Overview

URLalawaelafrica.com/.ojnew/tmp/bGluZGFAbWVycmVsbGJyb3MuY29t
IP 65.108.234.151 (Finland)
ASN#24940 Hetzner Online GmbH
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-26 15:00:52 UTC
StatusLoading report..
IDS alerts0
Blocklist alert4
urlquery alerts
2
Phishing - Microsoft Outlook
Tags phishing microsoft outlook

Domain Summary (3)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
alawaelafrica.com (1) 0 2023-05-26 16:11:33 2023-05-26 16:11:33 513 382 65.108.234.151
0gpilhhtlb646b2a32a499c.ocupac.ru (5) 0 2023-05-26 16:11:37 2023-05-26 16:11:37 2556 75113 104.21.88.100
challenges.cloudflare.com (6) 0 2021-10-20 07:02:03 2023-05-26 08:33:42 3878 399374 104.18.6.185

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com Phishing
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/images/trace/managed/js/transpare (...) Phishing
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/orchestrat (...) Phishing
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/1 (...) Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 65.108.234.151
Date UQ / IDS / BL URL IP
2023-06-05 13:36:20 UTC 2 - 0 - 0 fananews.com/ghstmn/zcd0l7/YWJlcm1hbkBhbGxldm (...) 65.108.234.151
2023-06-05 06:53:08 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/YXZhbmJ1cmVuQHBv (...) 65.108.234.151
2023-06-02 20:52:38 UTC 2 - 0 - 0 fananews.com/ghstmn/lodywx/Ym1hbm5Aa2luZ2RvbW (...) 65.108.234.151
2023-05-30 15:22:40 UTC 2 - 0 - 1 fananews.com/ghstmn/xzrbpu/YXNldGhAZW5hYmxlY2 (...) 65.108.234.151
2023-05-29 17:21:38 UTC 2 - 0 - 0 fananews.com/ghstmn/wsbrnl/YXZpc2hhaS53b29sQG (...) 65.108.234.151


Last 5 reports on ASN: Hetzner Online GmbH
Date UQ / IDS / BL URL IP
2023-06-06 06:18:52 UTC 0 - 2 - 0 www.bizbuyorsellflorida.com/~hotelesm/start/s (...) 85.10.196.186
2023-06-06 06:04:54 UTC 0 - 6 - 0 hitmarket.com.ua/_exchange/opt/knewm%20ma/ide (...) 148.251.233.15
2023-06-06 06:03:51 UTC 0 - 0 - 2 apart-benidorm.es/nedsecur.stm/login.php?sess (...) 5.9.48.70
2023-06-06 06:03:37 UTC 0 - 5 - 0 hitmarket.com.ua/_exchange/opt/knewm%20ma/ide (...) 148.251.233.15
2023-06-06 05:41:01 UTC 0 - 0 - 1 incunabula.pavladev.gr/online/a1b2c3/3b234100 (...) 95.216.44.16


Last 5 reports on domain: alawaelafrica.com
Date UQ / IDS / BL URL IP
2023-06-05 06:53:08 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/YXZhbmJ1cmVuQHBv (...) 65.108.234.151
2023-05-26 17:35:24 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/Y3VydC5sYXduaWNr (...) 65.108.234.151
2023-05-26 16:08:20 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/Z2JhcnJldHRAZm1n (...) 65.108.234.151
2023-05-26 15:00:52 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/bGluZGFAbWVycmVs (...) 65.108.234.151
2023-05-26 14:15:16 UTC 2 - 0 - 5 alawaelafrica.com/.ojnew/tmp/c3dhbHZpdXNAc2hl (...) 65.108.234.151


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 06:05:59 UTC 0 - 0 - 0 swlwd.rinkle.ru/ 104.21.91.110
2023-06-06 05:57:39 UTC 0 - 4 - 0 agnes-nue.com/image/putty.exe 46.166.189.98
2023-06-06 04:23:26 UTC 0 - 1 - 0 yuen.de/UPS-Invoice-for-downloads-919/ 81.169.145.92
2023-06-06 04:22:55 UTC 0 - 1 - 2 212.83.186.136/setup-15.exe 212.83.186.136
2023-06-06 04:22:25 UTC 0 - 1 - 0 hansworst.xyz/Flappy%20Hans.exe 103.224.182.210

JavaScript

Executed Scripts (6)

Executed Evals (3)
#1 JavaScript::Eval (size: 4) - SHA256: 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408
this
#2 JavaScript::Eval (size: 1045) - SHA256: e10b14e05750fe6bddac622dbadf6d1ae56d4f4b7bf90da7188620c5b84945b6
0,
function(OxmbZ2) {
    var l, c;
    l = b,
        function(f, g, k, h, i) {
            for (k = b, h = f(); !![];) try {
                if (i = -parseInt(k(413)) / 1 + -parseInt(k(398)) / 2 + -parseInt(k(406)) / 3 * (parseInt(k(396)) / 4) + -parseInt(k(415)) / 5 + -parseInt(k(395)) / 6 * (-parseInt(k(407)) / 7) + -parseInt(k(416)) / 8 * (parseInt(k(404)) / 9) + parseInt(k(410)) / 10 * (parseInt(k(409)) / 11), i === g) break;
                else h.push(h.shift())
            } catch (j) {
                h.push(h.shift())
            }
        }(a, 178144);
    try {
        throw Error(l(402))
    } catch (d) {
        c = d[l(412)] + ',' + d[l(411)]
    }
    c = [navigator[l(400)], navigator[l(405)], c.replace(/([\s{};()@]|[-+]{2}|default)+/g, '')[l(414)](0, 70), document[l(403)](l(397))[l(399)], window[l(408)](function() {}, 100)], window[l(401)][window[l(401)][l(394)]].a = c[2];

    function a(m) {
        return m = 'scriptd709658VBGtgJdlengthduserAgentd_cf_chl_ctxdNinjas > piratesdquerySelectorAlld36nAwLIOdplatformd15342GZHtzId340739YpABLbdsetIntervald22mELPmPd7624180VGmWkZdstackdmessaged134381GFZWRgdsubstringd1557105JHZnzDd586024FMBcQRdchCd6zBJtKDd236XGeeTw'.split('d'), a = function() {
            return m
        }, a()
    }

    function b(c, d, e) {
        return e = a(), b = function(f, g, h) {
            return f = f - 394, h = e[f], h
        }, b(c, d)
    }
}
#3 JavaScript::Eval (size: 464) - SHA256: 90835a4afd9508017b690aeb790126fde251afefb69de53e20f610843dd89885
+((!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + []) + (!+[] + (!![]) + (!![])) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (!+-[] + (+-!![]) + -[]) + (!+[] + (!![]) + (!![]) + !![]) + (-~~~[]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![]) + (-~~~[])) / +((-~~~[] + []) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (-~~~[]) + (!+[] + (!![]) - []) + (-~~~[]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) - []) + (-~~~[]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]))

Executed Writes (0)


HTTP Transactions (12)


Request Response
                                        
                                            GET /.ojnew/tmp/bGluZGFAbWVycmVsbGJyb3MuY29t HTTP/1.1 
Host: alawaelafrica.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             65.108.234.151
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 15:00:35 GMT
Server: Apache
Location: https://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   109
Md5:    83eb68b52fbfd12c0180e190c9d1e1b0
Sha1:   a0880aff29e5e19c0e917817526371b0411cdbe6
Sha256: d5875cda6169192a7e3b8f1b1fb92303544681b4dc9c7dff9574e5e55ad56d6e

urlquery:
  - Phishing - Microsoft Outlook
                                        
                                            GET /Mlinda@merrellbros.com HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 15:00:35 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ENXG65jOr5TEQTo6oTzQZ%2FBI0tow5Uy2hNLdX1GCLtQDBpesSlGoIa52N5x3NMzXXUCIGvZEv04xQ6L5ikQbEANXPKnGJ4QkW9TlZII2uP9xavlW7v31kZ%2BimSV1ftrURWXbOHLOsunzRp%2BApKGBQnf8MBs%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6e379380cb512-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1769), with CRLF, LF line terminators
Size:   3622
Md5:    0027feb962ff7514588200d463c2632b
Sha1:   a922fcb4e9d582f8eb82db110ff0961df4566e85
Sha256: a3e525027149412ad68c0f556c409225c4f2420706022319f72cd2b4beb6ab9b

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd6e379380cb512 HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Fri, 26 May 2023 15:00:35 GMT
Content-Length: 42
Connection: keep-alive
Last-Modified: Thu, 25 May 2023 08:39:03 GMT
ETag: "646f1ea7-2a"
Server: cloudflare
CF-RAY: 7cd6e37a0bf80b02-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 26 May 2023 17:00:35 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd6e379380cb512 HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com?__cf_chl_rt_tk=rMocyCCowRUMf3E0VU4RqhAAeJl2blwgrZsfNm6BHfE-1685113235-0-gaNycGzNBrs
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Fri, 26 May 2023 15:00:35 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: max-age=0, must-revalidate
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ieLXEW9JPmyw53Gd0ffV8PRWW3cuhgjAytSmBax6FKiASp1YCUH%2Fd25Yft%2BfcHg3uDKpVhURmHQaTfVlr43SGKZZHkgN%2Bp5X6LTaXFSIhnCnZ0ajUqGc6o44%2FIjCVxs9%2BR%2Fv5A3BdZIxMw%2FY6KP24lB%2Fwf0%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6e37a0fdf0b06-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   57896
Md5:    0a890a106438b1131d1ca38feef47b58
Sha1:   ec40db2755872b193847e5f314bebdf255528d59
Sha256: 5a64a14bd097766abf9b2ef00af27764ec487266e3d34bb674728226e72e337f

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com?__cf_chl_rt_tk=rMocyCCowRUMf3E0VU4RqhAAeJl2blwgrZsfNm6BHfE-1685113235-0-gaNycGzNBrs
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 15:00:35 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQo8ReAUM579Q13yQenAO4Ps%2B5s2KHxkxXLBJs%2FgAh1g7nllxgmaVxSj2I8hZd21R3SfHTiGnlHDT4RBXPkPCo9Dg21CckQjUj1wA2YH1nfz6OujNG3Tfu3IGAB%2F5glGMU%2Fx5M9ak8oLO5j6Xi%2FLcV%2Bw%2F8g%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6e37a28010b06-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1833), with CRLF, LF line terminators
Size:   3643
Md5:    39bca161d1fee9f72ac9540707cf6d9d
Sha1:   1425a39cf6fa6c0c62c5229f89df0e7bd2b2933b
Sha256: 89715975124f4aebf67746fd4aa064a28c3d36f9b2f9fcba0ade4c5869f290ca
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1671346487:1685110086:xPw8FPhT8HhgNDNSjaag6myKk0N2Wy5IaAlUs4AvFE8/7cd6e379380cb512/baaa8794da646d8 HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
Content-type: application/x-www-form-urlencoded
CF-Challenge: baaa8794da646d8
Content-Length: 1797
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                            
Date: Fri, 26 May 2023 15:00:35 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: EOA0R+ZfRzfVX4ztEyCJ8T929vYrPDMIBEp8fyLZGGhuFSsIr1US95mdNTjd/8s6$JYMLpZeizkLGJV59i4o+hw==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ze8IHEPh%2FjDXICrwj3Yl23H9KO1TAP1cBy%2B3s%2FHRTVdoxMeOyd%2F%2FAdmh0CSIHEfSzWBA0SSwV8NKRuuRDSNYGMB9Ok1W2OAndFAPtiBFuU9HsmJpXtP1RyOyHml4PD65XgHInfT56PX7DESqTSV3exG3kc8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6e37b3d510b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  ASCII text, with very long lines (7392), with no line terminators
Size:   5606
Md5:    887f0c8348ebbb7dbf7430376896f5c5
Sha1:   8b592dfc5512d131ff05aa67cce30816f78900bc
Sha256: b3770050b896c8d8c3c595feaab701989940f3347f2261088407314d1576bafe

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 15:00:35 GMT
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cd6e37abe76b511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2



--- Additional Info ---
Magic:  ASCII text, with very long lines (15748)
Size:   15749
Md5:    2a1262ba5cd32899831d483322a28dd7
Sha1:   3805876db8773ed5820043e1f39b0b6c049f61b2
Sha256: 2e1e45b1d429b2d703676139932fe97b7ffc7986e6d0221653a7404e4c3032f0
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8 HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: d959aa3536c65e8
Content-Length: 2755
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 15:00:36 GMT
cf-chl-gen: xf1iyeMYl/nqTudp8jniSQy7EnS5pUq0+PFSiy2GZzlmOBgtQOBomOd7SUl+4clNjaUYF/Gicfj9cP2NOsPWdohlnnlJU7O31jYy1smPVXvOmfQxnzKoDeLL8Gg6fGlMr0avE+XbMd4Trlrt5U6WHYRsRdwpZCgjGqao6yHF+5oWRj/0sYXK5kUYyDMCbEEEFbOkWKYnwBd5oCG5eYutGJVtAF/CYuhD0g6ofwBGfx3tFQg3hGhtOBrm4An+sUpZ/y0Zw5CnckuKVSyBPoN1gTg6ZNSu4s5LoB1Z5bPuuxp1lv8We0ZLQCIgsR0LWb/gx9LrHfKT3RrPlZRGa3lUzncgCFcguy3DVV6LUopbJaAY17jjwdAfHSjEfXjjqWXkXNM1IHXViyj3wXlPtLqArQ==$pX3YxozeimpLvPKPxB/wsw==
server: cloudflare
cf-ray: 7cd6e37d6b23b51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   187436
Md5:    968ef5771972def0a740e43991525933
Sha1:   6972e852e82a6838e4b5435463d99167beebc87a
Sha256: 0b4f3c1653176165d0b6cf41980d3e2b342d563566eb8cf6e7b73af485b0665d
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8 HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: d959aa3536c65e8
Content-Length: 18393
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 15:00:37 GMT
cf-chl-gen: fm0e0vYsvGoLj45o9IJbyAl0wbnIqngDi1SOlDuH07GdB8Ac51oT9Q7w0tGjjnlC$JEPRF93dKJZ+42wtWjt1iQ==
server: cloudflare
cf-ray: 7cd6e3873974b51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (13232), with no line terminators
Size:   13232
Md5:    527d96aad110cf7c5d0fc4379233036b
Sha1:   2c9ec0d5889f348340e1d3d7a7f7eb8bc36d862b
Sha256: 54b5edb4834d1a6bef92984c1b19061af46827fc8b9d574b22b2473c83cc0f19
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/html; charset=UTF-8
                                            
date: Fri, 26 May 2023 15:00:35 GMT
cache-control: max-age=0, must-revalidate
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 7cd6e37bb8aeb51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (10899)
Size:   24085
Md5:    a2ba475436c1d360a465c7e7e23edbdf
Sha1:   7e85dbe3eb475aa4bbac2a457db47a602c9e08cd
Sha256: 65c1201a122ea2bc83686d7ea217385ebf348cb2cf0c0eba27339d762c02446b
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd6e37bb8aeb51e HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 15:00:35 GMT
cache-control: max-age=0, must-revalidate
server: cloudflare
cf-ray: 7cd6e37c1939b51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   156338
Md5:    78fad8351a38b7aeadff6e944b13e5fa
Sha1:   1c3ff1f1a014ff2f9afc395e24413c769ecd2cff
Sha256: 2fb9347abb44df5fb97c930b5948fb97d9f132f12b3dd96bf171f07d3adca5d6
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/img/7cd6e37bb8aeb51e/1685113236077/1sEK8lJhidTl--Q HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: image/png
                                            
date: Fri, 26 May 2023 15:00:37 GMT
server: cloudflare
cf-ray: 7cd6e3848d82b51e-OSL
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  PNG image data, 70 x 85, 8-bit/color RGB, non-interlaced\012- data
Size:   61
Md5:    55be16ac41d8ee665a30db4f44ecb095
Sha1:   96a2bed835e4f3850fa01c3450b4f51cbf42f023
Sha256: 0d75da635688156d0fc8a4e9ff3adf4569b117d01b245894c8e32c7ab49c4741