r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1cdc095521e9ee2606059be447d1fdd5
02b5d0a5b5823e2338daf7e144700babe2a213af
8bda3aabcf331c2bfcc4c7023cd797c760fd301dc353641bb95048e072f66c66
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8BDA3AABCF331C2BFCC4C7023CD797C760FD301DC353641BB95048E072F66C66"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3142
Expires: Sun, 05 Feb 2023 03:00:48 GMT
Date: Sun, 05 Feb 2023 02:08:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c21ba65e44ac95470c314e068e49a9eb
17a13b13738993d889d4afa3d848dc63bf6eba64
9bd0795b30e84ce63b6e2a365ca91bbffc395dd955e112152066c31e63a4ab66
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9BD0795B30E84CE63B6E2A365CA91BBFFC395DD955E112152066C31E63A4AB66"
Last-Modified: Sat, 04 Feb 2023 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7431
Expires: Sun, 05 Feb 2023 04:12:17 GMT
Date: Sun, 05 Feb 2023 02:08:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fb7b6b46e708ad73eaaa3c21e74569ae
950663c025acad81556af5aa3022ecc9d55097fe
763f58b9fb838378c92033b59907b036f4c33081f5103d9bcc2ca2a8de500d64
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "763F58B9FB838378C92033B59907B036F4C33081F5103D9BCC2CA2A8DE500D64"
Last-Modified: Sat, 04 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15057
Expires: Sun, 05 Feb 2023 06:19:23 GMT
Date: Sun, 05 Feb 2023 02:08:26 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 05 Feb 2023 01:36:17 GMT
content-type: application/json
age: 1929
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: C1h6QYymecSzNIot3FqwH1yNW+T7igg/Oyg6p2fD7kZG6oKClv257RfxsCU/4pJ3MRq440WxUDx12qO++VSaLg==
x-amz-request-id: MMRF6FBK7AW3FMQZ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 05 Feb 2023 01:53:04 GMT
age: 922
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 05 Feb 2023 02:08:26 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
119.29.2.14/
200 OK 12 kB IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text
Hash b5f0914f4673710492d5e71ddd3da63a
a0b3c1c0a75e96ba7ec4261098185eec4bc35438
66281ef2f8e06cf4d50d01eb6526c57810332b5df444e90604908c3e07e5c54b
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
NIDS Severity Alert suricata medium ET PHISHING Possible Phish - Saved Website Comment Observed
GET / HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:26 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 05 Feb 2023 02:07:20 GMT
age: 67
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash dedf9c519ac38c4bece9c5bc895787d7
4911175c3f8a435978c5301c33c7a99a5e00a1d5
bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BDDD7E3A4939F863642A7C5348C1C8B9BC569B35C10A27F4CF5EC71F7E6B9698"
Last-Modified: Fri, 03 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4474
Expires: Sun, 05 Feb 2023 03:23:01 GMT
Date: Sun, 05 Feb 2023 02:08:27 GMT
Connection: keep-alive
119.29.2.14/CIMB%20Clicks_files/common-905dbb77.css
200 OK 37 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/common-905dbb77.css
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type ASCII text, with very long lines (57015), with CRLF line terminators
Hash 293174f671377282dd001924bc2b5f2c
12fc3511328aee55a25065fb59db1f835d259d62
4a2dbfee415c2a46d683e6316bbddcfc127cc4805fcf815843b644c138223376
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/common-905dbb77.css HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:27 GMT
Content-Type: text/css
Last-Modified: Mon, 13 Jun 2022 03:51:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"62a6b440-31ec3"
Expires: Sun, 05 Feb 2023 14:08:27 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
119.29.2.14/CIMB%20Clicks_files/login-60e38c95.css
200 OK 43 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/login-60e38c95.css
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type ASCII text, with very long lines (65536), with no line terminators
Hash 53a53c7a01b486a799fd7cfb3ba7230d
a09dbff084099e0e5bdc76ec31fc0aad35515be6
d70d9238d5e85287e67d2af5f5e919cc8b44826eaa52f24dd35e1c8345279c4c
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/login-60e38c95.css HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:27 GMT
Content-Type: text/css
Last-Modified: Mon, 13 Jun 2022 03:51:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"62a6b442-30c6c"
Expires: Sun, 05 Feb 2023 14:08:27 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: g5hRP2L1zbz+WZEqhOT1Ag==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: YJ4+DdmbFL24XIdVqJflb+FJjkI=
119.29.2.14/CIMB%20Clicks_files/jquery.compressed.min.js.%E4%B8%8B%E8%BD%BD
200 OK 87 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/jquery.compressed.min.js.%E4%B8%8B%E8%BD%BD
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Hash d9ee36fc71f7dae1b2bccdc77113c50b
6e6685aa1bc192a5e2b15e509798ca57640e93bb
694bf9178c5eac35fe43f0df03d862e716c97bdbb07bbd0aaee09e4fd4e68f1a
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/jquery.compressed.min.js.%E4%B8%8B%E8%BD%BD HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:27 GMT
Content-Type: application/octet-stream
Content-Length: 86555
Last-Modified: Mon, 13 Jun 2022 03:51:30 GMT
Connection: keep-alive
ETag: "62a6b442-1521b"
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/main-18d79bb6.css
200 OK 198 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/main-18d79bb6.css
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type ASCII text, with very long lines (65536), with no line terminators
Size 198 kB (198212 bytes)
Hash 1565be0be7c816ec04e51e2671eb168e
003f727de63071179933b39cef0c4d35b76a9476
ef45df7751d288f0359b54471c8b623c1d24d083a04be4b42e60bd0d868f09ec
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/main-18d79bb6.css HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:27 GMT
Content-Type: text/css
Last-Modified: Mon, 13 Jun 2022 03:51:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"62a6b446-f0f1e"
Expires: Sun, 05 Feb 2023 14:08:27 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
119.29.2.14/CIMB%20Clicks_files/rccp.compressed.min.js.%E4%B8%8B%E8%BD%BD
200 OK 128 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/rccp.compressed.min.js.%E4%B8%8B%E8%BD%BD
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Unicode text, UTF-8 text, with very long lines (65530), with no line terminators
Size 128 kB (128488 bytes)
Hash e9b8ada35c2a2446c59591165eb76854
94fbabc78ff1720bb2414bca8f38c05609959849
3c7d74db631a4fcf6745dc5afbf2f69a8b4aad39ee1ae8c7c32624bf0150aa32
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/rccp.compressed.min.js.%E4%B8%8B%E8%BD%BD HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:27 GMT
Content-Type: application/octet-stream
Content-Length: 128488
Last-Modified: Mon, 13 Jun 2022 03:51:36 GMT
Connection: keep-alive
ETag: "62a6b448-1f5e8"
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/logo-white.svg
200 OK 7.0 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/logo-white.svg
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash 429638fbee5e8101272da1688b781ea6
9350182dbc283c0e593035bf2ae3d85e29d154c8
6ae72937c581d6fb8d474ef93b4c4aafe4f2f54e8cb6418f4ae1e309dc7e60ed
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/logo-white.svg HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: image/svg+xml
Content-Length: 7023
Last-Modified: Mon, 13 Jun 2022 03:51:32 GMT
Connection: keep-alive
ETag: "62a6b444-1b6f"
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/octobus-banner.png
200 OK 104 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/octobus-banner.png
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type PNG image data, 485 x 484, 8-bit/color RGB, non-interlaced\012- data
Size 104 kB (103532 bytes)
Hash 56bf65c50a9ddfb2a775838699ad2743
f865747e7e66d5a86d78da5f6e1b97136a442334
c43d31d3df78ee182323010bc2822e5fed25dba8646bb939e982dec7cafe6363
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/octobus-banner.png HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: image/png
Content-Length: 103532
Last-Modified: Mon, 13 Jun 2022 03:51:34 GMT
Connection: keep-alive
ETag: "62a6b446-1946c"
Expires: Tue, 07 Mar 2023 02:08:28 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/clicks-app-logo.png
200 OK 12 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/clicks-app-logo.png
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced\012- data
Hash 4a768a69eef9db7b752c11a0959ac5d6
5662ad9ac55cbedb22b39a7015a3e4eb406dea4d
738300e0e9ae248896745a45a2b9e4eb4cb46aa6468e9b9cad08962433f1e83b
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/clicks-app-logo.png HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: image/png
Content-Length: 12544
Last-Modified: Mon, 13 Jun 2022 03:51:28 GMT
Connection: keep-alive
ETag: "62a6b440-3100"
Expires: Tue, 07 Mar 2023 02:08:28 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/octo_downtime.png
200 OK 45 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/octo_downtime.png
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type PNG image data, 728 x 200, 8-bit/color RGB, non-interlaced\012- data
Hash de6054a5e6c4ceb584de2c1b4c824e71
4f70266e255152fc3e062703af5ec56be671e419
d65b69df1ce1c5699810c3ef0afc9e44e5378119214b7b070c8d14d83e00c378
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/octo_downtime.png HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: image/png
Content-Length: 44579
Last-Modified: Mon, 13 Jun 2022 03:51:34 GMT
Connection: keep-alive
ETag: "62a6b446-ae23"
Expires: Tue, 07 Mar 2023 02:08:28 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/stripebar.gif
200 OK 220 B URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/stripebar.gif
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type GIF image data, version 89a, 1040 x 5\012- data
Hash e115051da507e091561923bbb5ea0d75
32522b4313718bd998afdc40cf80ab346900e3cd
6c5b9660ee94fc8dc962c410201774efad581177a1e69eb7733a219bd9c4e30d
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/stripebar.gif HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: image/gif
Content-Length: 220
Last-Modified: Mon, 13 Jun 2022 03:51:40 GMT
Connection: keep-alive
ETag: "62a6b44c-dc"
Expires: Tue, 07 Mar 2023 02:08:28 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
ocsp2.globalsign.com/rootr3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/rootr3
IP
Hash 5f20bfeece901c4f944e8083fd119b9a
2e57960e39c8b3f04d568609e63d9a2d4f40e712
07943e3b76050e5bfd0b818ae09d288d6e3cfe98bacbe249eafcb4ba2f90518c
POST /rootr3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 81
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: application/ocsp-response
Content-Length: 1434
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:45:56 GMT
ETag: "2e57960e39c8b3f04d568609e63d9a2d4f40e712"
Last-Modified: Sun, 05 Feb 2023 00:45:57 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2294
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 794819334e550b06-OSL
ocsp2.globalsign.com/rootr3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/rootr3
IP
Hash 5f20bfeece901c4f944e8083fd119b9a
2e57960e39c8b3f04d568609e63d9a2d4f40e712
07943e3b76050e5bfd0b818ae09d288d6e3cfe98bacbe249eafcb4ba2f90518c
POST /rootr3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 81
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: application/ocsp-response
Content-Length: 1434
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:45:56 GMT
ETag: "2e57960e39c8b3f04d568609e63d9a2d4f40e712"
Last-Modified: Sun, 05 Feb 2023 00:45:57 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2294
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 794819334bd5b4fd-OSL
ocsp2.globalsign.com/rootr3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/rootr3
IP
Hash 5f20bfeece901c4f944e8083fd119b9a
2e57960e39c8b3f04d568609e63d9a2d4f40e712
07943e3b76050e5bfd0b818ae09d288d6e3cfe98bacbe249eafcb4ba2f90518c
POST /rootr3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 81
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: application/ocsp-response
Content-Length: 1434
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:45:56 GMT
ETag: "2e57960e39c8b3f04d568609e63d9a2d4f40e712"
Last-Modified: Sun, 05 Feb 2023 00:45:57 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2294
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 794819334a34b511-OSL
ocsp2.globalsign.com/rootr3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/rootr3
IP
Hash 5f20bfeece901c4f944e8083fd119b9a
2e57960e39c8b3f04d568609e63d9a2d4f40e712
07943e3b76050e5bfd0b818ae09d288d6e3cfe98bacbe249eafcb4ba2f90518c
POST /rootr3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 81
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: application/ocsp-response
Content-Length: 1434
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:45:56 GMT
ETag: "2e57960e39c8b3f04d568609e63d9a2d4f40e712"
Last-Modified: Sun, 05 Feb 2023 00:45:57 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2294
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7948193348bafab4-OSL
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1b25bf82638deaab60981e1315ee0849
e3bd912fd1a890e64ee6746a78a674db7ff77039
a99b0dfa9ca7176b21cc2d65963a1b6eb6d534b3767d02ef06cc207a63331ebf
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A99B0DFA9CA7176B21CC2D65963A1B6EB6D534B3767D02EF06CC207A63331EBF"
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18211
Expires: Sun, 05 Feb 2023 07:11:59 GMT
Date: Sun, 05 Feb 2023 02:08:28 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F030e2301-116b-4cdd-ae90-c5bbc86e9669.jpeg
200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F030e2301-116b-4cdd-ae90-c5bbc86e9669.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b1092c4dd4d9ca4d09462ae46e1dd7c1
17444ff60be1afbc40d3653fa936f9eaf9478068
ea8362c7249080b34288ee675f70333607fc3be37e716fdcf63e4901849def9f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F030e2301-116b-4cdd-ae90-c5bbc86e9669.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7288
x-amzn-requestid: 1aa297f5-2f9a-45be-b823-1eb4d5887769
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f1WrwH-iIAMFyhQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ded17e-2b630b4a302b8ae118883b71;Sampled=0
x-amzn-remapped-date: Sat, 04 Feb 2023 21:43:26 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: z2oKgp1keqEkvN6jjsUepMbrxD4JCXKAOHrMNJHcuXN0CpulUh5GLA==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 21:43:39 GMT
etag: "17444ff60be1afbc40d3653fa936f9eaf9478068"
content-type: image/jpeg
age: 15889
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a38348b-ed70-4e2f-80ce-d13e44fefcfc.webp
200 OK 14 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a38348b-ed70-4e2f-80ce-d13e44fefcfc.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7b596a8e984911df703e15c72d25d513
a1fa1355f4de6f246d35bed9f128e13fc9dc4e72
aba708124199ec6b0ce86ac14c6c18d233ff405071a7f22522217c2fcb0aa9b7
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a38348b-ed70-4e2f-80ce-d13e44fefcfc.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13557
x-amzn-requestid: 981a0f31-e874-4392-a81d-12d667020700
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fH8-JGEsoAMFhZA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cca85a-7398031f2676734c65447e5b;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 03:07:06 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 3dw5Oj2su-_kCvpC1jDJsyAEUPzaexgTzhAC9yAYSyXTFRVge2FR6Q==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 22:10:43 GMT
age: 14265
etag: "a1fa1355f4de6f246d35bed9f128e13fc9dc4e72"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed9dd21c-6496-4f6e-b306-570e4802aba4.jpeg
200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed9dd21c-6496-4f6e-b306-570e4802aba4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 251f1a5d671fb797fb98e9a71754c341
335425603d9eec146a3c03422dbca91134272e53
74932f07561287e33302aabcf9c639e9df7ae0fbc4bf71f5467310aabafea208
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed9dd21c-6496-4f6e-b306-570e4802aba4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6202
x-amzn-requestid: 01b85fcd-69a0-49da-8640-32a3ef19378a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fi3bUFEJoAMFapg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d76c48-14817e717361e09170714e9d;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 07:05:44 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1_1mEN4j5cciWEiimz4PRjx3PNGnrSRib9oEJAdYLrrtyjqnz_zvcQ==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 13:05:46 GMT
age: 46962
etag: "335425603d9eec146a3c03422dbca91134272e53"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F94063a59-0665-4d1d-89f4-785b4ab501d8.jpeg
200 OK 6.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F94063a59-0665-4d1d-89f4-785b4ab501d8.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash bee08788da5b88dde69aeb1d4de005c9
537c7a19a9395a60452b6b0b3ae08d47f4705181
02365d88ae9ff3ace3f29509df0e436ab0838d44714ef0f25dea463d665f794a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F94063a59-0665-4d1d-89f4-785b4ab501d8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6486
x-amzn-requestid: 544d13b9-8d45-4029-88e0-280f27cc0fa3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fi4-SHN1IAMFSkw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d76ec1-3f1ee84f53fe45cc01439a28;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 07:16:17 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: TtyPO9j12ZpU3XdElRgCrqB4XNERrppavwJZJn5As8mqjjDLyZBmsw==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 21:43:39 GMT
age: 15889
etag: "537c7a19a9395a60452b6b0b3ae08d47f4705181"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg
200 OK 9.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7dbe304b5138a360ff07a9842bcf6a7f
00572f7667e322c9ef34bc35b7998c1c172dd34c
d63c58d6c96e23c61b92272de8c2aab01f4cf85f3420cc434c05447d355b1c77
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F085f1306-f595-4e1a-8162-7d3d1f959ac3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9108
x-amzn-requestid: a3bffa19-86ce-4a59-b826-551deddb3e9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fostZG2xIAMF0wQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d9c188-18acd7311c6190c9486e86ac;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 01:34:00 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mWqq5MbsWYvQmSzPw3kTdjzTkz22mNHbOoqyiHfbxv0BhNhgFfnZGw==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 21:43:52 GMT
age: 15876
etag: "00572f7667e322c9ef34bc35b7998c1c172dd34c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61ef2f28-06d6-4c28-b598-e80a6c49ef77.jpeg
200 OK 4.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61ef2f28-06d6-4c28-b598-e80a6c49ef77.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1f4a8749b09484bfc2a8fe4b33c69624
299d7514cf29c2dbd919581883239ef44c0984dd
22a61b6e7b48eeb44339469a353efdef0dc089be670fb490627dd33adc59168b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F61ef2f28-06d6-4c28-b598-e80a6c49ef77.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4526
x-amzn-requestid: 0942d90f-c9a6-40e6-9439-5da97a42cd35
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fye2wEngoAMFmGQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ddab5e-5d3234d519561b4040eff4c3;Sampled=0
x-amzn-remapped-date: Sat, 04 Feb 2023 00:48:30 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: WqipgPOkYYXuD4D0MYHUEn4Gusno3xTQyHrwq-XlF9mwiPP0BtQGWg==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 04 Feb 2023 09:56:11 GMT
age: 58337
etag: "299d7514cf29c2dbd919581883239ef44c0984dd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
119.29.2.14/fonts/OpenSans-Bold.woff2
200 OK 24 kB URL HTTP/1.1 119.29.2.14/fonts/OpenSans-Bold.woff2
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format (Version 2), TrueType, length 23940, version 1.6554\012- data
Hash 59a4209d1573ed4686302d5dffaffb40
5937031eef68d807835b558e0f837211965ef08f
e417e31a3f65fcac3512b824624b37b4a21cc0ba1323fb10e46991250bdbc40e
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /fonts/OpenSans-Bold.woff2 HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://119.29.2.14/CIMB%20Clicks_files/common-905dbb77.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: font/woff2
Content-Length: 23940
Last-Modified: Mon, 13 Jun 2022 03:51:44 GMT
Connection: keep-alive
ETag: "62a6b450-5d84"
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/logo.svg
200 OK 4.5 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/logo.svg
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash 24833f05e69d0be2e1f118146ef75dea
4b3a48f5fc9822151ec45b0bc947c661cffb6602
5b1cfbf278659603e48917a92dd18ba2c027cc7a4eb452eb05380dcf34ec5905
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/logo.svg HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: image/svg+xml
Content-Length: 4526
Last-Modified: Mon, 13 Jun 2022 03:51:32 GMT
Connection: keep-alive
ETag: "62a6b444-11ae"
Accept-Ranges: bytes
119.29.2.14/fonts/OpenSans-Semibold.woff2
200 OK 23 kB URL HTTP/1.1 119.29.2.14/fonts/OpenSans-Semibold.woff2
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format (Version 2), TrueType, length 23040, version 1.6554\012- data
Hash e576ac6417d65c3fee6b762dc68ddf53
f2019bb3ff4aaeb8419135d18771ac15fa7a0db0
b366d38c92fdf8b3f24293be0c8bfc908816ebd0822e7136ff0416a62a929b59
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /fonts/OpenSans-Semibold.woff2 HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://119.29.2.14/CIMB%20Clicks_files/common-905dbb77.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: font/woff2
Content-Length: 23040
Last-Modified: Mon, 13 Jun 2022 03:51:44 GMT
Connection: keep-alive
ETag: "62a6b450-5a00"
Accept-Ranges: bytes
119.29.2.14/fonts/OpenSans.woff2
200 OK 23 kB URL HTTP/1.1 119.29.2.14/fonts/OpenSans.woff2
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format (Version 2), TrueType, length 22772, version 1.6554\012- data
Hash 7192c1d248c9b8719cbef9219f3f9ec1
fca50e56d52d39d6c5ff27d630a344e12d3b1665
e1aa0e8cec5d3cc600c4c6b1afcc77d8b66f51d57b97d706ce71f8b6e2311a65
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /fonts/OpenSans.woff2 HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://119.29.2.14/CIMB%20Clicks_files/common-905dbb77.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: font/woff2
Content-Length: 22772
Last-Modified: Mon, 13 Jun 2022 03:51:44 GMT
Connection: keep-alive
ETag: "62a6b450-58f4"
Accept-Ranges: bytes
119.29.2.14/fonts/icons.woff2
200 OK 24 kB URL HTTP/1.1 119.29.2.14/fonts/icons.woff2
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format (Version 2), TrueType, length 23452, version 1.0\012- data
Hash 93c5821f7941a1279a0bf692cc2e8c9f
07df24e52a779a36e3c684a538e8f26aa7f5f3cc
0a332911ea42c1f336b01967f6e51b5f226928ed3703418ee9dead6b56c00211
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /fonts/icons.woff2 HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://119.29.2.14/CIMB%20Clicks_files/common-905dbb77.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: font/woff2
Content-Length: 23452
Last-Modified: Mon, 13 Jun 2022 03:51:42 GMT
Connection: keep-alive
ETag: "62a6b44e-5b9c"
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/transparent.png
200 OK 926 B URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/transparent.png
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced\012- data
Hash bdb4338de6462f0a7f0fd4a053024235
084e8edd30bc5a9fc5cd23c32c73dbc40336b2c7
34d88584b623cb24a63f17f0b7032c732a7890d00aa691bdd498d17596b80e12
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/transparent.png HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: image/png
Content-Length: 926
Last-Modified: Mon, 13 Jun 2022 03:51:42 GMT
Connection: keep-alive
ETag: "62a6b44e-39e"
Expires: Tue, 07 Mar 2023 02:08:29 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/header-service-login.png
200 OK 93 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/header-service-login.png
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type PNG image data, 750 x 225, 8-bit/color RGBA, non-interlaced\012- data
Hash cb3c32588b7c347f0d6af85fef4aef01
d38d68915f8c4cb979c3c13c335e633c3543237c
8815cd55b5ce976479c51dca2c38839ef59fec747c88fe20b8e20c633fa59e34
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/header-service-login.png HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:28 GMT
Content-Type: image/png
Content-Length: 92829
Last-Modified: Mon, 13 Jun 2022 03:51:28 GMT
Connection: keep-alive
ETag: "62a6b440-16a9d"
Expires: Tue, 07 Mar 2023 02:08:28 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/logo-mob.svg
200 OK 4.2 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/logo-mob.svg
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash a5e0a25e8e76f6c123f6a8a77fc6cb90
10e047849ba5aa521976afe2a15e9562e5e4256a
d105cd67745d3e73f5cc8342d509f028cf988bee961ebd4cae203f7a148d974b
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/logo-mob.svg HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: image/svg+xml
Content-Length: 4179
Last-Modified: Mon, 13 Jun 2022 03:51:32 GMT
Connection: keep-alive
ETag: "62a6b444-1053"
Accept-Ranges: bytes
119.29.2.14/CIMB%20Clicks_files/login-banner-mob1.png
200 OK 80 kB URL HTTP/1.1 119.29.2.14/CIMB%20Clicks_files/login-banner-mob1.png
IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type PNG image data, 750 x 520, 8-bit colormap, non-interlaced\012- data
Hash 51f0f80b31229642d16602bdd9ec4d03
87d0cf5f284756e479e70b2873f331db4f180dbe
a23ac55e96da066d478ddeccd7d31e6ea9ae3e1d20718bfff0d5c32211f17944
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /CIMB%20Clicks_files/login-banner-mob1.png HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: image/png
Content-Length: 79878
Last-Modified: Mon, 13 Jun 2022 03:51:30 GMT
Connection: keep-alive
ETag: "62a6b442-13806"
Expires: Tue, 07 Mar 2023 02:08:29 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
ocsp2.globalsign.com/gsextendvalsha2g3r3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsextendvalsha2g3r3
IP
Hash 48f8897e0486c3c2be364852ff0782c7
26080d8ecb1f66c01ad9e4e005d0089597ffca89
3ede774af55474240856e56aa0124edd95628c47fa0584f8622b7abf6d9cbe69
POST /gsextendvalsha2g3r3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: application/ocsp-response
Content-Length: 1444
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:18:21 GMT
ETag: "26080d8ecb1f66c01ad9e4e005d0089597ffca89"
Last-Modified: Sun, 05 Feb 2023 00:18:22 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 794819335e5d0b06-OSL
ocsp2.globalsign.com/gsextendvalsha2g3r3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsextendvalsha2g3r3
IP
Hash 48f8897e0486c3c2be364852ff0782c7
26080d8ecb1f66c01ad9e4e005d0089597ffca89
3ede774af55474240856e56aa0124edd95628c47fa0584f8622b7abf6d9cbe69
POST /gsextendvalsha2g3r3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: application/ocsp-response
Content-Length: 1444
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:18:21 GMT
ETag: "26080d8ecb1f66c01ad9e4e005d0089597ffca89"
Last-Modified: Sun, 05 Feb 2023 00:18:22 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 0
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 794819335bd9b4fd-OSL
www.cimbclicks.com.my/resource.web/clicks.login.banner/cpl-1k-588-d.jpg
200 OK 86 kB URL HTTP/2 www.cimbclicks.com.my/resource.web/clicks.login.banner/cpl-1k-588-d.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1200x726, components 3\012- data
Hash 197f3ee8cfebf7a295e506f748516558
abbb6ecba1de4b1a5a9ff64751b6e8f7b14a84ce
a6080307a514d29fa4668bb7c6338ab635bcae5ac9359c8d1c9c9e0a878b506f
GET /resource.web/clicks.login.banner/cpl-1k-588-d.jpg HTTP/1.1
Host: www.cimbclicks.com.my
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://119.29.2.14/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-oneagent-js-injection: true
last-modified: Tue, 07 Jun 2022 23:49:42 GMT
content-length: 85938
server-timing: dtSInfo;desc="0", dtRpid;desc="880150871"
content-type: image/jpeg
content-language: en-US
date: Sun, 05 Feb 2023 02:08:29 GMT
X-Firefox-Spdy: h2
www.cimbclicks.com.my/resource.web/clicks.login.banner/raya22-c.jpg
200 OK 90 kB URL HTTP/2 www.cimbclicks.com.my/resource.web/clicks.login.banner/raya22-c.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1366x768, components 3\012- data
Hash 11199057efa5c7ea9e22f70fe56a470e
e7b0547da03df7ae576cb732b646f00680570161
f5ec9f603c67aa55f0bc9439c2ef63a9892b6e8abdbcaa4c091b9079dca0dd05
GET /resource.web/clicks.login.banner/raya22-c.jpg HTTP/1.1
Host: www.cimbclicks.com.my
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://119.29.2.14/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-oneagent-js-injection: true
last-modified: Wed, 06 Apr 2022 14:57:49 GMT
content-length: 89480
server-timing: dtSInfo;desc="0", dtRpid;desc="-710116000"
content-type: image/jpeg
content-language: en-US
date: Sun, 05 Feb 2023 02:08:29 GMT
X-Firefox-Spdy: h2
www.google-analytics.com/ga.js
200 OK 17 kB URL HTTP/1.1 www.google-analytics.com/ga.js
IP
File type ASCII text, with very long lines (1305)
Hash 01d5892e6e243b52998310c2925b9f3a
58180151b6a6ee4af73583a214b68efb9e8844d4
7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d
GET /ga.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Server: Golfe2
Content-Length: 17168
Date: Sun, 05 Feb 2023 01:08:15 GMT
Expires: Sun, 05 Feb 2023 03:08:15 GMT
Cache-Control: public, max-age=7200
Age: 3614
Last-Modified: Tue, 10 Jan 2023 21:29:14 GMT
Content-Type: text/javascript
ocsp2.globalsign.com/gsextendvalsha2g3r3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsextendvalsha2g3r3
IP
Hash 48f8897e0486c3c2be364852ff0782c7
26080d8ecb1f66c01ad9e4e005d0089597ffca89
3ede774af55474240856e56aa0124edd95628c47fa0584f8622b7abf6d9cbe69
POST /gsextendvalsha2g3r3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: application/ocsp-response
Content-Length: 1444
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:18:21 GMT
ETag: "26080d8ecb1f66c01ad9e4e005d0089597ffca89"
Last-Modified: Sun, 05 Feb 2023 00:18:22 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 0
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7948193358bbfab4-OSL
ocsp2.globalsign.com/gsextendvalsha2g3r3
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsextendvalsha2g3r3
IP
Hash 48f8897e0486c3c2be364852ff0782c7
26080d8ecb1f66c01ad9e4e005d0089597ffca89
3ede774af55474240856e56aa0124edd95628c47fa0584f8622b7abf6d9cbe69
POST /gsextendvalsha2g3r3 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: application/ocsp-response
Content-Length: 1444
Connection: keep-alive
Expires: Thu, 09 Feb 2023 00:18:21 GMT
ETag: "26080d8ecb1f66c01ad9e4e005d0089597ffca89"
Last-Modified: Sun, 05 Feb 2023 00:18:22 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 0
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 794819335a3eb511-OSL
www.cimbclicks.com.my/resource.web/clicks.login.banner/topupjer-hotlink.jpg
200 OK 68 kB URL HTTP/2 www.cimbclicks.com.my/resource.web/clicks.login.banner/topupjer-hotlink.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, progressive, precision 8, 1366x768, components 3\012- data
Hash 9ae5db8872c44383055671ab0adf247b
a14654a6b6b2d6e6efe5f692cd2a281983296d92
1b63d9bf7ceee5ba08db6195910adf5402547b63192b832ed66a4b087a5504cf
GET /resource.web/clicks.login.banner/topupjer-hotlink.jpg HTTP/1.1
Host: www.cimbclicks.com.my
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://119.29.2.14/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-oneagent-js-injection: true
last-modified: Tue, 07 Jun 2022 23:47:39 GMT
server-timing: dtSInfo;desc="0", dtRpid;desc="-1997838636"
content-type: image/jpeg
content-language: en-US
content-length: 68393
date: Sun, 05 Feb 2023 02:08:29 GMT
X-Firefox-Spdy: h2
www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=83992649&utmhn=119.29.2.14&utmcs=UTF-8&utmsr=1280x1024&utmvp=1280x939&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=CIMB%20Clicks&utmhid=608692353&utmr=-&utmp=%2F&utmht=1675562947811&utmac=UA-34667158-1&utmcc=__utma%3D53369704.600391987.1675562948.1675562948.1675562948.1%3B%2B__utmz%3D53369704.1675562948.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1783951436&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
302 Found 368 B URL HTTP/1.1 www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=83992649&utmhn=119.29.2.14&utmcs=UTF-8&utmsr=1280x1024&utmvp=1280x939&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=CIMB%20Clicks&utmhid=608692353&utmr=-&utmp=%2F&utmht=1675562947811&utmac=UA-34667158-1&utmcc=__utma%3D53369704.600391987.1675562948.1675562948.1675562948.1%3B%2B__utmz%3D53369704.1675562948.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1783951436&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Hash dcb2caba06a5ac1444511314af313b48
ed5843bac777e7aa19dbd39c9e0cbd72aac5a626
27841d2fdd6921eda31ad1d80d75b2f7c8dc9a836cce5fff17cc82245d9bc9cd
GET /r/__utm.gif?utmwv=5.7.2&utms=1&utmn=83992649&utmhn=119.29.2.14&utmcs=UTF-8&utmsr=1280x1024&utmvp=1280x939&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=CIMB%20Clicks&utmhid=608692353&utmr=-&utmp=%2F&utmht=1675562947811&utmac=UA-34667158-1&utmcc=__utma%3D53369704.600391987.1675562948.1675562948.1675562948.1%3B%2B__utmz%3D53369704.1675562948.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1783951436&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 302 Found
Location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649
Access-Control-Allow-Origin: *
Date: Sun, 05 Feb 2023 02:08:29 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
Cross-Origin-Resource-Policy: cross-origin
Content-Type: text/html; charset=UTF-8
Server: Golfe2
Content-Length: 368
119.29.2.14/favicon.ico
404 Not Found 146 B IP
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert openphish CIMB Bank Berhad
quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: 119.29.2.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://119.29.2.14/
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 05 Feb 2023 02:08:29 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
www.cimbclicks.com.my/resource.web/clicks.login.banner/d4durian-may22-2.jpg
200 OK 54 kB URL HTTP/2 www.cimbclicks.com.my/resource.web/clicks.login.banner/d4durian-may22-2.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, progressive, precision 8, 1366x768, components 3\012- data
Hash 17f279fd42679a4fc5859aeb82829bae
940aee685f2c9de51534790d34bbdb8f2e8f14fe
79a51914844e8f1f223a27334780af90bdfeddcf4cefa05b081a60861ca54ea2
GET /resource.web/clicks.login.banner/d4durian-may22-2.jpg HTTP/1.1
Host: www.cimbclicks.com.my
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://119.29.2.14/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-oneagent-js-injection: true
last-modified: Tue, 07 Jun 2022 23:47:39 GMT
content-length: 54378
server-timing: dtSInfo;desc="0", dtRpid;desc="1619767960"
content-type: image/jpeg
content-language: en-US
date: Sun, 05 Feb 2023 02:08:29 GMT
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 5ac5aaa2dd1a2ab697244f3c0fe3b5b5
bb8a9aeb28cc645435760f3a9a57d85e295de419
d42327bb295e41a2b04efa1c2ad6094a3480d0010de10bb32600f4d17fe9f0d4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 02:08:29 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649
302 Found 366 B URL HTTP/2 stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Hash 38067ed41d9b64d428d7acf299d3e597
6c63b308021936cebefa66704429c229c583e014
021814260f8983789d253329080307ae4fea390afe15728d6d1971bd97897cd9
GET /r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://119.29.2.14/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
location: https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649
access-control-allow-origin: *
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 05 Feb 2023 02:08:29 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: Golfe2
content-length: 366
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash a78b06ca527ce7542b24b349e0485d8b
6f5e5126c1c9d40c9ba09d58e1755d2ca39d02ab
bc7dc156ab8b2b33422fff0922e219246eb1d12469d10ac8007416fed41ac473
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 02:08:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 5ac5aaa2dd1a2ab697244f3c0fe3b5b5
bb8a9aeb28cc645435760f3a9a57d85e295de419
d42327bb295e41a2b04efa1c2ad6094a3480d0010de10bb32600f4d17fe9f0d4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 02:08:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649
302 Found 0 B URL HTTP/2 www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://119.29.2.14/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 05 Feb 2023 02:08:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
location: https://www.google.no/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649&slf_rd=1&random=2848559009
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash c7d887fc3e3b7a68b7872c76802085c0
eb26f820776e7d87a00489eb14f918e5f6945835
915e873e95d8f0276f4763e5596b03cac487f6f8a36c65577c6622fc8560d929
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 02:08:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 8077210062c315b98902cb06c74d485b
808e94ac31f1b45185103ce25c1bc2afd056b17a
78871f45de0c58bffa6a86b50f6bd0db61932bf6a2b7d8191dba0f0eaab628b1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 02:08:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.no/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649&slf_rd=1&random=2848559009
200 OK 42 B URL HTTP/2 www.google.no/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649&slf_rd=1&random=2848559009
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34667158-1&cid=600391987.1675562948&jid=1783951436&_v=5.7.2&z=83992649&slf_rd=1&random=2848559009 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://119.29.2.14/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 05 Feb 2023 02:08:30 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 8077210062c315b98902cb06c74d485b
808e94ac31f1b45185103ce25c1bc2afd056b17a
78871f45de0c58bffa6a86b50f6bd0db61932bf6a2b7d8191dba0f0eaab628b1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 05 Feb 2023 02:08:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
119.29.2.14
142.250.74.163
23.36.77.32
104.18.21.226