Report - lmpronta-dlgltal-xyl-org.preview-domain.com/

Report Overview

Submitted URL
lmpronta-dlgltal-xyl-org.preview-domain.com/
IP
104.18.20.112
ASN
#13335 CLOUDFLARENET
Submitted
2023-02-27 10:58:19
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.1 kB	93.184.220.29
challenges.cloudflare.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	801 B	68 kB	104.18.7.185
lmpronta-dlgltal-xyl-org.preview-domain.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.1 kB	174 kB	104.18.20.112
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.0 kB	8.0 kB	23.36.77.32
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.88.113.219
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	64 kB	34.120.237.76
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.9 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-27 11:00:04	medium	Client IP	Internal IP	ET INFO Observed DNS Query to Commonly Abused Preview Domain (preview-domain .com)
2023-02-27 11:00:04	medium	Client IP	Internal IP	ET INFO Observed DNS Query to Commonly Abused Preview Domain (preview-domain .com)

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-27	medium	lmpronta-dlgltal-xyl-org.preview-domain.com/	Phishing
2023-02-27	medium	lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7a0067541b8ab4ff	Phishing
2023-02-27	medium	lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7a0067541b8ab4ff	Phishing
2023-02-27	medium	lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/img/7a0067541b8ab4ff/1677495489347/nxA-yiPbt40YDTe	Phishing
2023-02-27	medium	lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.29039619976047004:1677493445:Vv7qPZTlX5xfUNLOJkpxvv5NJbkn1i5m40k5hXUvJBw/7a0067541b8ab4ff/51aae3eae5a8e07	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7a0067541b8ab4ff	121 kB	2023-03-14	2023-03-14
Pretty URL lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7a0067541b8ab4ff IP 104.18.20.112 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-14 13:11:38 Last Seen2023-03-14 13:11:38 Times Seen1 Hash 9f5cc2ae682a0c2707743f45b983f9fe 283fe38fc6318acaaaff86d641bc242ac72f9817 98e881c2b6f9898a744b3037c6f29f37531454a39a3aad862cde51747f8f8e58 Loading...

	challenges.cloudflare.com/turnstile/v0/api.js?onload=_cf_chl_turnstile_l&render=explicit	14 kB	2023-03-14	2023-03-14
Pretty URL challenges.cloudflare.com/turnstile/v0/api.js?onload=_cf_chl_turnstile_l&render=explicit IP 104.18.7.185 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-14 01:09:57 Last Seen2023-03-14 19:43:48 Times Seen1 Hash c1cb67ffef4ea0a2678e25d0ca242415 a27dd8843015fa04b85c998a107fcce3af79cb3b 88552553af10ffa83f22bb8e02c1b88809c85181ce2e45d5827f479eec1e4be1 Loading...

	lmpronta-dlgltal-xyl-org.preview-domain.com/	3.3 kB	2023-03-14	2023-03-14
Pretty URL lmpronta-dlgltal-xyl-org.preview-domain.com/ IP 104.18.20.112 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-14 13:11:38 Last Seen2023-03-14 13:11:38 Times Seen1 Hash 8b432bf9bf6cd9a822cb93c66d78e580 443361a7024888635344db8746b7210be87bc509 65b7678252559f20136442830041379997eda6f76c355942f79f9598dd27dc28 Loading...

		Size	First Seen	Last Seen
	#1 Eval - 53e902ba2af585b2dc5b03583b8180a4	521 B	2023-03-14	2023-03-14
Pretty Observations First Seen2023-03-14 13:11:38 Last Seen2023-03-14 13:11:38 Times Seen1 Hash 53e902ba2af585b2dc5b03583b8180a4 728ce5040a40db4944a8f878c0b522c768256a5a cf0c0033ef0cb8a1635093c285178b36ad89710d981f3a1d4394fe8a7cc5f3e7 Loading...

	#2 Eval - 70efa725f660990cc6701727e98c360b	769 kB	2023-03-07	2023-07-11
Pretty Observations First Seen2023-03-07 01:07:04 Last Seen2023-07-11 03:19:46 Times Seen6035 Hash 70efa725f660990cc6701727e98c360b 04f4df4180629c6a1a8648630310794bfdb39eb8 cb2789441eb37a5d5520d68b778e5e1a0743c6d105076aa2e3be07147e0dc752 Loading...

	#3 Eval - 7f0ab37754ee4521a28ba0b6a964d076	7 B	2023-03-14	2023-03-14
Pretty Observations First Seen2023-03-14 13:11:38 Last Seen2023-03-14 13:11:38 Times Seen1 Hash 7f0ab37754ee4521a28ba0b6a964d076 6bd796acdcb9a1aba2f00559eae8a186f6945097 83fbff1684c6ebc98f0f372051edde918fec94f1ddcc3b9099955eaed3efd68c Loading...

HTTP Transactions (31)

URL IP Response Size

lmpronta-dlgltal-xyl-org.preview-domain.com/

104.18.20.112

403 Forbidden

3.7 kB

URL HTTP/1.1
lmpronta-dlgltal-xyl-org.preview-domain.com/
IP
104.18.20.112:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1327)
Size
3.7 kB (3731 bytes)
Hash
56bdd89e4a24410ce4a5b425122aefdb
e7ad3ab4d8d95c04e2b9c1549b90b20e49eb4394
9d55b33b34f3398d5ece01f3b565564e9ffae9fc615f30b142451b7b40d7b770

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET / HTTP/1.1
Host: lmpronta-dlgltal-xyl-org.preview-domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 403 Forbidden
Date: Mon, 27 Feb 2023 10:58:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Set-Cookie: __cf_bm=.HAzCEwawvyNwpt.2c2IzLXJCPVj6ba4zgDSEsgkeLg-1677495488-0-Af/m2/ypJ+eqiXc9wNsWHQdijkGiF4iEd/Xz84CN1Gt68s0RR8Vg9fHBmx9MB0WI721zXhl4zYjLdongroo8494=; path=/; expires=Mon, 27-Feb-23 11:28:08 GMT; domain=.preview-domain.com; HttpOnly; SameSite=None
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7a0067541b8ab4ff-OSL
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
666c7f3c3342b2fdca31a2355ee20bea
09bd5cbacba34412f5fff9d44f97e46c8c76d001
cb3a380fc71bc65dfde35069f0fc441400974afcf28c0fbb6fec8f41e16f70c8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CB3A380FC71BC65DFDE35069F0FC441400974AFCF28C0FBB6FEC8F41E16F70C8"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2308
Expires: Mon, 27 Feb 2023 11:36:36 GMT
Date: Mon, 27 Feb 2023 10:58:08 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
bc3cacbc6c565bf2955b507302b8fb41
7b773e19aff1d4904cec328c456513e80f917ba4
b45c582b42efef5e8bd5744333a137f13e94a93cafbaace39b36cfa1eeb041bd

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B45C582B42EFEF5E8BD5744333A137F13E94A93CAFBAACE39B36CFA1EEB041BD"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13690
Expires: Mon, 27 Feb 2023 14:46:18 GMT
Date: Mon, 27 Feb 2023 10:58:08 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
29cfccb9238759ed21dbb0d92cae75f8
f41ad1b02e353cd2b33af7618c71cc16fae2886e
91e392e78e584e8a82762dab0d5615aa1af3893237d601db3d45bb6fad488580

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "91E392E78E584E8A82762DAB0D5615AA1AF3893237D601DB3D45BB6FAD488580"
Last-Modified: Sat, 25 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5726
Expires: Mon, 27 Feb 2023 12:33:34 GMT
Date: Mon, 27 Feb 2023 10:58:08 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
4ad6984a756720fbfff47b37a75513a2
355e35258114452af8b9638985ed9d8ef3bf0aca
43181fccb10652c68cae86e5e32b4e8f426fb5ad49d8125cb99e072cff573cf5

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 27 Feb 2023 10:07:56 GMT
content-type: application/json
age: 3012
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
b5ba6334e73496995e3e3a9ecd0eb323
ad80d3b7718c28364e8c2004fb38a13a1747e462
aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: SSsZNI1LElDVFqwIxXJn6vba/fKo2nfR2K9J14BypfJQERBBfNeWpL5ILTdH9D8My5G1XtHVuCw=
x-amz-request-id: HB9CEK5VB4MAYN1H
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 27 Feb 2023 10:14:05 GMT
age: 2643
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/styles/challenges.css

104.18.20.112

200 OK

2.6 kB

URL HTTP/1.1
lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/styles/challenges.css
IP
104.18.20.112:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (6190), with no line terminators
Size
2.6 kB (2585 bytes)
Hash
0cfcef358de34ee519bc7aee694f3963
ee32fa87d15414efca97a881c99a2172d728ea77
1b82a0dbaae19093a91691e510ea2606a8476ed60a5f3a63794dcbc1fc0d2789

HTTP Headers

GET /cdn-cgi/styles/challenges.css HTTP/1.1
Host: lmpronta-dlgltal-xyl-org.preview-domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lmpronta-dlgltal-xyl-org.preview-domain.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 10:58:08 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 22 Feb 2023 10:50:41 GMT
ETag: W/"63f5f381-182e"
Server: cloudflare
CF-RAY: 7a0067561afe0b69-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Mon, 27 Feb 2023 12:58:08 GMT
Cache-Control: max-age=7200, public
Content-Encoding: gzip

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Mon, 27 Feb 2023 10:58:08 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7a0067541b8ab4ff

104.18.20.112

200 OK

42 B

URL HTTP/1.1
lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7a0067541b8ab4ff
IP
104.18.20.112:0
ASN
#13335 CLOUDFLARENET

File type
GIF image data, version 89a, 1 x 1\012- data
Size
42 B (42 bytes)
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7a0067541b8ab4ff HTTP/1.1
Host: lmpronta-dlgltal-xyl-org.preview-domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lmpronta-dlgltal-xyl-org.preview-domain.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 10:58:09 GMT
Content-Type: image/gif
Content-Length: 42
Connection: keep-alive
Last-Modified: Wed, 22 Feb 2023 10:50:41 GMT
ETag: "63f5f381-2a"
Server: cloudflare
CF-RAY: 7a006756bba60b69-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Mon, 27 Feb 2023 12:58:09 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes

lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7a0067541b8ab4ff

104.18.20.112

200 OK

42 kB

URL HTTP/1.1
lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7a0067541b8ab4ff
IP
104.18.20.112:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65536), with no line terminators
Size
42 kB (42381 bytes)
Hash
92e9c6b067a3caf0b2560246b34c3caf
70b378ef8dcde08eb9f2828518a042b4118e5473
b6849ad72a3a360fce38b8e5478a9ee9335c7086eadca07e3096b95fa860b447

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7a0067541b8ab4ff HTTP/1.1
Host: lmpronta-dlgltal-xyl-org.preview-domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lmpronta-dlgltal-xyl-org.preview-domain.com/?__cf_chl_rt_tk=DqEm6ljIEjReHFN.l9FqW7ECp1DwMVECMhrwx2k.Ir4-1677495488-0-gaNycGzNBPs
Connection: keep-alive

HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 10:58:09 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: max-age=0, must-revalidate
Set-Cookie: __cf_bm=z.3q1wr4B28qbvgG1TiwVly.3nSY3gCteOLBKlQpws4-1677495489-0-AYMLr6VuTXVxSdYCJ5W1358nK7HJD05HkWar4BC+1qah1rmrS75D3Ay5/wuj2Y7EK7phvxeWBJF9XMJjFWmBb90=; path=/; expires=Mon, 27-Feb-23 11:28:09 GMT; domain=.preview-domain.com; HttpOnly; SameSite=None
Server: cloudflare
CF-RAY: 7a006756bb3efabc-OSL
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

lmpronta-dlgltal-xyl-org.preview-domain.com/favicon.ico

104.18.20.112

404 Not Found

112 kB

URL HTTP/1.1
lmpronta-dlgltal-xyl-org.preview-domain.com/favicon.ico
IP
104.18.20.112:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
112 kB (112020 bytes)
Hash
1246a4c0de0e63a91a7c67c7f0754c0f
9c94f867598ae414a0501cab20b2ab2a9d1ba0e8
6f22416355437eb207b67e15d1de4155e7f605d299fd1f598fd6c9408a7070bc

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: lmpronta-dlgltal-xyl-org.preview-domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lmpronta-dlgltal-xyl-org.preview-domain.com/
Connection: keep-alive

HTTP/1.1 404 Not Found
Date: Mon, 27 Feb 2023 10:58:09 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: MISS
Expires: Mon, 27 Feb 2023 14:58:09 GMT
Cache-Control: public, max-age=14400
Set-Cookie: __cf_bm=BEY5NkDvp6mwby6tR2a.Wa9RCaF0jqu8I5q782yfvPQ-1677495489-0-AcdydALTrfVnh2jdiV8kDECUfH6US5Eh4WZKyxQyAW208kcluSmdCCmQka57CLrk4dbOG5tpZnMyUM8L92K2OiU=; path=/; expires=Mon, 27-Feb-23 11:28:09 GMT; domain=.preview-domain.com; HttpOnly; SameSite=None
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7a0067562cd4b524-OSL
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
b82a426adcc16bf1c2ec13033970430c
54979f14f791dfab5ef4b2bfae53c8db3d3e9874
943a6aaef88d965fd1d65fd524d1488d7a5faac3282abb769b0047e5bf9200bd

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1187
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 10:58:09 GMT
Last-Modified: Mon, 27 Feb 2023 10:38:22 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 280

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
b82a426adcc16bf1c2ec13033970430c
54979f14f791dfab5ef4b2bfae53c8db3d3e9874
943a6aaef88d965fd1d65fd524d1488d7a5faac3282abb769b0047e5bf9200bd

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1187
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 10:58:09 GMT
Last-Modified: Mon, 27 Feb 2023 10:38:22 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 280

challenges.cloudflare.com/turnstile/v0/api.js?onload=_cf_chl_turnstile_l&render=explicit

104.18.7.185

302 Found

67 kB

URL HTTP/2
challenges.cloudflare.com/turnstile/v0/api.js?onload=_cf_chl_turnstile_l&render=explicit
IP
104.18.7.185:0
ASN
#13335 CLOUDFLARENET

File type
gzip compressed data, from Unix\012- data
Size
67 kB (66832 bytes)
Hash
43bb1392611b4c0c12e36efe8311a573
26aac7471f9683c4196a10a0cdc221f052f3a386
a3b89d2c1cdf29e500d97b8dc5d8b5ae16f0f1372e71ee553b77237cc889445a

HTTP Headers

GET /turnstile/v0/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 302 Found
date: Mon, 27 Feb 2023 10:58:09 GMT
vary: accept-encoding
location: /turnstile/v0/g/6756a6af/api.js?onload=_cf_chl_turnstile_l&render=explicit
cache-control: max-age=300, public
server: cloudflare
cf-ray: 7a0067580a2d0b61-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Cache-Control, Backoff, Pragma, Expires, Last-Modified, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 27 Feb 2023 10:03:35 GMT
age: 3274
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b1d73c7d1e3e594a7be10b7ac62176ac
46105f3b581c409f00524674825c08343e4d71d1
7b31674705946d30e1822ddca8008520258d81a32cb11fadeded012dac2b0d13

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7B31674705946D30E1822DDCA8008520258D81A32CB11FADEDED012DAC2B0D13"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5525
Expires: Mon, 27 Feb 2023 12:30:14 GMT
Date: Mon, 27 Feb 2023 10:58:09 GMT
Connection: keep-alive

lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/img/7a0067541b8ab4ff/1677495489347/nxA-yiPbt40YDTe

104.18.20.112

200 OK

61 B

URL HTTP/1.1
lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/img/7a0067541b8ab4ff/1677495489347/nxA-yiPbt40YDTe
IP
104.18.20.112:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 37 x 56, 8-bit/color RGB, non-interlaced\012- data
Size
61 B (61 bytes)
Hash
31b377044e94137eb2d3bbb27083668e
de54a9ee7ed5a7681d493eab29f987bfbe8f731d
6d36742c4f6cc2b181549b59a840f78d27060713dd43a8cd8a149b4ad8d148ec

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/img/7a0067541b8ab4ff/1677495489347/nxA-yiPbt40YDTe HTTP/1.1
Host: lmpronta-dlgltal-xyl-org.preview-domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lmpronta-dlgltal-xyl-org.preview-domain.com/
Connection: keep-alive

HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 10:58:10 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cf_bm=xPYBnSVMhHt8abvJDbYtzsyn4tt6ZdOXgMBqMurZA4E-1677495490-0-AT6KRejSdLGFdt8yxxjXDa9yuKXoBcAYcO/SVN60sZSM1QfH3/jtw0sN6MfOtIyM/8sMI6SLHQoW6VH9JOd1D1o=; path=/; expires=Mon, 27-Feb-23 11:28:10 GMT; domain=.preview-domain.com; HttpOnly; SameSite=None
Server: cloudflare
CF-RAY: 7a00675d0870fabc-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

push.services.mozilla.com/

52.88.113.219

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.88.113.219:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: wgnHIXU39Wem6LJCnR/BiQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 0NNo0HrxKgmhfLaF/Z65iB69aS8=

lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.29039619976047004:1677493445:Vv7qPZTlX5xfUNLOJkpxvv5NJbkn1i5m40k5hXUvJBw/7a0067541b8ab4ff/51aae3eae5a8e07

104.18.20.112

200 OK

8.7 kB

URL HTTP/1.1
lmpronta-dlgltal-xyl-org.preview-domain.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.29039619976047004:1677493445:Vv7qPZTlX5xfUNLOJkpxvv5NJbkn1i5m40k5hXUvJBw/7a0067541b8ab4ff/51aae3eae5a8e07
IP
104.18.20.112:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (11520), with no line terminators
Size
8.7 kB (8654 bytes)
Hash
6d691f723928994ee7eb9873afee9995
d4aceb83a18eda6d5c64eefb5f6533213d2c554a
8389ed19e6f0c139e6a2ee82ba71f936a7cbf06b2d3b2850ca2fb957f7c36acb

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/flow/ov1/0.29039619976047004:1677493445:Vv7qPZTlX5xfUNLOJkpxvv5NJbkn1i5m40k5hXUvJBw/7a0067541b8ab4ff/51aae3eae5a8e07 HTTP/1.1
Host: lmpronta-dlgltal-xyl-org.preview-domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lmpronta-dlgltal-xyl-org.preview-domain.com/
Content-type: application/x-www-form-urlencoded
CF-Challenge: 51aae3eae5a8e07
Content-Length: 17026
Origin: http://lmpronta-dlgltal-xyl-org.preview-domain.com
Connection: keep-alive

HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 10:58:10 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf_chl_gen: gZbUzVxYu8rHonCCaxxSBs+4AUDOKuczS5TI6g3Xoe8=$BGYdthOpdP1lPeLLWzADIw==
Set-Cookie: __cf_bm=SWGst17nZ92gBrWJ4qb7yYMLHWIDz470ZGb3BaZOgeA-1677495490-0-ARVUp/OuCS4iDSAr7jnca5dLfs+9QJRxj4MxexBLfwkof9k+BpFayEwXZX//lL923IChMh/HK372lZnI6k0cmII=; path=/; expires=Mon, 27-Feb-23 11:28:10 GMT; domain=.preview-domain.com; HttpOnly; SameSite=None
Server: cloudflare
CF-RAY: 7a006760eb53fabc-OSL
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c930829bdcc2bf23ff3014e5dd21f270
7e175882efd19d1649537da3c2c2e70833558d87
c18c9de6b0d5d2d78d1869d8138a00ef62cbd29a77e7cc2c69d30ad54799dda7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C18C9DE6B0D5D2D78D1869D8138A00EF62CBD29A77E7CC2C69D30AD54799DDA7"
Last-Modified: Sat, 25 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4714
Expires: Mon, 27 Feb 2023 12:16:45 GMT
Date: Mon, 27 Feb 2023 10:58:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c930829bdcc2bf23ff3014e5dd21f270
7e175882efd19d1649537da3c2c2e70833558d87
c18c9de6b0d5d2d78d1869d8138a00ef62cbd29a77e7cc2c69d30ad54799dda7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C18C9DE6B0D5D2D78D1869D8138A00EF62CBD29A77E7CC2C69D30AD54799DDA7"
Last-Modified: Sat, 25 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4714
Expires: Mon, 27 Feb 2023 12:16:45 GMT
Date: Mon, 27 Feb 2023 10:58:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c930829bdcc2bf23ff3014e5dd21f270
7e175882efd19d1649537da3c2c2e70833558d87
c18c9de6b0d5d2d78d1869d8138a00ef62cbd29a77e7cc2c69d30ad54799dda7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C18C9DE6B0D5D2D78D1869D8138A00EF62CBD29A77E7CC2C69D30AD54799DDA7"
Last-Modified: Sat, 25 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2152
Expires: Mon, 27 Feb 2023 11:34:03 GMT
Date: Mon, 27 Feb 2023 10:58:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c930829bdcc2bf23ff3014e5dd21f270
7e175882efd19d1649537da3c2c2e70833558d87
c18c9de6b0d5d2d78d1869d8138a00ef62cbd29a77e7cc2c69d30ad54799dda7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C18C9DE6B0D5D2D78D1869D8138A00EF62CBD29A77E7CC2C69D30AD54799DDA7"
Last-Modified: Sat, 25 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4714
Expires: Mon, 27 Feb 2023 12:16:45 GMT
Date: Mon, 27 Feb 2023 10:58:11 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c930829bdcc2bf23ff3014e5dd21f270
7e175882efd19d1649537da3c2c2e70833558d87
c18c9de6b0d5d2d78d1869d8138a00ef62cbd29a77e7cc2c69d30ad54799dda7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C18C9DE6B0D5D2D78D1869D8138A00EF62CBD29A77E7CC2C69D30AD54799DDA7"
Last-Modified: Sat, 25 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2152
Expires: Mon, 27 Feb 2023 11:34:03 GMT
Date: Mon, 27 Feb 2023 10:58:11 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb97e8f2e-6da0-4f8b-b12c-1af676e3e4da.jpeg

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb97e8f2e-6da0-4f8b-b12c-1af676e3e4da.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9093 bytes)
Hash
2a5f3d376fe6a3a78a5d1fe136f962fb
3e9b03cc296e954d63526a4e7e75beea3130fc3b
c8cf4f1c0352102764247e4dc5a2076921e0eaa18bfd110e5b0b97a55c706690

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb97e8f2e-6da0-4f8b-b12c-1af676e3e4da.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9093
x-amzn-requestid: 3fd9f8c8-cf10-4222-a2cc-5f18ff7b2e9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Az9D3HqmoAMFeBQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63f7dbb2-352315613cc0c2bc7eb28e05;Sampled=0
x-amzn-remapped-date: Thu, 23 Feb 2023 21:33:38 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Mn6TjisRzQNNHhkTMjHjsiOQosH9A5TZVtJypfHstcjuAG-DLUbIag==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:35:04 GMT
age: 48187
etag: "3e9b03cc296e954d63526a4e7e75beea3130fc3b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc20aa394-e9e1-42e1-bfe2-87bf5f21211a.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10875 bytes)
Hash
acdc95cb094faaa1bc8de6466e534d82
3e66ae8d704653a3a3b60423256bd99175e75fe7
153bf472aa6f75d30c321bb77014bb7126113cf7529af9f91327592887d34ead

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc20aa394-e9e1-42e1-bfe2-87bf5f21211a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10875
x-amzn-requestid: e1a6aa11-ddea-4ace-a51d-2274d999bf9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A91zIEfnIAMFi8A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fbd013-1bbce6907a7bce643bb8cffa;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 21:33:07 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: rQl4jWhuZZ8wGcjff3KWhmQndShWZ-TEA_BBIAaVXdOGoVkrxYGeZg==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 f958a3846d80a3925f664b320dfad9c8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:48:47 GMT
age: 47364
etag: "3e66ae8d704653a3a3b60423256bd99175e75fe7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F295d4f58-a4e7-4e32-afa1-14ec57ea9f22.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.5 kB (5466 bytes)
Hash
c4189bdb07b68d555ae276dc38eef898
e582f368834c38e42ae59b9a25db3a9fd0a86a92
29c3c20c6317b8f20fdbcae04da908b3425a4f044ffc72cc64500e433737bd1f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F295d4f58-a4e7-4e32-afa1-14ec57ea9f22.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5466
x-amzn-requestid: 6a52f329-4469-4c76-80b1-03c0c15efdae
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A92u7GN9IAMFXBQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fbd192-051a694b1ca74ee6737500be;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 21:39:30 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: R5llhdWeb1i5ppkaj6afectOVAq9XtKWMsOqr3HG4jQjmwMpCQVDHg==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 0ec9ddba08fcd99386924593dbdbd44a.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:45:48 GMT
etag: "e582f368834c38e42ae59b9a25db3a9fd0a86a92"
content-type: image/jpeg
age: 47543
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd565b47e-328d-440f-9d25-5151d790fe1c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11944 bytes)
Hash
5d1587a3350180c0e38928d35b5f0302
a56127fae1153909442c1fd3ffe1f2b3f562baff
79afcd535b1633f7441aaac73fcfee0b87263f0833eabefdfa346d064601c388

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd565b47e-328d-440f-9d25-5151d790fe1c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11944
x-amzn-requestid: 40dc01d4-dfb2-41e5-ae81-22769045208c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A93C5E5ioAMF-Lw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fbd212-7149f553088afc7f63eb3ef4;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 21:41:38 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: IU5XfTtguAFSsE2kW1RbnFDhHGK3ZGJy-LlaHM9F3VJix5kK1LF1Hg==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 0ec9ddba08fcd99386924593dbdbd44a.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:45:48 GMT
etag: "a56127fae1153909442c1fd3ffe1f2b3f562baff"
content-type: image/jpeg
age: 47543
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F016462a1-fadc-4180-93f8-995cab0e1395.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.2 kB (8170 bytes)
Hash
32d08a3dc7c1e88313f487d74babdfe5
12f4693c36cb8980a5c740b735b7cf64542734e4
ae717a6760a0a6c179b950643eb3590c0ab5ec6cf159061246c6e8fc38a7ae89

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F016462a1-fadc-4180-93f8-995cab0e1395.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8170
x-amzn-requestid: bd3ecc5c-1efc-4589-8789-48693fbfa6d2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A6i2sGKkIAMFXtQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fa7e90-7acdeb5b05f8bcf726309125;Sampled=0
x-amzn-remapped-date: Sat, 25 Feb 2023 21:33:04 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: OIer9IgcIIbMg6EdrYFpojiEtN5oxPBijKFbX4UzURWTKha09i8NcQ==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 1d0860167e2100a6d1cd9c0213c2b8e8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:53:01 GMT
age: 47110
etag: "12f4693c36cb8980a5c740b735b7cf64542734e4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc367c3a-0a46-4c7d-b047-34e670da2517.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (12495 bytes)
Hash
e40c5020fb1bd03b9bb34c90d3f29a10
f153e3735f1e89b372b7957f4cd1095c341a8de9
689e9dcedf1c29eea7624c5ba9a962e427f290d5347600aa174d552485abe242

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc367c3a-0a46-4c7d-b047-34e670da2517.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12495
x-amzn-requestid: 5d94d2c2-9566-482c-a09c-f5efc00fb393
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A91yHF5TIAMF62g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fbd00d-507be9ea2a9f228b79a78892;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 21:33:01 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: IHdcawTtzO2qU1IykhEu-Fhiconn_oG4kmevy9_Lzzs0FlzQmk5iDw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 3bb2b699cd244bf37141ea08a6a61732.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:45:48 GMT
etag: "f153e3735f1e89b372b7957f4cd1095c341a8de9"
content-type: image/jpeg
age: 47543
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/g/6756a6af/api.js?onload=_cf_chl_turnstile_l&render=explicit

104.18.7.185

200 OK

0 B

URL HTTP/2
challenges.cloudflare.com/turnstile/v0/g/6756a6af/api.js?onload=_cf_chl_turnstile_l&render=explicit
IP
104.18.7.185:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /turnstile/v0/g/6756a6af/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Mon, 27 Feb 2023 10:58:09 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 7a0067584a720b61-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (31)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type