Overview

URLlist-manage.agle1.cc/click?u=https://x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net
IP 216.58.207.211 (United States)
ASN#15169 GOOGLE
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-26 14:46:19 UTC
StatusLoading report..
IDS alerts2
Blocklist alert8
urlquery alerts No alerts detected
Tags None

Domain Summary (4)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
challenges.cloudflare.com (6) 0 2021-10-20 07:02:03 2023-05-26 08:33:42 3864 347736 104.18.6.185
ocsp.pki.goog (1) 175 2018-07-01 08:43:07 2023-05-26 05:09:27 347 712 142.250.74.3
list-manage.agle1.cc (1) 0 2017-01-30 09:44:24 2023-05-26 08:43:20 545 375 216.58.207.211
x4pbzj.calasavacj.com (5) 0 2023-05-23 14:56:10 2023-05-26 13:00:00 2478 73325 188.114.97.1

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-05-26 14:46:01 UTC medium Client IP Internal IP ET DNS Query for .cc TLD 
2023-05-26 14:46:01 UTC medium Client IP Internal IP ET DNS Query for .cc TLD 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-26 medium x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net Phishing
2023-05-26 medium x4pbzj.calasavacj.com/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7 (...) Phishing
2023-05-26 medium x4pbzj.calasavacj.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1 (...) Phishing
2023-05-26 medium x4pbzj.calasavacj.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1120277551:16 (...) Phishing

mnemonic secure dns
Scan Date Severity Indicator Comment
2023-05-26 medium slurpmail.net Sinkholed
2023-05-26 medium slurpmail.net Sinkholed

Quad9 DNS
Scan Date Severity Indicator Comment
2023-05-26 medium slurpmail.net Sinkholed
2023-05-26 medium slurpmail.net Sinkholed

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 216.58.207.211
Date UQ / IDS / BL URL IP
2023-06-06 05:54:09 UTC 0 - 0 - 0 www.eduhubavi.com 216.58.207.211
2023-06-05 11:51:28 UTC 0 - 2 - 0 www.viaggiespresso.com/2021/03/valle-del-mis.html 216.58.207.211
2023-06-05 07:30:51 UTC 0 - 4 - 0 www.assessoria2m.com/ 216.58.207.211
2023-06-05 04:34:46 UTC 0 - 1 - 0 www.ministerkyle.com/wp-content/themes/twenty (...) 216.58.207.211
2023-06-05 03:37:59 UTC 0 - 0 - 2 www.primarypunch.com/search/label/Christmas 216.58.207.211


Last 5 reports on ASN: GOOGLE
Date UQ / IDS / BL URL IP
2023-06-06 06:00:46 UTC 0 - 0 - 2 108.177.15.188 108.177.15.188
2023-06-06 06:00:25 UTC 0 - 0 - 3 ww1.download2-cdn.com/ 35.186.238.101
2023-06-06 05:58:55 UTC 0 - 0 - 3 5gfhghtrgeg3f3.blogspot.gr/ 142.250.74.65
2023-06-06 05:54:09 UTC 0 - 0 - 0 www.eduhubavi.com 216.58.207.211
2023-06-06 05:50:13 UTC 0 - 0 - 1 videoxxnxx5.blogspot.si/ 172.217.21.161


Last 5 reports on domain: slurpmail.net
Date UQ / IDS / BL URL IP
2023-06-06 05:56:32 UTC 0 - 6 - 0 all-china-tour.com/wp-content/themes/vc/deliv (...) 208.91.197.46
2023-06-06 05:51:13 UTC 4 - 0 - 0 mmtro.com/c?tagid=6565567-e43649793250da16347 (...) 195.66.82.41
2023-06-06 05:23:37 UTC 0 - 2 - 0 www.cbdshop.cc/PageCMS/NewsLetter_Click.aspx? (...) 172.67.174.89
2023-06-06 04:38:00 UTC 0 - 0 - 3 wqywj.lurequim.com/Mmike.ellis@slurpmail.net 172.67.191.91
2023-06-06 04:31:24 UTC 0 - 0 - 5 muenchnernotizen.info/wp-content/plugins/62df (...) 172.67.155.14


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 05:57:39 UTC 0 - 4 - 0 agnes-nue.com/image/putty.exe 46.166.189.98
2023-06-06 04:23:26 UTC 0 - 1 - 0 yuen.de/UPS-Invoice-for-downloads-919/ 81.169.145.92
2023-06-06 04:22:55 UTC 0 - 1 - 2 212.83.186.136/setup-15.exe 212.83.186.136
2023-06-06 04:22:25 UTC 0 - 1 - 0 hansworst.xyz/Flappy%20Hans.exe 103.224.182.210
2023-06-06 04:14:09 UTC 0 - 6 - 0 cdd.net.ua/apothecary/login.php?action=proces (...) 89.184.88.6

JavaScript

Executed Scripts (6)

Executed Evals (4)
#1 JavaScript::Eval (size: 13) - SHA256: 80b90237b40178e74c34d6652d95b3918d01b603ba83f9dce47ba6b19343c245
typeof module
#2 JavaScript::Eval (size: 4) - SHA256: 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408
this
#3 JavaScript::Eval (size: 549) - SHA256: 0f276db85bbc73f744d130a3ccea3f5451154c59d63d17d7695ce277200977d3
+((!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + []) + (!+[] + (!![]) + (!![]) + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![]) + (!+-[] + (+-!![]) + -[]) + (!+[] + (!![]) + (!![]))) / +((!+[] + (!![]) + (!![]) + []) + (!+[] + (!![]) + (!![]) + !![] + !![]) + (!+[] + (!![]) + (!![])) + (!+[] + (!![]) + (!![])) + (-~~~[]) + (!+[] + (!![]) - []) + (!+[] + (!![]) - []) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![]))
#4 JavaScript::Eval (size: 15) - SHA256: db8d20f2dfaf9df3877967927de5ecb9648fecda131ab44bf854f8d72baa2b23
typeof pyimport

Executed Writes (1)
#1 JavaScript::Write (size: 3575) - SHA256: 36d48aeb87174dbf8b0ea333d2042d9e198797bd33c3f849597981eacd619515
< html > < head > < style > # pr1 {
    border: solid 2.715 px;border - color: green;padding: 3.98 px;margin - left: 12.12 px;
}
# pr2 {
    border: solid 2 px;border - color: purple;font - size: 30 px;margin - top: 200 px; - webkit - transform: skewY(23.1753218 deg); - moz - transform: skewY(23.1753218 deg); - ms - transform: skewY(23.1753218 deg); - o - transform: skewY(23.1753218 deg);transform: skewY(23.1753218 deg);
}
# pr3 {
    border: solid 2.89 px;border - color: orange;font - size: 45 px;transform: scale(100000000000000000000009999999999999.99, 1.89);margin - top: 50 px;
}
# pr4 {
    border: solid 2 px;border - color: silver;transform: matrix(1.11, 2.0001, -1.0001, 1.009, 150, 94.4); - webkit - transform: matrix(0.95559, 2.13329, -0.9842, 0.98423, 150, 95); - moz - transform: matrix(0.66371, 1.94587, -0.6987, 0.98423, 150, 103.238); - ms - transform: matrix(0.5478, 1.94587, -0.7383, 0.98423, 150, 100.569); - o - transform: matrix(0.4623, 1.83523, -0.6734, 0.81231, 150, 99.324);position: absolute;margin - top: 11.1331 px;margin - left: 12.1212 px;padding: 4.4545 px;left: 239.4141 px;top: 178.5050 px;
}
# pr5 {
    border: solid 2 pt;border - color: red;margin - left: 42.395 pt;
}
caption {
    border: solid 2 px;border - color: darkred;font - size: 20.99 px;margin - left: 20.8 px;
}
# pr6 {
    border: solid 2 px;border - color: darkblue; - webkit - transform: perspective(12890 px) translateZ(101.5 px); - moz - transform: perspective(12890 px) translateZ(101.5 px); - ms - transform: perspective(12890 px) translateZ(101.5 px); - o - transform: perspective(12890 px) translateZ(101.5 px);transform: perspective(12890 px) translateZ(101.5 px);padding: 12 px;
}
# pr7 {
    position: absolute;margin - top: -350.552 px;margin - left: 0.9099 rem;border: solid 2 px;border - color: burlywood;
}
# pr8 {
    position: absolute;margin - top: -150.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: sandybrown;
}
# pr9 {
    position: absolute;margin - top: -110.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: orchid;
}
# pr10 {
    position: absolute;margin - top: -315.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: turquoise;
} < /style></head > < body > < div id = "pr1" > Ssss tttt < /div>       <div id="pr2">TTTT tttt</div > < div id = "pr3" > WW & nbsp & nbsp; & nbsp; & nbsp; & nbsp; & nbsp;
ssss tttt < /div>       <div id="pr4">vvvv sssss ttttt tttt</div > < table id = "pr5" > < caption > ttttt cccc tttt < /caption>         <thead>         <tr>             <th>tttt hhhh</th > < /tr>         </thead > < tbody > < tr > < td > tttt bbbb < /td>         </tr > < /tbody>     </table > < div id = "pr6" > ttttt pppp tttt tttt < /div>     <div id="pr7">         <select>         <option>sss ooo</option > < /select>     </div > < div id = "pr8" > < details > < summary > dddd ssss < /summary>         </details > < /div>     <div id="pr9">         <progress value="49" max="100"></progress > < /div>     <div id="pr10">         <button type="button"></button > < /div>     <script>parent._cf_gcr();</script > < /body></html >


HTTP Transactions (13)


Request Response
                                        
                                            POST /s/gts1d4/eXnoLhYmd4M HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Date: Fri, 26 May 2023 14:46:02 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /click?u=https://x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net HTTP/1.1 
Host: list-manage.agle1.cc
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             216.58.207.211
HTTP/2 302 Found
content-type: text/plain
                                            
set-cookie: JSESSIONID=-TkE89knNPuiJGFrnjnV0Q;Path=/;Secure
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net
x-cloud-trace-context: e9009be1b94b788f8632febe0ebe3178
date: Fri, 26 May 2023 14:46:02 GMT
server: Google Frontend
content-length: 0
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - mnemonic_dns: Sinkholed
  - quad9: Sinkholed
                                        
                                            GET /Manne.cinquemani@slurpmail.net HTTP/1.1 
Host: x4pbzj.calasavacj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.97.1
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:46:03 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C%2F5eLYtDVt6itt778l3L4th7CpeYhwwDByhbhevlbftLmYKQkuKQEDbo1Dy%2B%2FhFjuJKBsfi%2BcBbhmp8FC6f%2BNwliGBfskbVmu0GvWqO0vKwpiw0z7zVWMd2gNoZwoZnghbPOdYZeWbI%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6ce2d98001c0a-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1747), with CRLF, LF line terminators
Size:   3591
Md5:    bc2ff7cc9632bdbcd9bf9cc7188a760d
Sha1:   586d3989dd125f6fe6c0d57b52118b0891eba786
Sha256: a9e33a7af76891f8dc0ac6be36dc472341fc7dfb78ed12e91d3e936dabc99740

Blocklists:
  - fortinet: Phishing
  - mnemonic_dns: Sinkholed
  - quad9: Sinkholed
                                        
                                            GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd6ce2d98001c0a HTTP/1.1 
Host: x4pbzj.calasavacj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.96.1
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Fri, 26 May 2023 14:46:03 GMT
Content-Length: 42
Connection: keep-alive
Last-Modified: Thu, 25 May 2023 08:39:03 GMT
ETag: "646f1ea7-2a"
Server: cloudflare
CF-RAY: 7cd6ce2edb46b4fd-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 26 May 2023 16:46:03 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd6ce2d98001c0a HTTP/1.1 
Host: x4pbzj.calasavacj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net?__cf_chl_rt_tk=Q_jlOFE_wN5jBfeXpiXSFR3mYi34qmSQXB5lCey.NoU-1685112363-0-gaNycGzNBqU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.96.1
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:46:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: max-age=0, must-revalidate
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vkmc3VtDJsoAKjMpGaFF1VI1J5WhcBE96m9mhK%2FxRwLqB%2B6taFMpr17pXA9GziE8MKfKtx9%2FZq0mKWfMvj1ikiuK6aXyjLnePzDgGKoBaA%2B14nncUcIioXPt61oEZCL8VTZo7qXd0g4%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6ce2ed92c0afe-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   54416
Md5:    c7e9700e739e368e5727e17518d40c7d
Sha1:   defeeb40fb5266fd05fe9aa9a990500df5a87879
Sha256: df0079816ac3bc8ddf3bc8e7d8748d9580ff228b760d9c412cd4e78f681235a8

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: x4pbzj.calasavacj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net?__cf_chl_rt_tk=Q_jlOFE_wN5jBfeXpiXSFR3mYi34qmSQXB5lCey.NoU-1685112363-0-gaNycGzNBqU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.96.1
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:46:03 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RYCJdz80ZLU0lVZU7rXwqk%2B3uz5ep2IyFLFEhJyo6NZLIfd97YsBT9gaPPYbHt9J8y%2BmdNgY7Ykt2kdyyV2pQNTt4qMHM8o2YLVvKlln%2BC1NWzyn8UojpDJhF2gCFdBq8syAyNB7TB0%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6ce2ef94b0afe-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1811), with CRLF, LF line terminators
Size:   3612
Md5:    fc4a064df7787e22790ec4917d897c3f
Sha1:   1f5745c1f2f95d3d5fc170ab793a20cf7c2f2124
Sha256: 96580cae31992ff276ea0d0c961b96d13e3e4e085286ac2b25f913c6f8c556bb
                                        
                                            GET /turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://x4pbzj.calasavacj.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.6.185
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:46:03 GMT
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cd6ce2f8d5bb4ee-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (15748)
Size:   11039
Md5:    2a1262ba5cd32899831d483322a28dd7
Sha1:   3805876db8773ed5820043e1f39b0b6c049f61b2
Sha256: 2e1e45b1d429b2d703676139932fe97b7ffc7986e6d0221653a7404e4c3032f0
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vz0bs/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/html; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:46:03 GMT
cache-control: max-age=0, must-revalidate
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 7cd6ce304ac30afe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (10899)
Size:   24085
Md5:    b9cce554931d1858f4f268c42e5ce1f3
Sha1:   6c28a4582259fe9e99bf6b69a477b87f24b5168e
Sha256: 86b3b933cbafbeadcbc1804aabb49475caa437566854a60ca7286bee45ca0623
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1553822328:1685110227:4zvkXctFT1Z2vTipEnWYDxj5A2MX7fyP5BCK_7Aa2ik/7cd6ce304ac30afe/55cd0c02d081634 HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vz0bs/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 55cd0c02d081634
Content-Length: 2785
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:46:03 GMT
cf-chl-gen: /6J/69V9C7ZoZvZV7cVtjRzdbb0rj/EtWzshyIDBc0tNrRSE6tMThql2zgeneUNW/z1JDN6RkQcap5mcQtiZIURECB+M5HX/X//Y4/7B741Cl1uSM67qxNQ8u/TzqOqJMcD9vGfosfjArZPObSWA4SnSwZF7qZvXTpXup/SLXtWh84NBwFdHCQ6HAOGZR1g8idZk6zrW6aTlSwXNyqSgPotFflp9kM9A6fUGaIz+JSSAZigSei6RTXKY5ADYw972O0LzosQ3EIrtCn4BSjpHbKPJ1UA7BkWYUbFH/YdPCVTtKUt5A9kX2Pr0fO7r3UIFTysFeNTtvqUNatSU9EZSbckLvC5zEIqFEkWw2IPzmZSw30yDbt7o1jc4TR3gPPZwQNCgF+kRMG1MZ4gc3g2eGZ/3dVjuYOuy3FtWtJGMyRnuxxqp2omQRZalQj54QYD7$SiQ+6kAeKq+Yxmy4+mYUTg==
server: cloudflare
cf-ray: 7cd6ce320d1d0afe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   133408
Md5:    e9188f70337353f52b3c77ab796b1b45
Sha1:   f695e5af7502391435140a7793d75cf8c0e87240
Sha256: 568c8f1e053120e7b33845e5a09fe253490820f6a64ac9ecc8389bf0bff25b9e
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1553822328:1685110227:4zvkXctFT1Z2vTipEnWYDxj5A2MX7fyP5BCK_7Aa2ik/7cd6ce304ac30afe/55cd0c02d081634 HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vz0bs/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 55cd0c02d081634
Content-Length: 17967
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:46:06 GMT
cf-chl-gen: ImIa4YHBcDuzf69svaEeGqCvdyyuw4eDFWke8eGRaES+b+lKfgHcQisBZRgmvBM8$sgeoua5sQXcVlEWGzblybg==
server: cloudflare
cf-ray: 7cd6ce41fd760afe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (13272), with no line terminators
Size:   13272
Md5:    8b7d230556da9fa699df0edbb098754d
Sha1:   d0a6f804a277a241076ab4a171c76e3cad34efc9
Sha256: 9dbcd01c5ede81ece13d951558ccae2b825b5f11fb314efcf60eadb5cbbdbdd6
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1120277551:1685110239:ktSxKUspJ5GcdBIwFlJ3c0bDtuH6Ein0KFNpR3YFHJ0/7cd6ce2d98001c0a/836323ef3b9baee HTTP/1.1 
Host: x4pbzj.calasavacj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://x4pbzj.calasavacj.com/Manne.cinquemani@slurpmail.net
Content-type: application/x-www-form-urlencoded
CF-Challenge: 836323ef3b9baee
Content-Length: 1785
Origin: http://x4pbzj.calasavacj.com
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             188.114.96.1
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:46:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: UHgO98yFDtpmjHMcPzZ+A9HBvLZpNHGYOi9p+y8qqFtyidfk8qoxbeMNvZkpCCsK$Vg/hfqSmnNDxm509D4TmUw==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KU%2BBzhrGiLPsrVpGb59thuOkySdJWMYZMx%2BZz7LzQwp4yTROGAh86gXb6CF6A171tLjcDyIdiM1aDcTZNLKzFPHAJMa2fxAj0LhLWzi7a90g15NDPcb0VgVulK31kyBMdmspSuxc6TU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6ce300cceb4fd-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60



--- Additional Info ---
Magic:  ASCII text, with very long lines (7440), with no line terminators
Size:   7440
Md5:    e82f74932f612f7e9964b16c45f59eb6
Sha1:   5bc903c53f7cfc6228938d6f280480cc35dd97de
Sha256: 76cdb2da85f9646d5897a4fe6515bb1c6190685a8259bd2b479c32d5653c9023

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd6ce304ac30afe HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vz0bs/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:46:03 GMT
cache-control: max-age=0, must-revalidate
server: cloudflare
cf-ray: 7cd6ce30bb300afe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   163360
Md5:    da97bc2746c1cb8b7a8ba31d24946d3c
Sha1:   fd0855270b5ab88bc2be8236b8027d693449ca8d
Sha256: ded66d281926cd6a019ac97f1ca9bff3ddca3ed8e7af20832bb0e2b2259e1f92
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/img/7cd6ce304ac30afe/1685112363855/IeRRkxiqDP_acPU HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/vz0bs/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: image/png
                                            
date: Fri, 26 May 2023 14:46:06 GMT
server: cloudflare
cf-ray: 7cd6ce40cc6d0afe-OSL
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  PNG image data, 95 x 10, 8-bit/color RGB, non-interlaced\012- data
Size:   61
Md5:    c168326fe4c2076c0aa0f16169eff222
Sha1:   6196e5562dfce8977513e49f6cbaaf545df19f89
Sha256: c161641df065307f3d238e607007daec8e1ce0b40cb039e942741942affa5a0f