 00:09:29 GMT
Date: Mon, 23 Jan 2023 19:32:36 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CB028034340B709ECE65E45E8FC1A26A64DD85926BEAA542F308D3F1D5EE2C84"
Last-Modified: Sun, 22 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15377
Expires: Mon, 23 Jan 2023 23:48:53 GMT
Date: Mon, 23 Jan 2023 19:32:36 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "6547376C41DCAA352CC4E747291916902BCDDC0032B750BD84C5E3B2FE6F7D16"
Last-Modified: Sat, 21 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2530
Expires: Mon, 23 Jan 2023 20:14:46 GMT
Date: Mon, 23 Jan 2023 19:32:36 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 23 Jan 2023 18:35:03 GMT
age: 3453
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    dcd75ca6daca51c5e39d431468511793
Sha1:   07f76d3bf23d65c9110d810fa71a994e39e085d3
Sha256: 73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: 1kokYJ3ym0tRdM0NH9cJrSoKpFtf11uI/Q21GKcoiGzWRYqsAiTYWNiTmSGBWqNoD67b8XfmGx0=
x-amz-request-id: Q04PC4RE640W22E4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 23 Jan 2023 18:47:50 GMT
age: 2686
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    7b922915ebf1fa3639b333f994c74f24
Sha1:   144a3f80b98fd0652d4614f24cf6cbbee40f8938
Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Mon, 23 Jan 2023 19:32:36 GMT
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 23 Jan 2023 19:17:30 GMT
age: 906
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js HTTP/1.1 
Host: assets.adobedtm.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.38.200.237
HTTP/2 200 OK
content-type: application/x-javascript
                                        
accept-ranges: bytes
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 1597
expires: Mon, 23 Jan 2023 20:32:36 GMT
date: Mon, 23 Jan 2023 19:32:36 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (3155)
Size:   1597
Md5:    e672de61b277fc72de4299829bfbb31c
Sha1:   157a7409922d58a02dad3ba879d04eb2a3ef8f3d
Sha256: e1a1c2a6f2ed4ffb63ebfda157eaf12c6ee3973be4da649eb63e0402c0d29215
                                        
                                            GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js HTTP/1.1 
Host: assets.adobedtm.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.38.200.237
HTTP/2 200 OK
content-type: application/x-javascript
                                        
accept-ranges: bytes
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 12163
expires: Mon, 23 Jan 2023 20:32:36 GMT
date: Mon, 23 Jan 2023 19:32:36 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (32768)
Size:   12163
Md5:    e616df092766c7ab7904619f971a35cc
Sha1:   a960429c42802a43e3ce728fc4d1e8bdab10e606
Sha256: 082ae7647bfdb639846791e5c0ca39b96544dff3aed0c365973c9589cd5b091e
                                        
                                            GET /c710ed4af822/4edff89d26dd/launch-1574d0b03693.min.js HTTP/1.1 
Host: assets.adobedtm.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         23.38.200.237
HTTP/2 200 OK
content-type: application/x-javascript
                                        
accept-ranges: bytes
etag: "00714a64b1758bd55efffc4ba4749518:1671553608.984329"
last-modified: Tue, 20 Dec 2022 16:26:48 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Mon, 23 Jan 2023 20:32:36 GMT
date: Mon, 23 Jan 2023 19:32:36 GMT
content-length: 46433
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (32722)
Size:   46433
Md5:    c0adfbdf586b65b00148dfbd8d520f6e
Sha1:   03d388b00456dcae77478055c1af1b6a4eddc4bc
Sha256: feb8784918a56df368f456affca929ec1d9f8d390638aeab855c30ebcd47c382
                                        
                                            GET /dfcu/pages/sty HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5879
Cache-Control: max-age=113088
Date: Mon, 23 Jan 2023 19:32:36 GMT
Etag: "63cde09d-1d7"
Expires: Wed, 25 Jan 2023 02:57:24 GMT
Last-Modified: Mon, 23 Jan 2023 01:19:25 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4697
Cache-Control: 'max-age=158059'
Date: Mon, 23 Jan 2023 19:32:36 GMT
Last-Modified: Mon, 23 Jan 2023 18:14:19 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4697
Cache-Control: 'max-age=158059'
Date: Mon, 23 Jan 2023 19:32:36 GMT
Last-Modified: Mon, 23 Jan 2023 18:14:19 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1058
Cache-Control: 'max-age=158059'
Date: Mon, 23 Jan 2023 19:32:36 GMT
Last-Modified: Mon, 23 Jan 2023 19:14:58 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /5.5.0/logo.js HTTP/1.1 
Host: mpsnare.iesnare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.195.39.4
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
                                        
Server: nginx
Date: Mon, 23 Jan 2023 19:32:36 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Expires: Tue, 23 Jan 2024 19:32:36 GMT
Cache-Control: private
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (377)
Size:   420
Md5:    6c896ac137fae591d4ce611a1ebbfd06
Sha1:   9014e19bd176cffdd371b77b8afe7d538ecd6c86
Sha256: f4e82a7774798eaee08c4ca88d6ce33c41447f0fcbc3e50453f9f28c7da29cce
                                        
                                            GET /general5/wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1 
Host: mpsnare.iesnare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.195.39.4
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
                                        
Server: nginx
Date: Mon, 23 Jan 2023 19:32:36 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=z1nnFNqqSwPc2Ql/2WcKsBhdfpyh5C3PJgTz6ManQjk=;Path=/;Expires=Tue, 23-Jan-2024 19:32:36 GMT;Max-Age=31536000;Secure;HttpOnly;SameSite=None
Cache-Control: no-cache, private
Pragma: no-cache
Expires: 0
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (1056)
Size:   18558
Md5:    6f5a2138dd4f02609f8e33e72738833e
Sha1:   70595a4748da7c155a70a6dc8e215b6e9f19cc37
Sha256: 7055f6396a169108f469306b1f814cb9a33d9942f9ef64fc3e8e838c62efa43e
                                        
                                            GET /dfcu/pages/iovation/config.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/pages/iovation/loader_only.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /css/vendor.18ecc1fa.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /iojs/general5/static_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /css/app.12ac5d63.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            POST / HTTP/1.1 
Host: ocsp.godaddy.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         192.124.249.22
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Sucuri/Cloudproxy
Date: Mon, 23 Jan 2023 19:32:36 GMT
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 22 Jan 2023 20:42:11 GMT
Expires: Mon, 23 Jan 2023 20:42:11 GMT
ETag: "116114452aaa2a461ae29d3ae61c32b136cb82e5"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"


--- Additional Info ---
Magic:  data
Size:   1778
Md5:    d1d257c0b3ee7518bc2ffc0cc48ba7f3
Sha1:   116114452aaa2a461ae29d3ae61c32b136cb82e5
Sha256: 40f7ca74e9272c87f7d0fd30d7c98c53989e4722eddf94ee09315d19f79fc11c
                                        
                                            POST / HTTP/1.1 
Host: ocsp.godaddy.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         192.124.249.22
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Sucuri/Cloudproxy
Date: Mon, 23 Jan 2023 19:32:36 GMT
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 22 Jan 2023 20:42:11 GMT
Expires: Mon, 23 Jan 2023 20:42:11 GMT
ETag: "116114452aaa2a461ae29d3ae61c32b136cb82e5"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"


--- Additional Info ---
Magic:  data
Size:   1778
Md5:    d1d257c0b3ee7518bc2ffc0cc48ba7f3
Sha1:   116114452aaa2a461ae29d3ae61c32b136cb82e5
Sha256: 40f7ca74e9272c87f7d0fd30d7c98c53989e4722eddf94ee09315d19f79fc11c
                                        
                                            POST / HTTP/1.1 
Host: ocsp.godaddy.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         192.124.249.22
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Sucuri/Cloudproxy
Date: Mon, 23 Jan 2023 19:32:36 GMT
Content-Length: 1778
Connection: keep-alive
X-Sucuri-ID: 19022
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 22 Jan 2023 20:42:11 GMT
Expires: Mon, 23 Jan 2023 20:42:11 GMT
ETag: "116114452aaa2a461ae29d3ae61c32b136cb82e5"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"


--- Additional Info ---
Magic:  data
Size:   1778
Md5:    d1d257c0b3ee7518bc2ffc0cc48ba7f3
Sha1:   116114452aaa2a461ae29d3ae61c32b136cb82e5
Sha256: 40f7ca74e9272c87f7d0fd30d7c98c53989e4722eddf94ee09315d19f79fc11c
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 6nmcFw5SDLNokVDsnJd1JQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         35.83.201.49
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: /BR/7RXmFkB8DAYeeu7DgsGBGHU=

                                        
                                            GET /css/67.9e8fe349.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /js/67.08d37c06.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /star HTTP/1.1 
Host: mpsnare.iesnare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: http://nyt-ep.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: u/htvefHvOOIQ8tqqGuMcw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         54.228.71.178
HTTP/1.1 101 Switching Protocols
                                        
Server: nginx
Date: Mon, 23 Jan 2023 19:32:37 GMT
Connection: upgrade
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Accept: lFbCefNcHDDiKdqXnSp0ele+4Z4=
Upgrade: WebSocket

                                        
                                            GET /css/chunk-common.b93dc9af.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /css/2.fa09428f.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /js/chunk-common.ee86c272.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1405
Cache-Control: max-age=125866
Date: Mon, 23 Jan 2023 19:32:37 GMT
Etag: "63ce2402-1d7"
Expires: Wed, 25 Jan 2023 06:30:23 GMT
Last-Modified: Mon, 23 Jan 2023 06:06:58 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=46051B125B89FACB0A495DD6%40AdobeOrg&d_nsid=0&ts=1674502355618 HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: http://nyt-ep.com
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         52.31.36.191
HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8
                                        
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://nyt-ep.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-1-v045-0e1730cee.edge-irl1.demdex.com 5 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=50183333384823962334441931855338865596; Max-Age=15552000; Expires=Sat, 22 Jul 2023 19:32:37 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin
X-TID: lUQA7I9YQ6Q=
Content-Length: 836
Connection: keep-alive


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (2304), with no line terminators
Size:   836
Md5:    460bdadac6bb275b4f76010940948033
Sha1:   6223933ffe6fa400c1d80ea3424ddcd235a39737
Sha256: 2266319d981cfa1d744b9e61b40aeb056b8ed20992f51be233a99784f9ffb38e
                                        
                                            GET /js/2.eae3d549.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /iojs/5.5.0/dyn_wdp.js?loaderVer=5.2.2&compat=false&tp=true&tp_split=false&fp_static=true&fp_dyn=true&flash=false HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js HTTP/1.1 
Host: assets.adobedtm.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
If-Modified-Since: Mon, 14 Feb 2022 16:35:31 GMT
If-None-Match: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
TE: trailers

search
                                         23.38.200.237
HTTP/2 304 Not Modified
content-type: application/x-javascript
                                        
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
expires: Mon, 23 Jan 2023 20:32:37 GMT
date: Mon, 23 Jan 2023 19:32:37 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2

                                        
                                            GET /extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js HTTP/1.1 
Host: assets.adobedtm.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
If-Modified-Since: Mon, 14 Feb 2022 16:35:31 GMT
If-None-Match: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
TE: trailers

search
                                         23.38.200.237
HTTP/2 304 Not Modified
content-type: application/x-javascript
                                        
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
expires: Mon, 23 Jan 2023 20:32:37 GMT
date: Mon, 23 Jan 2023 19:32:37 GMT
cache-control: no-cache
access-control-allow-origin: http://nyt-ep.com
timing-allow-origin: *
X-Firefox-Spdy: h2

                                        
                                            GET /iojs/5.5.0/logo.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /js/vendor.4cab2b63.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /css/vsc.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4548
Cache-Control: 'max-age=158059'
Date: Mon, 23 Jan 2023 19:32:37 GMT
Last-Modified: Mon, 23 Jan 2023 18:16:49 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 313

                                        
                                            GET /cobrowse/loadScripts HTTP/1.1 
Host: us.cobrowse.pega.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         52.54.239.164
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Mon, 23 Jan 2023 19:32:37 GMT
content-length: 508
set-cookie: AWSALB=0mlcM0SkehfZT1cGbMNpDRJZP9lTBjg/7cLmi7u+lRWjP8EBv0lByIACexCoJxuYlY02U7QYDGOLeUFg4Fo8YfRDu/NBlSb38fPDJe3u+efr/ltKbakxwQ7UdHEg; Expires=Mon, 30 Jan 2023 19:32:37 GMT; Path=/ AWSALBCORS=0mlcM0SkehfZT1cGbMNpDRJZP9lTBjg/7cLmi7u+lRWjP8EBv0lByIACexCoJxuYlY02U7QYDGOLeUFg4Fo8YfRDu/NBlSb38fPDJe3u+efr/ltKbakxwQ7UdHEg; Expires=Mon, 30 Jan 2023 19:32:37 GMT; Path=/; SameSite=None; Secure connect.sid=s%3AQ81nRjmf5yqih4qQHYEuk1Zo9JaoSsvb.FuWXHK0R7auIKqB7FW7edgFy1jjEGzEHi4%2BNKnvFzp4; Path=/; Expires=Wed, 25 Jan 2023 19:32:37 GMT; Secure; SameSite=None
server: nginx
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: X-CSRF-Token, X-Requested-With, accept, x-j-token, content-type
etag: W/"1fc-7h1D3lVTGQGfiwcTpoOkY4A6m0E"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text
Size:   508
Md5:    9cdb6851bb88c14e6033ca658ac8aa88
Sha1:   ee1d43de555319019f8b0713a683a463803a9b41
Sha256: fa05f2814bdcd558f6b652532c66d74a995b0a05f464bda6e9375fcb3c02cf82
                                        
                                            GET /assets/stylesheets/customer/final/default.css?v=8.7.1 HTTP/1.1 
Host: usassets.cobrowse.pega.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         52.54.239.164
HTTP/2 200 OK
content-type: text/css
                                        
date: Mon, 23 Jan 2023 19:32:37 GMT
content-length: 3489
set-cookie: AWSALB=8klLASZ2+gmDAp/VbKioY+BjuWnmFh2aO9Xi4v/dhJNqFRYk9exkq9crZujvAy5wIhhnXwCKWgTSiSs/kjFiyNmPsNQ3kkYXggi0n1thoqKGvd7E6//qNo8kiFhM; Expires=Mon, 30 Jan 2023 19:32:37 GMT; Path=/ AWSALBCORS=8klLASZ2+gmDAp/VbKioY+BjuWnmFh2aO9Xi4v/dhJNqFRYk9exkq9crZujvAy5wIhhnXwCKWgTSiSs/kjFiyNmPsNQ3kkYXggi0n1thoqKGvd7E6//qNo8kiFhM; Expires=Mon, 30 Jan 2023 19:32:37 GMT; Path=/; SameSite=None; Secure
server: nginx
last-modified: Wed, 13 Jul 2022 12:04:58 GMT
etag: "62ceb4ea-da1"
access-control-allow-origin: *
content-encoding: gzip
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (14626)
Size:   3489
Md5:    c9e0ee1acc72fd18e3953cf614f7e879
Sha1:   bacc2349aab9dfac47cd153702e98e1fa48466f4
Sha256: e13c4a8b7d5d884e11579582e7e99198c7fdfbd2587a37f52add1783e49e5d8e
                                        
                                            GET /id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&mid=49972895579170701054420752018891816172&ts=1674502355883 HTTP/1.1 
Host: digitalfederalcreditunion.sc.omtrdc.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Origin: http://nyt-ep.com
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         15.236.117.205
HTTP/2 200 OK
content-type: application/x-javascript;charset=utf-8
                                        
access-control-allow-origin: http://nyt-ep.com
access-control-allow-credentials: true
date: Mon, 23 Jan 2023 19:32:37 GMT
p3p: CP="This is not a P3P policy"
server: jag
vary: Origin
content-length: 2
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   2
Md5:    99914b932bd37a50b983c5e7c90ae93b
Sha1:   bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
Sha256: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                        
                                            GET /js/app.2123d633.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /css/vendor.18ecc1fa.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /css/2.fa09428f.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CvVersion%7C5.4.0

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /assets/scripts/final/customer.js?v=8.7.1 HTTP/1.1 
Host: usassets.cobrowse.pega.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         52.54.239.164
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Mon, 23 Jan 2023 19:32:37 GMT
content-length: 261370
set-cookie: AWSALB=9hA1lKpQoC0Z/RT/2osaiqS9Hm/nyyjIO/ppxI5MQhV4RKKLNXeLyADVUZ+oILZG7eyfu7kOOzyhbpMJnUEB3jHeg/7zByD1/O3i2Kk+h46+2Nl7xxxptcSWvLxV; Expires=Mon, 30 Jan 2023 19:32:37 GMT; Path=/ AWSALBCORS=9hA1lKpQoC0Z/RT/2osaiqS9Hm/nyyjIO/ppxI5MQhV4RKKLNXeLyADVUZ+oILZG7eyfu7kOOzyhbpMJnUEB3jHeg/7zByD1/O3i2Kk+h46+2Nl7xxxptcSWvLxV; Expires=Mon, 30 Jan 2023 19:32:37 GMT; Path=/; SameSite=None; Secure
server: nginx
last-modified: Mon, 18 Jul 2022 06:30:25 GMT
etag: "62d4fe01-3fcfa"
access-control-allow-origin: *
content-encoding: gzip
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   261370
Md5:    eb9524e46cc30efd2673a51baa3a655e
Sha1:   f9860cf1e6dc646899418909a7bf2156df4556a4
Sha256: c1898417dc51a18a977daaea237101556511c77a676d51982c6c035cbf15f1c1
                                        
                                            GET /dest5.html?d_nsid=0 HTTP/1.1 
Host: dcu.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         52.50.220.58
HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
                                        
Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
date: Mon, 23 Jan 2023 19:32:37 GMT
DCS: dcs-prod-irl1-1-v045-09e3db1c5.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Fri, 28 Oct 2022 13:34:30 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: KQcv/IcgRLM=
transfer-encoding: chunked
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (550)
Size:   2791
Md5:    ccbdcb1e84c241950763ec4cd516cdfc
Sha1:   55dfa8d4b09c5c3a80fcd101152f6ebed3d27a2c
Sha256: de9ccb9b168945a24f20edc28c39be4135b328129ba8ee378401a7aedc925d12
                                        
                                            GET /css/vsc.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /js/vendor.4cab2b63.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/pages/card.php HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         103.120.66.134
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:30 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (29546), with CRLF line terminators
Size:   543747
Md5:    5f72a225493e2dc2ab4e69c013e6c358
Sha1:   00afa1f9dc5eea61d006f7a0fcb9101f227d8554
Sha256: cc65c2a9c1344f50c6e721e523f17fa358af9353a54ca899cae451460cfb805f

Alerts:
  Blocklists:
    - openphish: Generic/Spear Phishing
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.r2m01.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.80.227
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Mon, 23 Jan 2023 19:32:37 GMT
Last-Modified: Mon, 23 Jan 2023 18:37:35 GMT
Server: ECS (nyb/1D31)
X-Cache: Miss from cloudfront
Via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: LbPi9_lGq8QNRe1FakfORU1p0FPG_HGHBrOXQCcaLslbjtpx_lIAKw==
Age: 3302

                                        
                                            GET /assets.projectfinance.io/siteAssets/DCU/dcuLogoDark.png HTTP/1.1 
Host: s3.amazonaws.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         52.217.136.120
HTTP/1.1 200 OK
Content-Type: image/png
                                        
x-amz-id-2: UhVxEKTpX+KwLbkm5/kVfpfw3UoOG9UpmsXMeewNwKgr4CI4HilRChLLn+wOlctbFUXIOE9+jDI=
x-amz-request-id: GVV6Q4GHJ09H6CWZ
Date: Mon, 23 Jan 2023 19:32:38 GMT
Last-Modified: Tue, 12 May 2020 18:43:36 GMT
ETag: "ae64e87365d6e6696145c8c53ce3632e"
Accept-Ranges: bytes
Server: AmazonS3
Content-Length: 7743


--- Additional Info ---
Magic:  PNG image data, 217 x 78, 8-bit/color RGBA, non-interlaced\012- data
Size:   7743
Md5:    ae64e87365d6e6696145c8c53ce3632e
Sha1:   09337bd0289c432bffab6f653297fe2534ad0c68
Sha256: d1093fceb5f8b35c09e5d3329c8dc55509d7f46096efeea840f6e433212ba45e
                                        
                                            GET /js/app.2123d633.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/pages/style/js/jquery.mask.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Last-Modified: Mon, 23 Jan 2023 03:24:30 GMT
Accept-Ranges: bytes
Content-Length: 18430
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text
Size:   18430
Md5:    219d169a80568884a3d6baab3e5e7def
Sha1:   61d00104de8c972c820cd9b527d8e2edb30e5c4a
Sha256: cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/pages/src/styles/main.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:32 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            GET /dfcu/pages/src/styles/css/variables.css HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:32 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CA4543E6F77CA7B06EEBE2931D655356968DE7F13C00CAFC86B73A8DAD1E4BAF"
Last-Modified: Mon, 23 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10383
Expires: Mon, 23 Jan 2023 22:25:41 GMT
Date: Mon, 23 Jan 2023 19:32:38 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CA4543E6F77CA7B06EEBE2931D655356968DE7F13C00CAFC86B73A8DAD1E4BAF"
Last-Modified: Mon, 23 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10383
Expires: Mon, 23 Jan 2023 22:25:41 GMT
Date: Mon, 23 Jan 2023 19:32:38 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CA4543E6F77CA7B06EEBE2931D655356968DE7F13C00CAFC86B73A8DAD1E4BAF"
Last-Modified: Mon, 23 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10383
Expires: Mon, 23 Jan 2023 22:25:41 GMT
Date: Mon, 23 Jan 2023 19:32:38 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a0bad57-b7ca-4aa8-85b4-3ac127cb7346.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7244
x-amzn-requestid: a9dfb0b3-2f43-49c0-8341-d242de8f6fe8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: exbl8HHyIAMFS3Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c3a625-06ec97e4419248a777ed9e77;Sampled=0
x-amzn-remapped-date: Sun, 15 Jan 2023 07:07:17 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: uosIDE2c24c8qkJbUBjBliFv_Vweey99QzcN80MmHK-jS29voofwLA==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 05:28:59 GMT
age: 50619
etag: "654c00ad053213758c5946123f49cb157f751570"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7244
Md5:    eac67b57277f6a61589ef5f6a4daccbb
Sha1:   654c00ad053213758c5946123f49cb157f751570
Sha256: 9271b578346c4e1c2192c5d64222af2874fc86e25e886c76a5d70e34d308f694
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F602ef184-7161-4092-91b7-61e14eef28a5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3411
x-amzn-requestid: 62afd364-e94f-45ff-ba6c-9b589fc53e5f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e-EyCEzrIAMFb8A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c8b4d9-203f51040f82f12d535446c4;Sampled=0
x-amzn-remapped-date: Thu, 19 Jan 2023 03:11:21 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: K73B093GBbsf85ny_o8fc9oE417nJBFlH0eEdhiifeQk3KG5Q-HHdg==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 23 Jan 2023 07:53:50 GMT
age: 41928
etag: "2bd02a45c8b407e36a41a482b121ea3e14f7c722"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3411
Md5:    805711aaab303931f8966bbf73aeda52
Sha1:   2bd02a45c8b407e36a41a482b121ea3e14f7c722
Sha256: 66268668c1a970268d75beb1b57f66a759bedac76958a3359cb23104de40fbeb
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faf2abec1-a455-47b9-9aaf-69794032330f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7982
x-amzn-requestid: 59d91715-b444-445e-bd6b-268fc630024b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fKezLExAIAMFSeA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cdab47-1e12e8f335ea162532ce6aca;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 21:31:51 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0BgrMQG0-OHmZipKTgnHTs3HxYGBqKowIS37tg_QooT4JPlqHBPFvw==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 22 Jan 2023 21:47:46 GMT
age: 78292
etag: "a67bd0fa5beb10935442bef246bf4f52ec6e74bd"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7982
Md5:    8ec35d753b6b816abcd14030255a7b76
Sha1:   a67bd0fa5beb10935442bef246bf4f52ec6e74bd
Sha256: 9adfddc8877a8ea9f1c3bcc0af99548cb11dc4e1d62a706bf9b2a5cc6d72e82f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0247217-9730-4fdb-8be7-667f0568ffc2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10822
x-amzn-requestid: 60a33a3f-36b1-4f6e-a17b-964118a9da31
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e3AcMGeNoAMFs7A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c5e11a-7673a87f26759a1a64e4aab2;Sampled=0
x-amzn-remapped-date: Mon, 16 Jan 2023 23:43:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: JqvCEzxKP39gLHZjcr7R303XMAlfQz2nAtz-Wv_9W0rsAYJ3ODczPg==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Sun, 22 Jan 2023 21:58:40 GMT
age: 77638
etag: "4c6d22bdc48d7011e2c875ee18876da6a8401669"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10822
Md5:    d95b4a29d3337c5c2ca7e4d31fa3a0b6
Sha1:   4c6d22bdc48d7011e2c875ee18876da6a8401669
Sha256: 23421c7f67582c927dacf52c25779e43f5196a40fb1b70467ed737c2417ba39e
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe0a4afa9-05c4-4ab9-b9eb-17970c04dbbb.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3814
x-amzn-requestid: 48468720-0305-4f17-862b-f2f854fdfe41
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fKq8mEPnIAMFzXg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cdbeb6-470a030661c749ae0fa14c31;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 22:54:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: U9hYFY_BBaMWiasXJJzYqTe2Rb2fH06yFE0vuinlYA2V_lUaDjfmbg==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Sun, 22 Jan 2023 23:09:39 GMT
age: 73379
etag: "cc010d66fe22fce8e82f9bbc78fc3b836120ff0b"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3814
Md5:    c664f89307d9f2cc8170ca0816708ef9
Sha1:   cc010d66fe22fce8e82f9bbc78fc3b836120ff0b
Sha256: c77d9cae0c4132f2695322b8c33fa875a341948ffb6c3023ddb1d3ef41c9ae23
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd68d33e7-2d1d-4f9d-9544-28746d9156e6.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8057
x-amzn-requestid: 5469b005-6740-4f3d-80ca-a45fd39cae68
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fHNkCFiZoAMF8oQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cc5c80-210da08f113a3273257b7d61;Sampled=0
x-amzn-remapped-date: Sat, 21 Jan 2023 21:43:28 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 75pGAcylxKUIPpPoXBhc4v4OUldfaTgT0zjrU3_7BSgcp4Webl7bQw==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Sun, 22 Jan 2023 21:54:19 GMT
age: 77899
etag: "401dd58e34982d3434739b9a2f7182487ea1cac5"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8057
Md5:    4e71636bb9a13ad7d52d253e16cd6a3f
Sha1:   401dd58e34982d3434739b9a2f7182487ea1cac5
Sha256: 1ac336df72b6eb569983e197f094378a26a175113249bedca0610cabd57e2e54
                                        
                                            GET /dfcu/pages/style/js/jquery.validate.min.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Last-Modified: Mon, 23 Jan 2023 03:24:32 GMT
Accept-Ranges: bytes
Content-Length: 50234
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (511), with CRLF line terminators
Size:   50234
Md5:    96fcc200e5f088f4a750fb771806cf7d
Sha1:   51dfb8ab65fc4bcb946561d1050bc92197cbbb6b
Sha256: ac2faaa0365cb4fa0389ddffc2957571ab541b85f0113ffdb519dc075c6b3f33

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/fonts/fa-solid-900.0a037305.woff2 HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:32 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/fonts/fa-solid-900.46457309.ttf HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:32 GMT
Server: Apache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/pages/style/js/angular.min.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Last-Modified: Mon, 23 Jan 2023 03:24:32 GMT
Accept-Ranges: bytes
Content-Length: 167131
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (566)
Size:   167131
Md5:    be6af23e2a716c006da75d0291784254
Sha1:   9c923313eabc56d715a7c07bf855feb26a72f671
Sha256: 8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /dfcu/pages/style/js/jquery.min.js HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Mon, 23 Jan 2023 19:32:31 GMT
Server: Apache
Last-Modified: Mon, 23 Jan 2023 03:24:30 GMT
Accept-Ranges: bytes
Content-Length: 293072
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   293072
Md5:    796b7948cbe79d3498e76e395bff5a2b
Sha1:   e620c80f65fbcb252e91f12c8d7d36d3dc5b57e4
Sha256: 692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /time.mp3?nocache=0.07955478423793161 HTTP/1.1 
Host: mpsnare.iesnare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.195.39.4
HTTP/1.1 206 Partial Content
Content-Type: audio/mpeg
                                        
Server: nginx
Date: Mon, 23 Jan 2023 19:32:39 GMT
Content-Length: 504
Connection: keep-alive
Content-Disposition: inline; filename=time.mp3
Content-Range: bytes 0-503/504
Accept-Ranges: bytes
Pragma: public
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains


--- Additional Info ---
Magic:  MPEG ADTS, layer III, v2.5, 32 kbps, 8 kHz, JntStereo\012- data
Size:   504
Md5:    cfe47da3367b896cf8fe9d23144e6294
Sha1:   5eb28e56c71ce7e851b99b4d90b4091e3090243a
Sha256: 2857eb76b4850703192f5d42bc145b2384147fcb65f63b5447ed74664e241507
                                        
                                            GET /time.mp3?nocache=0.237270902410452 HTTP/1.1 
Host: mpsnare.iesnare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.195.39.4
HTTP/1.1 206 Partial Content
Content-Type: audio/mpeg
                                        
Server: nginx
Date: Mon, 23 Jan 2023 19:32:39 GMT
Content-Length: 504
Connection: keep-alive
Content-Disposition: inline; filename=time.mp3
Content-Range: bytes 0-503/504
Accept-Ranges: bytes
Pragma: public
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains


--- Additional Info ---
Magic:  MPEG ADTS, layer III, v2.5, 32 kbps, 8 kHz, JntStereo\012- data
Size:   504
Md5:    cfe47da3367b896cf8fe9d23144e6294
Sha1:   5eb28e56c71ce7e851b99b4d90b4091e3090243a
Sha256: 2857eb76b4850703192f5d42bc145b2384147fcb65f63b5447ed74664e241507
                                        
                                            GET /time.mp3?nocache=0.1481889384982229 HTTP/1.1 
Host: mpsnare.iesnare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.195.39.4
HTTP/1.1 206 Partial Content
Content-Type: audio/mpeg
                                        
Server: nginx
Date: Mon, 23 Jan 2023 19:32:39 GMT
Content-Length: 504
Connection: keep-alive
Content-Disposition: inline; filename=time.mp3
Content-Range: bytes 0-503/504
Accept-Ranges: bytes
Pragma: public
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains


--- Additional Info ---
Magic:  MPEG ADTS, layer III, v2.5, 32 kbps, 8 kHz, JntStereo\012- data
Size:   504
Md5:    cfe47da3367b896cf8fe9d23144e6294
Sha1:   5eb28e56c71ce7e851b99b4d90b4091e3090243a
Sha256: 2857eb76b4850703192f5d42bc145b2384147fcb65f63b5447ed74664e241507
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: nyt-ep.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/dfcu/pages/card.php
Cookie: AMCV_46051B125B89FACB0A495DD6%40AdobeOrg=1176715910%7CMCIDTS%7C19381%7CMCMID%7C49972895579170701054420752018891816172%7CMCAAMLH-1675107155%7C6%7CMCAAMB-1675107155%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1674509556s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0; AMCVS_46051B125B89FACB0A495DD6%40AdobeOrg=1

search
                                         103.120.66.134
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Date: Mon, 23 Jan 2023 19:32:33 GMT
Server: Apache
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text
Size:   16
Md5:    4845f01eaa8068384625e302e9a4eb05
Sha1:   fb6ff8293fa45e17ba97f84954e7d1d5b0d38f87
Sha256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.245.100
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Mon, 23 Jan 2023 19:32:39 GMT
Last-Modified: Mon, 23 Jan 2023 18:41:47 GMT
Server: ECS (nyb/1D1E)
X-Cache: Miss from cloudfront
Via: 1.1 b2b04ca80b95df6bc86478a1bf96b7cc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: RdPNBEEt6IB02qSGO3zOT2aSku1FIm_0iMpOxvDLTRhj-81eARO6vg==
Age: 3052

                                        
                                            GET /b/ss/dfcudigbankingprod,dfcumainglobal/1/JS-2.22.4-LCXS/s61447369408208?AQB=1&ndh=1&pf=1&t=23%2F0%2F2023%2019%3A32%3A37%201%200&vid=49972895579170701054420752018891816172&mid=49972895579170701054420752018891816172&aamlh=6&ce=UTF-8&pageName=projectfinance%3Aen%3Adfcu%3Apages%3Acard.php&g=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Fcard.php&cc=USD&ch=dfcu&server=nyt-ep.com&events=event1&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v1=dfcu&c2=dfcu%3Apages&v2=dfcu%3Apages&c3=dfcu%3Apages%3Acard.php&v3=dfcu%3Apages%3Acard.php&c9=D%3Dv9&v9=http%3A%2F%2Fnyt-ep.com%2Fdfcu%2Fpages%2Fcard.php&v10=D%3Dc10&v11=projectfinance%3Aen%3Adfcu%3Apages%3Acard.php&v12=year%3D2023%20%7C%20month%3DJanuary%20%7C%20date%3D23%20%7C%20day%3DMonday%20%7C%20time%3D7%3A32%20PM&v13=New&c14=29&v14=D%3Dc14&c15=New%20Visitor&c16=1&c17=first%20hit%20of%20visit&v20=Project%20Finance&v41=49972895579170701054420752018891816172&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=939&mcorgid=46051B125B89FACB0A495DD6%40AdobeOrg&AQE=1 HTTP/1.1 
Host: digitalfederalcreditunion.sc.omtrdc.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nyt-ep.com/

search
                                         15.236.117.205
HTTP/1.1 200 OK
content-type: image/gif;charset=utf-8
                                        
access-control-allow-origin: *
date: Mon, 23 Jan 2023 19:32:39 GMT
expires: Sun, 22 Jan 2023 19:32:39 GMT
last-modified: Tue, 24 Jan 2023 19:32:39 GMT
pragma: no-cache
p3p: CP="This is not a P3P policy"
server: jag
etag: 3595966434506506240-4619680264345126503
vary: *
content-length: 43
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-content-type-options: nosniff


--- Additional Info ---
Magic:  GIF image data, version 89a, 2 x 2\012- data
Size:   43
Md5:    ad480fd0732d0f6f1a8b06359e3a42bb
Sha1:   a544538683a2dfe574eeb2e358ac8fcc78289d50
Sha256: a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
                                        
                                            GET /cm/dd?d_uuid=50183333384823962334441931855338865596 HTTP/1.1 
Host: cm.everesttech.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.229.62.148
HTTP/1.1 302
                                        
Date: Mon, 23 Jan 2023 19:32:39 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: everest_g_v2=g_surferid~Y87g1wAAANqTIwNe; Domain=.everesttech.net; Expires=Tue, 23-Jan-2024 19:32:39 GMT; Path=/ everest_session_v2=Y87g1wAAANqTJANe; Domain=.everesttech.net; Path=/
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y87g1wAAANqTIwNe
Server: AMO-cookiemap/1.1

                                        
                                            GET /ibs:dpid=411&dpuuid=Y87g1wAAANqTIwNe HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://nyt-ep.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         52.31.36.191
HTTP/1.1 302 Found
                                        
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
DCS: dcs-prod-irl1-2-v045-061dae83e.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y87g1wAAANqTIwNe
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
set-cookie: demdex=70061146346282225561271772565165086841; Max-Age=15552000; Expires=Sat, 22 Jul 2023 19:32:39 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: /H1YXlOdRtU=
Content-Length: 0
Connection: keep-alive

                                        
                                            GET /demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=Y87g1wAAANqTIwNe HTTP/1.1 
Host: dpm.demdex.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://nyt-ep.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         52.31.36.191
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
DCS: dcs-prod-irl1-2-v045-0b398da67.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: l4eN4pG6Sa4=
Content-Length: 59
Connection: keep-alive


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   59
Md5:    1251cd5e5c2def4c046309375f87c1c1
Sha1:   e02d6b0c6a5c495c15985e2832e335eda8528c80
Sha256: 4e7010cc46fa361c88e57e3346d27421cf3b8a8bf5f39b43fc45997c60cb1c13
                                        
                                            GET /link/v2/stable/link-initialize.js HTTP/1.1 
Host: cdn.plaid.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nyt-ep.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         54.230.111.120
HTTP/2 200 OK
content-type: application/javascript
                                        
x-amz-id-2: UNeLemsQCmAKG/dKmt9N6asqs2l1fiFsfvUFJ5X3xXNEVzZsFJOF8qe3Fi7vNgOdwQ6P5s3AoDA=
x-amz-request-id: V3DSARAEFAXGV0XA
x-amz-replication-status: COMPLETED
last-modified: Fri, 20 Jan 2023 21:48:01 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: Olz7vHS2338JOTgdQDy.quPH4S1stpH6
server: AmazonS3
content-encoding: gzip
date: Mon, 23 Jan 2023 04:14:37 GMT
cache-control: no-cache,must-revalidate,max-age=0
etag: W/"353f8766665513254498e596ae3de7ac"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: sqkWje7L19AYe8CO19i7nXt3GEqnvArklQgdIAtgECOspztiXWvI_Q==
age: 55194
X-Firefox-Spdy: h2


--- Additional Info ---