staydrye.com/old/now/gFdQI/Y2Fyb2x5bi5jbGF5dG9uQG5tc3Mub3Jn?referrer=singular_click_id=6cd69ce4-dd51-49be-ba3b-b35c6692ddd9
69.49.228.234200 OK 0 B URL User Request GET HTTP/1.1 staydrye.com/old/now/gFdQI/Y2Fyb2x5bi5jbGF5dG9uQG5tc3Mub3Jn?referrer=singular_click_id=6cd69ce4-dd51-49be-ba3b-b35c6692ddd9
IP 69.49.228.234:443
ASN #46606 UNIFIEDLAYER-AS-1
Certificate IssuerLet's Encrypt
Subjectwebdisk.staydrye.com
Fingerprint74:9D:44:42:39:A8:FC:1E:46:E9:A4:CE:4B:72:AE:7A:D0:79:05:F6
ValiditySun, 12 Nov 2023 15:51:47 GMT - Sat, 10 Feb 2024 15:51:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /old/now/gFdQI/Y2Fyb2x5bi5jbGF5dG9uQG5tc3Mub3Jn?referrer=singular_click_id=6cd69ce4-dd51-49be-ba3b-b35c6692ddd9 HTTP/1.1
Host: staydrye.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 19 Nov 2023 00:17:56 GMT
Server: Apache
refresh: 0;url=https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
clickdownloaddocument.com/cdn-cgi/challenge-platform/h/g/flow/ov1/871254224:1700350157:vAdwkYs4o_yJ4ueDrHOkE7MQtdNwInYA5FrjvS0dSvs/828445f779587131/a518b8c5809edfa
104.21.84.184200 OK 13 kB URL POST HTTP/3 clickdownloaddocument.com/cdn-cgi/challenge-platform/h/g/flow/ov1/871254224:1700350157:vAdwkYs4o_yJ4ueDrHOkE7MQtdNwInYA5FrjvS0dSvs/828445f779587131/a518b8c5809edfa
IP 104.21.84.184:443
Requested by https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Certificate IssuerGoogle Trust Services LLC
Subjectclickdownloaddocument.com
FingerprintB6:E2:D9:2E:55:E7:1D:D9:DF:DD:78:E6:62:16:70:DA:18:80:A0:6F
ValidityThu, 26 Oct 2023 07:54:24 GMT - Wed, 24 Jan 2024 07:54:23 GMT
File type ASCII text, with very long lines (12712), with no line terminators
Hash 3140704289442cd36275a4f0bb647bd9
287eb8c7dd409fa4f75b5dc11fdaa3c700dcfb1a
312c8d303dbd7d6367c2f3cb1d3cd6ecd4c6f9cee64448db891169b3fa5a38a1
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/871254224:1700350157:vAdwkYs4o_yJ4ueDrHOkE7MQtdNwInYA5FrjvS0dSvs/828445f779587131/a518b8c5809edfa HTTP/1.1
Host: clickdownloaddocument.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Content-type: application/x-www-form-urlencoded
CF-Challenge: a518b8c5809edfa
Content-Length: 1883
Origin: https://clickdownloaddocument.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: 6Hrlgxx6EmC65oYBqe+WSHFUxi5X+Jezm85gGTQEi/e1fUF19N10ug782Tzwr/2z$gdhFjK5IWM8EvIM8fEULWw==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AMIUES8Gsy%2FX3VGvXa1MaTJAVLTgGiJIRPBrTdxsKSCxus34K9GW2Vhv0RZkoy3Cos7fjEhJUW49PSbHhVkvBH5EUOXnhR%2Fgj1OOjU8eyx4gv7AXoSxaqEYdInwFiNf3%2FDoViMrCR3iNIniz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 828445fa7f3bb4eb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/828445faef6b1c02/1700353079904/Ku3KWPLRUbbIkg1
104.17.2.184200 OK 61 B URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/828445faef6b1c02/1700353079904/Ku3KWPLRUbbIkg1
IP 104.17.2.184:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type PNG image data, 98 x 89, 8-bit/color RGB, non-interlaced\012- data
Hash c76734819bee6a87534910510f718305
9d7632d91bc6604be357d1b6a0f07d514b211817
895782479c7b3e15b8b1daf1af0bca6385fcda8f649b6beff09e048ff4a98d80
GET /cdn-cgi/challenge-platform/h/g/i/828445faef6b1c02/1700353079904/Ku3KWPLRUbbIkg1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:18:01 GMT
content-type: image/png
server: cloudflare
cf-ray: 82844606f9d51c02-OSL
alt-svc: h3=":443"; ma=86400
clickdownloaddocument.com/cdn-cgi/styles/challenges.css
104.21.84.184200 OK 6.6 kB URL GET HTTP/3 clickdownloaddocument.com/cdn-cgi/styles/challenges.css
IP 104.21.84.184:443
Requested by https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Certificate IssuerGoogle Trust Services LLC
Subjectclickdownloaddocument.com
FingerprintB6:E2:D9:2E:55:E7:1D:D9:DF:DD:78:E6:62:16:70:DA:18:80:A0:6F
ValidityThu, 26 Oct 2023 07:54:24 GMT - Wed, 24 Jan 2024 07:54:23 GMT
File type ASCII text, with very long lines (6608), with no line terminators
Hash f0fd80732479959c893cfd7380f594bd
04111102f46bc02c195561743b3f41b4d5a349ca
704e70fc0fd54cb83a1100d48093680b73e0d3c45a32dc326c38355185aaf37f
GET /cdn-cgi/styles/challenges.css HTTP/1.1
Host: clickdownloaddocument.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: text/css
last-modified: Thu, 16 Nov 2023 21:55:48 GMT
etag: W/"65568fe4-19c8"
server: cloudflare
cf-ray: 828445f88e57b4eb-OSL
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Sun, 19 Nov 2023 02:17:59 GMT
cache-control: max-age=7200, public
content-encoding: gzip
clickdownloaddocument.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=828445f779587131
104.21.84.184200 OK 174 kB URL GET HTTP/3 clickdownloaddocument.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=828445f779587131
IP 104.21.84.184:443
Requested by https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Certificate IssuerGoogle Trust Services LLC
Subjectclickdownloaddocument.com
FingerprintB6:E2:D9:2E:55:E7:1D:D9:DF:DD:78:E6:62:16:70:DA:18:80:A0:6F
ValidityThu, 26 Oct 2023 07:54:24 GMT - Wed, 24 Jan 2024 07:54:23 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 174 kB (174411 bytes)
Hash 99fdf8489b1a08d9262cfd65f835d77c
14f9f227daf5235911befed2b6e5d0eba0bfcb04
bd86dd804fa557b3546b683212ef3d6cb4a67b048d45c4fe13e1bdc8c5cb2130
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=828445f779587131 HTTP/1.1
Host: clickdownloaddocument.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org?__cf_chl_rt_tk=CAXdrx5RNJHUo8CQBbUxe547I4ptsaIs8kWLmpofGrE-1700353078-0-gaNycGzNDBA
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VXBwwiyjRT0e%2B4FchzbM0wOP9K3szTEuxrYnSnTbREqhc%2F5pPBzaOndCrIKykrif5njEIwIiVIx8%2F3ItQ1KH2hpD6Q3Pxy3KHhXjsjudgqsK04k7PyQ%2BvAWyKo0bZyWUR6Y%2F0AhrQgoFLB2G"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 828445f8de7fb4eb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=FAIg1&render=explicit
104.17.2.184200 OK 34 kB URL GET HTTP/2 challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=FAIg1&render=explicit
IP 104.17.2.184:443
Requested by https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (34253)
Hash 6142a5f5c66e2c1be52ee9506a565962
c3b39e8352efd1e0619b6dd62af8b2a917622868
51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7
GET /turnstile/v0/g/9914b343/api.js?onload=FAIg1&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://clickdownloaddocument.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 828445f9cfbab50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1425985924:1700350207:kOBh7tNjioElHbnFJbAbokeZQe5Wli3kz-ROVpE_jBg/828445faef6b1c02/7edaa17c9595ad1
104.17.2.184200 OK 83 kB URL POST HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1425985924:1700350207:kOBh7tNjioElHbnFJbAbokeZQe5Wli3kz-ROVpE_jBg/828445faef6b1c02/7edaa17c9595ad1
IP 104.17.2.184:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash ba2c8888708ad79dc886f931e4a73af9
df0450976c8a7e19032e9ed676b61bf1670cc833
f17a62dde26ca4e93bf98cad78a84f021cdf8c85a4e43256177620f9f024df5b
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1425985924:1700350207:kOBh7tNjioElHbnFJbAbokeZQe5Wli3kz-ROVpE_jBg/828445faef6b1c02/7edaa17c9595ad1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 7edaa17c9595ad1
Content-Length: 3205
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: u/GaXU76wa6VUKAwDRmW61egRvCz2yTLUg2AaDkwoz9ySNjq4/HUPp9ZLqVlrEby85oj0l1x5K3eb4sE0HJIfAvGPPrIX5N0QMGSPjjlplLu0dVdUj7T5eL64yy12pF7/VI3hz4EB6CJYvHXi8jEq2fPwMZ0LUUTA8Yttx70gHNKgCBVd6VZL7CiFnDilYDw3Jnwe1zjTwrw4mcvnR9YGqev42moJv3D8fBDOL6tc2OfkiladvRPWksygUqrcz8uUibyjz9yH8Pk9i1h5yQmzxahKgsu6fhf8RX+K6J6xlEJz72uN0EPdwx9YR5Iw4BctjCon8uvmybkh8yMedlbT8YB5crhdbbQK00/bSZ2jp0=$9Kwgc4ZnogOTrEeQ57eawQ==
server: cloudflare
cf-ray: 828445fd4ff61c02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/828445faef6b1c02/1700353079904/13b6d8d0e2795db9a09b22be18fb3db5b17c3e9ac25ec5d9b4135db3115445aa/MiyBy7cEISXJ_ye
104.17.2.184401 Unauthorized 1 B URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/828445faef6b1c02/1700353079904/13b6d8d0e2795db9a09b22be18fb3db5b17c3e9ac25ec5d9b4135db3115445aa/MiyBy7cEISXJ_ye
IP 104.17.2.184:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type very short file (no magic)
Hash ff44570aca8241914870afbc310cdb85
58668e7669fd564d99db5d581fcdb6a5618440b5
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
GET /cdn-cgi/challenge-platform/h/g/pat/828445faef6b1c02/1700353079904/13b6d8d0e2795db9a09b22be18fb3db5b17c3e9ac25ec5d9b4135db3115445aa/MiyBy7cEISXJ_ye HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 401 Unauthorized
date: Sun, 19 Nov 2023 00:18:01 GMT
content-type: text/plain; charset=UTF-8
www-authenticate: PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gE7bY0OJ5XbmgmyK-GPs9tbF8PprCXsXZtBNdsxFURaoAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEA2Vpu93cQGJ2LaZqutZBtBreQbl_on09bX3jUD1xgGHNU1bhZDG0Mis-M3E9MoLsj0SXQPrgtEEXCrSty2tCoCHs4hds4Th8FtYf6vr6jcGvhP-JPUCv7zhxe2WixKmBEuBMQPOEnZpPY5qGlclA0pn5z1YdkqVDVuPLDsqYDXAsntqJEXsVqxzOxbHOAWm7Unww5KwcId437A1PncomjAGLNf0sFUKCTQ0CULWIPIaOE__-uztyz5ahlObs2gAGcQwskwDCWAS3sN5mp3SCTpB4OPKwZ1DcVhhqHJrhvtP_8AgwwCgl9K4KqkgXop7P1oLjAeJ3eQhWNua7m5REZMwIDAQAB, max-age=20, PrivateToken challenge=AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIBO22NDieV25oJsivhj7PbWxfD6awl7F2bQTXbMRVEWqABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAyAcIyqXWj0XAym0z5V844rFA0WOzLVwj0uCwmVj6zC4qOH40oBiGHrMNMBnDyk95jvnBAuHeEs855e7nA4l4DPJ4jUWKZbua8BxGAzjn74A1BV81a52F1zvBPUm-VEJXPAPXQehXphSv51uR7HKtfcM5oaS33TGDSy-6xv0r84xjMuTBvwPgXGehxpi1MCGGE5yWkzKN5Zzllk7m6Nkiv6learV-Uz7tzaoPbdZkBk1bFXxm2q07jWavoBZ-JEuEJyjQ00PSTz2Zjpbct6AlR3eCS9sbmXtb5XxSs7JMsvoa8uojD7a5m2SEJIwaf8xKL6wtxkaPonUfvsLj4JoJZQIDAQAB, max-age=20
server: cloudflare
cf-ray: 82844606c9c71c02-OSL
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
104.17.2.184200 OK 73 kB URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
IP 104.17.2.184:443
Requested by https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (40091)
Hash 6aa798c7da40c42af8e919a64a4be381
f7b93aa8274b74b1764b20ba2cc711a10eda6dce
d53f1ff5152060f58191d87bb063d081ea19c882389cb624db53dce16a538db4
GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 828445faef6b1c02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/9DKbiDfWH6ZjHxgSNTG3KHa3ucVmP6rj9MHN3bQn2%2BU%3D
104.17.2.184200 OK 61 B URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/9DKbiDfWH6ZjHxgSNTG3KHa3ucVmP6rj9MHN3bQn2%2BU%3D
IP 104.17.2.184:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced\012- data
Hash 9246cca8fc3c00f50035f28e9f6b7f7d
3aa538440f70873b574f40cd793060f53ec17a5d
c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/g/cmg/1/9DKbiDfWH6ZjHxgSNTG3KHa3ucVmP6rj9MHN3bQn2%2BU%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: image/png
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 828445fb8f841c02-OSL
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=828445faef6b1c02
104.17.2.184200 OK 178 kB URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=828445faef6b1c02
IP 104.17.2.184:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 178 kB (177890 bytes)
Hash 8acddbf7698a33a0468f84bd6d8f42d4
1e0f1f229e79baa0bbe25c58800e58d6a3d2ec6a
c3f005c23b2b0f702513b586d4f2be30175f65256df0a76ad1e25b8399bb9731
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=828445faef6b1c02 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
server: cloudflare
cf-ray: 828445fb8f851c02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
104.21.84.184403 Forbidden 6.4 kB URL User Request GET HTTP/2 clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
IP 104.21.84.184:443
Certificate IssuerGoogle Trust Services LLC
Subjectclickdownloaddocument.com
FingerprintB6:E2:D9:2E:55:E7:1D:D9:DF:DD:78:E6:62:16:70:DA:18:80:A0:6F
ValidityThu, 26 Oct 2023 07:54:24 GMT - Wed, 24 Jan 2024 07:54:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (6437), with no line terminators
Hash 19c85dc6f49b71c5d641489e856f3425
bda8225d5ab22ac3386690af0dedba278c191212
7478f58892927b4e811c077d86afd7bd925cb0078c1ca013211c1ce089acfbb3
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /Mcarolyn.clayton@nmss.org HTTP/1.1
Host: clickdownloaddocument.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Sun, 19 Nov 2023 00:17:58 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KBqFcqAmUuILNklaMWs0uyoJOshxeGtcwTyKj1MzWj%2FXRFw0jnRHTbLjsyec3aE%2BfudaDTCnnT2%2BHj0mmfiMeEZvaSWWsTLF1RbZVBWeQYavMXsGKQIgnoTKt96AF1h6Q0lY1sntPDO%2BTJMu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 828445f779587131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
clickdownloaddocument.com/favicon.ico
104.21.84.184403 Forbidden 5.7 kB URL GET HTTP/3 clickdownloaddocument.com/favicon.ico
IP 104.21.84.184:443
Requested by https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Certificate IssuerGoogle Trust Services LLC
Subjectclickdownloaddocument.com
FingerprintB6:E2:D9:2E:55:E7:1D:D9:DF:DD:78:E6:62:16:70:DA:18:80:A0:6F
ValidityThu, 26 Oct 2023 07:54:24 GMT - Wed, 24 Jan 2024 07:54:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (5778), with no line terminators
Hash d8b16075e17c121af05ba008c3732f6c
38556ed7e744ccda58f89bf66e44bacede19ea47
a0e1bde05b192b415b2a2dd8b143f9f6afb8299d504889b95e9c8344e047742d
GET /favicon.ico HTTP/1.1
Host: clickdownloaddocument.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PMR4qxOfw1fh40TZKzgMUfqglWKO6oqT0U4CM%2B25JOMJrd4Ia5DNy36RUFvQJjMkoZ5dKsgd3K%2FWgcnBdCKiFyZSuVdY8f1uvue8kv06qb38K7DbalgLqlUzWARZKqHz8UbJwrUoHOBR87fS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 828445f90e92b4eb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
clickdownloaddocument.com/favicon.ico
104.21.84.184403 Forbidden 5.7 kB URL GET HTTP/3 clickdownloaddocument.com/favicon.ico
IP 104.21.84.184:443
Requested by https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
Certificate IssuerGoogle Trust Services LLC
Subjectclickdownloaddocument.com
FingerprintB6:E2:D9:2E:55:E7:1D:D9:DF:DD:78:E6:62:16:70:DA:18:80:A0:6F
ValidityThu, 26 Oct 2023 07:54:24 GMT - Wed, 24 Jan 2024 07:54:23 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (5778), with no line terminators
Hash 6d272288ef98d05e3eaa42df66a1f9e7
06bf9a36cc6987e1b180b0cd5d792f9dfcadb406
54c8e5ddcbffc3f520dc568ab503e0034732ad43b3b7c9fae1d0138f044f9422
GET /favicon.ico HTTP/1.1
Host: clickdownloaddocument.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://clickdownloaddocument.com/Mcarolyn.clayton@nmss.org
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Sun, 19 Nov 2023 00:17:59 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fTRmtgZM8J7%2FSJAocYi7pLn6gB6mMc8N62RSFngYk4WSV6TIWZmClR88Dkqt2hNHAXvPflLhxvi%2BtilQ%2B%2F42zSoYpkhyMAYv2PEjbjQ4AVPRhttLYP5wDJKP%2FG%2F6CCzVtvQ3XQeqMfJ8tNmK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 828445f97ebfb4eb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1425985924:1700350207:kOBh7tNjioElHbnFJbAbokeZQe5Wli3kz-ROVpE_jBg/828445faef6b1c02/7edaa17c9595ad1
104.17.2.184200 OK 18 kB URL POST HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1425985924:1700350207:kOBh7tNjioElHbnFJbAbokeZQe5Wli3kz-ROVpE_jBg/828445faef6b1c02/7edaa17c9595ad1
IP 104.17.2.184:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (17816), with no line terminators
Hash daeb35c2c4accfeb672bba8a76b2ab00
73e032349aefcebd27f0eda0517fbedceb6df0f6
2ee217ee134573b26b05e688b4905175e5758831087e58ed12c5bd22a85be957
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1425985924:1700350207:kOBh7tNjioElHbnFJbAbokeZQe5Wli3kz-ROVpE_jBg/828445faef6b1c02/7edaa17c9595ad1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/wnlft/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 7edaa17c9595ad1
Content-Length: 25806
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 19 Nov 2023 00:18:01 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: PpOqbttl3IHqdkiuVQJ5MrmUmDmTpakg3uLa0MA7IGaRK9xMLYqrmGUO/0/vDtXU$LzRYCqFZs+U+BH4LCFsDqA==
server: cloudflare
cf-ray: 828446087a341c02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400