r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a8b4f1afb0e830b797238d34ab9254aa
e011acef3d05c959a65205d53b651ecd18a889fe
f7ceff5b4fda083c7449b7298c232224cf48a632dcb87233b646790de207d49c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F7CEFF5B4FDA083C7449B7298C232224CF48A632DCB87233B646790DE207D49C"
Last-Modified: Thu, 12 Jan 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5300
Expires: Sat, 14 Jan 2023 07:44:50 GMT
Date: Sat, 14 Jan 2023 06:16:30 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cab5b63e128895128726181aff42e42e
d39c36237554fcd41addec0664d7fe7f7d157c06
18e82a5b82eb8f2d8b49df824c336015f19367c5a05467ad139a56db59f88852
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "18E82A5B82EB8F2D8B49DF824C336015F19367C5A05467AD139A56DB59F88852"
Last-Modified: Wed, 11 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4519
Expires: Sat, 14 Jan 2023 07:31:49 GMT
Date: Sat, 14 Jan 2023 06:16:30 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 14 Jan 2023 05:48:53 GMT
content-type: application/json
age: 1657
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0f4ecf4f26be1ba09e61135b1b488bf4
f16b8277e00033bc990a8bcce54b693cb3c87d62
3018c2a228f0a894d217e8e8b0b8dd060527f06879cd2f469bac6c8766acbbf8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3018C2A228F0A894D217E8E8B0B8DD060527F06879CD2F469BAC6C8766ACBBF8"
Last-Modified: Wed, 11 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2623
Expires: Sat, 14 Jan 2023 07:00:13 GMT
Date: Sat, 14 Jan 2023 06:16:30 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: l7h7dNEukhDhaZqzjqn1vxU/ao4CzJD/wTvL6cyEZ+GjjTMszqh71DKBFufOdGsnEVxkfhmAXDWQDw+XoPyixw==
x-amz-request-id: ZQ5Y9VX8E2R7F219
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 14 Jan 2023 05:54:49 GMT
age: 1301
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 14 Jan 2023 06:16:30 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Expires, Pragma, Content-Type, Backoff, Last-Modified, Cache-Control, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 14 Jan 2023 05:33:45 GMT
age: 2566
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash b1e3535cab3c1ac295b1412126a9325c
d1bdf1b8663817ae34b6182db29d6b20666779e7
90c4ecd4b0782647fd78110b5bacfb73d2b05aae4de789a90318574407dfb565
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 728
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 06:16:31 GMT
Last-Modified: Sat, 14 Jan 2023 06:04:23 GMT
Server: ECS (ska/F70A)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: XSb45+QR/VCIW98Yfhwtxw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: eqzsqW0J2AxngwQhC2Ob3bvHQuw=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5131
Expires: Sat, 14 Jan 2023 07:42:03 GMT
Date: Sat, 14 Jan 2023 06:16:32 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5131
Expires: Sat, 14 Jan 2023 07:42:03 GMT
Date: Sat, 14 Jan 2023 06:16:32 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 256e39696ba05f2324bbc49b2a396115
e1cf8b15abd0a20eb1218be517c03459514a59e0
d576a66e6b39751bdbc7b662454d37866b75efef1aa51761daba61783d755bc9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D576A66E6B39751BDBC7B662454D37866B75EFEF1AA51761DABA61783D755BC9"
Last-Modified: Thu, 12 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5130
Expires: Sat, 14 Jan 2023 07:42:03 GMT
Date: Sat, 14 Jan 2023 06:16:33 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F44dfed94-1e38-4105-8fc7-5ab0ae001cdd.jpeg
200 OK 7.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F44dfed94-1e38-4105-8fc7-5ab0ae001cdd.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6df192c1053dbe9de29f29608e76dabe
b4a13de14cfeca5113726f4e08cf25285bcc35c8
c55be5facddfb5d5e3147ec009300761b1e60ac8c8f2ec066c9c91ef4832a02a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F44dfed94-1e38-4105-8fc7-5ab0ae001cdd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7466
x-amzn-requestid: 9c471b0d-4db5-4571-9913-0c372594a239
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enAczGcZoAMFZ0A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bf7ab8-249769bd788217df7c2b35d6;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 03:12:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: EtqXI2BrCJM4qYU8txfhXqWnqIuhSmH1XZ6xorUtv-ClvHUeDQsN1g==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 03:23:04 GMT
age: 10409
etag: "b4a13de14cfeca5113726f4e08cf25285bcc35c8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F917985a1-aa8d-4c0a-860c-0b16c203387e.jpeg
200 OK 8.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F917985a1-aa8d-4c0a-860c-0b16c203387e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d24ea1f095f492934a1f1c63f5d8590c
dade37148c9b9a941f93a8535d8ddc5de3952623
2d8e3f90eb347eb3479a6c5d20a1c2ca6a0560f335a6c6800948db2640e4c878
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F917985a1-aa8d-4c0a-860c-0b16c203387e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8181
x-amzn-requestid: 7ada8fbd-58e6-4433-a532-b4a4ef93ac9c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: es0paH-OIAMFg5A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1ce3c-582529522dbb67ee728484f8;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 21:33:48 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AHjOmYxva5avyA3gt9DvYLas_B2ACimer5QRQOi919HDtSjnKq22lw==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 21:49:20 GMT
age: 30433
etag: "dade37148c9b9a941f93a8535d8ddc5de3952623"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbd91e555-c9f3-4166-92be-27db2e1919b6.jpeg
200 OK 14 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbd91e555-c9f3-4166-92be-27db2e1919b6.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash afcc8f4875f4b74ca0640829b689731e
584d0e11665ae89f9a294baf1e9bb4f0e4e9a4df
3e487396389c4330abc99bc99053eecc6aaf56f7afa398d70c30e1f4709577a0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbd91e555-c9f3-4166-92be-27db2e1919b6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13626
x-amzn-requestid: 4769eaeb-0c78-4054-ad47-eefdd6ab2d03
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eWHMZErbIAMF6sQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b8b8b5-4c7bacfe060899044e361f70;Sampled=0
x-amzn-remapped-date: Sat, 07 Jan 2023 00:11:33 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: uJjDFuqKCZyyAorUVUq9PyCb_8fWukPf6YE3LwqK2FrwMFzDNkftFQ==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Fri, 13 Jan 2023 11:16:26 GMT
age: 68407
etag: "584d0e11665ae89f9a294baf1e9bb4f0e4e9a4df"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa2ecf6b3-8443-4b47-96b6-2695fa885f0d.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa2ecf6b3-8443-4b47-96b6-2695fa885f0d.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d3c35722c1c8a0b7a17b5a48a352aa64
4a939794eb33d9fb1b2cc56ca92f683a7d28e407
073d355bfc201c7feb4af2d1fac623fe7803f081c28467fa72b363074b0446a4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa2ecf6b3-8443-4b47-96b6-2695fa885f0d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7437
x-amzn-requestid: 0efc1457-5919-4244-9837-6e75d03ef1d6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enAd0F0poAMF6PA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bf7abe-24df70ad7e1811a744a7c9de;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 03:13:02 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ezdnQ-2RPpSESm42QCywHIZf4AmanMmy2f19NcUhzQ-PRjsFQfLNkg==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 03:43:58 GMT
age: 9155
etag: "4a939794eb33d9fb1b2cc56ca92f683a7d28e407"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F750e055f-1243-4c70-87b9-582708543ae4.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F750e055f-1243-4c70-87b9-582708543ae4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 0da64df67061f18811c06143292c4d5c
866288df55737a8e66ea1c0d460f72e0c9367173
611b58debf4cf0425e401878ff8fcd06ed9551b638520711e146e23c8b34575d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F750e055f-1243-4c70-87b9-582708543ae4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10337
x-amzn-requestid: ad86342a-d9e0-4146-8c6d-7dcffd26725d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enAlRHHAoAMFm1A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bf7aee-41bcda400a6bcbf1774b7ffe;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 03:13:50 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: bXs67QBz_apqGlfmPnm3_tTwlq9i_hRy3fMZ6LXtxh7pF7qMA-vGCQ==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 04:00:39 GMT
age: 8154
etag: "866288df55737a8e66ea1c0d460f72e0c9367173"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F217f47b7-7266-4f31-a889-da2550827aab.jpeg
200 OK 8.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F217f47b7-7266-4f31-a889-da2550827aab.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 52e72b1dbc9a93274c080eade6dbe9d5
a43c0b04bb01df4f56567a54ef39baf5d6cdd75d
80824298f622522bbf538a719c5586d953e5a7c245d4eb2344131dde7b937ad4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F217f47b7-7266-4f31-a889-da2550827aab.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8871
x-amzn-requestid: e56a0195-3705-4650-b2af-4dde36516690
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: enjNoHxVoAMF5YA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bfb257-365691b672f1ae5a0f0fd5e4;Sampled=0
x-amzn-remapped-date: Thu, 12 Jan 2023 07:10:15 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Fng_0UgXEGOlOfegLifoC2GpbBTBSAbj_cuCLlEx4I0Olzo1jHB0rg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 14 Jan 2023 03:29:59 GMT
age: 9994
etag: "a43c0b04bb01df4f56567a54ef39baf5d6cdd75d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
bornagroup.ir/
200 OK 25 kB IP
ASN #204213 Netmihan Communication Company Ltd
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (11292)
Hash 3064db74744f0845072493a84f590051
44bb19c6b2c88376c433e7c22e474e3a5baf7645
166509baeea5e106134c5d1193917e4103aa67251d7df1096953b48336103120
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET / HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html; charset=UTF-8
link: <http://bornagroup.ir/wp-json/>; rel="https://api.w.org/", <http://bornagroup.ir/wp-json/wp/v2/pages/1188>; rel="alternate"; type="application/json", <http://bornagroup.ir/>; rel=shortlink
transfer-encoding: chunked
content-encoding: gzip
vary: Accept-Encoding
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-vendors-style.css?ver=8.9.2
200 OK 2.2 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-vendors-style.css?ver=8.9.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (10435), with no line terminators
Hash c6405413bd3778a564cb6949fcc3bc1b
49e5156842229b7ef4316da4f8ec0f50094678a9
7d34cdbd3d2e616d4a76c3087a6ae8728695ca513cf9b3bc60c834725ac161e6
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-vendors-style.css?ver=8.9.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:18:41 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2232
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/themes/xtra//assets/css/blocks.css?ver=6.1.1
200 OK 808 B URL HTTP/1.1 bornagroup.ir/wp-content/themes/xtra//assets/css/blocks.css?ver=6.1.1
IP
ASN #204213 Netmihan Communication Company Ltd
Hash 747a6e934ee49664b2f1c7a17dc17059
008de50a9f029b2820d09ba0653efc8a5ce9429a
66ef724c3ada2b8bfe11aac11b0c5d48f4ad9c04dcefaf6ddd9f38d5bbe55679
Analyzer Verdict Alert quad9 Sinkholed
GET /wp-content/themes/xtra//assets/css/blocks.css?ver=6.1.1 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:53:53 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 808
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/otter-blocks/build/blocks/advanced-columns/style.css?ver=c35a444f68a1928fa0d9
200 OK 1.5 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/otter-blocks/build/blocks/advanced-columns/style.css?ver=c35a444f68a1928fa0d9
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (14877)
Hash 2728a65b5d29365060d8d13f309f66e3
276f5ff2271fccf85ec785a1c453455e636b062d
3208d5e3e8edf1e633472e38d138cca7a9fa0bca8e8eff3b4f6e8b10bd1e45f4
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/otter-blocks/build/blocks/advanced-columns/style.css?ver=c35a444f68a1928fa0d9 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:18:02 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1498
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
200 OK 5.7 kB URL HTTP/1.1 bornagroup.ir/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (15660)
Hash fc4f45913ef699f322a778ca95a0a7ee
9627510494f10f5cec255cb56926684d56f7cb78
cf358090a21171182854417b6fef077bc31a2123fa2953c1c06ec970b3253b9c
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-includes/js/wp-emoji-release.min.js?ver=6.1.1 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: application/javascript
last-modified: Tue, 12 Apr 2022 05:56:23 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 5712
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-includes/css/classic-themes.min.css?ver=1
200 OK 217 B URL HTTP/1.1 bornagroup.ir/wp-includes/css/classic-themes.min.css?ver=1
IP
ASN #204213 Netmihan Communication Company Ltd
Hash 95e891f28e44a9b314c09545d86be2b7
f9b13a8bd47273b086a0a07df15f314e0af0bc3e
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-includes/css/classic-themes.min.css?ver=1 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Tue, 25 Oct 2022 13:45:16 GMT
accept-ranges: bytes
content-length: 217
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-includes/css/dist/block-library/style-rtl.min.css?ver=6.1.1
200 OK 16 kB URL HTTP/1.1 bornagroup.ir/wp-includes/css/dist/block-library/style-rtl.min.css?ver=6.1.1
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (65536), with no line terminators
Hash c407fe8def472b2288a4311c733f4849
6cebd3f3c7ac0010d2fd2a85e93a5fd10e68bdd7
d9f74c6e6458a3d0b384fa94699a119e05b745dbeaf2b893067c1e41fe293d5a
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-includes/css/dist/block-library/style-rtl.min.css?ver=6.1.1 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Fri, 11 Nov 2022 14:56:45 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 15739
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b5628887325331ad3d660f7208e1995c
9e4bf04468a7aed126488ccb5552a8e02610f6dd
5cd181d6728fc5f0f4d88407b97af61db39c5a38feebdeb2c21335cf4402fca4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 06:16:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
bornagroup.ir/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css?ver=6.10.0
200 OK 4.7 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css?ver=6.10.0
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (34217)
Hash 4bca2bfe175eb9beaf14ad24db9060e6
c04099ac2172d24ea6488fa39ab476fa91fc0d6c
d818222b5695684a2b2461ef7d122f9026c78e1397138f63625de9445f1975b9
Analyzer Verdict Alert quad9 Sinkholed
GET /wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css?ver=6.10.0 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:46 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 4655
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/codevz-plus/admin/fields/codevz_fields/icons/czicons.css?ver=4.4.17
200 OK 5.5 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/codevz-plus/admin/fields/codevz_fields/icons/czicons.css?ver=4.4.17
IP
ASN #204213 Netmihan Communication Company Ltd
Hash 6f75eb3120a58a811bb98513cec8e5ec
cb1054bad93a264f8c0de82c0e1570535055e6e6
26b4a55714a32745a9a2c768791f6420dde499ec403ec009ff7ff1269182c0be
Analyzer Verdict Alert quad9 Sinkholed
GET /wp-content/plugins/codevz-plus/admin/fields/codevz_fields/icons/czicons.css?ver=4.4.17 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:25 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 5497
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/codevz-plus/rtl-xtra/css/rtl-xtra-front.css?ver=6.1.1
200 OK 5.1 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/codevz-plus/rtl-xtra/css/rtl-xtra-front.css?ver=6.1.1
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with CRLF line terminators
Hash 37c33e4f11bd4a291778a80521332e61
08208700006b651a5b226a850efbff0e7c066e39
266c2dde95ecd94a2fb1c55d2f595266af692f28057ad448bab70f023f10dffd
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/codevz-plus/rtl-xtra/css/rtl-xtra-front.css?ver=6.1.1 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:21 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 5129
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-style-rtl.css?ver=8.9.2
200 OK 33 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-style-rtl.css?ver=8.9.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type Unicode text, UTF-8 text, with very long lines (65527), with no line terminators
Hash 657456739a096169079bbf406b33fff6
314ca6abb93525fa3853296b94b6b79583e50025
8083abd5163774de9d6b6fa818b352f3a249abfd521830b9e27a6eb1363d481e
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-style-rtl.css?ver=8.9.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:18:41 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 33013
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.10.0
200 OK 14 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.10.0
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (55739)
Hash 3cdd74702cf3f637bf433e803a443d7c
eb1a0f13f37d4428fb2b35ae8f778d3b34158b75
e9521934f51aa66c5dd910e176155ab62c366215066db494c5047a61702bcd46
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.css?ver=6.10.0 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:46 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 13547
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/codevz-plus/rtl-xtra/css/xtra_js_composer.min.css?ver=6.1.1
200 OK 152 B URL HTTP/1.1 bornagroup.ir/wp-content/plugins/codevz-plus/rtl-xtra/css/xtra_js_composer.min.css?ver=6.1.1
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (384)
Hash ca9d802cbca63b1d97ed321bde30a665
2b4542dea78e3418b0200edc47e512fcbb5ff299
a4befb108e299d61bc9304f56618e85d4d401925f6f8db7771089362b660f966
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/codevz-plus/rtl-xtra/css/xtra_js_composer.min.css?ver=6.1.1 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:21 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 152
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.2
200 OK 1.1 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.2
IP
ASN #204213 Netmihan Communication Company Ltd
Hash 2f6a93066860278c889a72c18a218215
6fa8362c5ffc2bc29d9d3faa2e421780f4ffe07b
c1d2b37b79b372fac3c639dd7fe2071211a20d6d858c2d565783be88da4dc6dc
Analyzer Verdict Alert quad9 Sinkholed
GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Thu, 29 Dec 2022 08:37:03 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1065
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.10.0
200 OK 56 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.10.0
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (65358)
Hash f2150a49fdae49bf740676309380dbc2
ad9bfc5609225420aa7fa2dcf9d5b1685ccc922e
ca27daecf4bcac78d816081852296a633083ef0a1ac4b386593c331a25cb2fd2
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.10.0 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:48 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 55879
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/11d/az.exe
302 Found 4.9 kB IP
ASN #204213 Netmihan Communication Company Ltd
Hash 1d39b660a646460094a26de9adbc6b24
b6a7a2cc862a897a19c26222d5fcbf6529686cba
f14ed8c29e6bfe880e5ddcedad25809683bc7fd0e8681c53f9389ffac484011a
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
NIDS Severity Alert suricata medium ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
GET /11d/az.exe HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
x-redirect-by: WordPress
location: http://bornagroup.ir
link: <http://bornagroup.ir/wp-json/>; rel="https://api.w.org/"
transfer-encoding: chunked
content-encoding: gzip
vary: Accept-Encoding
date: Sat, 14 Jan 2023 06:16:36 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/woocommerce/assets/css/woocommerce-layout-rtl.css?ver=7.2.2
200 OK 3.0 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/woocommerce/assets/css/woocommerce-layout-rtl.css?ver=7.2.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (17812), with no line terminators
Hash d200ce58896b46c35cfc40c973a24877
6f097c8891532b3c4973c02938cd6ab8f1038192
4485b5246b3a5276cb9929f4cce7d513278faa9b12f802042afb9511dc6b9952
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/woocommerce/assets/css/woocommerce-layout-rtl.css?ver=7.2.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:18:39 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 3011
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/woocommerce/assets/css/woocommerce-rtl.css?ver=7.2.2
200 OK 11 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/woocommerce/assets/css/woocommerce-rtl.css?ver=7.2.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type Unicode text, UTF-8 text, with very long lines (62827), with no line terminators
Hash 9c20f742c4795e65950d30c67bdc45c7
8d4d50e7904c9a367c72e8d26fe55547abf222a9
c2921d4f117db0553cfd5b040e9c94d6895e8f53967d2e7cc26d4dfef356e8a5
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/woocommerce/assets/css/woocommerce-rtl.css?ver=7.2.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:18:38 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 10828
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/themes/xtra/assets/css/core.rtl.css?ver=4.4.18
200 OK 2.2 kB URL HTTP/1.1 bornagroup.ir/wp-content/themes/xtra/assets/css/core.rtl.css?ver=4.4.18
IP
ASN #204213 Netmihan Communication Company Ltd
Hash ca2d2bea6314741ff54cee728320d22b
8fb1104e4d48adfa7f60a19040f8b6cf5e23128b
220b28c2590aebb52a6c4f10f0b4683865ffc6e62c2c87d283c0ce0555b68722
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/themes/xtra/assets/css/core.rtl.css?ver=4.4.18 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:53:53 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2193
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/themes/xtra/assets/css/woocommerce.css?ver=4.4.18
200 OK 7.0 kB URL HTTP/1.1 bornagroup.ir/wp-content/themes/xtra/assets/css/woocommerce.css?ver=4.4.18
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with CRLF line terminators
Hash 0ff8fc49ab5a5ef1ad23c4ebdc8a4705
90f78c398445a710848e40cc45405a36b8b08cc5
24694bd9948e66fe7c8e06c4ae416b0b35baa7285e1a18134cfd361c0c3bd214
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/themes/xtra/assets/css/woocommerce.css?ver=4.4.18 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:53:53 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 7042
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/themes/xtra/assets/css/woocommerce.rtl.css?ver=4.4.18
200 OK 834 B URL HTTP/1.1 bornagroup.ir/wp-content/themes/xtra/assets/css/woocommerce.rtl.css?ver=4.4.18
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with CRLF line terminators
Hash e262276761b3acbe2bfef0d2cf9448d5
0796b0fd01941761699484cff50261034199049a
857b85e8439b5ba6a568b3fd4baeeed890b08e5262a329a0f96cceb5f4c6095f
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/themes/xtra/assets/css/woocommerce.rtl.css?ver=4.4.18 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:53:53 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 834
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/share.css?ver=4.4.17
200 OK 456 B URL HTTP/1.1 bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/share.css?ver=4.4.17
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with CRLF line terminators
Hash 2dc009d49b38d381e364c082117b6749
f3c2ca855792d341406b6ae2ba9253f6f70b3927
9159f778d44382d49f53ef9a2d1365f59c488e0b5d8f6e11cfe5abaf5da3d9c5
Analyzer Verdict Alert quad9 Sinkholed
GET /wp-content/plugins/codevz-plus/assets/css/share.css?ver=4.4.17 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 456
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/mobile-nav.css?ver=4.4.17
200 OK 397 B URL HTTP/1.1 bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/mobile-nav.css?ver=4.4.17
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with CRLF line terminators
Hash 78deffaa0fcf9e0db2cf3da69cf47786
a2fe24ff6e1a1245f44d3b745390e3a6db8ac4f0
033076ed5d65259303bcb8a40f1643ef319c13a0130e78612a87fdcd98fbb473
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/codevz-plus/assets/css/mobile-nav.css?ver=4.4.17 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 397
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/codevzplus.css?ver=4.4.17
200 OK 8.9 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/codevzplus.css?ver=4.4.17
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (901), with CRLF line terminators
Hash 205b6111b18886aace7b291ca3bb9f5c
c101c057af452736e01715f9112ff111fb5a2b92
7875f2b81c924069439764723bb21e1c76b86554a1ee8162e3449b93806dbb21
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/codevz-plus/assets/css/codevzplus.css?ver=4.4.17 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 8905
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b5628887325331ad3d660f7208e1995c
9e4bf04468a7aed126488ccb5552a8e02610f6dd
5cd181d6728fc5f0f4d88407b97af61db39c5a38feebdeb2c21335cf4402fca4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 06:16:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
bornagroup.ir/wp-content/themes/xtra/assets/css/core.css?ver=4.4.18
200 OK 25 kB URL HTTP/1.1 bornagroup.ir/wp-content/themes/xtra/assets/css/core.css?ver=4.4.18
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (1975)
Hash 48fff6e66a52c239debc81f75862c9b2
3fab89b793f5e8254080c32172f46fb34a36a4ae
29bcdd385f36858ea29b4bf7b55202c2924f1900931d30d68f097226ab35bc66
Analyzer Verdict Alert quad9 Sinkholed
GET /wp-content/themes/xtra/assets/css/core.css?ver=4.4.18 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:53:53 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 24692
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/elementor.css?ver=4.4.17
200 OK 792 B URL HTTP/1.1 bornagroup.ir/wp-content/plugins/codevz-plus/assets/css/elementor.css?ver=4.4.17
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with CRLF line terminators
Hash d2dbb6f1bfb02226081af68f5008ed10
590dab0b5f196bf5b92b39efc275717cc5a9b9cb
9d938897cdacf05568e2b3a226742d4b8419d4fe1afbc54ea413ee118b38f2d1
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/codevz-plus/assets/css/elementor.css?ver=4.4.17 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: text/css
last-modified: Sat, 29 Oct 2022 06:23:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 792
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
200 OK 4.5 kB URL HTTP/1.1 bornagroup.ir/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (11126)
Hash b58921fb05a6cd3dcd6a9e5dc711d101
c147159c1a060cf4d4efb5f9e1fd5622f602c372
a2060d15016d5ea84f62e0404eb7a6e8d22177f5d26a8c2b9130146715986d5e
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:39 GMT
content-type: application/javascript
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 4461
date: Sat, 14 Jan 2023 06:16:39 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=7.2.2
200 OK 1.2 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=7.2.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type HTML document, ASCII text, with very long lines (3029), with no line terminators
Hash 8f21ef623635929b77e233f970f3654d
f8793e8056d03432ba28a8ed73760ec6e033576e
6629abaf6a515ebd42e9895e32c22bd9be2a37b8774d68536f09b8da3f3a55ae
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=7.2.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:39 GMT
content-type: application/javascript
last-modified: Sun, 25 Dec 2022 11:18:38 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1157
date: Sat, 14 Jan 2023 06:16:39 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.7.2.2
200 OK 3.7 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.7.2.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (9111)
Hash 621b08c7c95b547ce3531f2ffb590245
3cdb29cf4f6da58850f295af40baf7384ed31541
1aee3e3578b3c99d18947926ddb85d395bb49cbb222205740431f064852be86a
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.7.2.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: application/javascript
last-modified: Sun, 25 Dec 2022 11:18:38 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 3661
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/elementor/assets/css/frontend-lite-rtl.min.css?ver=3.9.2
200 OK 15 kB URL HTTP/1.1 bornagroup.ir/wp-content/plugins/elementor/assets/css/frontend-lite-rtl.min.css?ver=3.9.2
IP
ASN #204213 Netmihan Communication Company Ltd
File type ASCII text, with very long lines (65497)
Hash 433cf21d21ba0a77ca69c7f0a72fc1fd
4038d114bab391385c67df5e6251b796e0ce43dd
fab87c4784e0ce84562074d2e1f834eeca2088cf882e9f472c1be0a2fdc62d74
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-content/plugins/elementor/assets/css/frontend-lite-rtl.min.css?ver=3.9.2 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:39 GMT
content-type: text/css
last-modified: Sun, 25 Dec 2022 11:47:06 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 15086
date: Sat, 14 Jan 2023 06:16:39 GMT
server: LiteSpeed
bornagroup.ir/wp-content/plugins/js_composer/assets/js/vendors/woocommerce-add-to-cart.js?ver=6.10.0
200 OK 389 B URL HTTP/1.1 bornagroup.ir/wp-content/plugins/js_composer/assets/js/vendors/woocommerce-add-to-cart.js?ver=6.10.0
IP
ASN #204213 Netmihan Communication Company Ltd
Hash b37085f3756bc6981e933d411a00a2ca
94232def472be675048aebf11ff1e7384fee057c
1559ab238204c38b4a70e1c0f1125a323568e453972f490113c6c18829d6c155
Analyzer Verdict Alert quad9 Sinkholed
GET /wp-content/plugins/js_composer/assets/js/vendors/woocommerce-add-to-cart.js?ver=6.10.0 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:39 GMT
content-type: application/javascript
last-modified: Sat, 29 Oct 2022 06:23:47 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 389
date: Sat, 14 Jan 2023 06:16:39 GMT
server: LiteSpeed
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b5628887325331ad3d660f7208e1995c
9e4bf04468a7aed126488ccb5552a8e02610f6dd
5cd181d6728fc5f0f4d88407b97af61db39c5a38feebdeb2c21335cf4402fca4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 14 Jan 2023 06:16:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.googleapis.com/css2?family=Outfit:wght@400;800&display=swap
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css2?family=Outfit:wght@400;800&display=swap
IP
GET /css2?family=Outfit:wght@400;800&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://bornagroup.ir/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 14 Jan 2023 06:16:38 GMT
date: Sat, 14 Jan 2023 06:16:38 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
bornagroup.ir/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
200 OK 0 B URL HTTP/1.1 bornagroup.ir/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
IP
ASN #204213 Netmihan Communication Company Ltd
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.1 HTTP/1.1
Host: bornagroup.ir
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bornagroup.ir/
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 21 Jan 2023 06:16:38 GMT
content-type: application/javascript
last-modified: Mon, 19 Sep 2022 14:16:24 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 34867
date: Sat, 14 Jan 2023 06:16:38 GMT
server: LiteSpeed
fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
IP
GET /css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://bornagroup.ir/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 14 Jan 2023 06:16:39 GMT
date: Sat, 14 Jan 2023 06:16:39 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
217.144.104.53
142.250.74.106
23.33.119.27
93.184.220.29