alawaelafrica.com/.ojnew/tmp/Z2JhcnJldHRAZm1nbmouY29t
65.108.234.151302 Found 106 B URL User Request GET HTTP/1.1 alawaelafrica.com/.ojnew/tmp/Z2JhcnJldHRAZm1nbmouY29t
IP 65.108.234.151:443
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subject*.alawaelafrica.com
Fingerprint0C:96:6B:AB:EF:3F:05:6B:41:01:84:52:29:4C:B1:C2:93:64:EB:89
ValidityThu, 18 May 2023 17:04:53 GMT - Wed, 16 Aug 2023 17:04:52 GMT
File type ASCII text, with no line terminators
Hash 5426358d4cbbc26f1ecca0ef0e97b9c4
742d279ad02997ea6acc1c4dc48f0340db7d7df6
cdd7fc99b3e2426acf15a3e84ad0520ed60bc5425159255839c9998097b95d07
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /.ojnew/tmp/Z2JhcnJldHRAZm1nbmouY29t HTTP/1.1
Host: alawaelafrica.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Fri, 26 May 2023 16:08:03 GMT
Server: Apache
Location: https://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
104.21.88.100403 Forbidden 3.6 kB URL User Request GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
IP 104.21.88.100:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1769), with CRLF, LF line terminators
Hash 209e94789881fe7242f6f1cebb2e5d29
e70c783f7cbf0bbcef72cf5572cd331e6c4d519c
75a92ad26aa68587bbfc45204b562d5892455af2275cecb7609b68aefd40d669
Analyzer Verdict Alert fortinet Phishing
GET /Mgbarrett@fmgnj.com HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Fri, 26 May 2023 16:08:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PV7URdTOpKrg3E%2BiVtC%2Bpg4O3dgjQfyxigP4UdD%2BYlDQI%2F9cJPEwOhUJm36Idsk9zM6oOoi%2BJ1R%2BExz3uKdVqiKRn0Ad9%2BPgaJ0%2BGusrPrI94jHOUZ5XlFODPOvmoNZkcfNVVEy0iIvEUHl8YrhubxvyfJs%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd7464efef2b4ed-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd7464efef2b4ed
172.67.176.78200 OK 42 B URL GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd7464efef2b4ed
IP 172.67.176.78:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Analyzer Verdict Alert fortinet Phishing
GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd7464efef2b4ed HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 26 May 2023 16:08:04 GMT
Content-Type: image/gif
Content-Length: 42
Connection: keep-alive
Last-Modified: Thu, 25 May 2023 08:39:03 GMT
ETag: "646f1ea7-2a"
Server: cloudflare
CF-RAY: 7cd74650f9c50b41-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 26 May 2023 18:08:04 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes
0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd7464efef2b4ed
172.67.176.78200 OK 53 kB URL GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd7464efef2b4ed
IP 172.67.176.78:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
File type ASCII text, with very long lines (65536), with no line terminators
Hash 84141d1d2c808f68804998ee8e80ed6c
b548d4a54fd42dc68f709e2616474d418f55c939
2a2d1c8c2707a96902d8e5d2a63481e22082f547c59d8f2d07e7bedbe56bf143
Analyzer Verdict Alert fortinet Phishing
GET /cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd7464efef2b4ed HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com?__cf_chl_rt_tk=1R.ThkWgGA8bnCZvjDY.9wN0u2clae7p797oEO0mk1c-1685117283-0-gaNycGzNBrs
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 26 May 2023 16:08:04 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: max-age=0, must-revalidate
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5DeZ08rKtZDl1SWnn%2FVhdehoo86opm%2FcULKaV2DCxzlVbLKQBh%2F1uLCayT47sAEZi75JgUvJ2fAzqZvkA2upxcnLXkgXZ595rjsXRVtSFxUIaxv0KpxXzDkeSdYn53t1VT2kengnxCh%2B96%2Bb0OpX0a3Oerw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd7465109dab4ed-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
0gpilhhtlb646b2a32a499c.ocupac.ru/favicon.ico
172.67.176.78403 Forbidden 3.7 kB URL GET HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/favicon.ico
IP 172.67.176.78:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1833), with CRLF, LF line terminators
Hash 03e86cbe58511e5813281d5adb5a006f
1b2f3254c03ab5cb69c65375e440e793d406c1e5
6c72a760f4ac576f3e4c41b5a0b0ad6e111e3e4d9535508100e17ef5e102c588
GET /favicon.ico HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com?__cf_chl_rt_tk=1R.ThkWgGA8bnCZvjDY.9wN0u2clae7p797oEO0mk1c-1685117283-0-gaNycGzNBrs
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Fri, 26 May 2023 16:08:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kRqMwBkoogmB2gzWP8beugx61cWQ0gux1j1mY9V%2BrroSMwta4fC3m0XcY7OD8ccO0a0trb74dQB6Cn9EC%2FEmrblLk7Jf92m7YQa6DF7cqMtkXnIZMwZj0NyRFSZli3hlsGWYR%2FCoMEa5M%2FYkk9NOmdkNufE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd746514a56b4ed-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
challenges.cloudflare.com/turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit
104.18.7.185200 OK 11 kB URL GET HTTP/2 challenges.cloudflare.com/turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit
IP 104.18.7.185:443
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (15748)
Hash 2a1262ba5cd32899831d483322a28dd7
3805876db8773ed5820043e1f39b0b6c049f61b2
2e1e45b1d429b2d703676139932fe97b7ffc7986e6d0221653a7404e4c3032f0
GET /turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 May 2023 16:08:04 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cd746521ca3b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
104.18.7.185200 OK 24 kB URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
IP 104.18.7.185:443
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (10899)
Hash 3f1a34cc2037f8475f114974ed222ddd
cd3dace82724d57c33e2391d49c2988d474aa462
f620fbf7f06e67f17780f38bce68fb00014e3dc83784311d162b5d729e468d96
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 16:08:04 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=0, must-revalidate
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 7cd746537df5b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/845577580:1685113829:VZHTd4afXAteqI2QbbTbaWbad_6nFG-Z7iT_pMNRIb0/7cd746537df5b4f1/3b83c1c3213d50d
104.18.7.185200 OK 13 kB URL POST HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/845577580:1685113829:VZHTd4afXAteqI2QbbTbaWbad_6nFG-Z7iT_pMNRIb0/7cd746537df5b4f1/3b83c1c3213d50d
IP 104.18.7.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (13208), with no line terminators
Hash f4ffca84b9d79214b2cd2a9dbbb47a68
25c72f72de3e5190ee7d34db8570c83fa5d8446c
6e303966d2eaa4b883d48eebf1eff8344cf699cd11cc24162358d3888fc6ac26
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/845577580:1685113829:VZHTd4afXAteqI2QbbTbaWbad_6nFG-Z7iT_pMNRIb0/7cd746537df5b4f1/3b83c1c3213d50d HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 3b83c1c3213d50d
Content-Length: 17885
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 16:08:06 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: yGwzPI8Ho2XZzaWYG6JmTk5LEPfjytP11tJclXIEHazOlxhDymNnVnyK4s5AchJs$C8D9vXDxC2Cb3O/FXdRp0w==
server: cloudflare
cf-ray: 7cd7465d6f97b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/img/7cd746537df5b4f1/1685117284772/KH1AsCRPv4rJdbL
104.18.7.185200 OK 61 B URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/img/7cd746537df5b4f1/1685117284772/KH1AsCRPv4rJdbL
IP 104.18.7.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type PNG image data, 52 x 79, 8-bit/color RGB, non-interlaced\012- data
Hash ec908aa0686e1dee85895de195bb43df
1aaa65785a3918ca39eb06cbe4920350e8ecb324
3423456b5f3575d58823d6904ab03b223ce8ca3a8a526f8a615ae2dc35063a30
GET /cdn-cgi/challenge-platform/h/b/img/7cd746537df5b4f1/1685117284772/KH1AsCRPv4rJdbL HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 16:08:05 GMT
content-type: image/png
server: cloudflare
cf-ray: 7cd7465a3ce1b4f1-OSL
alt-svc: h3=":443"; ma=86400
0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/1051834168:1685113772:JGrFjIm_juldzCG7aHAjN-2YJCDefnoqDjYZhBuyofQ/7cd7464efef2b4ed/9da680d1936047b
172.67.176.78200 OK 7.4 kB URL POST HTTP/1.1 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/1051834168:1685113772:JGrFjIm_juldzCG7aHAjN-2YJCDefnoqDjYZhBuyofQ/7cd7464efef2b4ed/9da680d1936047b
IP 172.67.176.78:80
Requested by http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
File type ASCII text, with very long lines (7400), with no line terminators
Hash 239013ea986c6707f37d2704d8839813
a0d6dda288335093c968096990a4da67c53c1d0c
77e18077d48c7f4cc78a9f2eb97fcfd7f03672afd48081ef590e2b3796421f1d
Analyzer Verdict Alert fortinet Phishing
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1051834168:1685113772:JGrFjIm_juldzCG7aHAjN-2YJCDefnoqDjYZhBuyofQ/7cd7464efef2b4ed/9da680d1936047b HTTP/1.1
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mgbarrett@fmgnj.com
Content-type: application/x-www-form-urlencoded
CF-Challenge: 9da680d1936047b
Content-Length: 1785
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 26 May 2023 16:08:04 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: BhRs8h66CTmIqSJJ+3ZpCRnU6kLMyaE7jFu9CmTX02EqwPOA4Pco3FNEXq/6Vv/T$DVHt71IAdtARd1/M9YFtmA==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RsR94kMYhrg2Pr3ff6h%2FfTXcL4nxpk1tPdcjqogyoh2rzTad%2FYIM0%2FC%2BcIBQOWhJFhHwJF38P6MZTuveAI%2BCFZIDUw3%2F9NYSSd7WRpUmysEh70YzI6b1rj5%2BDGnmbnhP3%2BxUlqBv4UAqShy%2FPOq6vU5xcTs%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd74652bb910b41-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd746537df5b4f1
104.18.7.185200 OK 156 kB URL GET HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd746537df5b4f1
IP 104.18.7.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 156 kB (155891 bytes)
Hash 54d542d5542f67008eb2f2cfd0bf01c0
28b385c295d767b683fd4f867bdeeb4468886edf
88acf9354a8ededf30028c5a29effe3267e5e258022ee4112b42b86102346dae
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd746537df5b4f1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 16:08:04 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, must-revalidate
server: cloudflare
cf-ray: 7cd746544ec2b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/845577580:1685113829:VZHTd4afXAteqI2QbbTbaWbad_6nFG-Z7iT_pMNRIb0/7cd746537df5b4f1/3b83c1c3213d50d
104.18.7.185200 OK 114 kB URL POST HTTP/3 challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/845577580:1685113829:VZHTd4afXAteqI2QbbTbaWbad_6nFG-Z7iT_pMNRIb0/7cd746537df5b4f1/3b83c1c3213d50d
IP 104.18.7.185:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Certificate IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5C:7B:D7:57:5A:53:A4:99:8E:1E:5A:C4:58:30:7C:2D:6C:D8:3C:C5
ValiditySun, 18 Sep 2022 00:00:00 GMT - Sun, 17 Sep 2023 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 114 kB (114312 bytes)
Hash f10eed924f0a64bbcb0e5d3ca26f62b9
62e1c928df797fb4bdcb0a676da89f08a515d38e
0b9417804a41d1dcf54d2f455c4f5f39c67d7b87de0eba1da6524b1e2ce82a9f
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/845577580:1685113829:VZHTd4afXAteqI2QbbTbaWbad_6nFG-Z7iT_pMNRIb0/7cd746537df5b4f1/3b83c1c3213d50d HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7g3v3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 3b83c1c3213d50d
Content-Length: 2772
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 May 2023 16:08:04 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: esPQFeK+WgW9/IJmRcG+pImSTYNCXBGHiggr2kAjRhNA+A/tey1BYBbxaUtzZF5avj5BRWYMf94AGL0xgz3nQyJb/kplwDCWQhftlMZE98sltSeaYeumiPXZncZdAzZO42Pm5NL9BmWn/74+Ky9kgrQ9z54bjFYYpNIlKcHaxPv6AcODkcYq2GbtlMwS1p3R6CY26n6OmWHzIgYZgcDsUB97HhwtAF3oj2nt3NaZsl9CNxB95RJwc/j5ZwiICvYL+x2TnG/5oBDWcMLQexbGYJM/+MMYfj1b5rUXoRumLsmXVsbJMqMV2YcFeKkfhqJjK2az+x3XXpOo5yuldXNCkcSHdytZgRCMpnDb7VW6sEgobSIVcGCeLbfc1hJz33hCOOp9AQE0fQiM5CqSI5qfNWFuhfG4YFQ6Es/gzx/jMX0=$BazYe8tL6MZR6RSeOyFWpw==
server: cloudflare
cf-ray: 7cd74655c864b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400