r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ec332b81a27117ce9c16b67a5a8e4fac
b6d2afa2c859d000ad830d3d8d73f57bac6ffce2
1dc32c78e4e850303813338fd4e9616a41c8c05d1063748a1e76a92c397a5e8f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1DC32C78E4E850303813338FD4E9616A41C8C05D1063748A1E76A92C397A5E8F"
Last-Modified: Mon, 20 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19051
Expires: Tue, 21 Mar 2023 09:40:33 GMT
Date: Tue, 21 Mar 2023 04:23:02 GMT
Connection: keep-alive
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
200 OK 8.6 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (369)
Hash 6b3317d3833f299a098c2a402ddd388f
53d1dd50db844e2424d62da4d6403c8ac6d4a02b
43c8735c6f8de8d8f53bec49686c65cb814e718c142a490028af8888f6fd3a70
Analyzer Verdict Alert openphish Nordea Bank
fortinet Phishing
quad9 Sinkholed
GET /id/finlogin.php HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:02 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 28774b36cf8bb6b054329393a33f6239
728313ddff6d5ceb6db3eb8445f039779616a140
08378fe6a897ab5a9c8d3bc2748c9670659d0d0d164317fdfac88d23fee78fa0
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "08378FE6A897AB5A9C8D3BC2748C9670659D0D0D164317FDFAC88D23FEE78FA0"
Last-Modified: Sun, 19 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6133
Expires: Tue, 21 Mar 2023 06:05:15 GMT
Date: Tue, 21 Mar 2023 04:23:02 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 4ad6984a756720fbfff47b37a75513a2
355e35258114452af8b9638985ed9d8ef3bf0aca
43181fccb10652c68cae86e5e32b4e8f426fb5ad49d8125cb99e072cff573cf5
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Content-Type, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 21 Mar 2023 04:14:57 GMT
content-type: application/json
age: 485
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 4e6141892ec4705c6a0134f3157b969d
4169fdea42b0fa9cb565e14b8e8fdb293575c78e
905537ef3e3a4a9030391b44bd6ac6bb5d7c9ec752b1821d683dfbf483096163
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "905537EF3E3A4A9030391B44BD6AC6BB5D7C9EC752B1821D683DFBF483096163"
Last-Modified: Sun, 19 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4133
Expires: Tue, 21 Mar 2023 05:31:55 GMT
Date: Tue, 21 Mar 2023 04:23:02 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
File type PEM certificate\012- , ASCII text
Hash e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: PUlIbsnye/yvLb+wznXqhY2VUr2dKhBZO4vEeoX25AMABwOAZPjFvUCMGMIdC0fqjMen9ftvYeo=
x-amz-request-id: Q92B12H8Q740W046
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 21 Mar 2023 03:58:58 GMT
age: 1444
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 21 Mar 2023 04:23:02 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
200 OK 49 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type assembler source, ASCII text, with CRLF line terminators
Hash b9ab7abda3db8f2401bc732f29b78460
1c256bdf0a2c5ed807765d851f08ee99d8f0a0ac
02cd70fbf63e9c61e1abc49a269c5dc62c829e69ac39b33552b6fc118995234b
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
quad9 Sinkholed
GET /id/all/styles.css HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:02 GMT
Server: Apache
Last-Modified: Mon, 12 Dec 2022 07:06:32 GMT
Accept-Ranges: bytes
Content-Length: 49064
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b0445b72ebb7f72dd933cbad9ed3468b
3163284eedefecab51377aad9f0804387d098112
12e64d29e82683c5384d8de70ebca45985a090e9f0098e4b7dbe3e4cd3ad9357
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "12E64D29E82683C5384D8DE70EBCA45985A090E9F0098E4B7DBE3E4CD3AD9357"
Last-Modified: Sun, 19 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14681
Expires: Tue, 21 Mar 2023 08:27:44 GMT
Date: Tue, 21 Mar 2023 04:23:03 GMT
Connection: keep-alive
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/partials/js/jquery.js
200 OK 272 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/partials/js/jquery.js
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type ASCII text, with CRLF line terminators
Size 272 kB (272155 bytes)
Hash 3f24e8505d471bd934a5a68b86971580
876bd436d3b3c1436a8ac17a654e38d062acf45e
4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
fortinet Phishing
quad9 Sinkholed
GET /id/partials/js/jquery.js HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Last-Modified: Fri, 05 Feb 2021 08:11:28 GMT
Accept-Ranges: bytes
Content-Length: 272155
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/codes_app-a89defc476c5ea3f806b6f5360157e81.svg
200 OK 1.4 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/codes_app-a89defc476c5ea3f806b6f5360157e81.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1442), with no line terminators
Hash a89defc476c5ea3f806b6f5360157e81
640dcac46dbc76ee388429336d7c1b5212300c50
b88b6130e6d786e3793f9811c6ad215e23237c3875b1bd85330505dc8ff350f9
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
fortinet Phishing
quad9 Sinkholed
GET /id/all/codes_app-a89defc476c5ea3f806b6f5360157e81.svg HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Last-Modified: Fri, 04 Nov 2022 10:41:59 GMT
Accept-Ranges: bytes
Content-Length: 1442
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/5e73b3c67b0510c4c5cf-6629cb5350d6f3276b2dccc43bd3f397.png
200 OK 40 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/5e73b3c67b0510c4c5cf-6629cb5350d6f3276b2dccc43bd3f397.png
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type PNG image data, 828 x 300, 4-bit colormap, non-interlaced\012- data
Hash 6629cb5350d6f3276b2dccc43bd3f397
63d964e5caaa541475a4c2da976871a9f9986067
9fc5b5c44107cfc6701be07fa5d5a4d7ab066607dd7ab6e9f396ac709e28424f
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
quad9 Sinkholed
GET /id/all/5e73b3c67b0510c4c5cf-6629cb5350d6f3276b2dccc43bd3f397.png HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Last-Modified: Mon, 07 Nov 2022 21:40:36 GMT
Accept-Ranges: bytes
Content-Length: 40339
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: vzl1Kq67w9TwyNX8Kv9CMg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 9C6l0WqEuMv7RYoU9aZAy3F03F4=
Date: Tue, 21 Mar 2023 04:23:03 GMT
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/assets/aa78d594083d0ccfefcf-d2c5355e1fcc507cd7b7389e87e6c9de.svg
404 Not Found 10 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/assets/aa78d594083d0ccfefcf-d2c5355e1fcc507cd7b7389e87e6c9de.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4070)
Hash a6c6257d7c0799649f59e64e9578792a
270f65efc3f49650a6e63831685bae5e374f9655
85767d1b6afe1b462f6806ffa1f713d2779b013b2a42f77919ffb5cd5b6c939b
Analyzer Verdict Alert quad9 Sinkholed
GET /assets/aa78d594083d0ccfefcf-d2c5355e1fcc507cd7b7389e87e6c9de.svg HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 404 Not Found
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Accept-Ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/assets/3defb92f3d1f7309bb86-28abb007069a4e48b1a0830fb5d4a822.svg
404 Not Found 10 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/assets/3defb92f3d1f7309bb86-28abb007069a4e48b1a0830fb5d4a822.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4070)
Hash a0e91eb1417a497cbb551c000bab4b22
4dc025f6c98f631f0efb50c46e77c3b253c3eee7
d599b5a8ea1868ee17045246bc4c50925decb0ade4a3a98056c75e71eeba458c
Analyzer Verdict Alert quad9 Sinkholed
GET /assets/3defb92f3d1f7309bb86-28abb007069a4e48b1a0830fb5d4a822.svg HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 404 Not Found
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Accept-Ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
200 OK 31 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type Web Open Font Format, TrueType, length 31152, version 0.0\012- data
Hash 3a4d9a8b6adf39716f28af71fc9b030a
5d9acfd762ccd9a4a519951ad008f119741c513b
21a2a17b532837aeafeb95de9f252bfec714028517f79fb4143845ca4d23353c
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
fortinet Phishing
quad9 Sinkholed
GET /id/all/aa1ee103968475b48934-3a4d9a8b6adf39716f28af71fc9b030a.woff HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Last-Modified: Mon, 12 Dec 2022 06:59:54 GMT
Accept-Ranges: bytes
Content-Length: 31152
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/837ba80d0ba906e8c20d-4fa38d775a1f6b9179bc7c425ecaf7f4.woff
200 OK 3.0 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/837ba80d0ba906e8c20d-4fa38d775a1f6b9179bc7c425ecaf7f4.woff
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type Web Open Font Format, TrueType, length 2988, version 1.0\012- data
Hash 4fa38d775a1f6b9179bc7c425ecaf7f4
999363e7db078097dd06c303a4fd09839da7cc6e
6252319c96777a4ce3952f63ec70735230c1c5c9392e81a9b3f9a8b2bc06c164
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
fortinet Phishing
quad9 Sinkholed
GET /id/all/837ba80d0ba906e8c20d-4fa38d775a1f6b9179bc7c425ecaf7f4.woff HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Last-Modified: Mon, 12 Dec 2022 06:59:56 GMT
Accept-Ranges: bytes
Content-Length: 2988
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: font/woff
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Last-Modified, Content-Length, Pragma, Expires, ETag, Backoff, Alert, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 21 Mar 2023 04:14:33 GMT
age: 510
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
200 OK 32 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type Web Open Font Format, TrueType, length 31772, version 0.0\012- data
Hash 11eca7aa5a85ec0c6cc3deba794b264e
9bd19e1a9d5859833cbd50f501444c8c2afec2e1
ff28a732b1fc6a547797b7a9a7c29025ae41b74cc5e208232418d9c41fb43c44
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
fortinet Phishing
quad9 Sinkholed
GET /id/all/b90f1e1b93f3b23dd79e-11eca7aa5a85ec0c6cc3deba794b264e.woff HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/all/styles.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Last-Modified: Mon, 12 Dec 2022 06:59:53 GMT
Accept-Ranges: bytes
Content-Length: 31772
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/favicon.ico
404 Not Found 10 kB URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/favicon.ico
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4070)
Hash cdf29063304b94513fa4b7847a8065d1
5915fdb40b9a6de16fd2c4b9a8e9bc1e0a963c23
0c635135b3558d08dfe8e9a27325f3db1552bb245c8222a6e6ac97d32c5e5a49
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 404 Not Found
Date: Tue, 21 Mar 2023 04:23:03 GMT
Server: Apache
Accept-Ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
cdn.tynt.com/tc.js
200 OK 6.9 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (631)
Hash 73d28c994744440ee2c2cbd7ef8a0181
a1b526b49cd0c92f0265e8fdca1f95353d5f3f37
f3bccdccba8f765388669a963560ca8662447f37df95a38f8d6e74cfee67c0f6
GET /tc.js HTTP/1.1
Host: cdn.tynt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 21 Mar 2023 04:23:03 GMT
content-type: application/javascript
last-modified: Tue, 14 Mar 2023 15:48:17 GMT
vary: Accept-Encoding
etag: W/"64109741-4750"
content-encoding: gzip
cf-cache-status: HIT
age: 45269
expires: Fri, 24 Mar 2023 04:23:03 GMT
cache-control: public, max-age=259200
server: cloudflare
cf-ray: 7ab36ad9ddfc0b65-OSL
X-Firefox-Spdy: h2
ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&t=Nordea%20-%20Tunnistautuminen
204 No Content 0 B URL HTTP/2 ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&t=Nordea%20-%20Tunnistautuminen
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&t=Nordea%20-%20Tunnistautuminen HTTP/1.1
Host: ic.tynt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx/1.16.1
date: Tue, 21 Mar 2023 04:23:04 GMT
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
X-Firefox-Spdy: h2
ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
204 No Content 0 B URL HTTP/2 ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php HTTP/1.1
Host: ic.tynt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx/1.16.1
date: Tue, 21 Mar 2023 04:23:04 GMT
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
X-Firefox-Spdy: h2
de.tynt.com/deb/v2?id=w!holland001&dn=TC&cc=1&r=&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
200 OK 4 B URL HTTP/2 de.tynt.com/deb/v2?id=w!holland001&dn=TC&cc=1&r=&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
IP
File type ASCII text, with no line terminators
Hash 350fd6ef6446635f7a8f608434a405ec
a4b6c275ac2c80ec925b5c0c5c6abb79ba897356
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
GET /deb/v2?id=w!holland001&dn=TC&cc=1&r=&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php HTTP/1.1
Host: de.tynt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: max-age=86400
expires: Wed, 22 Mar 2023 04:23:04 GMT
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
content-type: application/javascript
content-length: 4
date: Tue, 21 Mar 2023 04:23:03 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
X-Firefox-Spdy: h2
ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
204 No Content 0 B URL HTTP/2 ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php HTTP/1.1
Host: ic.tynt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx/1.16.1
date: Tue, 21 Mar 2023 04:23:04 GMT
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
X-Firefox-Spdy: h2
ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
204 No Content 0 B URL HTTP/2 ic.tynt.com/b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /b/p?id=w!holland001&lm=0&ts=1679372586081&dn=TC&iso=0&pu=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php HTTP/1.1
Host: ic.tynt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx/1.16.1
date: Tue, 21 Mar 2023 04:23:04 GMT
cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash de95776582936b8e129e876cf6d80fa8
0233251e1cf0123f1260d980d7c8ef92718723f9
49c07da2ab4ebd66bd166bf0e20dd084b38973cd40c79f85eb283d15a1ccac36
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "49C07DA2AB4EBD66BD166BF0E20DD084B38973CD40C79F85EB283D15A1CCAC36"
Last-Modified: Sun, 19 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2840
Expires: Tue, 21 Mar 2023 05:10:25 GMT
Date: Tue, 21 Mar 2023 04:23:05 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash de95776582936b8e129e876cf6d80fa8
0233251e1cf0123f1260d980d7c8ef92718723f9
49c07da2ab4ebd66bd166bf0e20dd084b38973cd40c79f85eb283d15a1ccac36
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "49C07DA2AB4EBD66BD166BF0E20DD084B38973CD40C79F85EB283D15A1CCAC36"
Last-Modified: Sun, 19 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2840
Expires: Tue, 21 Mar 2023 05:10:25 GMT
Date: Tue, 21 Mar 2023 04:23:05 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash de95776582936b8e129e876cf6d80fa8
0233251e1cf0123f1260d980d7c8ef92718723f9
49c07da2ab4ebd66bd166bf0e20dd084b38973cd40c79f85eb283d15a1ccac36
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "49C07DA2AB4EBD66BD166BF0E20DD084B38973CD40C79F85EB283D15A1CCAC36"
Last-Modified: Sun, 19 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2840
Expires: Tue, 21 Mar 2023 05:10:25 GMT
Date: Tue, 21 Mar 2023 04:23:05 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash de95776582936b8e129e876cf6d80fa8
0233251e1cf0123f1260d980d7c8ef92718723f9
49c07da2ab4ebd66bd166bf0e20dd084b38973cd40c79f85eb283d15a1ccac36
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "49C07DA2AB4EBD66BD166BF0E20DD084B38973CD40C79F85EB283D15A1CCAC36"
Last-Modified: Sun, 19 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2840
Expires: Tue, 21 Mar 2023 05:10:25 GMT
Date: Tue, 21 Mar 2023 04:23:05 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash de95776582936b8e129e876cf6d80fa8
0233251e1cf0123f1260d980d7c8ef92718723f9
49c07da2ab4ebd66bd166bf0e20dd084b38973cd40c79f85eb283d15a1ccac36
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "49C07DA2AB4EBD66BD166BF0E20DD084B38973CD40C79F85EB283D15A1CCAC36"
Last-Modified: Sun, 19 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2840
Expires: Tue, 21 Mar 2023 05:10:25 GMT
Date: Tue, 21 Mar 2023 04:23:05 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd02b7e2d-e49d-4cc0-b89e-9fd6221ec202.jpeg
200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd02b7e2d-e49d-4cc0-b89e-9fd6221ec202.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 67a217c6c45d72018d90227abf59bc56
6f93ab1b2c313aefdb2e0b647ff9d299cfc522c0
a62f8a087ec5ea1e758857cc64b53478f26a9fad180fc16191b12017fc5b59e4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd02b7e2d-e49d-4cc0-b89e-9fd6221ec202.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7254
x-amzn-requestid: 478965d1-a7ad-45a5-bff2-c08d81bf6bd7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B6evIEwPoAMF-Pg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64141193-0f83de050b14ff0d420bb74d;Sampled=0
x-amzn-remapped-date: Fri, 17 Mar 2023 07:06:59 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: RZ17RxytmDO8a0hosUh9GqkpSbEHpMo1L0hRjWx5yTbRFGWzBAVN6Q==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 f958a3846d80a3925f664b320dfad9c8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 15:03:19 GMT
age: 47986
etag: "6f93ab1b2c313aefdb2e0b647ff9d299cfc522c0"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc78f90b-41af-4ead-ad86-702e5fda80ad.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc78f90b-41af-4ead-ad86-702e5fda80ad.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2b8211ace94cc818c0b092a0f8c24c7e
785e7ca94d770a89c2d738d38c880d676bf14652
f14171e1bf278f881e63d81884e84b0395f37871bfdad187c57ee8b1c337602d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc78f90b-41af-4ead-ad86-702e5fda80ad.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10326
x-amzn-requestid: 21739424-faef-436b-9024-5354854b622c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CGWI8E4poAMFsvg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418d09f-1627c1db7ff0c2f05f9c4e6e;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 21:31:11 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: RIABIQaX9GWt0kbVqf4YeCZOVYYZRq0I31xV_YXoi4TQKvAQqY7ftA==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 31dfa94142c6eaf975b0e5454c00340a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 21:45:17 GMT
age: 23868
etag: "785e7ca94d770a89c2d738d38c880d676bf14652"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7ac4bd79-9966-45ec-9163-6d82808ad8e1.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7ac4bd79-9966-45ec-9163-6d82808ad8e1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2e4a56e01366e8d0e9aa570539b423f4
7759489cac98590fd01b94e70bd37c742cf2e80e
96b27781b8c7103ccadbf648a400e1b1295e7c50b745e6986fb7fef1e4d9426c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7ac4bd79-9966-45ec-9163-6d82808ad8e1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12040
x-amzn-requestid: 4507792f-180b-4904-8b70-80fb89014d7c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CGWkcGnRoAMFXiw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418d14f-36a1f2924096fd8b56d262a2;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 21:34:07 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: Gm_k2_nwp5FBTYeCmkb4Vv-L0Oy--3D_9ADB7Ut3MMJnmlu9OXqB1Q==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 28fdf6e146f70e7372911f118404fb20.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 21:52:13 GMT
age: 23452
etag: "7759489cac98590fd01b94e70bd37c742cf2e80e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb2ad5022-7f23-468e-8e1f-6388d8cc9db8.jpeg
200 OK 6.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb2ad5022-7f23-468e-8e1f-6388d8cc9db8.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4e5f234aedfabd736b50fef3017380f9
71672a6c3523d9999522e005091863d07ea0e94a
3314df7a93e317d509aeffc1cde69ec450ddad116a27dc197db1abce966da344
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb2ad5022-7f23-468e-8e1f-6388d8cc9db8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6511
x-amzn-requestid: 82d12180-bdcb-4ce0-8588-4239ee27f236
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CGWI_E_eoAMF3sA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418d09f-2f5df7cd5f6cee4762703d29;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 21:31:11 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: sTt0-W1XE7yUFGFXg2nPnKw5tKKkrw-cH_TCIbQy8JL-k0QtCNZS8w==
via: 1.1 0a2ce08fa1ec3c33302a7547d3305978.cloudfront.net (CloudFront), 1.1 7545e37b10b5fcf5e3df98185c85194a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 21:52:08 GMT
age: 23457
etag: "71672a6c3523d9999522e005091863d07ea0e94a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbc7839c7-2b7e-47fa-a8d7-b001f2527406.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbc7839c7-2b7e-47fa-a8d7-b001f2527406.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e7f3f5682ef230a0e5ead556ccbb9c8d
93bcb7e0d7f2e7648f2749060e0a58bca3a033b9
e63beb09275f78a899e992ce814b4a079aaf38a4932a32b9f9431552702224b8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbc7839c7-2b7e-47fa-a8d7-b001f2527406.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11397
x-amzn-requestid: 9c96a37a-b2e6-46f1-94dd-1a299da61a02
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CGWw1HwVIAMF0Hg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418d19e-0638254835be22cc17465cc2;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 21:35:26 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: g2YNKMDYmcQl3rpt8G2tHJFrBf25_aNKA4v4WKBgpCQeEWEnwgbkYg==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 e11ee4e3208082d534c251b36bbee268.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 21:45:17 GMT
etag: "93bcb7e0d7f2e7648f2749060e0a58bca3a033b9"
content-type: image/jpeg
age: 23868
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2b5e25da-048a-413a-a665-a2f7722e7a8b.jpeg
200 OK 5.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2b5e25da-048a-413a-a665-a2f7722e7a8b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e14006bd4b8766e373bc11e21bba6c42
70b8c46d3b829be40d27fbeda2dbefcdb7ad17a4
31c962ccd63afaa71a162c7f8b0b259347bd52630427f2387dcdd46ca2bf062f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2b5e25da-048a-413a-a665-a2f7722e7a8b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5906
x-amzn-requestid: aa937d0b-da54-4bf4-a47f-662bea154a65
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CEYMXEk7oAMFmMw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6418071b-63ccde3f35f1d1496cc313f4;Sampled=0
x-amzn-remapped-date: Mon, 20 Mar 2023 07:11:23 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: dggiiyVySzSmFWlwweCoOdgJyGfLG-gsjHRUR1xfv3IDOu_8CRIOkw==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 3f3347264bcaae7af741e2a2f692c6a0.cloudfront.net (CloudFront), 1.1 google
date: Mon, 20 Mar 2023 07:21:34 GMT
age: 75691
etag: "70b8c46d3b829be40d27fbeda2dbefcdb7ad17a4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/partials/status.php
500 Internal Server Error 0 B URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/partials/status.php
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
fortinet Phishing
quad9 Sinkholed
GET /id/partials/status.php HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 500 Internal Server Error
Date: Tue, 21 Mar 2023 04:23:06 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=3426ee4b2fed23e2b84f898922c372fa; path=/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/partials/status.php
500 Internal Server Error 0 B URL HTTP/1.1 certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/partials/status.php
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Nordea
fortinet Phishing
quad9 Sinkholed
GET /id/partials/status.php HTTP/1.1
Host: certificate.privat.dokument.opdate.20-199-42-181.cprapid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/id/finlogin.php
Cookie: PHPSESSID=3426ee4b2fed23e2b84f898922c372fa
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 500 Internal Server Error
Date: Tue, 21 Mar 2023 04:23:09 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
widgets.amung.us/small.js
200 OK 0 B URL HTTP/2 widgets.amung.us/small.js
IP
GET /small.js HTTP/1.1
Host: widgets.amung.us
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 21 Mar 2023 04:23:03 GMT
content-type: application/x-javascript
last-modified: Thu, 12 Jan 2023 17:19:48 GMT
etag: W/"63c04134-2170"
expires: Wed, 22 Mar 2023 03:30:10 GMT
cache-control: max-age=86400
access-control-allow-origin: *
content-encoding: gzip
cf-cache-status: HIT
age: 3173
vary: Accept-Encoding
server: cloudflare
cf-ray: 7ab36ad66bfc0a1d-ARN
X-Firefox-Spdy: h2
t.dtscout.com/i/?l=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&j=
200 OK 0 B URL HTTP/2 t.dtscout.com/i/?l=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&j=
IP
GET /i/?l=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&j= HTTP/1.1
Host: t.dtscout.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 21 Mar 2023 04:23:03 GMT
content-type: application/javascript
x-s: ger1
set-cookie: m=1; Domain=dtscout.com; Expires=Tue, 21-Mar-2023 05:46:23 GMT; Max-Age=5000; Path=/; SameSite=None; Secure
oa=1; Domain=dtscout.com; Expires=Tue, 21-Mar-2023 08:23:03 GMT; Max-Age=14400; Path=/; SameSite=None; Secure
df=1679372583; Domain=dtscout.com; Expires=Thu, 29-Jun-2023 04:23:03 GMT; Max-Age=8640000; Path=/; SameSite=None; Secure
x-t: 0.53
expires: Tue, 21 Mar 2023 04:23:02 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vKKgG27SYcLsrF39oZ4Rew8d%2FIQf3nAsCfriTlxUK1ot9biHVdr%2Bviw%2FdK9MO%2FtVdKShxo7troURmNFqaTETpYVfKueLLLj89Cf%2B%2Bh%2FQBTQdbveW65jnj%2BYaYLzphZw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7ab36ad70cac2d6e-ARN
content-encoding: br
X-Firefox-Spdy: h2
whos.amung.us/pingjs/?k=holland001&t=Nordea%20-%20Tunnistautuminen&c=s&x=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&y=&a=0&d=0.791&v=27&r=1032
200 OK 0 B URL HTTP/2 whos.amung.us/pingjs/?k=holland001&t=Nordea%20-%20Tunnistautuminen&c=s&x=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&y=&a=0&d=0.791&v=27&r=1032
IP
GET /pingjs/?k=holland001&t=Nordea%20-%20Tunnistautuminen&c=s&x=https%3A%2F%2Fcertificate.privat.dokument.opdate.20-199-42-181.cprapid.com%2Fid%2Ffinlogin.php&y=&a=0&d=0.791&v=27&r=1032 HTTP/1.1
Host: whos.amung.us
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 21 Mar 2023 04:23:03 GMT
content-type: text/javascript;charset=UTF-8
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7ab36ad77cc30a1d-ARN
X-Firefox-Spdy: h2
t.dtscout.com/pv/?_a=v&_h=certificate.privat.dokument.opdate.20-199-42-181.cprapid.com&_ss=2n31xp9fi4&_pv=1&_ls=0&_u1=1&_u3=1&_cc=no&_pl=d&_cbid=5zxy&_cb=_dtspv.c
200 OK 0 B URL HTTP/2 t.dtscout.com/pv/?_a=v&_h=certificate.privat.dokument.opdate.20-199-42-181.cprapid.com&_ss=2n31xp9fi4&_pv=1&_ls=0&_u1=1&_u3=1&_cc=no&_pl=d&_cbid=5zxy&_cb=_dtspv.c
IP
GET /pv/?_a=v&_h=certificate.privat.dokument.opdate.20-199-42-181.cprapid.com&_ss=2n31xp9fi4&_pv=1&_ls=0&_u1=1&_u3=1&_cc=no&_pl=d&_cbid=5zxy&_cb=_dtspv.c HTTP/1.1
Host: t.dtscout.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://certificate.privat.dokument.opdate.20-199-42-181.cprapid.com/
Cookie: m=1; oa=1; df=1679372583
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Tue, 21 Mar 2023 04:23:03 GMT
content-type: application/javascript
x-t: 0.13
x-c: 0
expires: Tue, 21 Mar 2023 04:23:02 GMT
cache-control: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fLABd%2FNK6xB4Z%2F22KR4DKcPGAoMtlx9cd8XrR2mtyVmohUpTzueCRe3QOZ9gHeVzkNMoS0OYLUYlA8DaZLZtkc0XgT0Ajp3pjmmXcVdOH8PAKo0Me636D0aiUwjjVU0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7ab36ad7bd4b2d6e-ARN
content-encoding: br
X-Firefox-Spdy: h2
20.199.42.181
35.241.9.150
104.22.75.171
23.36.77.32