is.gd/Takarek
301 Moved Permanently 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /Takarek HTTP/1.1
Host: is.gd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Thu, 08 Dec 2022 18:59:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 08 Dec 2022 19:59:58 GMT
Location: https://is.gd/Takarek
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7767bdc0eb08b505-OSL
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7181eff9c60e83eb0004ece591e47dca
0fd8cd0c9d10b0547938982e57d2c43e2d98679f
89c5c0e2d6890798644174a8e31976aec03a1b3deb03812afbb520e5ed68f522
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89C5C0E2D6890798644174A8E31976AEC03A1B3DEB03812AFBB520E5ED68F522"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8172
Expires: Thu, 08 Dec 2022 21:16:10 GMT
Date: Thu, 08 Dec 2022 18:59:58 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 388f6fea5bafa378266622b72311a6ee
447f102dc12172ce1ba44c5e94e1d7bb49d43372
a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3778
Expires: Thu, 08 Dec 2022 20:02:56 GMT
Date: Thu, 08 Dec 2022 18:59:58 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Length, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 08 Dec 2022 18:08:13 GMT
content-type: application/json
age: 3105
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 00e7703bd74975689fc9050356aaca6b
9788fe6a36d6f278e8da329ebc5dd87bcd212317
593bc437ff8a8233516c62613d50220fcb25b9f967ed5fb384c253f0db135103
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "593BC437FF8A8233516C62613D50220FCB25B9F967ED5FB384C253F0DB135103"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7634
Expires: Thu, 08 Dec 2022 21:07:12 GMT
Date: Thu, 08 Dec 2022 18:59:58 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: MTqY5uiWB9eBhdizuymohoGPrHR3U21NiB9K0BniFJD/MLcjEwKbzJmtWY5GHoxlGRnNUo+TQMQ=
x-amz-request-id: NH548DS3CXQJPTV0
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 08 Dec 2022 18:49:55 GMT
age: 603
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:58 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Last-Modified, ETag, Cache-Control, Alert, Content-Length, Pragma, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 08 Dec 2022 18:07:55 GMT
age: 3123
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ad4abb867fcf97efddacf1f3ede368dc
cb1a634db12929b2a8d2ba2bdc802077ef014422
20282dd7db903cd68f1f51a88ad8f6482a67b242bc3471dab87aba7f0baf0460
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "20282DD7DB903CD68F1F51A88AD8F6482A67B242BC3471DAB87ABA7F0BAF0460"
Last-Modified: Wed, 07 Dec 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Fri, 09 Dec 2022 00:59:58 GMT
Date: Thu, 08 Dec 2022 18:59:58 GMT
Connection: keep-alive
22051-4482.s3.webspace.re/takrek/secured
301 Moved Permanently 333 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/secured
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash aec932e8d008654d1b1b85b2f4836fb2
8657f6fb31963544000d36addc834967787b65ea
b0785a840124c530c3dc711f3706a271491823fef27640bc3cdc66610011561a
Analyzer Verdict Alert fortinet Malware
GET /takrek/secured HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 301 Moved Permanently
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 333
location: https://22051-4482.s3.webspace.re/takrek/secured/
x-powered-by: PleskLin
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/secured/
302 Found 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/secured/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
GET /takrek/secured/ HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers
HTTP/2 302 Found
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: login.php
x-powered-by: PHP/7.4.33, PleskLin
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash fd55f4aaaab6ec40bc7dc10252cd819a
a72523f60be265a391fa9edc43e0a93418ad1fd0
bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4659
Cache-Control: max-age=141872
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 18:59:59 GMT
Etag: "6391a92c-1d7"
Expires: Sat, 10 Dec 2022 10:24:31 GMT
Last-Modified: Thu, 08 Dec 2022 09:06:52 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471
22051-4482.s3.webspace.re/takrek/secured/login.php
200 OK 6.7 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/secured/login.php
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 6b14bdd22b2eb1bd6acd5d518b4c3f66
0e469c3776e7e5db99fd3dbdd7ed4e5dfbf97c45
e3623d135832ba1dc377d608779f4ac703b73b40b5eeff529e6f803b53c503cf
Analyzer Verdict Alert fortinet Malware
GET /takrek/secured/login.php HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/html; charset=UTF-8
content-length: 6700
vary: Accept-Encoding
content-encoding: gzip
x-powered-by: PHP/7.4.33, PleskLin
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/zentk_communication730c.css?version=1647007157
200 OK 70 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/zentk_communication730c.css?version=1647007157
IP
Hash c7e9f7bca99756300125b271889ff634
685b99ba94a4835e5cc5bfb7f0f4a41a668b463b
818858c6b6fb72301a0f5ca06a01293bd4dcd680bf6daec17d30d7e695f23bf1
GET /takrek/1/zentk/zentk_communication730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
content-length: 70
x-accel-version: 0.01
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: "67-5ef0bd17f1a80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-powered-by: PleskLin
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/material-design-icons/iconfont/material-icons730c.css?version=1647007157
200 OK 447 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/material-design-icons/iconfont/material-icons730c.css?version=1647007157
IP
Hash bb6a21bec4cb0d297ceaf064b29e478f
e942d3db735c47ca914654e7cb2aab90d5eee8b0
277b20715225e7c687580854ed3472802bc43e7579d844d6a771770275f71b20
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/material-design-icons/iconfont/material-icons730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
content-length: 447
x-accel-version: 0.01
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: "3c9-5ef0bd17f1a80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-powered-by: PleskLin
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/pics/banklogo-white.png
200 OK 4.6 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/pics/banklogo-white.png
IP
File type PNG image data, 240 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash feefe3d550d350ce3385ee80dcc916f1
918c7172236bcc6595f1158f27f29f38b54033d0
fff6fc8f92dcc6b0e036d0ed6882b740163380b53f81b9140aed6d0303a20c0f
GET /takrek/1/pics/banklogo-white.png HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: image/png
content-length: 4615
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: "638d5d9a-1207"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: pE2Uhb1sU+EJYeEYXUacUA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 5NLf5BWdYaPPb+l/rNtKsSqW8Rc=
22051-4482.s3.webspace.re/takrek/1/login730c.css?version=1647007157
200 OK 146 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/login730c.css?version=1647007157
IP
File type ASCII text, with very long lines (4391)
Size 146 kB (146521 bytes)
Hash a1cd40f36708f36ace0500810ddebf0c
16e0d5866eef4a42554289a8530e038eeec77836
f36710aa0f3abbe0e2a2e677ae306b6321051159100a5de5a2be8fcc14d740b1
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/login730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-1128"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/fontawesome/css/all730c.css?version=1647007157
200 OK 150 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/fontawesome/css/all730c.css?version=1647007157
IP
Size 150 kB (150460 bytes)
Hash 9341242440eee75008b6bc92df7ca68f
ba912d9e5dcc0ef12cb982800f4dff03f3ef5055
f55bfcf6fd35daa83c438a44529ff93fc67fe2d7a195230c8c75c2d58efe93d5
GET /takrek/1/zentk/fontawesome/css/all730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-14113"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/zentk_formats.hu.min730c.js?version=1647007157
200 OK 48 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/zentk_formats.hu.min730c.js?version=1647007157
IP
File type ASCII text, with very long lines (571)
Hash 112e04c8e889c741d0ba5e0b11c2eda7
611609f993e4bbc0d7e18c75ee0c3496eb9138dc
40b1f641a21c213cafbc87f975e73ec1ddca6d9ff75fe20e70315c851656f7a3
GET /takrek/1/zentk/zentk_formats.hu.min730c.js?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-62fe"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/secured/image/f5.png
200 OK 14 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/secured/image/f5.png
IP
File type PNG image data, 151 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 5dd051b338b787b7b3cbc17b1abc6831
173a77381129268ec6fa5e82f5604755d7ecef79
05d942c4457f5e7b8867c5d8fc1ce44a7590faef0122e088908b84253e0925b6
GET /takrek/secured/image/f5.png HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Cookie: sid=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: image/png
content-length: 13530
last-modified: Mon, 05 Dec 2022 02:55:28 GMT
etag: "638d5da0-34da"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/eib.hu.min730c.js?version=1647007157
200 OK 9.4 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/eib.hu.min730c.js?version=1647007157
IP
File type ASCII text, with very long lines (642)
Hash ec66d0099a7caac37edf7ace55d82097
61802be7ec9f459aa1e771efd9fc91ae8d33b3ba
a7dab2d73256021125b50dccd9689da730040fde1bd381147b4aa51230b94218
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/eib.hu.min730c.js?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-74a7"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/jquery-ui/jquery-ui.css
200 OK 1.3 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/jquery-ui/jquery-ui.css
IP
Hash 019076f5721012b0aa629dabb6e28f0b
7c6d019555a6c6a2e438118290d40f0ec3280b5d
824133312d5d34e237725227d9b7bd7ad46c69eb67eb0542923c2a13acd33738
GET /takrek/1/zentk/jquery-ui/jquery-ui.css HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-b2d"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/foundation/css/app730c.css?version=1647007157
200 OK 20 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/foundation/css/app730c.css?version=1647007157
IP
File type Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Hash 1d651e123f7a8c626c0f066425164b56
30f17b9e64bbf17824109abed901590d7da40780
6d8073353baa43d0b813a51b1080b8ca38a9e5726aab1a68e4c474c3a569f777
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/foundation/css/app730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-306e5"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3928
Expires: Thu, 08 Dec 2022 20:05:28 GMT
Date: Thu, 08 Dec 2022 19:00:00 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 210b27f5f6310d8fad640acce3d9ae0e
08d241e56622cb900754d95bc5d58ed8826d9f32
64410e13759cdfa24976dcba0c64aca27edc3ee56358f344e55f60793422e3ea
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6557
x-amzn-requestid: 0232ddcd-8274-431e-a55e-8298fbfd6dfc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cmcuMG6bIAMFUng=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638c0e5a-3cc17121425f87321ce7ae7e;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 03:04:58 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: EeYw3qxRNMEhtLkUrHQe5b1H_f2k-5BWSZV4LEZ9U64rqm7Addv_Dw==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 06:56:32 GMT
age: 43408
etag: "08d241e56622cb900754d95bc5d58ed8826d9f32"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b87d6543345f73653ed4a49b37d7c959
c4f26846b8b72293368ff16915d49297cf12bbb9
aee6aa42e4b5b83b81f74801ff8f0039fc6d38036f42ee81875813c856cf5eef
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8659
x-amzn-requestid: 6f420d07-65d5-4bb2-9f1f-e56025de497b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFSYFArIAMF46w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c0f-0a295e5c48228d5806b4f107;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: TSh1BNzzIPhWCfYEiqvQJckSPAyhHobe-HK6msEVeEJ1ruX-_rMSSA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:35:32 GMT
age: 69868
etag: "c4f26846b8b72293368ff16915d49297cf12bbb9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg
200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8c94003641bb5a7595e7004f80f95d22
3446450df60d732f9021d5bfd5f5f7c6c870d9ec
4d782dbf94b2163e9bc18028cd0c1a391fdcfcb019f23c4c26ea0b44432039ff
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7801
x-amzn-requestid: cb8d5aab-409f-4b39-b498-b1ba84f34e06
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFRNHX4oAMFvoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c07-7c6e3bfa3f81082b48f43fa9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 8QHhEAFHTHd-5UqS1S5qwJj_h4WNfix2CgS4MO4zR_psrzgMP3SZ5g==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:16:35 GMT
age: 71005
etag: "3446450df60d732f9021d5bfd5f5f7c6c870d9ec"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/eib730c.css?version=1647007157
200 OK 19 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/eib730c.css?version=1647007157
IP
File type Unicode text, UTF-8 text, with very long lines (61786)
Hash dd7a6985b8ecada793a365d0a4d3cd30
25b9308ac32b9afcfa8b0700fbc8f471f2541a7d
189c35a28c3c9830a2543f9f7bfa93a661c2a8931e60f7c368f001157ef4c67e
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/eib730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-f16d"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg
200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 24d89b69ba37bf23c5d576aff4063caf
3d46a21b4da571d7e4962e335c18a28ca5f81ecf
09b52cdab278805c6e7282f469a02768ee62fc9ef09a6623a337e3d3aaa446fd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7268
x-amzn-requestid: ae5c231c-b1be-498a-a242-e8d641f3fe8e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFDgEzUoAMFgyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911baf-10f06dc37cac69631c823fd9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:03:11 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: wFqXeAYHSBcj85PiuqhV790clAMWg_NHMCO5Q5WARXDaohFWZdeCig==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:19:17 GMT
age: 70843
etag: "3d46a21b4da571d7e4962e335c18a28ca5f81ecf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/foundation/css/foundation.min.css
200 OK 30 kB URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/foundation/css/foundation.min.css
IP
File type Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Hash 865d3d3cecf6c457e4f2688a839d5810
5cf4da63d8621a2525ca1867df3dfcfe85ff7454
3af5a1d8bd19a321f649ddb5c9e302b3d9f83bb70d71855cfdd78a3a378b554c
GET /takrek/1/zentk/foundation/css/foundation.min.css HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-2600c"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/eibpublic_ib_S7/LPExt/logininfo.hu.html?version=1647007157
404 Not Found 0 B URL HTTP/2 22051-4482.s3.webspace.re/eibpublic_ib_S7/LPExt/logininfo.hu.html?version=1647007157
IP
POST /eibpublic_ib_S7/LPExt/logininfo.hu.html?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 14
Origin: https://22051-4482.s3.webspace.re
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Cookie: sid=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/html
last-modified: Fri, 18 Nov 2022 10:10:40 GMT
etag: W/"328-5edbbeafda422"
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/zentk730c.css?version=1647007157
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/zentk730c.css?version=1647007157
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/zentk730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-1362e"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/jquery-ui/jquery-ui.min.js
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/jquery-ui/jquery-ui.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/jquery-ui/jquery-ui.min.js HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-1ac08"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/foundation/js/vendor/foundation.min.js
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/foundation/js/vendor/foundation.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/foundation/js/vendor/foundation.min.js HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-7e770"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/zentk_mobilapp.hu.min730c.js?version=1647007157
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/zentk_mobilapp.hu.min730c.js?version=1647007157
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/zentk_mobilapp.hu.min730c.js?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-51c9"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/zentk_communication.hu.min730c.js?version=1647007157
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/zentk_communication.hu.min730c.js?version=1647007157
IP
GET /takrek/1/zentk/zentk_communication.hu.min730c.js?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-564c"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/zentk.hu.min730c.js?version=1647007157
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/zentk.hu.min730c.js?version=1647007157
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/zentk.hu.min730c.js?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-14f4d"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/icons730c.css?version=1647007157
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/icons730c.css?version=1647007157
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/icons730c.css?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-120bc"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/zentk_foundation.hu.min730c.js?version=1647007157
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/zentk_foundation.hu.min730c.js?version=1647007157
IP
GET /takrek/1/zentk/zentk_foundation.hu.min730c.js?version=1647007157 HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-97a8"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
is.gd/Takarek
301 Moved Permanently 0 B IP
GET /Takarek HTTP/1.1
Host: is.gd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 301 Moved Permanently
date: Thu, 08 Dec 2022 18:59:58 GMT
content-type: text/html; charset=UTF-8
location: https://22051-4482.s3.webspace.re/takrek/secured
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7767bdc29f10b518-OSL
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/foundation/js/vendor/what-input.js
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/foundation/js/vendor/what-input.js
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/foundation/js/vendor/what-input.js HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-36cf"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/takrek/1/zentk/jquery/jquery.min.js
200 OK 0 B URL HTTP/2 22051-4482.s3.webspace.re/takrek/1/zentk/jquery/jquery.min.js
IP
Analyzer Verdict Alert fortinet Malware
GET /takrek/1/zentk/jquery/jquery.min.js HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 02:55:22 GMT
etag: W/"638d5d9a-15851"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
22051-4482.s3.webspace.re/eibpublic_ib_S7/LPExt/usefullinks.hu.html
404 Not Found 0 B URL HTTP/2 22051-4482.s3.webspace.re/eibpublic_ib_S7/LPExt/usefullinks.hu.html
IP
Analyzer Verdict Alert fortinet Malware
POST /eibpublic_ib_S7/LPExt/usefullinks.hu.html HTTP/1.1
Host: 22051-4482.s3.webspace.re
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 14
Origin: https://22051-4482.s3.webspace.re
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/takrek/secured/login.php
Cookie: sid=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Thu, 08 Dec 2022 18:59:59 GMT
content-type: text/html
last-modified: Fri, 18 Nov 2022 10:10:40 GMT
etag: W/"328-5edbbeafda422"
content-encoding: br
X-Firefox-Spdy: h2
netbank.takarekbank.hu/eibpublic_ib_S8/zentk/fontawesome/webfonts/fa-regular-400.ttf
200 OK 0 B URL HTTP/1.1 netbank.takarekbank.hu/eibpublic_ib_S8/zentk/fontawesome/webfonts/fa-regular-400.ttf
IP
GET /eibpublic_ib_S8/zentk/fontawesome/webfonts/fa-regular-400.ttf HTTP/1.1
Host: netbank.takarekbank.hu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://22051-4482.s3.webspace.re
Connection: keep-alive
Referer: https://22051-4482.s3.webspace.re/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Thu, 08 Dec 2022 19:00:01 GMT
Server: Apache
Last-Modified: Wed, 27 Jul 2022 20:18:23 GMT
ETag: "4bacc-5e4cf1e6fc07c"
Accept-Ranges: bytes
Content-Length: 309964
Connection: close
Content-Type: application/font-sfnt
Strict-Transport-Security: max-age=16000000; preload;
Set-Cookie: SERVERID=peibnetweb01l; path=/; HttpOnly; Secure
Cache-control: private
104.25.234.53
93.184.220.29
23.36.76.226
91.218.65.6
195.228.180.117