Report - app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php

Report Overview

Submitted URL
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
IP
63.250.43.6
ASN
#22612 NAMECHEAP-NET
Submitted
2022-10-02 15:00:28
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
36

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.6 kB	47 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.77.32
app-ptsb-bcb3ac.ingress-comporellon.ewp.live	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	12 kB	1.4 MB	63.250.43.5
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	108.156.28.102
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
ocsp.sectigo.com	487	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	328 B	963 B	104.18.32.68
media-exp1.licdn.com	1784	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	526 B	9.7 kB	23.36.76.210
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	18.165.201.17
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	54.187.71.185
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	993 B	2.1 kB	142.250.74.3
maps.googleapis.com	33876	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	810 B	125 kB	172.217.21.170

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Marktplaats.Sprite.svg	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.woff2	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.woff2	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.woff	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.woff	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.ttf?v1	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.ttf?v1	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js(1).download	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download	Phishing
2022-10-02	medium	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php	162 B	2023-03-08	2023-06-18
Pretty URL app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php IP 63.250.43.5 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 04:37:15 Last Seen2023-06-18 09:19:31 Times Seen6 Hash cd5d46754f3fa23d9bf3eddbe952d8aa 71abffeb15174c5e032af9819cc69e1092417057 dad6a22699ad425bb4020f3eb571fbb0fafca4a633c12fb91cd1bbbcb9bf8967 Loading...

	maps.googleapis.com/maps-api-v3/api/js/45/8b/common.js	89 kB	2023-03-08	2023-03-08
Pretty URL maps.googleapis.com/maps-api-v3/api/js/45/8b/common.js IP 172.217.21.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 04:37:15 Last Seen2023-03-08 04:37:15 Times Seen1 Hash a12634dd047ea95846ecc2bec3daabee 009b3f96eef179fb05993a491ea70e0e46c49a6f 532c38e69af5268621d36b08c921d395e708031d1d5e0e921932a53ea0f5d23d Loading...

	maps.googleapis.com/maps-api-v3/api/js/45/8b/util.js	296 kB	2023-03-08	2023-03-08
Pretty URL maps.googleapis.com/maps-api-v3/api/js/45/8b/util.js IP 172.217.21.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 04:37:15 Last Seen2023-03-08 04:37:15 Times Seen1 Hash 9f54f9b3bb557f56cb8e57398634daca 89726e0ce39cd47e16652c0a81436a96f9af89a3 a8d6ad556ba215c4a9d099f74275b4e77f4d3fb91eeb6c21dafa186feaef92f8 Loading...

	app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php	4.0 kB	2023-03-08	2023-03-08
Pretty URL app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php IP 63.250.43.5 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 04:37:15 Last Seen2023-03-08 04:37:15 Times Seen1 Hash 84906a66978bc4e657b048db10c4535e 32835919828d82998dad7072a4dd92c1fcef9cba f06e32b15565db77e1bdaf125d6f347c82ec5cbc9ec9e655e86bcfca2f0f6483 Loading...

HTTP Transactions (49)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
60e4edea7b5f4d19f3547a3bb2d5df57
3ee076bab4da3416c2c5808f730cb316c28baef7
763e2dadfdd286a51327cd2000ca335e30cd0b9b7267875d22ca33f7556ba200

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "763E2DADFDD286A51327CD2000CA335E30CD0B9B7267875D22CA33F7556BA200"
Last-Modified: Fri, 30 Sep 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11174
Expires: Sun, 02 Oct 2022 18:06:30 GMT
Date: Sun, 02 Oct 2022 15:00:16 GMT
Connection: keep-alive

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php

63.250.43.5

301 Moved Permanently

0 B

URL HTTP/1.1
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
IP
63.250.43.5:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/correos.php HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
content-length: 0
location: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php

firefox.settings.services.mozilla.com/v1/

18.165.201.17

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
18.165.201.17:0
ASN
#0

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
1b3053fa528e28810f8a2cc9284cc921
cca9eb471d941881a6b9a1793aecb6c281908f6a
a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Backoff, Content-Length, Retry-After
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 02 Oct 2022 14:03:10 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 aa2f611dc578ba7eecb9a39cb23b1b70.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: mLr4fMCX_e4H38xJGHTqVwj5BX719GY1rQvY8rw9z_MXMMpfwc9pWQ==
Age: 3426

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

108.156.28.102

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
108.156.28.102:0
ASN
#16509 AMAZON-02

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 02 Oct 2022 03:33:17 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 7fcc9354bd594831abf31608fb6cde60.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: DO1PIFH8nVE6CzHGyH1KTwiUuM6AJ0mf91bNERoJfaxXgzp3MKuL1Q==
age: 41220
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 15:00:16 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

18.165.201.17

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
18.165.201.17:0
ASN
#0

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Expires, Backoff, ETag, Last-Modified, Pragma, Cache-Control, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Date: Sun, 02 Oct 2022 14:32:55 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Sun, 02 Oct 2022 14:32:53 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 675c3f96928d591debc37b54f2b16dc2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: lp1ePWSlUciNM6eNsHjM1PV-DHfGunlEXDmvTlCHxQEn906onndZ6A==
Age: 1643

ocsp.sectigo.com/

104.18.32.68

200 OK

471 B

URL HTTP/1.1
ocsp.sectigo.com/
IP
104.18.32.68:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
471 B (471 bytes)
Hash
fb4c1bf5376667088778b3d1cfa12945
e1b2a7ab5daeda2fcd4f72e79bcf9266976249ec
4204a3f1f984733f76d11ab9714a88c555b306756687051494546f84353d24a7

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 15:00:17 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 02 Oct 2022 07:03:52 GMT
Expires: Sun, 09 Oct 2022 07:03:51 GMT
Etag: "e1b2a7ab5daeda2fcd4f72e79bcf9266976249ec"
Cache-Control: max-age=575613,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 753e4e85a95db505-OSL

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
4eb30b4a4234809cf7d5f89fa1f6ceeb
797242aab2f13c820050aa9accd11b7b950cd177
ce9d833a0ac321a908184b655d6632c481f758a04a9c936a7c303bb253444146

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6087
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 15:00:17 GMT
Last-Modified: Sun, 02 Oct 2022 13:18:51 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

54.187.71.185

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.187.71.185:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: kMu/FSKpJXPu8in94XmcDw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 50HJqA55rUQ5dp1X5+N9mYbUd/I=

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php

63.250.43.6

200 OK

35 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (502)
Size
35 kB (35013 bytes)
Hash
09f5cdc4fc7ec4628a652a5eb5324040
93de1fc3388299f2d51f60e040d0b85eb51d3f90
c8ba31155dde1c7d14e2dd587c88927d003520df20189fba1396cb4bd39b114e

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/correos.php HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:20:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
x-cacheable: YES
age: 5971
x-cache: HIT
accept-ranges: bytes
content-length: 35013
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
83f9407574c75ca600c57af0637cb200
4ebabbc1900b8f575e90186e2024e48097b0c8d2
1e166ac737e5c3c015e0dc0c68115ebc5eeb53958682a9b77928ddb647137ac1

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 15:00:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
83f9407574c75ca600c57af0637cb200
4ebabbc1900b8f575e90186e2024e48097b0c8d2
1e166ac737e5c3c015e0dc0c68115ebc5eeb53958682a9b77928ddb647137ac1

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 15:00:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

maps.googleapis.com/maps-api-v3/api/js/45/8b/common.js

172.217.21.170

200 OK

32 kB

URL HTTP/2
maps.googleapis.com/maps-api-v3/api/js/45/8b/common.js
IP
172.217.21.170:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (1205)
Size
32 kB (32205 bytes)
Hash
4e263b95c612eae39ac86cb10d6bda00
c7fd73d2d3e76a6ed709d93110e1b3f39a5eeef9
47b8e99cf65d2f09b475d6e2cd4d3429e8b0dbc3573718a9720056e56d401fa0

HTTP Headers

GET /maps-api-v3/api/js/45/8b/common.js HTTP/1.1
Host: maps.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-length: 32205
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 30 Sep 2022 11:43:28 GMT
expires: Sat, 30 Sep 2023 11:43:28 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 06 Aug 2021 23:52:40 GMT
content-type: text/javascript
age: 184609
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

maps.googleapis.com/maps-api-v3/api/js/45/8b/util.js

172.217.21.170

200 OK

90 kB

URL HTTP/2
maps.googleapis.com/maps-api-v3/api/js/45/8b/util.js
IP
172.217.21.170:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (679)
Size
90 kB (90471 bytes)
Hash
405c073276b2282b497f8e7354b71fd2
d800a1d4e7f4be411e1336901331678dbd4eed21
f5a8a00646b743785e8cfff99afd7b54f737688a4c0cc109cc56a5bd249f7358

HTTP Headers

GET /maps-api-v3/api/js/45/8b/util.js HTTP/1.1
Host: maps.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-length: 90471
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 02 Oct 2022 04:58:49 GMT
expires: Mon, 02 Oct 2023 04:58:49 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 06 Aug 2021 23:52:40 GMT
content-type: text/javascript
age: 36088
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
165b2dbf56e36edf32811cc7eea70f58
f9e101da2c4f0f6dcca9cb9d0b36a7b77ef3114e
fcd8956f2d96a85e696ee4ba5eb8d575ad3319bc84c543188f3997ea1079c4e1

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 15:00:17 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/marktplaats.css

63.250.43.6

200 OK

57 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/marktplaats.css
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (16476)
Size
57 kB (57390 bytes)
Hash
1348d33964f279cb079705fd5a80b9e9
deb4c1cfac75ecc74e9f546dcd6994720b28edc5
76f93f058c7da4ab006c415d904f14a4c3f0c1af54208b0ecdea37dbc75d39d6

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/marktplaats.css HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: text/css
last-modified: Sun, 02 Oct 2022 13:10:13 GMT
vary: Accept-Encoding
etag: W/"63398db5-285ab"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
content-length: 57390
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/client.min.css

63.250.43.6

200 OK

57 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/client.min.css
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (16476)
Size
57 kB (57390 bytes)
Hash
1348d33964f279cb079705fd5a80b9e9
deb4c1cfac75ecc74e9f546dcd6994720b28edc5
76f93f058c7da4ab006c415d904f14a4c3f0c1af54208b0ecdea37dbc75d39d6

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/client.min.css HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: text/css
last-modified: Sun, 02 Oct 2022 13:10:09 GMT
vary: Accept-Encoding
etag: W/"63398db1-285ab"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
content-length: 57390
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/normalize.112272e5.css

63.250.43.6

200 OK

57 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/normalize.112272e5.css
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (16476)
Size
57 kB (57390 bytes)
Hash
1348d33964f279cb079705fd5a80b9e9
deb4c1cfac75ecc74e9f546dcd6994720b28edc5
76f93f058c7da4ab006c415d904f14a4c3f0c1af54208b0ecdea37dbc75d39d6

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/normalize.112272e5.css HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: text/css
last-modified: Sun, 02 Oct 2022 13:10:14 GMT
vary: Accept-Encoding
etag: W/"63398db6-285ab"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
content-length: 57390
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download

63.250.43.6

200 OK

78 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (1601)
Size
78 kB (77983 bytes)
Hash
2005cff13e09393e76f625c7c3e6d0b7
47d240c168d611f38c102cf2b6320ea582e69e46
50c76b6340f567a536017cdf52bef65fdbbec4d637253e823543059ac68c2fd1

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: application/octet-stream
content-length: 77983
last-modified: Sun, 02 Oct 2022 13:10:15 GMT
etag: "63398db7-1309f"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/Nederlandse-Loterij-1000x600.png

63.250.43.6

200 OK

6.8 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/Nederlandse-Loterij-1000x600.png
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
PNG image data, 309 x 163, 8-bit colormap, non-interlaced\012- data
Size
6.8 kB (6828 bytes)
Hash
aafd2d5698b25a06ed5b94b50ad2f87a
78acb9231d820de5530e30b49e67ebc4112a9256
b3ad3b967675da5c584a5b36d9fad8703f3904a10d944d4eb0002916d74b6c6f

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/Nederlandse-Loterij-1000x600.png HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:43 GMT
content-type: image/png
content-length: 6828
last-modified: Sun, 02 Oct 2022 13:10:10 GMT
etag: "63398db2-1aac"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
x-cacheable: YES
age: 6334
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/1.jpg

63.250.43.6

200 OK

6.3 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/1.jpg
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 200x200, components 3\012- data
Size
6.3 kB (6326 bytes)
Hash
796ab19d4c9814996cf24e2a88107d3a
ccbfa26f2fa23fc4324295bfa6a81bb261b1d107
2f39255d663245261d06451b6db96a7c64c92f716f0190634fae930cc5d2e4ed

HTTP Headers

GET /ESL/1.jpg HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:43 GMT
content-type: image/jpeg
content-length: 6326
last-modified: Sun, 02 Oct 2022 13:10:03 GMT
etag: "63398dab-18b6"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
x-cacheable: YES
age: 6334
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10357
Expires: Sun, 02 Oct 2022 17:52:55 GMT
Date: Sun, 02 Oct 2022 15:00:18 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10357
Expires: Sun, 02 Oct 2022 17:52:55 GMT
Date: Sun, 02 Oct 2022 15:00:18 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10357
Expires: Sun, 02 Oct 2022 17:52:55 GMT
Date: Sun, 02 Oct 2022 15:00:18 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10357
Expires: Sun, 02 Oct 2022 17:52:55 GMT
Date: Sun, 02 Oct 2022 15:00:18 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10357
Expires: Sun, 02 Oct 2022 17:52:55 GMT
Date: Sun, 02 Oct 2022 15:00:18 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg

34.120.237.76

200 OK

5.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.0 kB (4987 bytes)
Hash
463bdcfbec5426e18ecef83b1c373b71
2e533332ee5c49143e58dad32ee3717a39179532
2c40befd28781482b9be249a792571612d68d7045324083d2c832fa5ec42f04b

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4987
x-amzn-requestid: 763edd04-7f8d-42ae-8864-482be3549958
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEHpFs4oAMFbqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3ca-2f7b67e85aa83b69183e62b5;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:26 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 2Zoggf30lA-Kvt5QYa-IdhGePHCNiphR7pfFiOaFvL8ZkWZIaiK4pA==
via: 1.1 f4367b41311e3e9a490d7461b7b85490.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:54:45 GMT
etag: "2e533332ee5c49143e58dad32ee3717a39179532"
content-type: image/jpeg
age: 61533
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6315 bytes)
Hash
206fb65e75dbadf119512f71e0b78402
58ff0bf8ce7528b303d28bab01a80ad721705569
56c8d5f3b3060ee54bf81995269b86c070855d8c33bf437161339a45b309703f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6315
x-amzn-requestid: 6aa75b16-32e4-48a7-9fb0-9e3d5528c2d5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWSdsHUnIAMFXtw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338cabd-742d8a436403683e0cd9368f;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 23:18:21 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 5sAzc5Ewv4g6Wqq6JJiLylG3Jyy_nlWrr5Oteeo6ebEgq7Rvss4XaQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Sun, 02 Oct 2022 04:41:39 GMT
age: 37119
etag: "58ff0bf8ce7528b303d28bab01a80ad721705569"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11083 bytes)
Hash
edded48f558f739287a040151349ef67
d63b6ba630736d32c364b0e6a369274b2389b7ff
33b4a459df0ba7b36b907ba96d74e08660cc75640c42a5748b97d18ec2e9d533

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11083
x-amzn-requestid: 53e2c961-bcc0-4977-8648-ee3c1aed9cde
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEHRFWfIAMFhlA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3c7-070212d7386d5efa1b4aa8d3;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Z1KmxHJh9QNfg5x0enkqOjbmiqHvg7nlQiMnuDuCRNWQUBFEiKELbw==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:53:35 GMT
etag: "d63b6ba630736d32c364b0e6a369274b2389b7ff"
content-type: image/jpeg
age: 61603
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F23b0da68-a440-4387-9d47-1617d8157f55.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.3 kB (8324 bytes)
Hash
26b855e3a55a0cfd23896413332a5c05
342e3be8998b548a7004c2a51c9910959b3747db
dfb620bbfa8adde25d578bc9baaa165324170b2f6bbcc2275f1a824267081ccb

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F23b0da68-a440-4387-9d47-1617d8157f55.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8324
x-amzn-requestid: fa9aa819-4e83-4c42-a899-49396a990ead
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZS2QZEZqoAMF8SA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63376a68-1161ffe757f32d1666e230a6;Sampled=0
x-amzn-remapped-date: Fri, 30 Sep 2022 22:15:04 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: qLKXx_FMt1iTVh0bLwMkPNuKVVYzURAim45RmI2f3Fj6YfxtKHfjmQ==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 22:20:52 GMT
age: 59966
etag: "342e3be8998b548a7004c2a51c9910959b3747db"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F63464d04-a2f9-451b-a399-53362af292c5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10679 bytes)
Hash
d99550eb468960005df780c03ab6ecfc
03111ce2048e8bc5be100ff3a746da2e664f8aab
9dcd18e02621fa95d846be7c951e7353f24aa68a282ee0b693e7e5da38c3cfcb

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F63464d04-a2f9-451b-a399-53362af292c5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10679
x-amzn-requestid: fae3b86e-6f85-485f-81e4-22b7b17f30f0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWRkYF2tIAMF-OQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338c94f-486c76da111696471e3905f2;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 23:12:15 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: CU4YQ3XmxAexkl1rn7BOCSyqyIB12Ff9gMMXqVta5JgIIwQZmUCVMg==
via: 1.1 73b60e9a9fd08eae9e034cedba707280.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 02 Oct 2022 08:04:33 GMT
age: 24945
etag: "03111ce2048e8bc5be100ff3a746da2e664f8aab"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download

63.250.43.6

200 OK

23 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
data
Size
23 kB (23018 bytes)
Hash
8cc3d56acee1c592c9a4ee77b796ddd3
25aaea7fd7b590142968601b8e8040faad68f095
6372cc35a97a12201b36464b382cd3fd052da10006a0486a82c9f39970124ca1

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: application/octet-stream
content-length: 146194
last-modified: Sun, 02 Oct 2022 13:10:11 GMT
etag: "63398db3-23b12"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/bg.png

63.250.43.6

200 OK

868 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/bg.png
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
PNG image data, 1880 x 902, 8-bit/color RGB, non-interlaced\012- data
Size
868 kB (867534 bytes)
Hash
4f35fd46f51901b0e70cfef1a523ac33
310e29e0c50388bea84df02e705c88b0bcd924bb
77eb571cd0865d0fc1eeab8c787727120a0d8351c65f5d3176b7a1ba3cc650a1

HTTP Headers

GET /ESL/bg.png HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:43 GMT
content-type: image/png
content-length: 867534
last-modified: Sun, 02 Oct 2022 13:10:05 GMT
etag: "63398dad-d3cce"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
x-cacheable: YES
age: 6334
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download

63.250.43.6

200 OK

78 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (1601)
Size
78 kB (77983 bytes)
Hash
2005cff13e09393e76f625c7c3e6d0b7
47d240c168d611f38c102cf2b6320ea582e69e46
50c76b6340f567a536017cdf52bef65fdbbec4d637253e823543059ac68c2fd1

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js.download HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: application/octet-stream
content-length: 77983
last-modified: Sun, 02 Oct 2022 13:10:15 GMT
etag: "63398db7-1309f"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 6336
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js

63.250.43.6

200 OK

139 kB

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
ASCII text, with very long lines (2287)
Size
139 kB (139206 bytes)
Hash
b25af216c3d5ae7ae9b59a7b5778b012
cb85fe941054febdc321c1895840f1da689e68be
495cef95a578229aebbb067bd27fb4bfd158c7bde119f691ab4bac58ae78c615

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:20:46 GMT
content-type: application/octet-stream
content-length: 139206
last-modified: Sun, 02 Oct 2022 13:10:10 GMT
etag: "63398db2-21fc6"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 5973
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Marktplaats.Sprite.svg

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Marktplaats.Sprite.svg
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Marktplaats.Sprite.svg HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.woff2

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.woff2
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Roboto-Regular-webfont.woff2 HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.woff2

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.woff2
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Roboto-Light-webfont.woff2 HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.woff

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.woff
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Roboto-Regular-webfont.woff HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.woff

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.woff
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Roboto-Light-webfont.woff HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

media-exp1.licdn.com/dms/image/C4D0BAQFna3enwafmoQ/company-logo_200_200/0/1519892971511?e=2159024400&v=beta&t=sBNV-yifjeHODP8EVTY3ncD4I4om_FpNYnxftDGRVso

23.36.76.210

200 OK

9.1 kB

URL HTTP/2
media-exp1.licdn.com/dms/image/C4D0BAQFna3enwafmoQ/company-logo_200_200/0/1519892971511?e=2159024400&v=beta&t=sBNV-yifjeHODP8EVTY3ncD4I4om_FpNYnxftDGRVso
IP
23.36.76.210:0
ASN
#20940 Akamai International B.V.

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 200x200, components 3\012- data
Size
9.1 kB (9149 bytes)
Hash
4ed5931e53de075ac7dfbe58ff6a99de
29dae291cda10edc02d5e5a3c96255d3e0ba5d44
94f74779aedaf9d2d833a598710515d0b5b9ecde261b2167169d234e7c6ed527

HTTP Headers

GET /dms/image/C4D0BAQFna3enwafmoQ/company-logo_200_200/0/1519892971511?e=2159024400&v=beta&t=sBNV-yifjeHODP8EVTY3ncD4I4om_FpNYnxftDGRVso HTTP/1.1
Host: media-exp1.licdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: Play
content-type: image/jpeg
cache-control: max-age=86400
last-modified: Sat, 11 Sep 2021 04:13:29 GMT
x-li-fabric: prod-ltx1
x-li-pop: prod-ltx1-x
x-li-proto: http/1.1
access-control-expose-headers: X-CDN, X-CDN-Client-IP-Version, X-CDN-Proto, X-Cache, X-CDN-RCODE
x-li-uuid: AAXp/a3lJSZ5RcoWvLeCnA==
content-length: 9149
date: Sun, 02 Oct 2022 15:00:19 GMT
x-cache: TCP_REMOTE_HIT
x-cdn-proto: HTTP2
x-cdn-client-ip-version: IPV4
timing-allow-origin: *
access-control-allow-origin: *
x-cdn: AKAM-STLS
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/images.png

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/images.png
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

HTTP Headers

GET /ESL/images.png HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.ttf?v1

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Regular-webfont.ttf?v1
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Roboto-Regular-webfont.ttf?v1 HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.ttf?v1

63.250.43.6

404 Not Found

146 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Roboto-Light-webfont.ttf?v1
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Roboto-Light-webfont.ttf?v1 HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Sun, 02 Oct 2022 15:00:19 GMT
content-type: text/html
content-length: 146
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js(1).download

63.250.43.6

200 OK

0 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js(1).download
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/common.js(1).download HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: application/octet-stream
content-length: 88785
last-modified: Sun, 02 Oct 2022 13:10:11 GMT
etag: "63398db3-15ad1"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js

63.250.43.6

200 OK

0 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/js HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:20:46 GMT
content-type: application/octet-stream
content-length: 139206
last-modified: Sun, 02 Oct 2022 13:10:10 GMT
etag: "63398db2-21fc6"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 5971
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download

63.250.43.6

200 OK

0 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js.download HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: application/octet-stream
content-length: 146194
last-modified: Sun, 02 Oct 2022 13:10:11 GMT
etag: "63398db3-23b12"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 6336
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download

63.250.43.6

200 OK

0 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: application/octet-stream
content-length: 295768
last-modified: Sun, 02 Oct 2022 13:10:08 GMT
etag: "63398db0-48358"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download

63.250.43.6

200 OK

0 B

URL HTTP/2
app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download
IP
63.250.43.6:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ESL/Nederlandse%20loterij%20_%20Gefeliciteerd_files/util.js(1).download HTTP/1.1
Host: app-ptsb-bcb3ac.ingress-comporellon.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app-ptsb-bcb3ac.ingress-comporellon.ewp.live/ESL/correos.php
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 13:14:42 GMT
content-type: application/octet-stream
content-length: 295768
last-modified: Sun, 02 Oct 2022 13:10:08 GMT
etag: "63398db0-48358"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
x-cacheable: YES
age: 6335
x-cache: HIT
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (49)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type