Report - 104.14.132.210/

Report Overview

Submitted URL
104.14.132.210/
IP
104.14.132.210
ASN
#7018 ATT-INTERNET4
Submitted
2022-12-03 04:24:36
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
60

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.5 kB	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.9 kB	34.160.144.191
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
104.14.132.210	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.7 kB	898 kB	104.14.132.210
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.38.198.114
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	50 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	4.4 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-10-17	medium	104.14.132.210/cgi-bin/main_manage.cgi	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers
2022-12-02	medium	104.14.132.210/	Webmail Providers

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-12-03	medium	104.14.132.210/	Phishing
2022-12-03	medium	104.14.132.210/cgi-bin/main_manage.cgi	Phishing
2022-12-03	medium	104.14.132.210/cgi-bin/login.cgi	Phishing
2022-12-03	medium	104.14.132.210/js/jssha256.js	Phishing
2022-12-03	medium	104.14.132.210/js/common.1.2.00.js?v=1.0.00.0066	Phishing
2022-12-03	medium	104.14.132.210/js/language/skey_locale_eng.js?v=1.0.00.0066	Phishing
2022-12-03	medium	104.14.132.210/js/jquery-1.10.2.js	Phishing
2022-12-03	medium	104.14.132.210/js/jquery-ui.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed
2022-12-03	medium	104.14.132.210	Sinkholed

JavaScript (8)

	URL	Size	First Seen	Last Seen
	104.14.132.210/js/jssha256.js	9.7 kB	2023-03-07	2024-04-11
Pretty URL 104.14.132.210/js/jssha256.js IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:00 Last Seen2024-04-11 14:31:54 Times Seen238 Hash b54ef4b7e31f75ad9e7cb570113f5448 1cec9345b6a84aacb645386a7264a61448bdec47 04979e582e1fa2e54e88185c36968125e69b92674fb09471e420b2299535d5f0 Loading...

	104.14.132.210/js/common.1.2.00.js?v=1.0.00.0066	22 kB	2023-03-07	2024-01-26
Pretty URL 104.14.132.210/js/common.1.2.00.js?v=1.0.00.0066 IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:10:33 Last Seen2024-01-26 04:11:12 Times Seen40 Hash aa4a83e48681562426c2d6ba6b3a24c1 58a55fa15fdf4b6725340a4f1a2b1e514626ccea 833bceffab338dab1a396f3229458ee87964643d107a4bcb965bea3073cfcaa1 Loading...

	104.14.132.210/js/language/skey_locale_eng.js?v=1.0.00.0066	62 kB	2023-03-07	2023-03-17
Pretty URL 104.14.132.210/js/language/skey_locale_eng.js?v=1.0.00.0066 IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:10:33 Last Seen2023-03-17 10:29:19 Times Seen1 Hash 718c4b7492bbaeb2c4bbc45974277882 472b405592f0ad97471ff9d0bb7ae3efec7db1c6 89260dba8f110ca3237565c2a874dfa1c42b02183120c1b89001aa302c66092f Loading...

	104.14.132.210/js/jquery-1.10.2.js	273 kB	2023-03-07	2024-04-11
Pretty URL 104.14.132.210/js/jquery-1.10.2.js IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:54 Last Seen2024-04-11 14:31:54 Times Seen346 Hash 4af63b114dfa59215e7505f6399376db 866b70aba1c1fbade87ca3a36958ba6466c0dc67 604d4511b2209e392f1e8fa16e52665f9562a7bd1818b4afdfe197e1d2c4b82f Loading...

	104.14.132.210/js/jquery-ui.js	469 kB	2023-03-07	2024-04-11
Pretty URL 104.14.132.210/js/jquery-ui.js IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:00 Last Seen2024-04-11 14:31:54 Times Seen523 Hash b5f3656496ccb995aacdccc0e91437c2 4e6a74f1dd52f0b7aa4d9777426adecf8d9377fd 26e1b509ca17a756db87864840e31a1a7caa2ce9164aa2fff2c61284c582c0c2 Loading...

	104.14.132.210/cgi-bin/login.cgi	6.7 kB	2023-03-07	2024-02-27
Pretty URL 104.14.132.210/cgi-bin/login.cgi IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:10:33 Last Seen2024-02-27 23:40:37 Times Seen22 Hash 9e7c335f3d7f15591a1fc12dfb818ccb 525acb8b6167475281b444fcbc66ec8ebab8a5ac d6ff45a831a9a4d92ae0d7a32fdc1d32de79f8ec091a8c27e764182ced0a74eb Loading...

	104.14.132.210/	43 B	2023-03-07	2023-04-05
Pretty URL 104.14.132.210/ IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:54 Last Seen2023-04-05 02:00:41 Times Seen19 Hash c165455d97656f5dc2c5a10a9e6f36f6 9fdbf36cccc1754bcebedbc6399ccd45de232b5b 78f854c042c7a9c1d5154c2d4f16e467adc6a2b5ae2685fb8fd21ea74719b299 Loading...

	104.14.132.210/cgi-bin/main_manage.cgi	46 B	2023-03-07	2023-04-05
Pretty URL 104.14.132.210/cgi-bin/main_manage.cgi IP 104.14.132.210 ASN #7018 ATT-INTERNET4 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:54 Last Seen2023-04-05 02:00:41 Times Seen19 Hash 9e88d81c06748f1e5a531b52abf57153 c25908b081c05b696cd326f8eaf5b095862e1fbd 9aab670f0b7afe103f8f55d0c93153ec3706a123ad1929bcabb41a43d3a9418f Loading...

HTTP Transactions (29)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5067
Expires: Sat, 03 Dec 2022 05:48:52 GMT
Date: Sat, 03 Dec 2022 04:24:25 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3969
Expires: Sat, 03 Dec 2022 05:30:34 GMT
Date: Sat, 03 Dec 2022 04:24:25 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
7439fb99a444b66db1e68ffbfaa38451
4b7742d7956485906f1c392c478515ff89a46184
636327ce88f733e5a1d39af212f97242717a39ce20edaef330fafea238e3a309

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1995
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 03 Dec 2022 04:24:25 GMT
Last-Modified: Sat, 03 Dec 2022 03:51:10 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: YEhVgwVi86mLj/2Aj147VXKqLQmDAH0yqvkEKsxA/NBjR13Nx7TA2igZZSZiZz535bky/sasTtqpseEClI0mHQ==
x-amz-request-id: RHY7WWE3TB2E9AG7
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 03 Dec 2022 03:46:25 GMT
age: 2280
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 03 Dec 2022 04:19:59 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 266
alt-svc: clear
X-Firefox-Spdy: h2

104.14.132.210/

104.14.132.210

200 OK

364 B

URL HTTP/1.1
104.14.132.210/
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size
364 B (364 bytes)
Hash
1f4b19ce7812922392cf7a1e2846ee99
0a8fafdd90850282c9cbde7e332c65729cbd612a
6e1cc281aa418b6200a282203c5506892c3d8b152b492b3f6f2100f2752d1d8f

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: text/html
Accept-Ranges: bytes
ETag: "296326642"
Last-Modified: Tue, 09 Apr 2019 07:35:22 GMT
Content-Length: 364
Date: Fri, 02 Dec 2022 20:24:19 GMT
Server: lighttpd/1.4.37

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 03 Dec 2022 04:24:25 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 03 Dec 2022 04:11:17 GMT
cache-control: public,max-age=3600
age: 788
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

104.14.132.210/cgi-bin/main_manage.cgi

104.14.132.210

200 OK

99 B

URL HTTP/1.1
104.14.132.210/cgi-bin/main_manage.cgi
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
HTML document text\012- HTML document, ASCII text, with no line terminators
Size
99 B (99 bytes)
Hash
c0b3c5c1b871eae123eba8bf031168e7
f2ce7e9d9b0d4572a65f96f7da71c9d28a734407
3a3576a2ecce2f4b6c601b066f855fefec8ce92b830378e48406c700178273b2

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /cgi-bin/main_manage.cgi HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-type: text/html
Connection: Keep-Alive
Keep-Alive: timeout=15, max=94
Pragma: no-cache
Transfer-Encoding: chunked
Date: Fri, 02 Dec 2022 20:24:19 GMT
Server: lighttpd/1.4.37

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
7f1f8fc556d1f7e0aea3e1208ee2fd1c
09c341a56ff876479cfc8a0505a5fef4a5d110f1
65adcf58887bcc23f73379f74ab19a61cfbb93285c95c64b44a6716eeacc1482

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1936
Cache-Control: max-age=105284
Content-Type: application/ocsp-response
Date: Sat, 03 Dec 2022 04:24:26 GMT
Etag: "6389c02e-1d7"
Expires: Sun, 04 Dec 2022 09:39:10 GMT
Last-Modified: Fri, 02 Dec 2022 09:06:54 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471

104.14.132.210/cgi-bin/login.cgi

104.14.132.210

200 OK

17 kB

URL HTTP/1.1
104.14.132.210/cgi-bin/login.cgi
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
17 kB (17299 bytes)
Hash
de6ad973ab72a5df8e2b6aa40d322ca5
60e5c6c077d98e49cdb3f3eb53e5da19acbb9160
9247279628e2a549d533b04525391c186539fea78e7211aac1c3e9c4042da394

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /cgi-bin/login.cgi HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/main_manage.cgi
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Set-Cookie: 000c280bd44d_USER=; ;
000c280bd44d_POLICY=; ;
page_uid=; ;
Content-type: text/html
Connection: Keep-Alive
Keep-Alive: timeout=15, max=94
Pragma: no-cache
Transfer-Encoding: chunked
Date: Fri, 02 Dec 2022 20:24:20 GMT
Server: lighttpd/1.4.37

push.services.mozilla.com/

52.38.198.114

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.38.198.114:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 3+2v9tyenxuD75E1ip/W5A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 5oETap+KjIhMlDkafX8lY2EHCqs=

104.14.132.210/js/jssha256.js

104.14.132.210

200 OK

9.7 kB

URL HTTP/1.1
104.14.132.210/js/jssha256.js
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
ASCII text
Size
9.7 kB (9729 bytes)
Hash
b54ef4b7e31f75ad9e7cb570113f5448
1cec9345b6a84aacb645386a7264a61448bdec47
04979e582e1fa2e54e88185c36968125e69b92674fb09471e420b2299535d5f0

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /js/jssha256.js HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes
ETag: "2276342011"
Last-Modified: Tue, 09 Apr 2019 07:35:23 GMT
Content-Length: 9729
Date: Fri, 02 Dec 2022 20:24:20 GMT
Server: lighttpd/1.4.37

104.14.132.210/js/common.1.2.00.js?v=1.0.00.0066

104.14.132.210

200 OK

22 kB

URL HTTP/1.1
104.14.132.210/js/common.1.2.00.js?v=1.0.00.0066
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
Unicode text, UTF-8 text, with very long lines (319)
Size
22 kB (21621 bytes)
Hash
aa4a83e48681562426c2d6ba6b3a24c1
58a55fa15fdf4b6725340a4f1a2b1e514626ccea
833bceffab338dab1a396f3229458ee87964643d107a4bcb965bea3073cfcaa1

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /js/common.1.2.00.js?v=1.0.00.0066 HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes
ETag: "2610217699"
Last-Modified: Tue, 09 Apr 2019 07:35:23 GMT
Content-Length: 21621
Date: Fri, 02 Dec 2022 20:24:20 GMT
Server: lighttpd/1.4.37

104.14.132.210/css/jquery-ui.css

104.14.132.210

200 OK

36 kB

URL HTTP/1.1
104.14.132.210/css/jquery-ui.css
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
ASCII text, with very long lines (2363)
Size
36 kB (36403 bytes)
Hash
1ffd526cf8c2a498cd2e54e06cc020e0
6f925132f8a5e353fa3dcf1b74009d997f16b997
a936c01fab94663821986ae100372c35589fe4e5ec27e30f2aa06034fc0b4493

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
quad9	Sinkholed

HTTP Headers

GET /css/jquery-ui.css HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Accept-Ranges: bytes
ETag: "584370981"
Last-Modified: Tue, 09 Apr 2019 07:35:22 GMT
Content-Length: 36403
Date: Fri, 02 Dec 2022 20:24:20 GMT
Server: lighttpd/1.4.37

104.14.132.210/js/language/skey_locale_eng.js?v=1.0.00.0066

104.14.132.210

200 OK

62 kB

URL HTTP/1.1
104.14.132.210/js/language/skey_locale_eng.js?v=1.0.00.0066
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
62 kB (62078 bytes)
Hash
718c4b7492bbaeb2c4bbc45974277882
472b405592f0ad97471ff9d0bb7ae3efec7db1c6
89260dba8f110ca3237565c2a874dfa1c42b02183120c1b89001aa302c66092f

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /js/language/skey_locale_eng.js?v=1.0.00.0066 HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes
ETag: "3486835215"
Last-Modified: Tue, 09 Apr 2019 07:35:35 GMT
Content-Length: 62078
Date: Fri, 02 Dec 2022 20:24:20 GMT
Server: lighttpd/1.4.37

104.14.132.210/js/jquery-1.10.2.js

104.14.132.210

200 OK

273 kB

URL HTTP/1.1
104.14.132.210/js/jquery-1.10.2.js
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
ASCII text
Size
273 kB (273403 bytes)
Hash
4af63b114dfa59215e7505f6399376db
866b70aba1c1fbade87ca3a36958ba6466c0dc67
604d4511b2209e392f1e8fa16e52665f9562a7bd1818b4afdfe197e1d2c4b82f

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /js/jquery-1.10.2.js HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes
ETag: "892070181"
Last-Modified: Tue, 09 Apr 2019 07:35:23 GMT
Content-Length: 273403
Date: Fri, 02 Dec 2022 20:24:20 GMT
Server: lighttpd/1.4.37

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17664
Expires: Sat, 03 Dec 2022 09:18:51 GMT
Date: Sat, 03 Dec 2022 04:24:27 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17664
Expires: Sat, 03 Dec 2022 09:18:51 GMT
Date: Sat, 03 Dec 2022 04:24:27 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17664
Expires: Sat, 03 Dec 2022 09:18:51 GMT
Date: Sat, 03 Dec 2022 04:24:27 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg

34.120.237.76

200 OK

4.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.8 kB (4803 bytes)
Hash
cc0a257323f882caff067adb86d906e4
cedf2f21be7cd366bd46055b62b5513db3011dfc
c16a9296d5e840a468fef7fb2764b9f7d4b3131d7ade2ce4999de1eead5469e0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4803
x-amzn-requestid: ad2d9243-5e32-4faf-8ff3-b9abd3af1e89
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cb1_hEJJIAMF4Vg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6387d063-596f5833509112ee6cbedf54;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 21:51:31 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: PIC-TIeTFK_Y2AiqowYT4_8tMuzIKO23lAwx18fYepTf4PIWkmLqkQ==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 05:20:15 GMT
age: 83052
etag: "cedf2f21be7cd366bd46055b62b5513db3011dfc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F20049904-a818-4d1c-9585-79edf76dcc61.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (6966 bytes)
Hash
9b77186d0d93f7ccfe729edd9d184af3
458aa485b9abef3b72427d308a172d1c24eceabd
8bed5a8e56e8c43fcbdc807245c2b651d014a06368574e57a25b718399a4a701

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F20049904-a818-4d1c-9585-79edf76dcc61.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6966
x-amzn-requestid: 2b40c185-e050-4bfd-9b08-bb70e6f89824
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfAb7Ev3oAMFnrQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6389144c-65301ace20da6f580ed77e82;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 20:53:32 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: xBRZ6xulfveO7b5ZY8ApNbQJ1Sz8LbzEAb3YqxOEaZGYem-ZRaar_Q==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 05:22:25 GMT
age: 82922
etag: "458aa485b9abef3b72427d308a172d1c24eceabd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F528dcb40-0960-4efd-98b7-a07004a61b22.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.7 kB (7657 bytes)
Hash
3abdcce275bb9723b4ac1d0c38cc8891
91f0d888c38db0899f106b652e3dcac062648099
ff411fc0d5abaf519d6600961ec51ad71ad9a02e23cc02ad818e27f0324b3d1e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F528dcb40-0960-4efd-98b7-a07004a61b22.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7657
x-amzn-requestid: c0dbd862-41cf-4fa8-ab6b-256763c63fbf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZN1Fo6IAMF9EQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f25-554ffbc83fd70c557437120f;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:25 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ElvfdUly4Rb3YOQyMO2C_VelFUe6xcFbMh6x5fNrRzGjKCITdGSwLQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:37:47 GMT
age: 24400
etag: "91f0d888c38db0899f106b652e3dcac062648099"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73a2ea57-9c46-4205-a91a-a39e992ffe29.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.0 kB (6042 bytes)
Hash
a483cb4f5948987ff2fa6be8d8f3c4ab
3b36c020f5fc38693ac159e5747518a3234ba8cc
a1c33278142371a168ca50aff0c5dc887461a9c83251e397d45c957c7cf788e3

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73a2ea57-9c46-4205-a91a-a39e992ffe29.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6042
x-amzn-requestid: 51d7c6d8-e3ab-42ec-8771-22244bc65da0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZmkNGe0oAMFXNg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6386eae7-04a064426ee5d39b3c2afdfb;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 05:32:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 9fzO8Wc_eneNxExk9EPddOAUZPfKsbobykdAyEkBIzw1_wxawY9lOg==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 07:25:11 GMT
age: 75556
etag: "3b36c020f5fc38693ac159e5747518a3234ba8cc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e765102-d7b9-4765-a166-db04ae6113bc.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11233 bytes)
Hash
dcdb77a21f91a4a280ac9a8efbc48bbd
74c974eaf1cbdf6c5ae11793e42caf4c4e4cb25d
5ee7c45f21b38c653d03a24b10a190a9e9266226d221b006e787cd3719088d7f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e765102-d7b9-4765-a166-db04ae6113bc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11233
x-amzn-requestid: 04a762c8-8d2a-405a-a2e2-386a4da3c57f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZxHZEJXoAMFzqA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6386fbc8-174cbfee1ea6b7093fc18c58;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 06:44:24 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 3tSASLdggPnNrG2bqgvMF5fbE-EoamXkl6kX-kLSPkJwmIdQ6NMsJQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:53:20 GMT
age: 23467
etag: "74c974eaf1cbdf6c5ae11793e42caf4c4e4cb25d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F741da48c-a860-42fc-8f5c-4572522c2f56.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.4 kB (6416 bytes)
Hash
585e7e56aed6b2f2f5e658f46bb791c4
34b768eb68f6cb850ff984fd687096e089649523
5412ba902e667571b0bbb3879ba6b9ad39501abce59381e84e6aa09779e7198b

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F741da48c-a860-42fc-8f5c-4572522c2f56.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6416
x-amzn-requestid: f5456dd6-8459-4a19-a9b5-b7b567fceb01
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cik2pG5aoAMFrVg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a81c3-0923232b35133f471332062b;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 22:52:52 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 8TZjwYhWWdmfZcne3lTU9GR4TqsEjoslXu5WxuF0arKiup8-kBjqbQ==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 559326ad73233233a9e52cb9e8601ede.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 23:08:35 GMT
age: 18952
etag: "34b768eb68f6cb850ff984fd687096e089649523"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

104.14.132.210/js/jquery-ui.js

104.14.132.210

200 OK

469 kB

URL HTTP/1.1
104.14.132.210/js/jquery-ui.js
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
ASCII text, with very long lines (547)
Size
469 kB (469356 bytes)
Hash
b5f3656496ccb995aacdccc0e91437c2
4e6a74f1dd52f0b7aa4d9777426adecf8d9377fd
26e1b509ca17a756db87864840e31a1a7caa2ce9164aa2fff2c61284c582c0c2

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
fortinet	Phishing
quad9	Sinkholed

HTTP Headers

GET /js/jquery-ui.js HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes
ETag: "1202578347"
Last-Modified: Tue, 09 Apr 2019 07:35:23 GMT
Content-Length: 469356
Date: Fri, 02 Dec 2022 20:24:20 GMT
Server: lighttpd/1.4.37

104.14.132.210/favicon.ico

104.14.132.210

404 Not Found

345 B

URL HTTP/1.1
104.14.132.210/favicon.ico
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
XML 1.0 document text\012- XHTML document text (version 1.0)\012- broken XHTML document text (version 1.0)\012- HTML document text\012- XML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
345 B (345 bytes)
Hash
ab99593efdf397078f11d9c37dd218a1
34540ffc5331cc545c1035b06a72b4f8d375973d
beab79184bf1fca1f52ff3761f8a533827106fef3749c6c9c9a3e7eec619a226

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
quad9	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 404 Not Found
X-Frame-Options: SAMEORIGIN
Content-Type: text/html
Content-Length: 345
Date: Fri, 02 Dec 2022 20:24:21 GMT
Server: lighttpd/1.4.37

104.14.132.210/image/ui-icons_d19405_256x240.png

104.14.132.210

200 OK

4.5 kB

URL HTTP/1.1
104.14.132.210/image/ui-icons_d19405_256x240.png
IP
104.14.132.210:0
ASN
#7018 ATT-INTERNET4

File type
PNG image data, 256 x 240, 8-bit colormap, non-interlaced\012- data
Size
4.5 kB (4549 bytes)
Hash
9b1cdbc87afbb7d8e7745ce11535e2f1
ef0aab3665b9250ba39412f56e6232ae16e2bcb8
9dbe5674b880229e7592e526a8bb29b347ac34af6e2229b8859532e5f7fdb626

Detections

Analyzer	Verdict	Alert
openphish	Webmail Providers
quad9	Sinkholed

HTTP Headers

GET /image/ui-icons_d19405_256x240.png HTTP/1.1
Host: 104.14.132.210
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.14.132.210/cgi-bin/login.cgi

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Accept-Ranges: bytes
ETag: "3878173630"
Last-Modified: Tue, 09 Apr 2019 07:35:22 GMT
Content-Length: 4549
Date: Fri, 02 Dec 2022 20:24:22 GMT
Server: lighttpd/1.4.37

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (8)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations