Report - www.grandocasino.com/gaoskc/ca/index-uni.html

Report Overview

Submitted URL
www.grandocasino.com/gaoskc/ca/index-uni.html
IP
104.21.40.12
ASN
#13335 CLOUDFLARENET
Submitted
2022-11-29 07:03:34
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
www.grandocasino.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	5.4 kB	241 kB	172.67.173.217
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.4 kB	6.2 kB	23.36.77.32
ajax.googleapis.com	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	395 B	31 kB	142.250.74.42
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	54.187.31.159
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	48 kB	34.120.237.76
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.6 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	686 B	1.4 kB	142.250.74.35

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-29	medium	www.grandocasino.com/gaoskc/ca/index-uni.html	Phishing
2022-11-29	medium	www.grandocasino.com/gaoskc/ca/sounds/spin.mp3	Phishing
2022-11-29	medium	www.grandocasino.com/gaoskc/ca/alert.ogg	Phishing
2022-11-29	medium	www.grandocasino.com/gaoskc/ca/sounds/win.mp3	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	www.grandocasino.com/gaoskc/ca/index-uni.html	201 B	2023-03-07	2023-09-24
Pretty URL www.grandocasino.com/gaoskc/ca/index-uni.html IP 172.67.173.217 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:09 Last Seen2023-09-24 21:04:04 Times Seen83 Hash 96fdcbca3fc7800b152f7db151494bab fb96ba3b2369e4e3d6425e64d1fba048324d44ed 75f525420ab64a165c4b0b735e478f79a117808911b0034933ef9e8e548dd74a Loading...

	www.grandocasino.com/gaoskc/ca/index-uni.html	1.0 kB	2023-03-07	2023-04-05
Pretty URL www.grandocasino.com/gaoskc/ca/index-uni.html IP 172.67.173.217 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:01 Last Seen2023-04-05 02:04:52 Times Seen87 Hash 65c4d1f25fb339b5f6149e853b8cd58c a9ab805d3e4e6afbd5356a06939be94b60bd1fc3 fa877dc071e7b21532886df1283f07bce44c43dc94954a29094bcb12b5985996 Loading...

	ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js	86 kB	2023-03-07	2024-04-18
Pretty URL ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js IP 142.250.74.42 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:01 Last Seen2024-04-18 14:39:06 Times Seen5762 Hash 6fc159d00dc3cea4153c038739683f93 5d7e5bbfa540f0e53bd599e4305e1a4e815b5dd1 8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce Loading...

	www.grandocasino.com/gaoskc/ca/index-uni.html	2.7 kB	2023-03-07	2023-09-24
Pretty URL www.grandocasino.com/gaoskc/ca/index-uni.html IP 172.67.173.217 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:09 Last Seen2023-09-24 21:04:04 Times Seen58 Hash 6f066e350fd1eaa087a5c2b70f6cc8e6 260b16c58654aea514dfea95faec5c744fa508db 831d81dba75f622756c3526b830997b315edd84f409d7236cce70cb32f5bb6a0 Loading...

	www.grandocasino.com/gaoskc/ca/index-uni.html	1.1 kB	2023-03-07	2023-09-24
Pretty URL www.grandocasino.com/gaoskc/ca/index-uni.html IP 172.67.173.217 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:40:00 Last Seen2023-09-24 21:04:04 Times Seen61 Hash aa05fafeaf7e55fbc51c7adf34823d8c e95348645292b44f670b50241c072259b2cad98c aa712810619aaf3edea06bbc31b0390b18c93f74681193e3faceb57b3212f60a Loading...

	www.grandocasino.com/gaoskc/ca/index-uni.html	1.4 kB	2023-03-07	2024-04-13
Pretty URL www.grandocasino.com/gaoskc/ca/index-uni.html IP 172.67.173.217 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:01 Last Seen2024-04-13 12:48:18 Times Seen149 Hash 8f9057f4c95b378e83478b72b0b32ad0 8f145396bd381bff223d6797944172fb92d68d84 2cd19cb853d635c70706aea4a135ab92412b242332583f7cdf523d108875b83d Loading...

	www.grandocasino.com/gaoskc/ca/index-uni.html	211 B	2023-03-07	2023-05-23
Pretty URL www.grandocasino.com/gaoskc/ca/index-uni.html IP 172.67.173.217 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:29:16 Last Seen2023-05-23 07:33:00 Times Seen24 Hash 5ec1794c04aed2a12ef00e78660bd2c2 780edd53ae97203fef5a735ee837c73544e4f1bd a97769f59278b5f932e997571c8bca145f23c7535188ef3bc7497a3aa791a1ab Loading...

HTTP Transactions (38)

URL IP Response Size

www.grandocasino.com/gaoskc/ca/index-uni.html

172.67.173.217

200 OK

18 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/index-uni.html
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (2100)
Size
18 kB (18396 bytes)
Hash
aff93f1cf81303d030505c2b08a3c1a4
5c8cdfd8279b3cc4c7d354123520b23d1a22bba3
4642f1c85f698f30b8eb40eae29d698141ae3375c8c8c640163cb2a460d895d4

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gaoskc/ca/index-uni.html HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:23 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
x-amz-id-2: V2KSxM1mg9hIVuhzqtDRgWmOzuxWitEKTX6vIvJrUoBRjsVOoHG1x3rK/Av0BfkugzlaZJ14J0o=
x-amz-request-id: 1XA0TZKZMJHMDS1N
x-amz-meta-sha256: a84cf74fd4a871eb36db75b7aa4d30d9c4e6d472d9cd0542fa52ebc8c3a2e596
x-amz-meta-s3b-last-modified: 20220322T113839Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZgeH5cGTPt71%2FFWFwniTgosVREzEHdeMKzS2H5vQf88uC6qa4hcs9X3lL3EYYTuZa1FwXmQsscIpLx1969w9dsqkRwWIA%2B9QBhtN3o3kjm747Z4L4qw0RkKlg43pJmgqcTqAPmEKKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb52a25b51e-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a5daf4dc99951793ae2315d4795e8146
4427507ca4d3a5632cc8f598afbc85e2195d00bd
94fb64c1c826ed7099283c0bedb3cea7ac7e1d9526794cb9fad6e761f5989d32

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "94FB64C1C826ED7099283C0BEDB3CEA7AC7E1D9526794CB9FAD6E761F5989D32"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3596
Expires: Tue, 29 Nov 2022 08:03:19 GMT
Date: Tue, 29 Nov 2022 07:03:23 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
9408cc0694fcbea57966c3a3ba906092
fddcee1fdcf3209298e41a4b1b5560357fa165f0
6ef7120d9463f56e3ddfadd5766d02da8523f34061b13bdba54bf9ab72a1e979

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4696
Cache-Control: max-age=103573
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 07:03:23 GMT
Etag: "63848df9-1d7"
Expires: Wed, 30 Nov 2022 11:49:36 GMT
Last-Modified: Mon, 28 Nov 2022 10:31:21 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6d9d34c96b9a826ae5676640c966469c
8052a16d41a637e420478b7de1ff5a2dc951fccd
f18ac558cb786126bb7efb159e03353d268d5f5796bcfd2691a349dfc68d863c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F18AC558CB786126BB7EFB159E03353D268D5F5796BCFD2691A349DFC68D863C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9215
Expires: Tue, 29 Nov 2022 09:36:59 GMT
Date: Tue, 29 Nov 2022 07:03:24 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 29 Nov 2022 06:19:36 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2628
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: xxlgHIBy1PC/DgW5TyBFIXDmIxuF9Klb8NCd7zHYcM5nEWNum9fG9YEegW4HPVuVv6iQNO1h4VQ=
x-amz-request-id: NK2B1G59AYWKRSW4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 29 Nov 2022 06:45:21 GMT
age: 1083
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 07:03:24 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
07b8296613be09905e34b09dce4a203f
c97c67e8c4b1247423d089c028c31e05734f124e
c8c7b7cd00d5818bbe4a4ddb1b734a1b766dc6474cce300171bd5a0947adc6b2

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 07:03:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.grandocasino.com/gaoskc/ca/style.css

172.67.173.217

200 OK

2.4 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/style.css
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (10720), with no line terminators
Size
2.4 kB (2387 bytes)
Hash
76db79d6a8257fef57aeb0d5234fd211
4aa744e5b12d6fa19f4a00303aff0c20020897ad
65fa5f81f1e901b4a281e8ca9b84b6809ac7a0c34dace89273343be7222c0f46

HTTP Headers

GET /gaoskc/ca/style.css HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Cf-Bgj: minify
Cf-Polished: origSize=13007
ETag: W/"13385118a26c69b8fa492dd7dc703354"
Last-Modified: Tue, 22 Mar 2022 11:40:24 GMT
x-amz-id-2: 4PjS5c3FdpRY8XJbneomk8eoccyoVqDsXVD0DJqCn/mcBGOzJofQKEACdm9lhUURVl1wUIoakS0=
x-amz-meta-s3b-last-modified: 20180313T072906Z
x-amz-meta-sha256: bf1a1d18310dd4aa6d9f193fc50694cefb80c766309d5819993abe4fd06499f4
x-amz-request-id: YES3S2HWPQSB8TXW
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nVZHlIFWAzqYIz39dw%2BR7ZaykpJ6DF2N9I%2FI9RzmruzmJ2EhdoQJzjbDTyCQ9ObmPIhWwNedyZNq96nG1ggGxaiaY0BGY%2BcbdKzwVvSD95aAH85RWXgjsVqdbSxYZQ5SEHSi%2B7Tkcg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb79d1ab51e-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js

142.250.74.42

200 OK

30 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js
IP
142.250.74.42:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (32069)
Size
30 kB (30089 bytes)
Hash
4ae540714475aa934955496d990ab15f
b7724c4d72a422b86f5dc06571ff4bc86f0308a3
ca0222f8799d862ca8c427d6c612878f47043c9445ad0e1567f1f80e83c965e2

HTTP Headers

GET /ajax/libs/jquery/2.2.0/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.grandocasino.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30089
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Nov 2022 11:02:32 GMT
expires: Tue, 28 Nov 2023 11:02:32 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
age: 72052
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
07b8296613be09905e34b09dce4a203f
c97c67e8c4b1247423d089c028c31e05734f124e
c8c7b7cd00d5818bbe4a4ddb1b734a1b766dc6474cce300171bd5a0947adc6b2

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 07:03:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.grandocasino.com/gaoskc/ca/red-arrow-right.png

172.67.173.217

200 OK

1.4 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/red-arrow-right.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 50 x 50, 8-bit colormap, non-interlaced\012- data
Size
1.4 kB (1362 bytes)
Hash
881bdc037be8895ba5d8d53456890e7e
4e105c89e2a1475520bb74c9c20bf2f9e906fcb3
9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f

HTTP Headers

GET /gaoskc/ca/red-arrow-right.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 1362
Connection: keep-alive
x-amz-id-2: xSvFq7D8nZRIV1h+wFr4vVrdCBP3TQwweOOUQHdk77OHA5n4eFs95CjNYTenWKNye3rXsGLVx4o=
x-amz-request-id: YESEWQ8GEAGXX61B
x-amz-meta-sha256: 9f8160d6380fef91c8eadecc6e8e59e93e3f5c40be7963018c8104bef4354d8f
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:24 GMT
ETag: "881bdc037be8895ba5d8d53456890e7e"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1vtWGnF3BF8QGG3WrceTZilg8DZJr6JwlfZJNAJ4oLg6gD0ZUyty7eJNs6bsYkMaXBXxpEz%2BBmQKSsIyZJYWZi8wCzVrRFfE9u16L27Xi%2FTmHm1RST%2FIzn6utdYrultcnHIZz65%2B4w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb86d52b518-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/red-arrow-left.png

172.67.173.217

200 OK

1.3 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/red-arrow-left.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 50 x 50, 8-bit colormap, non-interlaced\012- data
Size
1.3 kB (1334 bytes)
Hash
92d3e482cacea857c5dfaf9fa3a21dfb
3f12c410c77d763cc4719ec367a18417b8300758
4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef

HTTP Headers

GET /gaoskc/ca/red-arrow-left.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 1334
Connection: keep-alive
x-amz-id-2: LG7vP+RSg1bSu2dpQ7MQo48YSah3civmSLmHuXNU9U1GBixMeuVwjPwLK+z+bUa5l2LowyO51QA=
x-amz-request-id: YES1BW8A7AY5C3MH
x-amz-meta-sha256: 4a688dc66588e8e86e98ccadb318fa2aca3fd6e2444aac783278b982f3e47eef
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:24 GMT
ETag: "92d3e482cacea857c5dfaf9fa3a21dfb"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wn2DK1k6YvE6OkJzU6SQNI3gOR0Mx1LOyH0qaFXBgVTZI78%2B0YEAFKpuBZff6Lqpv2tqdmG2np2pyD%2BjteuAA5JlQ0oQ473na6Gz6RJ7CHUm2IyfHU5beze6t%2FKr4C3TAfL3Fm5GlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb86d02b51d-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/images/slot-start.png

172.67.173.217

200 OK

26 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/images/slot-start.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
26 kB (26084 bytes)
Hash
f491647556e492de92530b48827690aa
6296c44299f5acb17cb2c06e37391a70672b1fd3
efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d

HTTP Headers

GET /gaoskc/ca/images/slot-start.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 26084
Connection: keep-alive
x-amz-id-2: qV7FXn2uKZHFd3BL59SQvrzbYfDmI/kjxIpl/ep2S6O0Qry/sFffK6o65q6OWBqYhCgaLodUK/c=
x-amz-request-id: YESANM4R7RMN9V3H
x-amz-meta-sha256: efb819d37f19ec7505d9602488ce97868d84e1c7929ce83e308e23f02d97b95d
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "f491647556e492de92530b48827690aa"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M3St0wjLojtJ2O5PZAwZLfaswEG2b%2B3n5fTLmTkt2kZ0C4ivs89kyRnJf0BHApMu4pM0ZeBpVczOY0k8rDLcK%2BbVn5BWH7Vb35UjaOjcvAriVM1HmyZDo5wDHwKSytRoMtoSIit5zw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb86de3b51e-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/images/slot-result-2.png

172.67.173.217

200 OK

27 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/images/slot-result-2.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
27 kB (26733 bytes)
Hash
b6ca0bfea4d0cec334f128f5c2c44cff
f6dc006902542a929187af718d9f6a244e5472b5
b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435

HTTP Headers

GET /gaoskc/ca/images/slot-result-2.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 26733
Connection: keep-alive
x-amz-id-2: 93V3BfF+jxKw81VIzyL2cVA7hNgRFhUIBwsSAgsHjb5nI/YwOfl1H/wZC2JgtGTB+Akps0Yg2F8=
x-amz-request-id: YES0YZA4RN55DPRD
x-amz-meta-sha256: b09b477eb93ed896b8e52a2f746e435695dbef2a1259987bae4fbea3c35b5435
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "b6ca0bfea4d0cec334f128f5c2c44cff"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2BXbRNXJhqwq%2BDT72n1pxBTJkf7yaSeoslPK5BCTmj8hK7Lwo5AEFHBTg1LgoVbZzj7XPt%2B9XISR5r4SuTzLNmtsV9aEDMsZhFIzahseCMCrP9uQcOHMmA59Pv8Q26F7swHuxChnLA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb868b8b4ed-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/images/slot-win.png

172.67.173.217

200 OK

14 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/images/slot-win.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
14 kB (14391 bytes)
Hash
939b6a73c96383ac0842317037f3a0f0
0654b62431c8ba522833950b8166d7a16e2a6b56
b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837

HTTP Headers

GET /gaoskc/ca/images/slot-win.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 14391
Connection: keep-alive
x-amz-id-2: 7XEKj69FV02L7XiFZya0/O6IDU1G/9NcoEKpbY0NlH7LD3TOmNBncSAqCy59qByIqaeeKPHvpeU=
x-amz-request-id: YESBVTA2TB6Z2B4T
x-amz-meta-sha256: b8f1ec0ac028bd024af2cf57b63b07069b2f4a41e61c1577e968ca5d7ba72837
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "939b6a73c96383ac0842317037f3a0f0"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BMU9MVAonEwDlwXuVaeUScXrFbgidBYG67B4US0o%2FtNXh%2F3skC7ECEJkLzFxPnlBkEfSVmnD0JkCpa%2FHH5TCNvHQ1FLFazDarcGQG6GFJedoIBOXGyrt%2B9nx%2BV1kHd5vXfXOVF74sw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb86d00b51d-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/images/CA.png

172.67.173.217

200 OK

1.2 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/images/CA.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 50 x 40, 8-bit colormap, non-interlaced\012- data
Size
1.2 kB (1185 bytes)
Hash
80c675990be83b696584c6bae4fa6af4
1e5554dbdcbd4c05f1227a4ddbe9dc3bfd280ca5
3fe7db2d24eb1bd7144f5da798026ca82abe351c377cbbc25906acf1fb573981

HTTP Headers

GET /gaoskc/ca/images/CA.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 1185
Connection: keep-alive
x-amz-id-2: 5s5iANZAyMGwygSyHniXMocIsY7RccLBQhF4AfmPBCH5ove4+SmIvqB+q3OkqOcJ2q+91J3+wY8=
x-amz-request-id: YC157GCA35BPY5GF
x-amz-meta-sha256: 3fe7db2d24eb1bd7144f5da798026ca82abe351c377cbbc25906acf1fb573981
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "80c675990be83b696584c6bae4fa6af4"
Cache-Control: max-age=2678400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=50%2FiycZOqQS5Y2LIkd1YgDmYrOVQM96TEouXk2mUBnrb%2BrdMj1THuzj%2FMzIJmE8QARnJKGC2%2FolalE4hJW8MIMwlxwtHZBZUr06gUq6TzV6J6ViHfxHT7w058zv0k1zGgO1ETkfoCA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb86bbeb515-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/arrow.png

172.67.173.217

200 OK

154 B

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/arrow.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 12 x 12, 4-bit colormap, non-interlaced\012- data
Size
154 B (154 bytes)
Hash
4daf12b0677dd9ae8923d3154187d1d8
d20e8f0a0c1a72d20cd421ba5e162ff938896e51
5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e

HTTP Headers

GET /gaoskc/ca/arrow.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/style.css

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 154
Connection: keep-alive
x-amz-id-2: sVBOKEc2VwsLuhCCqhV6kOqwjiwHxP5m1QIkQLIDuFUiW0+4m09eZtn9tfwSUMS+TkwQBRMCinI=
x-amz-request-id: YES8DW3N6NS9T2JA
x-amz-meta-sha256: 5351d7b058d47812c8a2c74bccef9389a11e3df9cd19874d95b7000c8ab9ea9e
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "4daf12b0677dd9ae8923d3154187d1d8"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jaWzCDBaq1nf8TnitqZguw58waUmqA6TDs5ejmngtqJ0Od2HwuYvQV2SPfBKmtagdPbNX6WXPwuUGRLjEqndFrau%2BUSiu%2Fkzvbq1N19Dg9wevK5zmGqlK99kWeq5hRfWO8GYqotulg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb91df3b518-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/sounds/spin.mp3

172.67.173.217

206 Partial Content

8.8 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/sounds/spin.mp3
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
MPEG ADTS, layer III, v2, 32 kbps, 16 kHz, JntStereo\012- data
Size
8.8 kB (8784 bytes)
Hash
5a2e10964c7fea8b0181831184bc0d97
8f5233dd6be372e7749c6cd8440db5b43de5a9c9
9b8fa3d6ccb98804102ffd59ee70c19e5d7ca7efabbe6c0d4471a1935348ee3d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gaoskc/ca/sounds/spin.mp3 HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 206 Partial Content
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: audio/mpeg
Content-Length: 8784
Connection: keep-alive
x-amz-id-2: M8GUu8p/Ma90U961+rZ1mvFCeBCUWzR2GDW3SmQ6CaebIoCeiORx2VbEIZ6XYTRHPppQRhq2xT0=
x-amz-request-id: YES89RG8RK13YD7B
x-amz-meta-sha256: 9b8fa3d6ccb98804102ffd59ee70c19e5d7ca7efabbe6c0d4471a1935348ee3d
x-amz-meta-s3b-last-modified: 20180313T072906Z
Last-Modified: Tue, 22 Mar 2022 11:40:24 GMT
ETag: "5a2e10964c7fea8b0181831184bc0d97"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Content-Range: bytes 0-8783/8784
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=giuMru5Hujx8w6AAH0lIuC9m9fUeleW2XaTEL%2Fup3ko4AYocTlnhqb7zh4e%2B9QuO%2Ba1ZOFyeelOmMXUhZLR%2Bn2yLScQs1QlUXZvfRaC5qav5IeJvLoyrWM2HklGy1knsPNwnIIJ4Nw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 77197bb939a7b4ed-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/images/slot-result-1.png

172.67.173.217

200 OK

20 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/images/slot-result-1.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 410 x 279, 8-bit colormap, non-interlaced\012- data
Size
20 kB (20370 bytes)
Hash
1fbd2b26e61236d5bcfdfeb6adbd2c8c
c9034272d28dab018b73f1967a679c734f987a1f
c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963

HTTP Headers

GET /gaoskc/ca/images/slot-result-1.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 20370
Connection: keep-alive
x-amz-id-2: W7EiPMWwJqcZE0vb8hmlAlcYkuW8knUGR1oKTuDa48BZaGfCcQQHz/HGzMgoxdnzkcszQY29ud4=
x-amz-request-id: YES660C7F499JYW5
x-amz-meta-sha256: c402c36eb8d623b618261d40846e63c130de1e78720ab5578eae1d645198c963
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "1fbd2b26e61236d5bcfdfeb6adbd2c8c"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2qBQQhugriobzuLjhvWr4LmDFQkqWgw0ARCglkAsaowiTxwlbtoOf%2Bh%2F1Ld4VI4CTQwOoRsPgsTkQyOgkHzIaGxvdasGzYaxJ0h%2FS4et7vi2WrwxIh0PQltodp%2BuVHEfYpUUNgnhGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb97cd2b515-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/alert.ogg

172.67.173.217

206 Partial Content

6.1 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/alert.ogg
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
Ogg data, Vorbis audio, mono, 44100 Hz, ~70000 bps, created by: Xiph.Org libVorbis I (1.3.2)\012- data
Size
6.1 kB (6061 bytes)
Hash
c24ec40453460f0d5617767016ebc7fe
c360aea4f0d0a34920ddacd376503734142438b9
6c24b85e36500836887748ab5fcfa2663bd6ab39d28f73e75aa5a669bf9386cb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gaoskc/ca/alert.ogg HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 206 Partial Content
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: application/octet-stream
Content-Length: 6061
Connection: keep-alive
x-amz-id-2: WzrfG2wENammE99AfqZSx9soKxkb7GQgNARuE2RHa3So3j/jvrzn2Vp3XHqw5RQyuo1ub2pOgDs=
x-amz-request-id: YES4HE6K75T90MQS
x-amz-meta-sha256: 6c24b85e36500836887748ab5fcfa2663bd6ab39d28f73e75aa5a669bf9386cb
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "c24ec40453460f0d5617767016ebc7fe"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Content-Range: bytes 0-6060/6061
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GszXOHAjeP1uAcv57YUaK89ExdHLIA5edyDanLdTTMATLQk37ufMAafNkIGnh98lghPiLsP3tkMUo%2BrNIBtiho%2BFWrpBujjqOvSDEIXRdQiNu%2FPlXzCWiUJBH%2FXgN0WGrl0JkVGgcg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 77197bb91dccb51d-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/sounds/win.mp3

172.67.173.217

206 Partial Content

10 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/sounds/win.mp3
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 32 kbps, 32 kHz, Monaural\012- data
Size
10 kB (10391 bytes)
Hash
bca40777013dec4a99eaa8b0b98a7fef
bc1c833577a1dcd82ad01a90e82898bc7b47cad7
635e9ee8fcd18bd4c3ae173f00f4c5cbf15ee90a27a302440e2e77c371314176

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /gaoskc/ca/sounds/win.mp3 HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 206 Partial Content
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: audio/mpeg
Content-Length: 10391
Connection: keep-alive
x-amz-id-2: U1dBegUDe1hFamRUDlMuO1mbtkVtLHQpYL/CXxudE79QtpIkbzl25+SgsLQeupVd8EW2JmIsQTM=
x-amz-request-id: YESB2EM5WAMYBPP3
x-amz-meta-sha256: 635e9ee8fcd18bd4c3ae173f00f4c5cbf15ee90a27a302440e2e77c371314176
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:24 GMT
ETag: "bca40777013dec4a99eaa8b0b98a7fef"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Content-Range: bytes 0-10390/10391
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cg6j%2Fcs8AhN1swmD7Gtxr60EWXFjvpQx3da6D%2FBPO5JgPUZPbBI%2FH9yK5j%2Fa6Hr0mqVGC0pRV8NH1QbuUbbu78QqlsI7a1eRs9JmyyjKZlc%2By%2BijWEpBIhktRqDPlPWcxPlDFl1W1A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 77197bb93eb4b51e-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/images/slot-spin.gif

172.67.173.217

200 OK

88 kB

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/images/slot-spin.gif
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
GIF image data, version 89a, 410 x 279\012- data
Size
88 kB (87599 bytes)
Hash
617c16c5e04c8603dd7f157862b1c682
1306296f9a666a7fc50f339a2a924ce8a3a18169
7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e

HTTP Headers

GET /gaoskc/ca/images/slot-spin.gif HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/gif
Content-Length: 87599
Connection: keep-alive
x-amz-id-2: OnvjCp7fAZvRVGrPkl6XYC5FzDCXTJks17djXkID6aoDY3UTctKxIomnibH3rxfuyKCLwJNPw78=
x-amz-request-id: YESF2YYPH3NQPE2M
x-amz-meta-sha256: 7f8e36cf7ac437d7c42440ef5f522c8e27adb06348b573192308038fa7c1dc7e
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "617c16c5e04c8603dd7f157862b1c682"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JJQsBSrPRhfLI0Z2mddlcmonjGafJhEG8qL%2Bw5RrIDz2dYKbj3Nucg9OQyzWwKIE2gY8oEoi3%2F%2F3ExtvtKvKZrBMiLLiTdWR2gwqdMTZIdNET77XMz3DkqGW%2FcFUQgOaIqRhiluVbA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bb94df9b51d-OSL
alt-svc: h2=":443"; ma=60

www.grandocasino.com/gaoskc/ca/favicon.png

172.67.173.217

200 OK

805 B

URL HTTP/1.1
www.grandocasino.com/gaoskc/ca/favicon.png
IP
172.67.173.217:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced\012- data
Size
805 B (805 bytes)
Hash
496b2b04c683aa1aee40aea9b8a9bd2b
e248732ed7105d6e618436ed2dad8556239243a1
ac90a1d4eed03e30376b0d3f7529652269e51bc2b0455797cb1acb34941f9ec2

HTTP Headers

GET /gaoskc/ca/favicon.png HTTP/1.1
Host: www.grandocasino.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.grandocasino.com/gaoskc/ca/index-uni.html

HTTP/1.1 200 OK
Date: Tue, 29 Nov 2022 07:03:24 GMT
Content-Type: image/png
Content-Length: 805
Connection: keep-alive
x-amz-id-2: MQFx6YHs5izrpMgTvXvv4OtPkzhXBm0YyTAaxLjsA9tEEazmoh5qywSzk8oXQ+56hd69iVOWZfc=
x-amz-request-id: YES42P8D4G1ZA33B
x-amz-meta-sha256: ac90a1d4eed03e30376b0d3f7529652269e51bc2b0455797cb1acb34941f9ec2
x-amz-meta-s3b-last-modified: 20180313T072905Z
Last-Modified: Tue, 22 Mar 2022 11:40:23 GMT
ETag: "496b2b04c683aa1aee40aea9b8a9bd2b"
Cache-Control: max-age=2678400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gO5QhF8%2FgswFjs%2FlOdgDuhtRJvlCboARGVv4Tp%2FJL0PdLLbEvYBrTze3nYCtCxZ0L1XfllFGF1m5IUw%2FN4NDZMdBhBB6DOkh0mKmijJdlRNVGeWcaJA3okd1kUGEnAxm6Az6UN8Hmg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77197bba4ef6b51d-OSL
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, ETag, Alert, Expires, Cache-Control, Backoff, Content-Length, Content-Type, Pragma, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 29 Nov 2022 06:08:56 GMT
cache-control: public,max-age=3600
age: 3268
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
7ab2ef968cb6a3078f4b9cb2dda813d4
e669116047ca058a2c1b2999ff0ea8682719162c
6ddecf0b21c44f3851da8efeb6ecdc6c8e9b83d7681153c31952b4ec8c23c940

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5291
Cache-Control: max-age=99101
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 07:03:25 GMT
Etag: "63847a2f-1d7"
Expires: Wed, 30 Nov 2022 10:35:06 GMT
Last-Modified: Mon, 28 Nov 2022 09:06:55 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

54.187.31.159

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.187.31.159:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: X0KjpEwS8/NDrHA4tvkd4A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: ITxBsjVVL0WLqpkeaOv9GWF2024=

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7746
Expires: Tue, 29 Nov 2022 09:12:32 GMT
Date: Tue, 29 Nov 2022 07:03:26 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7746
Expires: Tue, 29 Nov 2022 09:12:32 GMT
Date: Tue, 29 Nov 2022 07:03:26 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7746
Expires: Tue, 29 Nov 2022 09:12:32 GMT
Date: Tue, 29 Nov 2022 07:03:26 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7746
Expires: Tue, 29 Nov 2022 09:12:32 GMT
Date: Tue, 29 Nov 2022 07:03:26 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7746
Expires: Tue, 29 Nov 2022 09:12:32 GMT
Date: Tue, 29 Nov 2022 07:03:26 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F51b530e0-9ee5-45ee-95e9-a687ac33f22c.jpeg

34.120.237.76

200 OK

3.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F51b530e0-9ee5-45ee-95e9-a687ac33f22c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.0 kB (3004 bytes)
Hash
22e7d3e11e78242383e452adb9299016
035a1b4a2a7889787532ec2637d5c21e06daf672
990f18423bafc9cc3daaa1bd1290313b6cb3d3a391f642d01fd6797ad4fc9ca8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F51b530e0-9ee5-45ee-95e9-a687ac33f22c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3004
x-amzn-requestid: 1e6e228a-fb73-4ed3-881b-6b0e5c8297c7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cPYcrFRXoAMFUJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6382d450-45059338501b45d943d7e08c;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 03:06:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: rmBhEB-x2sOvI7XfEpZQ0-lXEDWZ4los77q017Im-Lwb32ZLA0Zvcg==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 04:45:15 GMT
age: 8291
etag: "035a1b4a2a7889787532ec2637d5c21e06daf672"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.8 kB (4803 bytes)
Hash
cc0a257323f882caff067adb86d906e4
cedf2f21be7cd366bd46055b62b5513db3011dfc
c16a9296d5e840a468fef7fb2764b9f7d4b3131d7ade2ce4999de1eead5469e0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4803
x-amzn-requestid: 80f7f1c8-0316-4181-83ac-2787b1ae825f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4iFHoIAMF2-g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-2c0a081b07e0785b4350c10c;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 9fRfgj9_S00P8fI_T-tVt7khJ1kYZux_55K_yLYUsiyVEoiWRM9QAw==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Mon, 28 Nov 2022 22:07:26 GMT
age: 32160
etag: "cedf2f21be7cd366bd46055b62b5513db3011dfc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1c32283b-8309-408e-85df-cad97da6bc80.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10176 bytes)
Hash
03014221d7f49b50ffc2d1b0a0e75457
772d86ad983042a728ee3490630a9cf1134ad0dd
81fb954fa569955907952987e9d8efd1dac80e0e4a682826abf3c5d90eb31771

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1c32283b-8309-408e-85df-cad97da6bc80.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10176
x-amzn-requestid: c2231955-5c78-4073-8399-b8b90f1add78
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cMo3oHpSoAMF5Qw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6381bb63-55a1cb004ac73c8b02f2fb8d;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 07:08:19 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: uGocx-Lv8ieJVvICjnTGQZyzaQzjVdICX2RZaNyBTQvUKeIcNxaCJQ==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 28 Nov 2022 07:38:02 GMT
age: 84324
etag: "772d86ad983042a728ee3490630a9cf1134ad0dd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9868f6d6-e29b-42b5-89c4-eec4771663b2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8402 bytes)
Hash
faf3524970b0c3256eb5708f4ccf11ce
47295f2cf1b039c4b85cbe463d7893671a563989
ba0c2ce23eae865936caa7fb47dd1ef6346b8a7bc8340db700df6e2f5e27ec27

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9868f6d6-e29b-42b5-89c4-eec4771663b2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8402
x-amzn-requestid: d2d62f85-b6be-4394-9668-1d913e4120d8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cPYeaGbgoAMFdCA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6382d45c-2b6bfdcc72011cf01ddbd66b;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 03:07:08 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 1il1ILDPBUseZWYjae_R0BQhpdyPTqqI0GycCljovgxjqhYezCwxCA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 04:17:21 GMT
age: 9965
etag: "47295f2cf1b039c4b85cbe463d7893671a563989"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3527eb28-888e-447d-90fd-1226d5b94433.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.9 kB (8921 bytes)
Hash
823e92f62ff7b3c2093828817d7f2866
c501de9eaa581a10b0b5fce40b54bb10f57f7c29
7d89669e23682f167b2fe1eff9edc5939112ec66b6b4e6389ef8aec78ccbdfe5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3527eb28-888e-447d-90fd-1226d5b94433.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8921
x-amzn-requestid: 98baf100-c007-4c44-89aa-b9cf55fa3f94
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cVNnwFYToAMFoWg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63852964-1227b5a9100c206e0c64f4b2;Sampled=0
x-amzn-remapped-date: Mon, 28 Nov 2022 21:34:28 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ivu6pzZ6dbt3I4tuFMg4oHcuPVdyNS-F3k_lQdmKoXFkdCfSseAEwQ==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 28 Nov 2022 21:46:55 GMT
age: 33391
etag: "c501de9eaa581a10b0b5fce40b54bb10f57f7c29"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b0dcfcd-38d5-4614-ad4e-405d8ad4ee91.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.0 kB (6037 bytes)
Hash
b5e2bc1651b37b8e0467c2a6cb860fb3
3348f081a3357490a704592d105d02e81886df89
751c601e075c9338335c05b0f430ba8065b4e97440e6630993afd943f302b253

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5b0dcfcd-38d5-4614-ad4e-405d8ad4ee91.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6037
x-amzn-requestid: eb17903e-1fd3-4a41-a6d1-8b671d890400
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cPAJjFa3oAMFcLA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6382ad70-3db95fcd1aeb9c411c55d173;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 00:21:04 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: NqtaziEIRl6auIGehos7TAJfBAY3CtGJX0vC-pWhjs377L_rEyM6hg==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 28 Nov 2022 10:14:18 GMT
age: 74948
etag: "3348f081a3357490a704592d105d02e81886df89"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (38)

URL HTTP/1.1

IP

ASN

File type

Size