Report - icrd.in/icrd.in?email=martin@slurpmail.net

Report Overview

Submitted URL
icrd.in/icrd.in?email=martin@slurpmail.net
IP
103.50.163.30
ASN
#394695 PUBLIC-DOMAIN-REGISTRY
Submitted
2022-11-26 23:16:30
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
32

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.4 kB	3.5 kB	23.36.77.32
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.6 kB	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	686 B	1.4 kB	142.250.74.35
icrd.in	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.3 kB	1.3 kB	103.50.163.30
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
ajax.googleapis.com	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	398 B	32 kB	216.58.207.234
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	54 kB	34.120.237.76
img1.wsimg.com	9893	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	754 B	605 B	23.36.79.16
img6.wsimg.com	15438	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	817 B	20 kB	23.36.79.16
events.api.secureserver.net	125179	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	19 kB	7.4 kB	104.84.152.186
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	54.189.139.67
vps-185605ee.vps.ovh.ca	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	382 B	607 B	142.44.162.93
ibn-usa.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	12 kB	284 kB	23.229.226.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-26	medium	icrd.in/icrd.in?email=martin@slurpmail.net	Phishing
2022-11-26	medium	icrd.in/icrd.in?email=martin@slurpmail.net	Phishing
2022-11-26	medium	vps-185605ee.vps.ovh.ca/?email=martin@slurpmail.net	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_1.html	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_3.html	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_5.html	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_6.html	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_2.html	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups-logo.svg	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_4.html	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/83c0873d77bec83dc27c01d016052abd333b7f2b	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Bold.woff	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Regular.woff	Phishing
2022-11-26	medium	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Medium.woff	Phishing
2022-11-26	medium	icrd.in/icrd.in/?email=martin@slurpmail.net	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	vps-185605ee.vps.ovh.ca/?email=martin@slurpmail.net	120 B	2023-03-11	2023-03-11
Pretty URL vps-185605ee.vps.ovh.ca/?email=martin@slurpmail.net IP 142.44.162.93 ASN #16276 OVH SAS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 20:13:27 Last Seen2023-03-11 21:00:57 Times Seen1 Hash caaf786e67fae8539f293c012d1c2eae aa869cdf12847a8a33ab5ef7a501ada986fb2f9c 42f7e178edc2057fb7e5125223f557602a6c4e9e14084fc32e021d30b16d558a Loading...

	img1.wsimg.com/traffic-assets/js/tccl.min.js	46 kB	2023-03-07	2023-10-15
Pretty URL img1.wsimg.com/traffic-assets/js/tccl.min.js IP 23.36.79.16 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:41 Last Seen2023-10-15 17:43:59 Times Seen9 Hash 362d20193a8fed115f99b16a157b7fc4 011964518b319a5aa479bf5c38bb8e15dd56138e 6cb0efedc1729d965016a35584cb00b03aa46e1a5e170f4b3ce092c7c3e99ec7 Loading...

	img1.wsimg.com/traffic-assets/js/tccl-tti.min.js	25 kB	2023-03-07	2024-02-02
Pretty URL img1.wsimg.com/traffic-assets/js/tccl-tti.min.js IP 23.36.79.16 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:41 Last Seen2024-02-02 18:24:37 Times Seen8238 Hash ce554d2333f3801abafb32da18213ff7 ef2b32494849244d9b9d8c23178e082cec9eab7f 6e74c12390bdb48bf5b0bb295ceed4f68add11467d2472d983a42e3023ecf312 Loading...

	ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html	337 B	2023-03-11	2023-03-11
Pretty URL ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html IP 23.229.226.1 ASN #398101 GO-DADDY-COM-LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 20:11:25 Last Seen2023-03-11 21:00:57 Times Seen1 Hash 73580e45272f30923bee4f078fb1c3f2 7eaa7a0daacda244562c471c39deb5314ac1d7cd 1cc1c1acfd1ff65290f90232ea9b1445d61e26dcbe0446fb542c447375d33ecc Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js	87 kB	2023-03-07	2024-04-16
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js IP 216.58.207.234 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-16 10:48:05 Times Seen104950 Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Loading...

HTTP Transactions (65)

URL IP Response Size

icrd.in/icrd.in?email=martin@slurpmail.net

103.50.163.30

301 Moved Permanently

258 B

URL HTTP/1.1
icrd.in/icrd.in?email=martin@slurpmail.net
IP
103.50.163.30:0
ASN
#394695 PUBLIC-DOMAIN-REGISTRY

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
258 B (258 bytes)
Hash
78539f303b4a86c86f4062a7d8963cd6
cf44475a3a0e690fd7413109a7cbcccb6c8e4d72
e93324323d6f16bee6ad51725cba2cf564935f8bb326d4e9b8410539fe296fc3

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /icrd.in?email=martin@slurpmail.net HTTP/1.1
Host: icrd.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Sat, 26 Nov 2022 23:16:19 GMT
Server: Apache
Location: https://icrd.in/icrd.in?email=martin@slurpmail.net
Content-Length: 258
Keep-Alive: timeout=5, max=75
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a9f1d4d98705c281fed3b60343463200
db6f8aa98d2eda4e5473b116a222c3055568bb78
164d11173045b569cafb32e300e4c1ec6d6ab177fd34d0414cc40c541268779f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "164D11173045B569CAFB32E300E4C1EC6D6AB177FD34D0414CC40C541268779F"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3355
Expires: Sun, 27 Nov 2022 00:12:14 GMT
Date: Sat, 26 Nov 2022 23:16:19 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
15b59d5e62caedb4bec3ba6724906c1e
960f801e608a56fdd11449f4face29f62cad2b21
8c72a45737c2eeddf328b0ed3236f3243551d904e94ec9dd7254972ebfb9229e

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 869
Cache-Control: max-age=127758
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:16:19 GMT
Etag: "6381eaec-1d7"
Expires: Mon, 28 Nov 2022 10:45:37 GMT
Last-Modified: Sat, 26 Nov 2022 10:31:08 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
260e9998c20d831b66f1029c8f47aac9
716d630f647c54dc69a7f9c63a6cac294b3df7f7
c9951a909f354174f0075a01c01c3c3aa6960983040e328bfbbbea81aeb405c2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C9951A909F354174F0075A01C01C3C3AA6960983040E328BFBBBEA81AEB405C2"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4205
Expires: Sun, 27 Nov 2022 00:26:24 GMT
Date: Sat, 26 Nov 2022 23:16:19 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
4d7e4eed097b9c4e5d509419f1cfc85a
290bb3d428a7c6330e2e3d73a952b16f820896c8
0dc9ca0f57af15adcd416035e92794711434e3d53a1feff21d8481d6d500986c

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Length, Alert, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 26 Nov 2022 22:17:33 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3526
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: NovBOvfCiLTbJga5cbhfgquUIqcXmw63jvcQvLVg+hL/cjuzWdbtTrcVqeWG7zmy5v3HUwFjWI4=
x-amz-request-id: RGBEBX79W5M93T9H
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 26 Nov 2022 22:41:23 GMT
age: 2096
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 26 Nov 2022 23:16:19 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e0c7d4d971ae956a43c85e157ba72f1d
ab1baa2a48a6ac212688a4ed5100d7900c665ced
aa4a95cb968f3cfd0024c9d324303817ccadd5453c1d38574d8172d1a803135d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AA4A95CB968F3CFD0024C9D324303817CCADD5453C1D38574D8172D1A803135D"
Last-Modified: Sat, 26 Nov 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Sun, 27 Nov 2022 05:16:19 GMT
Date: Sat, 26 Nov 2022 23:16:19 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 26 Nov 2022 23:11:12 GMT
cache-control: public,max-age=3600
age: 307
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

icrd.in/icrd.in?email=martin@slurpmail.net

103.50.163.30

301 Moved Permanently

259 B

URL HTTP/2
icrd.in/icrd.in?email=martin@slurpmail.net
IP
103.50.163.30:0
ASN
#394695 PUBLIC-DOMAIN-REGISTRY

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
259 B (259 bytes)
Hash
17ae46e04e2bba522f4c0a82775bd712
0f56c71a546059494d6c55bcee57c2963c73ef24
4e0ad22c06d41e75d1e771319fca0e6e6865a95ba3df13d24e640a2b1e295050

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /icrd.in?email=martin@slurpmail.net HTTP/1.1
Host: icrd.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 301 Moved Permanently
location: https://icrd.in/icrd.in/?email=martin@slurpmail.net
content-length: 259
content-type: text/html; charset=iso-8859-1
date: Sat, 26 Nov 2022 23:16:19 GMT
server: Apache
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
d3df71aab146eefc49acb608796aab63
8401892995193919376dfcd798b09c8261579454
a616c1e54e896576601e6107c1814adbebf35364d8ed807cdd89ac36b8200c88

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4988
Cache-Control: max-age=126820
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:16:19 GMT
Etag: "6381d72b-1d7"
Expires: Mon, 28 Nov 2022 10:29:59 GMT
Last-Modified: Sat, 26 Nov 2022 09:06:51 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

54.189.139.67

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.189.139.67:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: zkF9gcXVhONpaWUCBANKng==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: ZT+iAU2QvK9x0omgnJCEysyXQMI=

vps-185605ee.vps.ovh.ca/?email=martin@slurpmail.net

142.44.162.93

200 OK

189 B

URL HTTP/1.1
vps-185605ee.vps.ovh.ca/?email=martin@slurpmail.net
IP
142.44.162.93:0
ASN
#16276 OVH SAS

File type
HTML document, ASCII text
Size
189 B (189 bytes)
Hash
e0e18556a32d837c5752d6cd5de6439a
8a127bb3d38105535fc246856b90bcc994c7a8ac
ef5c3f582b6ad4504d1fb784d6efa8b300677c3f78b45cbd239ff43edc61b687

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /?email=martin@slurpmail.net HTTP/1.1
Host: vps-185605ee.vps.ovh.ca
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Sat, 26 Nov 2022 23:16:20 GMT
Server: Apache/2.4.41 (Ubuntu)
Set-Cookie: PHPSESSID=4asoe60u91fhcugsljp6u5s8in; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 189
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
619fa0039b94697fc8a5bd24f57e8aa2
53a366391a51d625029cc6d32fb4e8b6060990fd
dff604305831a0399aa44b2fac806e43512afa846569ba6e5685eca6495d9fa5

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:16:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

216.58.207.234

200 OK

30 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
IP
216.58.207.234:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (65451)
Size
30 kB (30399 bytes)
Hash
0f83cadc148d2ad7e53c91f6c4ee05bb
90035c5fffedf4b0f099465f6b929a030b46c92b
3f59aa77bbbed7760a9968af27d3c19ffddda021c948edf0bf0c0f828dd308ae

HTTP Headers

GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://vps-185605ee.vps.ovh.ca/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30399
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 23 Nov 2022 06:32:03 GMT
expires: Thu, 23 Nov 2023 06:32:03 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
age: 319457
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
619fa0039b94697fc8a5bd24f57e8aa2
53a366391a51d625029cc6d32fb4e8b6060990fd
dff604305831a0399aa44b2fac806e43512afa846569ba6e5685eca6495d9fa5

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:16:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12831
Expires: Sun, 27 Nov 2022 02:50:12 GMT
Date: Sat, 26 Nov 2022 23:16:21 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8387 bytes)
Hash
4e97baa4851785eac92c719abf481c64
c32a57038d3cdbc514c9081c9938eca6a04fb481
adb59e982648082e5421f58899a5331b2747e9d45be33c495fbe3ab8cc872b22

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8387
x-amzn-requestid: e4ce369f-7654-4c1a-94c2-70c913eb1a01
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cFL0tEcqIAMFXHw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637ec01d-37bd969f4cdfe220096b8c1f;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 00:51:41 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: __2hrJIdzCKzhuJ_YfbSSfz-WwyIqnPugk7P6SuYSjn6b2wwm0otCw==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 20:58:18 GMT
age: 8283
etag: "c32a57038d3cdbc514c9081c9938eca6a04fb481"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.8 kB (4803 bytes)
Hash
cc0a257323f882caff067adb86d906e4
cedf2f21be7cd366bd46055b62b5513db3011dfc
c16a9296d5e840a468fef7fb2764b9f7d4b3131d7ade2ce4999de1eead5469e0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4803
x-amzn-requestid: 80f7f1c8-0316-4181-83ac-2787b1ae825f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4iFHoIAMF2-g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-2c0a081b07e0785b4350c10c;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: AVwDLlKoy5pc9NNuR_OakMB0ONGAoO-k2AKwV--b2sjiaqYSKAWlZg==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:51:37 GMT
age: 5084
etag: "cedf2f21be7cd366bd46055b62b5513db3011dfc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html

23.229.226.1

200 OK

7.1 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5695), with CRLF line terminators
Size
7.1 kB (7077 bytes)
Hash
a75dea47535189364e3a1b7f0754dc36
59cd508468e2614194920f41754c709fbf38b624
bb6edf9ac2b2f45b3498393f58bbd09e462c2a06f64139239e574797f23108f7

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://vps-185605ee.vps.ovh.ca/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 22:26:28 GMT
etag: "820475e-a909-5ed75bb024d00-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 7077
content-type: text/html
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a7e16e2-9f5f-4739-817a-8a5447d80ee4.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.5 kB (9549 bytes)
Hash
099add42d39565e1a14ba60a61261a8d
7b0d859df11485329882daddcdd8ca85a1010e56
01a81962c06247835668581bcdd337320c62ba2121e94570f663396b6647c2b1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a7e16e2-9f5f-4739-817a-8a5447d80ee4.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9549
x-amzn-requestid: b99fc256-bdbd-4e59-bdec-b3f453cdfaac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b-50OFDDIAMFr1A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637c3ce7-75bc0aba74d71992450b11cb;Sampled=0
x-amzn-remapped-date: Tue, 22 Nov 2022 03:07:19 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: VOzEGsb5YWPA9-k63Jsb1Ejw9qoHfkH84GtbM2s7evsvv53iuh3Lug==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:54:18 GMT
age: 4923
etag: "7b0d859df11485329882daddcdd8ca85a1010e56"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F31dafe91-0b1b-40e9-927c-c01863516712.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9073 bytes)
Hash
ccb536b51f31391c89fb2abe3be6c749
c9a5ab962bfdd174aecd4809d770f0fe305ab8e4
b4b6f70603ab79399aeda1d8b7e8f2662da37b51a2d076b8e754c812b6fa5b47

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F31dafe91-0b1b-40e9-927c-c01863516712.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9073
x-amzn-requestid: 6cf20b75-6b27-4a34-97a8-017d7169f31b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b8JuVHY7IAMFtRg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637b2328-1ca76b3537613fb26358b8f2;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 07:05:12 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: lg8rdnHT_ndB-9CMrHcVN8a2xZCubuTEpUQ2m6i77l-NfdNfhfITEQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 cca7d60248a961ff8fc8c5640024b652.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 16:41:41 GMT
age: 23680
etag: "c9a5ab962bfdd174aecd4809d770f0fe305ab8e4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa78e81d9-dbc4-4911-9711-219f64026531.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10944 bytes)
Hash
5e586c141835f4ac8819c55dcb811b4d
a23fd98701ac35cd8740d1f7a832118c770e20c8
4296f391f755a649897a2211f9072c69a0510e43a313674908bb0a771b12650e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa78e81d9-dbc4-4911-9711-219f64026531.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10944
x-amzn-requestid: ed714e4a-0f80-4b2d-ae82-b28d617fe927
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b42xTGpSoAMF9Vw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6379d1a1-1235a4ad16a6bfee50615fbb;Sampled=0
x-amzn-remapped-date: Sun, 20 Nov 2022 07:05:05 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: UzVSiMniBPN9LTEIutLmWn7BZX7d5RWIxtH0H-RpLfIGqdIBTovGMg==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 28fdf6e146f70e7372911f118404fb20.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 22:36:11 GMT
age: 2410
etag: "a23fd98701ac35cd8740d1f7a832118c770e20c8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F297e7532-86f8-4631-9062-cdd6a291b40b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.1 kB (5099 bytes)
Hash
433875a1b1fef34e45f2d8ac344c07e3
f2129466436cbbdd58abe42a47fb7af19eba58e6
ab1e7b46f3804640c7dd94d70c8c31ec2dfc3e2f0f015a8556d04d9d9089c450

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F297e7532-86f8-4631-9062-cdd6a291b40b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5099
x-amzn-requestid: 57648043-7820-453d-9549-0f743b6c2557
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4jFBvoAMFl1w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-53b59d607b82c264180f469d;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: VsdLWuh4rCawI5V0YYGaHxEMl2YEVNgsbjfCwzDsrnCZhRK2FkCkVw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:51:41 GMT
age: 5080
etag: "f2129466436cbbdd58abe42a47fb7af19eba58e6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

img1.wsimg.com/traffic-assets/js/tccl.min.js

23.36.79.16

302 Found

0 B

URL HTTP/2
img1.wsimg.com/traffic-assets/js/tccl.min.js
IP
23.36.79.16:0
ASN
#20940 Akamai International B.V.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /traffic-assets/js/tccl.min.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 302 Found
content-length: 0
location: https://img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js
cache-control: max-age=1800
expires: Sat, 26 Nov 2022 23:46:21 GMT
date: Sat, 26 Nov 2022 23:16:21 GMT
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2

img1.wsimg.com/traffic-assets/js/tccl-tti.min.js

23.36.79.16

302 Found

0 B

URL HTTP/2
img1.wsimg.com/traffic-assets/js/tccl-tti.min.js
IP
23.36.79.16:0
ASN
#20940 Akamai International B.V.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /traffic-assets/js/tccl-tti.min.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 302 Found
content-length: 0
location: https://img6.wsimg.com/wrhs/ce554d2333f3801abafb32da18213ff7/tti.min.js
cache-control: max-age=1800
expires: Sat, 26 Nov 2022 23:46:21 GMT
date: Sat, 26 Nov 2022 23:16:21 GMT
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2

img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js

23.36.79.16

200 OK

11 kB

URL HTTP/2
img6.wsimg.com/wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js
IP
23.36.79.16:0
ASN
#20940 Akamai International B.V.

File type
ASCII text, with very long lines (45500)
Size
11 kB (11155 bytes)
Hash
1ac00b5d5abfa64175a140de3f29a8e2
c07c5611cfff3ec4c7034134e4148f177242908c
65198366099c4eea2ed8a4dbe30fbb7896435a3505c5265260715d3385058378

HTTP Headers

GET /wrhs/362d20193a8fed115f99b16a157b7fc4/tccl.min.js HTTP/1.1
Host: img6.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ibn-usa.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: application/javascript
accept-ranges: bytes
content-encoding: br
etag: "362d20193a8fed115f99b16a157b7fc4"
last-modified: Mon, 11 Apr 2022 14:15:53 GMT
vary: Accept-Encoding
x-amz-id-2: 73c+ZpWNgBh9xtilh6Nj22iH/BmUfkHwAgj9PgWHmvdTmSCUhi96da6Ell5SKHaif06RANK80zY=
x-amz-request-id: N5JSXGJTVEFZM8E9
x-amz-server-side-encryption: AES256
x-amz-version-id: Z0H0F1CdjRUI_nRMydHHi17Rv0HOw5tB
content-length: 11155
x-edgeconnect-midmile-rtt: 15, 15
x-edgeconnect-origin-mex-latency: 135, 135
x-edgeconnect-cache-status: 1
cache-control: max-age=31536000
date: Sat, 26 Nov 2022 23:16:21 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2

img6.wsimg.com/wrhs/ce554d2333f3801abafb32da18213ff7/tti.min.js

23.36.79.16

200 OK

7.5 kB

URL HTTP/2
img6.wsimg.com/wrhs/ce554d2333f3801abafb32da18213ff7/tti.min.js
IP
23.36.79.16:0
ASN
#20940 Akamai International B.V.

File type
ASCII text, with very long lines (24676)
Size
7.5 kB (7498 bytes)
Hash
b8a5a228a358454084c34dd1cf431c61
37aa5fe6e083b8147156ca66a1993a7bd74e8a61
06fae5ccf58a27a8e2ae6a0e7722f42db507c1873751f587cddd090810d94492

HTTP Headers

GET /wrhs/ce554d2333f3801abafb32da18213ff7/tti.min.js HTTP/1.1
Host: img6.wsimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ibn-usa.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: application/javascript
accept-ranges: bytes
content-encoding: br
etag: "ce554d2333f3801abafb32da18213ff7"
last-modified: Mon, 17 Jan 2022 17:21:37 GMT
vary: Accept-Encoding
x-edgeconnect-midmile-rtt: 8
x-edgeconnect-origin-mex-latency: 357
x-amz-id-2: nldPfdb2FYbpxPRfMYRSd83AOL7ZmlBdZQSm5hguJELKdfn8+sza0oLEpTYjiKd2JeD3gDplFHw=
x-amz-request-id: RJ3J3PMANG6125DE
x-amz-server-side-encryption: AES256
x-amz-version-id: F4fYptXBkP0fCCCWFLfVGE1HXlZmORny
content-length: 7498
x-edgeconnect-cache-status: 1
cache-control: max-age=31536000
date: Sat, 26 Nov 2022 23:16:21 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_1.html

23.229.226.1

200 OK

352 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_1.html
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (552)
Size
352 B (352 bytes)
Hash
b7d141292d39ce2efd1187f1118b862d
fcf0a237d51aa324d7b3018b89856ef7c14ead59
c846626fcadb369d584f02f5f2063b4ed1ccb30c658e7b53b0571b4c5e305d16

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/index_1.html HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 10 Dec 2020 18:29:52 GMT
etag: "820476a-a7-5b6205c948800-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 352
content-type: text/html
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_3.html

23.229.226.1

200 OK

409 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_3.html
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (552)
Size
409 B (409 bytes)
Hash
d2abd20ead15c1e8cf64d4de32dfcd38
ae523d556e4aa0407e7555c3a3474edea14cab5b
788d70613de3bf77bb25aaed0ed18a5f1e4d6f4e16cb757a1d41cbe46f4a7357

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/index_3.html HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 10 Dec 2020 18:29:52 GMT
etag: "820476c-147-5b6205c948800-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 409
content-type: text/html
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_5.html

23.229.226.1

200 OK

411 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_5.html
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (787), with no line terminators
Size
411 B (411 bytes)
Hash
71d652a19439391c857673a7dbc1e263
8b7502b2ec88743b4ef0c959e04de26cb4b6cb5d
c7001cd92344d028cf58f4c256f50a96da5ae82d2bbb4a1b6e904690b274160f

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/index_5.html HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:46 GMT
etag: "820476e-f2-5ed747a377f80-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 411
content-type: text/html
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_6.html

23.229.226.1

200 OK

396 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_6.html
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (559)
Size
396 B (396 bytes)
Hash
0a8edddc1c7fa3e69df868be354b16bd
efd15523faf74ce9d891bcc8a5c93c46a721c14e
5160ab7caa3d1d3d22e697b1a2f5e925aa8ec76115bea47fd594dd21c2898633

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/index_6.html HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:46 GMT
etag: "820476f-145-5ed747a377f80-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 396
content-type: text/html
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_2.html

23.229.226.1

200 OK

487 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_2.html
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (552)
Size
487 B (487 bytes)
Hash
ad758e0157fbcc6031cbfbd347170891
1b6048394c4a093e28948939c29ed6cf889d1f2b
49dbd9931d3e7fc773919b322a02b05640210817d041275020aba8da53a61ce8

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/index_2.html HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 10 Dec 2020 18:29:52 GMT
etag: "820476b-2bd-5b6205c948800-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 487
content-type: text/html
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/icp.gif

23.229.226.1

200 OK

43 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/icp.gif
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
GIF image data, version 89a, 2 x 2\012- data
Size
43 B (43 bytes)
Hash
ad480fd0732d0f6f1a8b06359e3a42bb
a544538683a2dfe574eeb2e358ac8fcc78289d50
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/icp.gif HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 10 Dec 2020 18:29:52 GMT
etag: "8204768-2b-5b6205c948800"
accept-ranges: bytes
content-length: 43
content-type: image/gif
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups-logo.svg

23.229.226.1

200 OK

997 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups-logo.svg
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1964), with no line terminators
Size
997 B (997 bytes)
Hash
b09b58079e1dcca9aeba59575c0e1291
659d87a86630a9be6d6e913af37254ccfc0e95b0
891b0e21b50fadcdeb416a467f7cbac49d84ba45e4e0dd14fa2da8a4c171fbd2

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/ups-logo.svg HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:46 GMT
etag: "820478a-7ac-5ed747a377f80-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 997
content-type: image/svg+xml
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/log.gif

23.229.226.1

200 OK

26 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/log.gif
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
GIF image data, version 89a, 1 x 1\012- data
Size
26 B (26 bytes)
Hash
6a43099d5c8fe991a7aa7ebaca53069d
5bce2f0d57305c58c7b05bfce29ebb39a18f5570
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/log.gif HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "8204772-1a-5ed747a18fb00"
accept-ranges: bytes
content-length: 26
content-type: image/gif
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.vendor.161a0d161a0d.css

23.229.226.1

200 OK

15 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.vendor.161a0d161a0d.css
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
Unicode text, UTF-8 text, with very long lines (65469)
Size
15 kB (15434 bytes)
Hash
3fcd7920fa9fca46665d8c839d1b3b50
e549e1d1fc18b29f85ee6c72acd4c31f1db3abe2
5ef094f3df7fe0e849f580dea35427f5f66a1a7d19632f5426900f48b25770be

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/ups.vendor.161a0d161a0d.css HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "8204790-1a7c0-5ed747a18fb00-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 15434
content-type: text/css
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css

23.229.226.1

200 OK

28 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
Unicode text, UTF-8 text, with very long lines (65429)
Size
28 kB (28347 bytes)
Hash
89308ea392f50999099240afd59f005c
9b54275ace83fd900f48a29ab2c7d157a8b54922
fe5601d60faf68ae3508f2b3fc8dd995b21a3968fe8c49cd49f008779c59be86

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "820478e-39159-5ed747a18fb00-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 28347
content-type: text/css
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/wr-dialog-close-btn-black.png

23.229.226.1

200 OK

256 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/wr-dialog-close-btn-black.png
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
PNG image data, 36 x 36, 8-bit gray+alpha, non-interlaced\012- data
Size
256 B (256 bytes)
Hash
fd495ca24c74d95ea3d5566a7cb25112
24682c91808ce607ab93b59c3bf7f343eba37e73
2547640cd989b80083eb3ade2a4993c1776a1229cfffd41adeb0fef3e86eaf2b

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/wr-dialog-close-btn-black.png HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "82047ca-100-5ed747a18fb00"
accept-ranges: bytes
content-length: 256
content-type: image/png
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/log-1.gif

23.229.226.1

200 OK

26 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/log-1.gif
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
GIF image data, version 89a, 1 x 1\012- data
Size
26 B (26 bytes)
Hash
6a43099d5c8fe991a7aa7ebaca53069d
5bce2f0d57305c58c7b05bfce29ebb39a18f5570
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/log-1.gif HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "8204771-1a-5ed747a18fb00"
accept-ranges: bytes
content-length: 26
content-type: image/gif
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582361&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=822046237&cv=2.0.0&z=38543718&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=edf2ae20-84ad-5452-8245-7b10f90861f8&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582361&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=822046237&cv=2.0.0&z=38543718&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=edf2ae20-84ad-5452-8245-7b10f90861f8&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582361&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=822046237&cv=2.0.0&z=38543718&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=edf2ae20-84ad-5452-8245-7b10f90861f8&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582462&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=822046237&cv=2.0.0&z=882100724&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=d2f407f1-88e5-594a-acf0-bb69547ad5c4&ht=perf&tce=1669504581300&tcs=1669504581300&tdc=1669504582414&tdclee=1669504582414&tdcles=1669504582414&tdi=1669504582367&tdl=1669504581523&tdle=1669504581300&tdls=1669504581300&tfs=1669504581300&tns=1669504581300&trqs=1669504581367&tre=1669504581519&trps=1669504581518&tles=1669504582414&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582462&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=822046237&cv=2.0.0&z=882100724&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=d2f407f1-88e5-594a-acf0-bb69547ad5c4&ht=perf&tce=1669504581300&tcs=1669504581300&tdc=1669504582414&tdclee=1669504582414&tdcles=1669504582414&tdi=1669504582367&tdl=1669504581523&tdle=1669504581300&tdls=1669504581300&tfs=1669504581300&tns=1669504581300&trqs=1669504581367&tre=1669504581519&trps=1669504581518&tles=1669504582414&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582462&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=822046237&cv=2.0.0&z=882100724&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=d2f407f1-88e5-594a-acf0-bb69547ad5c4&ht=perf&tce=1669504581300&tcs=1669504581300&tdc=1669504582414&tdclee=1669504582414&tdcles=1669504582414&tdi=1669504582367&tdl=1669504581523&tdle=1669504581300&tdls=1669504581300&tfs=1669504581300&tns=1669504581300&trqs=1669504581367&tre=1669504581519&trps=1669504581518&tles=1669504582414&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582451&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=953443902&cv=2.0.0&z=1940169671&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_1.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=9b2b76a0-5ba1-5579-bdee-5fc56d0376f4&ht=perf&tce=1669504581297&tcs=1669504581297&tdc=1669504582405&tdclee=1669504582405&tdcles=1669504582405&tdi=1669504582353&tdl=1669504581521&tdle=1669504581297&tdls=1669504581297&tfs=1669504581297&tns=1669504581297&trqs=1669504581365&tre=1669504581517&trps=1669504581517&tles=1669504582405&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582451&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=953443902&cv=2.0.0&z=1940169671&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_1.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=9b2b76a0-5ba1-5579-bdee-5fc56d0376f4&ht=perf&tce=1669504581297&tcs=1669504581297&tdc=1669504582405&tdclee=1669504582405&tdcles=1669504582405&tdi=1669504582353&tdl=1669504581521&tdle=1669504581297&tdls=1669504581297&tfs=1669504581297&tns=1669504581297&trqs=1669504581365&tre=1669504581517&trps=1669504581517&tles=1669504582405&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582451&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=953443902&cv=2.0.0&z=1940169671&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_1.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=9b2b76a0-5ba1-5579-bdee-5fc56d0376f4&ht=perf&tce=1669504581297&tcs=1669504581297&tdc=1669504582405&tdclee=1669504582405&tdcles=1669504582405&tdi=1669504582353&tdl=1669504581521&tdle=1669504581297&tdls=1669504581297&tfs=1669504581297&tns=1669504581297&trqs=1669504581365&tre=1669504581517&trps=1669504581517&tles=1669504582405&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582446&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=264275250&cv=2.0.0&z=689291920&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=51595eae-1275-5b01-990d-83c451f15345&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582446&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=264275250&cv=2.0.0&z=689291920&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=51595eae-1275-5b01-990d-83c451f15345&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582446&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=264275250&cv=2.0.0&z=689291920&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=51595eae-1275-5b01-990d-83c451f15345&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582350&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=953443902&cv=2.0.0&z=1064134859&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_1.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=c06e19d0-fbe6-558c-8590-40135e0a716e&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582350&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=953443902&cv=2.0.0&z=1064134859&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_1.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=c06e19d0-fbe6-558c-8590-40135e0a716e&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582350&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=953443902&cv=2.0.0&z=1064134859&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_1.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=c06e19d0-fbe6-558c-8590-40135e0a716e&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582376&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1718543168&cv=2.0.0&z=1271328373&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_5.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=6534cd8b-3e5a-56fa-9bb6-647e2b96f0a4&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582376&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1718543168&cv=2.0.0&z=1271328373&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_5.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=6534cd8b-3e5a-56fa-9bb6-647e2b96f0a4&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582376&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1718543168&cv=2.0.0&z=1271328373&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_5.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=6534cd8b-3e5a-56fa-9bb6-647e2b96f0a4&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582467&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1313264790&cv=2.0.0&z=660571309&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_6.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=64df83e0-f167-5564-9976-661021c400e2&ht=perf&tce=1669504581301&tcs=1669504581301&tdc=1669504582421&tdclee=1669504582421&tdcles=1669504582421&tdi=1669504582391&tdl=1669504581549&tdle=1669504581301&tdls=1669504581301&tfs=1669504581301&tns=1669504581301&trqs=1669504581375&tre=1669504581528&trps=1669504581527&tles=1669504582421&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582467&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1313264790&cv=2.0.0&z=660571309&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_6.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=64df83e0-f167-5564-9976-661021c400e2&ht=perf&tce=1669504581301&tcs=1669504581301&tdc=1669504582421&tdclee=1669504582421&tdcles=1669504582421&tdi=1669504582391&tdl=1669504581549&tdle=1669504581301&tdls=1669504581301&tfs=1669504581301&tns=1669504581301&trqs=1669504581375&tre=1669504581528&trps=1669504581527&tles=1669504582421&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582467&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1313264790&cv=2.0.0&z=660571309&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_6.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=64df83e0-f167-5564-9976-661021c400e2&ht=perf&tce=1669504581301&tcs=1669504581301&tdc=1669504582421&tdclee=1669504582421&tdcles=1669504582421&tdi=1669504582391&tdl=1669504581549&tdle=1669504581301&tdls=1669504581301&tfs=1669504581301&tns=1669504581301&trqs=1669504581375&tre=1669504581528&trps=1669504581527&tles=1669504582421&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582464&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1718543168&cv=2.0.0&z=348840955&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_5.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=7988ea05-ad4d-5611-92a1-8429b95d4d54&ht=perf&tce=1669504581301&tcs=1669504581301&tdc=1669504582419&tdclee=1669504582419&tdcles=1669504582419&tdi=1669504582379&tdl=1669504581543&tdle=1669504581301&tdls=1669504581301&tfs=1669504581301&tns=1669504581301&trqs=1669504581375&tre=1669504581527&trps=1669504581527&tles=1669504582419&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582464&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1718543168&cv=2.0.0&z=348840955&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_5.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=7988ea05-ad4d-5611-92a1-8429b95d4d54&ht=perf&tce=1669504581301&tcs=1669504581301&tdc=1669504582419&tdclee=1669504582419&tdcles=1669504582419&tdi=1669504582379&tdl=1669504581543&tdle=1669504581301&tdls=1669504581301&tfs=1669504581301&tns=1669504581301&trqs=1669504581375&tre=1669504581527&trps=1669504581527&tles=1669504582419&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582464&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1718543168&cv=2.0.0&z=348840955&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_5.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=7988ea05-ad4d-5611-92a1-8429b95d4d54&ht=perf&tce=1669504581301&tcs=1669504581301&tdc=1669504582419&tdclee=1669504582419&tdcles=1669504582419&tdi=1669504582379&tdl=1669504581543&tdle=1669504581301&tdls=1669504581301&tfs=1669504581301&tns=1669504581301&trqs=1669504581375&tre=1669504581527&trps=1669504581527&tles=1669504582419&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582388&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1313264790&cv=2.0.0&z=940343835&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_6.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=30da42ce-ee5b-5692-96c0-17153da661e4&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582388&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1313264790&cv=2.0.0&z=940343835&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_6.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=30da42ce-ee5b-5692-96c0-17153da661e4&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582388&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=1313264790&cv=2.0.0&z=940343835&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_6.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=30da42ce-ee5b-5692-96c0-17153da661e4&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery-mobile-G-1140202360-Q421.jpg

23.229.226.1

200 OK

72 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery-mobile-G-1140202360-Q421.jpg
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
JPEG image data, JFIF standard 1.01, resolution (DPCM), density 39x39, segment length 16, progressive, precision 8, 960x540, components 3\012- data
Size
72 kB (71774 bytes)
Hash
42481d3552007e6a930c3517ff1d69b3
7a6bc4e879af29505626837e9af08d2dc4a7e9a7
6946038b8e75dbd1d84b16454572a388005bcb3880a0202e660ac3ec7ef6d320

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery-mobile-G-1140202360-Q421.jpg HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "820475b-1185e-5ed747a18fb00"
accept-ranges: bytes
content-length: 71774
content-type: image/jpeg
date: Sat, 26 Nov 2022 23:16:21 GMT
server: Apache
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582474&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=264275250&cv=2.0.0&z=1808933975&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=a3a51e87-3845-5102-a570-4d6873b563b5&ht=perf&tce=1669504581718&tcs=1669504581718&tdc=1669504582458&tdclee=1669504582455&tdcles=1669504582455&tdi=1669504582448&tdl=1669504581933&tdle=1669504581718&tdls=1669504581718&tfs=1669504581718&tns=1669504581718&trqs=1669504581718&tre=1669504581933&trps=1669504581925&tles=1669504582458&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582474&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=264275250&cv=2.0.0&z=1808933975&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=a3a51e87-3845-5102-a570-4d6873b563b5&ht=perf&tce=1669504581718&tcs=1669504581718&tdc=1669504582458&tdclee=1669504582455&tdcles=1669504582455&tdi=1669504582448&tdl=1669504581933&tdle=1669504581718&tdls=1669504581718&tfs=1669504581718&tns=1669504581718&trqs=1669504581718&tre=1669504581933&trps=1669504581925&tles=1669504582458&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582474&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=264275250&cv=2.0.0&z=1808933975&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_3.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=a3a51e87-3845-5102-a570-4d6873b563b5&ht=perf&tce=1669504581718&tcs=1669504581718&tdc=1669504582458&tdclee=1669504582455&tdcles=1669504582455&tdi=1669504582448&tdl=1669504581933&tdle=1669504581718&tdls=1669504581718&tfs=1669504581718&tns=1669504581718&trqs=1669504581718&tre=1669504581933&trps=1669504581925&tles=1669504582458&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:22 GMT
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_4.html

23.229.226.1

200 OK

391 B

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_4.html
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (552)
Size
391 B (391 bytes)
Hash
4347b7827ce6286fd87e48c6b9e2d9c8
b5ca1b0d3e730ac1cda43057d0c59c8fab79d0d9
44a411760883099c7d8bad8ba3883eb23b5ade3327a74691ecadf215fc83fd0b

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/index_4.html HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/index_2.html
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 10 Dec 2020 18:29:52 GMT
etag: "820476d-f1-5b6205c948800-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 391
content-type: text/html
date: Sat, 26 Nov 2022 23:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/83c0873d77bec83dc27c01d016052abd333b7f2b

23.229.226.1

200 OK

2.8 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/83c0873d77bec83dc27c01d016052abd333b7f2b
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 2848, version 1.0\012- data
Size
2.8 kB (2848 bytes)
Hash
b12d0fb04db22dfcd3d336f79132be33
83c0873d77bec83dc27c01d016052abd333b7f2b
34c9719f7d735cabd8a39cc35659e8156e008d790d7813192c2c0ca789e99e44

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/83c0873d77bec83dc27c01d016052abd333b7f2b HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css
Cookie: _tccl_visitor=4601f1e8-1de3-5196-930d-c5bf20aebd05; _tccl_visit=4601f1e8-1de3-5196-930d-c5bf20aebd05
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "820475a-b20-5ed747a18fb00"
accept-ranges: bytes
content-length: 2848
vary: Accept-Encoding
date: Sat, 26 Nov 2022 23:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/social-icons-2022.png

23.229.226.1

200 OK

1.6 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/social-icons-2022.png
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
PNG image data, 20 x 140, 8-bit gray+alpha, non-interlaced\012- data
Size
1.6 kB (1603 bytes)
Hash
23374f94f3945cea305e76ba2aea4b9d
5effde69d2b3ce2fe4513f2e07deeca837f116dc
f7e2e8a3f19496cef8f3a2ca6669d41d08a6b76163837239ea8a85b55b6b8fd7

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/social-icons-2022.png HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css
Cookie: _tccl_visitor=4601f1e8-1de3-5196-930d-c5bf20aebd05; _tccl_visit=4601f1e8-1de3-5196-930d-c5bf20aebd05
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "8204781-643-5ed747a18fb00"
accept-ranges: bytes
content-length: 1603
content-type: image/png
date: Sat, 26 Nov 2022 23:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582959&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=2047217803&cv=2.0.0&z=691725015&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_4.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=94ba4a13-08eb-560e-98c6-6936a662be08&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582959&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=2047217803&cv=2.0.0&z=691725015&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_4.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=94ba4a13-08eb-560e-98c6-6936a662be08&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582959&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=2047217803&cv=2.0.0&z=691725015&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_4.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=94ba4a13-08eb-560e-98c6-6936a662be08&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:23 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582398&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=348105539&cv=2.0.0&z=1381460272&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=5ae8d9af-a43a-56bf-98b9-8db592d74456&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582398&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=348105539&cv=2.0.0&z=1381460272&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=5ae8d9af-a43a-56bf-98b9-8db592d74456&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582398&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=348105539&cv=2.0.0&z=1381460272&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=5ae8d9af-a43a-56bf-98b9-8db592d74456&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:23 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582969&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=2047217803&cv=2.0.0&z=792429058&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_4.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=d44249b3-d7b4-5dac-8bfa-24d85ed53d37&ht=perf&tce=1669504581717&tcs=1669504581717&tdc=1669504582963&tdclee=1669504582963&tdcles=1669504582962&tdi=1669504582962&tdl=1669504582899&tdle=1669504581717&tdls=1669504581717&tfs=1669504581717&tns=1669504581717&trqs=1669504581924&tre=1669504582861&trps=1669504582861&tles=1669504582963&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582969&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=2047217803&cv=2.0.0&z=792429058&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_4.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=d44249b3-d7b4-5dac-8bfa-24d85ed53d37&ht=perf&tce=1669504581717&tcs=1669504581717&tdc=1669504582963&tdclee=1669504582963&tdcles=1669504582962&tdi=1669504582962&tdl=1669504582899&tdle=1669504581717&tdls=1669504581717&tfs=1669504581717&tns=1669504581717&trqs=1669504581924&tre=1669504582861&trps=1669504582861&tles=1669504582963&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582969&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=2047217803&cv=2.0.0&z=792429058&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_4.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=d44249b3-d7b4-5dac-8bfa-24d85ed53d37&ht=perf&tce=1669504581717&tcs=1669504581717&tdc=1669504582963&tdclee=1669504582963&tdcles=1669504582962&tdi=1669504582962&tdl=1669504582899&tdle=1669504581717&tdls=1669504581717&tfs=1669504581717&tns=1669504581717&trqs=1669504581924&tre=1669504582861&trps=1669504582861&tles=1669504582963&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:23 GMT
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Bold.woff

23.229.226.1

200 OK

27 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Bold.woff
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 26564, version 1.0\012- data
Size
27 kB (26564 bytes)
Hash
849fd0ec4277f2e8ee9ebe2753a30edd
ebcff6b5216b7cfdacc058ab35023c6f9bd6f286
5fce1e38ce56a7e63a78d5811e54679dba8cd15d6455cf312f4d2bd886e42d36

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Bold.woff HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css
Cookie: _tccl_visitor=4601f1e8-1de3-5196-930d-c5bf20aebd05; _tccl_visit=4601f1e8-1de3-5196-930d-c5bf20aebd05
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "8204777-67c4-5ed747a18fb00"
accept-ranges: bytes
content-length: 26564
vary: Accept-Encoding
content-type: font/woff
date: Sat, 26 Nov 2022 23:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Regular.woff

23.229.226.1

200 OK

26 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Regular.woff
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 26152, version 1.0\012- data
Size
26 kB (26152 bytes)
Hash
c1de44acf1411a188b1efb3e415e66b8
2a9601e8dd8dd62422139ab415101d13542c31bf
444b94c2f00b433b4297bc32a247be7d30db791abb13d9d77bbec032c141eb46

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Regular.woff HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css
Cookie: _tccl_visitor=4601f1e8-1de3-5196-930d-c5bf20aebd05; _tccl_visit=4601f1e8-1de3-5196-930d-c5bf20aebd05
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "820477e-6628-5ed747a18fb00"
accept-ranges: bytes
content-length: 26152
vary: Accept-Encoding
content-type: font/woff
date: Sat, 26 Nov 2022 23:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582971&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=348105539&cv=2.0.0&z=893904243&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=fe2f40a3-f8a4-5cc3-a084-acfcccfbeaf0&ht=perf&tce=1669504581302&tcs=1669504581302&tdc=1669504582965&tdclee=1669504582432&tdcles=1669504582432&tdi=1669504582401&tdl=1669504581712&tdle=1669504581302&tdls=1669504581302&tfs=1669504581302&tns=1669504581302&trqs=1669504581375&tre=1669504581686&trps=1669504581685&tles=1669504582965&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582971&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=348105539&cv=2.0.0&z=893904243&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=fe2f40a3-f8a4-5cc3-a084-acfcccfbeaf0&ht=perf&tce=1669504581302&tcs=1669504581302&tdc=1669504582965&tdclee=1669504582432&tdcles=1669504582432&tdi=1669504582401&tdl=1669504581712&tdle=1669504581302&tdls=1669504581302&tfs=1669504581302&tns=1669504581302&trqs=1669504581375&tre=1669504581686&trps=1669504581685&tles=1669504582965&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582971&dh=ibn-usa.com&dr=https%3A%2F%2Fibn-usa.com%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=348105539&cv=2.0.0&z=893904243&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Findex_2.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=fe2f40a3-f8a4-5cc3-a084-acfcccfbeaf0&ht=perf&tce=1669504581302&tcs=1669504581302&tdc=1669504582965&tdclee=1669504582432&tdcles=1669504582432&tdi=1669504582401&tdl=1669504581712&tdle=1669504581302&tdls=1669504581302&tfs=1669504581302&tns=1669504581302&trqs=1669504581375&tre=1669504581686&trps=1669504581685&tles=1669504582965&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:23 GMT
X-Firefox-Spdy: h2

ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Medium.woff

23.229.226.1

200 OK

94 kB

URL HTTP/2
ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Medium.woff
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
Web Open Font Format, TrueType, length 94364, version 2.137\012- data
Size
94 kB (94364 bytes)
Hash
7350337b673e86f2d62ee0eb5761e1e2
eb11f6c75c34069217cc1692d00e8ac3945c8a3d
4f543ad26c42709ef00a1921f7dd1aa27a1930a354ecb353196665e43dac3706

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /schedule/https.ssl-secured.ups.com/ca-en/track/Roboto-Medium.woff HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/ups.styles.546e727abfb6.css
Cookie: _tccl_visitor=4601f1e8-1de3-5196-930d-c5bf20aebd05; _tccl_visit=4601f1e8-1de3-5196-930d-c5bf20aebd05
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 14 Nov 2022 20:56:44 GMT
etag: "820477b-1709c-5ed747a18fb00"
accept-ranges: bytes
content-length: 94364
vary: Accept-Encoding
content-type: font/woff
date: Sat, 26 Nov 2022 23:16:22 GMT
server: Apache
X-Firefox-Spdy: h2

ibn-usa.com/favicon.ico

23.229.226.1

404 Not Found

703 B

URL HTTP/2
ibn-usa.com/favicon.ico
IP
23.229.226.1:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
703 B (703 bytes)
Hash
8216b2246391d668b222b10fa7a8e365
4bb7699205a3dbd1e233b95769b6f09df666b3b7
4bd052f5166736de11ae4b9f8a7b8260c86928468f110b96666eed387e37b719

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: ibn-usa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ibn-usa.com/schedule/https.ssl-secured.ups.com/ca-en/track/change-delivery.page.html
Cookie: _tccl_visitor=4601f1e8-1de3-5196-930d-c5bf20aebd05; _tccl_visit=4601f1e8-1de3-5196-930d-c5bf20aebd05
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 703
content-type: text/html
date: Sat, 26 Nov 2022 23:16:23 GMT
server: Apache
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504582260&dh=ibn-usa.com&dr=http%3A%2F%2Fvps-185605ee.vps.ovh.ca%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=932755269&cv=2.0.0&z=64345037&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=3f9d9d7b-538b-5b57-a324-8161d5d73253&ht=pageview

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504582260&dh=ibn-usa.com&dr=http%3A%2F%2Fvps-185605ee.vps.ovh.ca%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=932755269&cv=2.0.0&z=64345037&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=3f9d9d7b-538b-5b57-a324-8161d5d73253&ht=pageview
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504582260&dh=ibn-usa.com&dr=http%3A%2F%2Fvps-185605ee.vps.ovh.ca%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=932755269&cv=2.0.0&z=64345037&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=3f9d9d7b-538b-5b57-a324-8161d5d73253&ht=pageview HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:23 GMT
X-Firefox-Spdy: h2

events.api.secureserver.net/t/1/tl/event?cts=1669504583484&dh=ibn-usa.com&dr=http%3A%2F%2Fvps-185605ee.vps.ovh.ca%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=932755269&cv=2.0.0&z=1438729819&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=f29d917f-f887-5fce-926d-76c32ba392f9&ht=perf&tce=1669504581118&tcs=1669504580658&tdc=1669504583476&tdclee=1669504582264&tdcles=1669504582263&tdi=1669504582261&tdl=1669504581283&tdle=1669504580658&tdls=1669504580585&tfs=1669504580577&tns=1669504580577&trqs=1669504581118&tre=1669504581274&trps=1669504581274&tles=1669504583476&tlee=0&nt=navigate&nav_type=hard

104.84.152.186

200 OK

43 B

URL HTTP/2
events.api.secureserver.net/t/1/tl/event?cts=1669504583484&dh=ibn-usa.com&dr=http%3A%2F%2Fvps-185605ee.vps.ovh.ca%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=932755269&cv=2.0.0&z=1438729819&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=f29d917f-f887-5fce-926d-76c32ba392f9&ht=perf&tce=1669504581118&tcs=1669504580658&tdc=1669504583476&tdclee=1669504582264&tdcles=1669504582263&tdi=1669504582261&tdl=1669504581283&tdle=1669504580658&tdls=1669504580585&tfs=1669504580577&tns=1669504580577&trqs=1669504581118&tre=1669504581274&trps=1669504581274&tles=1669504583476&tlee=0&nt=navigate&nav_type=hard
IP
104.84.152.186:0
ASN
#20940 Akamai International B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

HTTP Headers

GET /t/1/tl/event?cts=1669504583484&dh=ibn-usa.com&dr=http%3A%2F%2Fvps-185605ee.vps.ovh.ca%2F&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&vci=932755269&cv=2.0.0&z=1438729819&vg=4601f1e8-1de3-5196-930d-c5bf20aebd05&vtg=4601f1e8-1de3-5196-930d-c5bf20aebd05&dp=%2Fschedule%2Fhttps.ssl-secured.ups.com%2Fca-en%2Ftrack%2Fchange-delivery.page.html&ap=cpsh&trfd=%7B%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22p3plcpnl0579%22%2C%22dcenter%22%3A%22p3%22%2C%22id%22%3A%226513755%22%7D&hit_id=f29d917f-f887-5fce-926d-76c32ba392f9&ht=perf&tce=1669504581118&tcs=1669504580658&tdc=1669504583476&tdclee=1669504582264&tdcles=1669504582263&tdi=1669504582261&tdl=1669504581283&tdle=1669504580658&tdls=1669504580585&tfs=1669504580577&tns=1669504580577&trqs=1669504581118&tre=1669504581274&trps=1669504581274&tles=1669504583476&tlee=0&nt=navigate&nav_type=hard HTTP/1.1
Host: events.api.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ibn-usa.com
Connection: keep-alive
Referer: https://ibn-usa.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-type: image/gif
content-length: 43
access-control-allow-origin: https://ibn-usa.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
cache-control: private
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
date: Sat, 26 Nov 2022 23:16:23 GMT
X-Firefox-Spdy: h2

icrd.in/icrd.in/?email=martin@slurpmail.net

103.50.163.30

302 Found

0 B

URL HTTP/2
icrd.in/icrd.in/?email=martin@slurpmail.net
IP
103.50.163.30:0
ASN
#394695 PUBLIC-DOMAIN-REGISTRY

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /icrd.in/?email=martin@slurpmail.net HTTP/1.1
Host: icrd.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

HTTP/2 302 Found
content-encoding: gzip
vary: Accept-Encoding
location: http://vps-185605ee.vps.ovh.ca?email=martin@slurpmail.net
content-type: text/html; charset=UTF-8
date: Sat, 26 Nov 2022 23:16:19 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (65)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type