alawaelafrica.com/.ojnew/tmp/bGluZGFAbWVycmVsbGJyb3MuY29t
65.108.234.151302 Found 109 B URL User Request GET HTTP/1.1 alawaelafrica.com/.ojnew/tmp/bGluZGFAbWVycmVsbGJyb3MuY29t
IP 65.108.234.151:443
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subject*.alawaelafrica.com
Fingerprint0C:96:6B:AB:EF:3F:05:6B:41:01:84:52:29:4C:B1:C2:93:64:EB:89
ValidityThu, 18 May 2023 17:04:53 GMT - Wed, 16 Aug 2023 17:04:52 GMT
File type ASCII text, with no line terminators
Hash 83eb68b52fbfd12c0180e190c9d1e1b0
a0880aff29e5e19c0e917817526371b0411cdbe6
d5875cda6169192a7e3b8f1b1fb92303544681b4dc9c7dff9574e5e55ad56d6e
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /.ojnew/tmp/bGluZGFAbWVycmVsbGJyb3MuY29t HTTP/1.1
Host: alawaelafrica.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Fri, 26 May 2023 15:00:35 GMT
Server: Apache
Location: https://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
104.21.88.100403 Forbidden 3.6 kB URL User Request GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
IP 104.21.88.100:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1769), with CRLF, LF line terminators
Hash 0027feb962ff7514588200d463c2632b
a922fcb4e9d582f8eb82db110ff0961df4566e85
a3e525027149412ad68c0f556c409225c4f2420706022319f72cd2b4beb6ab9b
Analyzer Verdict Alert fortinet Phishing
GET /Mlinda@merrellbros.com HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Fri, 26 May 2023 15:00:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ENXG65jOr5TEQTo6oTzQZ%2FBI0tow5Uy2hNLdX1GCLtQDBpesSlGoIa52N5x3NMzXXUCIGvZEv04xQ6L5ikQbEANXPKnGJ4QkW9TlZII2uP9xavlW7v31kZ%2BimSV1ftrURWXbOHLOsunzRp%2BApKGBQnf8MBs%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6e379380cb512-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd6e379380cb512
104.21.88.100200 OK 42 B URL GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd6e379380cb512
IP 104.21.88.100:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Analyzer Verdict Alert fortinet Phishing
GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd6e379380cb512 HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 26 May 2023 15:00:35 GMT
Content-Type: image/gif
Content-Length: 42
Connection: keep-alive
Last-Modified: Thu, 25 May 2023 08:39:03 GMT
ETag: "646f1ea7-2a"
Server: cloudflare
CF-RAY: 7cd6e37a0bf80b02-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 26 May 2023 17:00:35 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes
0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd6e379380cb512
104.21.88.100200 OK 58 kB URL GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd6e379380cb512
IP 104.21.88.100:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
File type ASCII text, with very long lines (65536), with no line terminators
Hash 0a890a106438b1131d1ca38feef47b58
ec40db2755872b193847e5f314bebdf255528d59
5a64a14bd097766abf9b2ef00af27764ec487266e3d34bb674728226e72e337f
Analyzer Verdict Alert fortinet Phishing
GET /cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd6e379380cb512 HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com?__cf_chl_rt_tk=rMocyCCowRUMf3E0VU4RqhAAeJl2blwgrZsfNm6BHfE-1685113235-0-gaNycGzNBrs
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 26 May 2023 15:00:35 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: max-age=0, must-revalidate
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ieLXEW9JPmyw53Gd0ffV8PRWW3cuhgjAytSmBax6FKiASp1YCUH%2Fd25Yft%2BfcHg3uDKpVhURmHQaTfVlr43SGKZZHkgN%2Bp5X6LTaXFSIhnCnZ0ajUqGc6o44%2FIjCVxs9%2BR%2Fv5A3BdZIxMw%2FY6KP24lB%2Fwf0%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6e37a0fdf0b06-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
0gpilhhtlb646b2a32a499c.ocupac.ru/favicon.ico
104.21.88.100403 Forbidden 3.6 kB URL GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/favicon.ico
IP 104.21.88.100:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1833), with CRLF, LF line terminators
Hash 39bca161d1fee9f72ac9540707cf6d9d
1425a39cf6fa6c0c62c5229f89df0e7bd2b2933b
89715975124f4aebf67746fd4aa064a28c3d36f9b2f9fcba0ade4c5869f290ca
GET /favicon.ico HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com?__cf_chl_rt_tk=rMocyCCowRUMf3E0VU4RqhAAeJl2blwgrZsfNm6BHfE-1685113235-0-gaNycGzNBrs
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Fri, 26 May 2023 15:00:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQo8ReAUM579Q13yQenAO4Ps%2B5s2KHxkxXLBJs%2FgAh1g7nllxgmaVxSj2I8hZd21R3SfHTiGnlHDT4RBXPkPCo9Dg21CckQjUj1wA2YH1nfz6OujNG3Tfu3IGAB%2F5glGMU%2Fx5M9ak8oLO5j6Xi%2FLcV%2Bw%2F8g%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6e37a28010b06-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/1671346487:1685110086:xPw8FPhT8HhgNDNSjaag6myKk0N2Wy5IaAlUs4AvFE8/7cd6e379380cb512/baaa8794da646d8
104.21.88.100200 OK 5.6 kB URL POST HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/1671346487:1685110086:xPw8FPhT8HhgNDNSjaag6myKk0N2Wy5IaAlUs4AvFE8/7cd6e379380cb512/baaa8794da646d8
IP 104.21.88.100:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
File type ASCII text, with very long lines (7392), with no line terminators
Hash 887f0c8348ebbb7dbf7430376896f5c5
8b592dfc5512d131ff05aa67cce30816f78900bc
b3770050b896c8d8c3c595feaab701989940f3347f2261088407314d1576bafe
Analyzer Verdict Alert fortinet Phishing
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1671346487:1685110086:xPw8FPhT8HhgNDNSjaag6myKk0N2Wy5IaAlUs4AvFE8/7cd6e379380cb512/baaa8794da646d8 HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
Content-type: application/x-www-form-urlencoded
CF-Challenge: baaa8794da646d8
Content-Length: 1797
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 26 May 2023 15:00:35 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: EOA0R+ZfRzfVX4ztEyCJ8T929vYrPDMIBEp8fyLZGGhuFSsIr1US95mdNTjd/8s6$JYMLpZeizkLGJV59i4o+hw==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ze8IHEPh%2FjDXICrwj3Yl23H9KO1TAP1cBy%2B3s%2FHRTVdoxMeOyd%2F%2FAdmh0CSIHEfSzWBA0SSwV8NKRuuRDSNYGMB9Ok1W2OAndFAPtiBFuU9HsmJpXtP1RyOyHml4PD65XgHInfT56PX7DESqTSV3exG3kc8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6e37b3d510b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
challenges.cloudflare.com/turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit
104.18.6.185200 OK 16 kB URL GET HTTP/2 challenges.cloudflare.com/turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit
IP 104.18.6.185:443
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (15748)
Hash 2a1262ba5cd32899831d483322a28dd7
3805876db8773ed5820043e1f39b0b6c049f61b2
2e1e45b1d429b2d703676139932fe97b7ffc7986e6d0221653a7404e4c3032f0
GET /turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 May 2023 15:00:35 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cd6e37abe76b511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8
104.18.6.185200 OK 187 kB URL POST HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8
IP 104.18.6.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 187 kB (187436 bytes)
Hash 968ef5771972def0a740e43991525933
6972e852e82a6838e4b5435463d99167beebc87a
0b4f3c1653176165d0b6cf41980d3e2b342d563566eb8cf6e7b73af485b0665d
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: d959aa3536c65e8
Content-Length: 2755
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 15:00:36 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: xf1iyeMYl/nqTudp8jniSQy7EnS5pUq0+PFSiy2GZzlmOBgtQOBomOd7SUl+4clNjaUYF/Gicfj9cP2NOsPWdohlnnlJU7O31jYy1smPVXvOmfQxnzKoDeLL8Gg6fGlMr0avE+XbMd4Trlrt5U6WHYRsRdwpZCgjGqao6yHF+5oWRj/0sYXK5kUYyDMCbEEEFbOkWKYnwBd5oCG5eYutGJVtAF/CYuhD0g6ofwBGfx3tFQg3hGhtOBrm4An+sUpZ/y0Zw5CnckuKVSyBPoN1gTg6ZNSu4s5LoB1Z5bPuuxp1lv8We0ZLQCIgsR0LWb/gx9LrHfKT3RrPlZRGa3lUzncgCFcguy3DVV6LUopbJaAY17jjwdAfHSjEfXjjqWXkXNM1IHXViyj3wXlPtLqArQ==$pX3YxozeimpLvPKPxB/wsw==
server: cloudflare
cf-ray: 7cd6e37d6b23b51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8
104.18.6.185200 OK 13 kB URL POST HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8
IP 104.18.6.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (13232), with no line terminators
Hash 527d96aad110cf7c5d0fc4379233036b
2c9ec0d5889f348340e1d3d7a7f7eb8bc36d862b
54b5edb4834d1a6bef92984c1b19061af46827fc8b9d574b22b2473c83cc0f19
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1366401318:1685110113:M_nJ5rVKtc4XK8NLzC7DvGJooKL62XeU_DpXhHM_qxU/7cd6e37bb8aeb51e/d959aa3536c65e8 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: d959aa3536c65e8
Content-Length: 18393
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 15:00:37 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: fm0e0vYsvGoLj45o9IJbyAl0wbnIqngDi1SOlDuH07GdB8Ac51oT9Q7w0tGjjnlC$JEPRF93dKJZ+42wtWjt1iQ==
server: cloudflare
cf-ray: 7cd6e3873974b51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
104.18.6.185200 OK 24 kB URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
IP 104.18.6.185:443
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mlinda@merrellbros.com
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (10899)
Hash a2ba475436c1d360a465c7e7e23edbdf
7e85dbe3eb475aa4bbac2a457db47a602c9e08cd
65c1201a122ea2bc83686d7ea217385ebf348cb2cf0c0eba27339d762c02446b
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 15:00:35 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=0, must-revalidate
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 7cd6e37bb8aeb51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd6e37bb8aeb51e
104.18.6.185200 OK 156 kB URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd6e37bb8aeb51e
IP 104.18.6.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 156 kB (156338 bytes)
Hash 78fad8351a38b7aeadff6e944b13e5fa
1c3ff1f1a014ff2f9afc395e24413c769ecd2cff
2fb9347abb44df5fb97c930b5948fb97d9f132f12b3dd96bf171f07d3adca5d6
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd6e37bb8aeb51e HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 15:00:35 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, must-revalidate
server: cloudflare
cf-ray: 7cd6e37c1939b51e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/img/7cd6e37bb8aeb51e/1685113236077/1sEK8lJhidTl--Q
104.18.6.185200 OK 61 B URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/img/7cd6e37bb8aeb51e/1685113236077/1sEK8lJhidTl--Q
IP 104.18.6.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type PNG image data, 70 x 85, 8-bit/color RGB, non-interlaced\012- data
Hash 55be16ac41d8ee665a30db4f44ecb095
96a2bed835e4f3850fa01c3450b4f51cbf42f023
0d75da635688156d0fc8a4e9ff3adf4569b117d01b245894c8e32c7ab49c4741
GET /cdn-cgi/challenge-platform/h/b/img/7cd6e37bb8aeb51e/1685113236077/1sEK8lJhidTl--Q HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/arstz/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 15:00:37 GMT
content-type: image/png
server: cloudflare
cf-ray: 7cd6e3848d82b51e-OSL
alt-svc: h3=":443"; ma=86400