web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
301 Moved Permanently 162 B URL HTTP/1.1 web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6 HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 10 Dec 2022 03:35:35 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash f2acd891dc6eb1f09f57a2b086791781
1e2088306501a61edcca1ade62c4d54f23b3b083
51148fed95cc00d60dc3640350f135b1b2763ff0e3cfbffc40f0948317894be9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "51148FED95CC00D60DC3640350F135B1B2763FF0E3CFBFFC40F0948317894BE9"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20768
Expires: Sat, 10 Dec 2022 09:21:44 GMT
Date: Sat, 10 Dec 2022 03:35:36 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 388f6fea5bafa378266622b72311a6ee
447f102dc12172ce1ba44c5e94e1d7bb49d43372
a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3028
Expires: Sat, 10 Dec 2022 04:26:04 GMT
Date: Sat, 10 Dec 2022 03:35:36 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Backoff, Content-Length, Content-Type, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 10 Dec 2022 03:33:18 GMT
content-type: application/json
age: 138
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 4ee537977be9c03702f8ffe0025bf1fe
21637881c4aa34c4add703f8bff4eff573159f45
4819229fd8f502a0c68c80bd7409e104c1b4d1a98ca8a6cd9deba629b1511aea
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4819229FD8F502A0C68C80BD7409E104C1B4D1A98CA8A6CD9DEBA629B1511AEA"
Last-Modified: Thu, 08 Dec 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14732
Expires: Sat, 10 Dec 2022 07:41:08 GMT
Date: Sat, 10 Dec 2022 03:35:36 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: dSjCStCiUsxhEv61zfJlORGsjX28hwsqR/hCNPy+a9H1dGtx1bD9df2t1rrD4/wRFz0CzZR+N2c=
x-amz-request-id: ZSSG3KQRHNXGPMYP
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 10 Dec 2022 02:48:37 GMT
age: 2819
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash da7931c14b4e052823e23fdfed49b869
58cee2f2b167654492468e8cb0df008dd624c2cc
2dc0bc079e16f74f7680707333f2e660ef9281732995e715fe02f91e53758cca
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2DC0BC079E16F74F7680707333F2E660EF9281732995E715FE02F91E53758CCA"
Last-Modified: Thu, 08 Dec 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21543
Expires: Sat, 10 Dec 2022 09:34:39 GMT
Date: Sat, 10 Dec 2022 03:35:36 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Backoff, Content-Length, Pragma, Alert, Expires, Last-Modified, Retry-After, ETag, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 10 Dec 2022 03:07:55 GMT
age: 1661
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
200 OK 4.8 kB URL HTTP/2 web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (591)
Hash 731b03fc328086c2535f770952830f2c
f8751de9d952a44cbe94a44e9195da6a14fccb28
98350545ec3171b7e96f989bd08ad36d35c14ed16d38ef43fbfe09513259d285
GET /in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6 HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: text/html; charset=UTF-8
content-length: 4768
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
vary: Accept-Encoding
content-encoding: gzip
x-powered-by: PHP/7.4.33, PleskLin
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/form/css.css
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/login/form/css.css
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/login/form/css.css HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: text/css
content-length: 0
x-accel-version: 0.01
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: "0-5ec2c12761d00"
accept-ranges: bytes
x-powered-by: PleskLin
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash e6be4d2155028ffff5d01ab6e7edf6da
07172071b5cf43c4cd7d7930b4ad8518ec1e32e9
4d8a5fa2362fd0910babd6d128d850d4460829468eb23d34ee5ee6eaa42d5a38
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3188
Cache-Control: max-age=109467
Content-Type: application/ocsp-response
Date: Sat, 10 Dec 2022 03:35:36 GMT
Etag: "6392faaf-1d7"
Expires: Sun, 11 Dec 2022 10:00:03 GMT
Last-Modified: Fri, 09 Dec 2022 09:06:55 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471
web9259.web07.bero-webspace.de/in/login/ING_Deutschland_Claim.svg
200 OK 21 kB URL HTTP/2 web9259.web07.bero-webspace.de/in/login/ING_Deutschland_Claim.svg
IP
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 5dd5d510109fe4d0e8ea8d6988b76805
2793df60c869776d2fdb5ed4316e599e12150792
f41428bb3f8bd412eed7e59325ab789007fb6362ec5f06da18c67e5bb7639114
Analyzer Verdict Alert fortinet Phishing
GET /in/login/ING_Deutschland_Claim.svg HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/login/bundle.ibbr-ver-0EFCA3FE9DBDCD28ABB2BAEA94D9129E.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: image/svg+xml
content-length: 20856
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: "635d25d4-5178"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/INGMeWeb-Bold.woff2
200 OK 30 kB URL HTTP/2 web9259.web07.bero-webspace.de/in/login/INGMeWeb-Bold.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 30456, version 1.0\012- data
Hash 126c1fdeee5cc17fef5f5909ebb5c86f
e2676a4a0c0f88ad2f33fe8acefc038073785de3
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
Analyzer Verdict Alert fortinet Phishing
GET /in/login/INGMeWeb-Bold.woff2 HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/login/bundle.ibbr-ver-0EFCA3FE9DBDCD28ABB2BAEA94D9129E.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: font/woff2
content-length: 30456
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: "635d25d4-76f8"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/INGMeWeb-Regular.woff2
200 OK 30 kB URL HTTP/2 web9259.web07.bero-webspace.de/in/login/INGMeWeb-Regular.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 29616, version 1.0\012- data
Hash 97205b19383b6a85ef38eb0997c23c35
f7e0af7cfde57e454dde3a2a0c878cc37de5841e
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155
Analyzer Verdict Alert fortinet Phishing
GET /in/login/INGMeWeb-Regular.woff2 HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/login/bundle.ibbr-ver-0EFCA3FE9DBDCD28ABB2BAEA94D9129E.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:37 GMT
content-type: font/woff2
content-length: 29616
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: "635d25d4-73b0"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/icons.woff
200 OK 40 kB URL HTTP/2 web9259.web07.bero-webspace.de/in/login/icons.woff
IP
File type Web Open Font Format, TrueType, length 40128, version 1.0\012- data
Hash bbf967c24ec9deda08e3ecef994bffb8
963b670dbe0d1d025dab9a1180bae0be469ec519
b5042719aa693ccb50ddf9bb7a99d2df224389b5e8dbf4c2bb3b385b8e63bdd9
Analyzer Verdict Alert fortinet Phishing
GET /in/login/icons.woff HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/login/bundle.ibbr-ver-0EFCA3FE9DBDCD28ABB2BAEA94D9129E.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:37 GMT
content-type: font/woff
content-length: 40128
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: "635d25d4-9cc0"
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: vFZYRM/9hIMuN1SUrF38Sw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 1f+mdrY0YKHeMN3pjAwGltvnfOQ=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14701
Expires: Sat, 10 Dec 2022 07:40:39 GMT
Date: Sat, 10 Dec 2022 03:35:38 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14701
Expires: Sat, 10 Dec 2022 07:40:39 GMT
Date: Sat, 10 Dec 2022 03:35:38 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14701
Expires: Sat, 10 Dec 2022 07:40:39 GMT
Date: Sat, 10 Dec 2022 03:35:38 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 7b8c1870f03a90aac6370fc69516f95f
1e94fd7c9a2f9fe4867e21ab217879a2180a9cdb
f43702cd363447680d545d928f9ea6f997a770228108b4c9312999b76891bb38
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F43702CD363447680D545D928F9EA6F997A770228108B4C9312999B76891BB38"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14701
Expires: Sat, 10 Dec 2022 07:40:39 GMT
Date: Sat, 10 Dec 2022 03:35:38 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c3a6c54-dd12-46c8-8acb-7c425ab40af5.jpeg
200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c3a6c54-dd12-46c8-8acb-7c425ab40af5.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 052b61a3bd1c839e1f5ce37834cad817
1fbbf8fb328a1406904d6346004e2c89c6ba2419
96dcb266eaec98f6305071598df3b49ca93234e0e8b1c8c9801a1a99d7f5c817
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7c3a6c54-dd12-46c8-8acb-7c425ab40af5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7811
x-amzn-requestid: dc97f86e-a29c-4139-887a-e775a0327280
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: c5eK4EH_oAMFYqw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6393aa45-3a38086160ac180b3f8cf5d8;Sampled=0
x-amzn-remapped-date: Fri, 09 Dec 2022 21:36:05 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: TM_0Q_GmJDuXth6JpRvm_JAZXwT-xFZEjzuMeIzfzBu1J5jQ_Tng9A==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Dec 2022 21:53:25 GMT
age: 20533
etag: "1fbbf8fb328a1406904d6346004e2c89c6ba2419"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4acdd84d-55dd-4e5d-bcf3-ab9d63566335.jpeg
200 OK 7.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4acdd84d-55dd-4e5d-bcf3-ab9d63566335.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a81548132f6f176f60e4fc278114ff84
3f330d6c27242cc3d65b975ab4a1c39b08fb69de
82095572be60a13b933293fa38a956e366a854becc5532dfccbf5893366ab702
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4acdd84d-55dd-4e5d-bcf3-ab9d63566335.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7535
x-amzn-requestid: 9c904976-42b9-40c9-aefa-201f0f84358f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: c5eMUHw7IAMFSng=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6393aa4e-3a601e621f9f31c7509f4e52;Sampled=0
x-amzn-remapped-date: Fri, 09 Dec 2022 21:36:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: lqpcbADJan6TfJwh4c4A0pn6R11QwnLRxtyxQgFLLcCVvyVDMERfRg==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Dec 2022 21:54:09 GMT
age: 20489
etag: "3f330d6c27242cc3d65b975ab4a1c39b08fb69de"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/token/token.js?v=6393fe889a36c
200 OK 13 kB URL HTTP/2 web9259.web07.bero-webspace.de/in/login/token/token.js?v=6393fe889a36c
IP
File type ASCII text, with very long lines (1837), with no line terminators
Hash 7945f9f40fdfb7d43f844e8abec15a58
9cb6c87cf928f6911e36a9b43033fa7d07e9f5a9
c3b032ec5ed2dd90a9c03c52268b75d9d40c032528c68e3a53a54c10c02fa466
Analyzer Verdict Alert fortinet Phishing
GET /in/login/token/token.js?v=6393fe889a36c HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: application/javascript
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: W/"635d25d4-72d"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/core/form/core_form.js
200 OK 14 kB URL HTTP/2 web9259.web07.bero-webspace.de/in/core/form/core_form.js
IP
Hash 6b0c6c8eda00fbfab8d2b85eceb98346
2f01db2caf786e44ce89a10cb10e56cc16eb44de
fc3a606d1013ce33709ba0243762a7f727a421e16a6bf1eddd21dbb59b3557b6
Analyzer Verdict Alert fortinet Phishing
GET /in/core/form/core_form.js HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: application/javascript
last-modified: Sat, 29 Oct 2022 13:08:34 GMT
etag: W/"635d25d2-5180"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd68ffa2a-4440-4407-bedf-7e7bf7afdcba.jpeg
200 OK 5.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd68ffa2a-4440-4407-bedf-7e7bf7afdcba.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 15e70ae6d020b468c84816939a4329aa
be4d2e27d7d6041b17a4f3490126e4b73c68b8c1
188259d91d75505f7ee2253f80075b56174569b669ad17adbd88a06759a5f5aa
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd68ffa2a-4440-4407-bedf-7e7bf7afdcba.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5702
x-amzn-requestid: 0bd029d4-2c3b-4c62-ba67-4e28de3c0c6d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: c5eMWF2woAMFq8Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6393aa4e-34d8de9e4505e5d214083b44;Sampled=0
x-amzn-remapped-date: Fri, 09 Dec 2022 21:36:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: zQmBFpbXw0_W5_3CURt2oxwMCTsNPuTwYnBLdE4-UOVFDv4T0eMKmg==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Dec 2022 21:54:13 GMT
age: 20485
etag: "be4d2e27d7d6041b17a4f3490126e4b73c68b8c1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29d00d08-ec53-4c7b-a2ef-5901b64cdefd.jpeg
200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29d00d08-ec53-4c7b-a2ef-5901b64cdefd.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5de5d319f43d9c9c641419d96655541f
cde4c7fa0145d3645af17e34c83c63c08f76a076
fdb114eb142f035c7a54195d16af51b5b423642c312f4bccc0f407d8fcc245aa
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29d00d08-ec53-4c7b-a2ef-5901b64cdefd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7557
x-amzn-requestid: 400d1465-ecbf-4d95-8aa8-4dce5dca0716
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ctluwGo4oAMFhTg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638ee991-6dba29ae7065d5347a1a420d;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 07:04:49 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Lazl-stakC-31gMuQ2WzH9uFkIb0g7HaaM3xkwSFdFJMWKTaKqrBEQ==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Dec 2022 04:07:07 GMT
age: 84511
etag: "cde4c7fa0145d3645af17e34c83c63c08f76a076"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/bundle.ibbr-ver-0EFCA3FE9DBDCD28ABB2BAEA94D9129E.css
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/login/bundle.ibbr-ver-0EFCA3FE9DBDCD28ABB2BAEA94D9129E.css
IP
GET /in/login/bundle.ibbr-ver-0EFCA3FE9DBDCD28ABB2BAEA94D9129E.css HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: W/"635d25d4-bb690"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/form/form.js?v=6393fe889a36a
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/login/form/form.js?v=6393fe889a36a
IP
Analyzer Verdict Alert fortinet Phishing
GET /in/login/form/form.js?v=6393fe889a36a HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: application/javascript
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: W/"635d25d4-d67"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/login/BusyIndicator-ver-B7F2943258D5A2E62FFE465B6AD641A2.css
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/login/BusyIndicator-ver-B7F2943258D5A2E62FFE465B6AD641A2.css
IP
GET /in/login/BusyIndicator-ver-B7F2943258D5A2E62FFE465B6AD641A2.css HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: W/"635d25d4-43c"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/favicon.ico
404 Not Found 0 B URL HTTP/2 web9259.web07.bero-webspace.de/favicon.ico
IP
GET /favicon.ico HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Sat, 10 Dec 2022 03:35:37 GMT
content-type: text/html
last-modified: Mon, 05 Dec 2022 12:51:53 GMT
etag: W/"328-5ef1426d188cf"
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335733&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1670643335735
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335733&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1670643335735
IP
GET /in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335733&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1670643335735 HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:42 GMT
content-type: application/json
x-powered-by: PHP/7.4.33, PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/bower_components/font-awesome/css/font-awesome.min.css
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/bower_components/font-awesome/css/font-awesome.min.css
IP
GET /in/bower_components/font-awesome/css/font-awesome.min.css HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: W/"635d25d4-7918"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/bower_components/jquery/dist/jquery.min.js
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/bower_components/jquery/dist/jquery.min.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /in/bower_components/jquery/dist/jquery.min.js HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: application/javascript
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: W/"635d25d4-15283"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335733&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1670643335734
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335733&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1670643335734
IP
GET /in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335733&data=%7B%22mes%22%3A%22User%20on%20login%20page%22%7D&_=1670643335734 HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:37 GMT
content-type: application/json
x-powered-by: PHP/7.4.33, PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/bower_components/ua-parser-js/dist/ua-parser.min.js
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/bower_components/ua-parser-js/dist/ua-parser.min.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /in/bower_components/ua-parser-js/dist/ua-parser.min.js HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: application/javascript
last-modified: Sat, 29 Oct 2022 13:08:36 GMT
etag: W/"635d25d4-4298"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/core/form/core_form.css
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/core/form/core_form.css
IP
GET /in/core/form/core_form.css HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 13:08:34 GMT
etag: W/"635d25d2-12af"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/core/token/core_token.js
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/core/token/core_token.js
IP
Analyzer Verdict Alert fortinet Phishing
GET /in/core/token/core_token.js HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:36 GMT
content-type: application/javascript
last-modified: Sat, 29 Oct 2022 13:08:34 GMT
etag: W/"635d25d2-4898"
x-powered-by: PleskLin
content-encoding: br
X-Firefox-Spdy: h2
web9259.web07.bero-webspace.de/in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335731&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1670643335732
200 OK 0 B URL HTTP/2 web9259.web07.bero-webspace.de/in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335731&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1670643335732
IP
GET /in/home.php?pl=token&link=ing.de&bid=48b7969ce140cb012903b177581cc976&callback=jQuery32108255304532002039_1670643335731&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1670643335732 HTTP/1.1
Host: web9259.web07.bero-webspace.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://web9259.web07.bero-webspace.de/in/a1b2c3/48b7969ce140cb012903b177581cc976/login/?index=83580&feeder=3409ab0542dd0fae9d5dae600064daa1adbacea6
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 10 Dec 2022 03:35:37 GMT
content-type: application/json
x-powered-by: PHP/7.4.33, PleskLin
content-encoding: br
X-Firefox-Spdy: h2
109.71.253.24
34.216.88.5
95.101.11.115
93.184.220.29
0.0.0.0