Overview

URLalawaelafrica.com/.ojnew/tmp/c3dhbHZpdXNAc2hlZXguY29t
IP 65.108.234.151 (Finland)
ASN#24940 Hetzner Online GmbH
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-26 14:15:16 UTC
StatusLoading report..
IDS alerts0
Blocklist alert5
urlquery alerts
2
Phishing - Microsoft Outlook
Tags phishing microsoft outlook

Domain Summary (3)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
0gpilhhtlb646b2a32a499c.ocupac.ru (6) 0 2023-05-26 16:11:37 2023-05-26 16:11:37 3052 89943 104.21.88.100
challenges.cloudflare.com (6) 0 2021-10-20 07:02:03 2023-05-26 08:33:42 3876 319304 104.18.7.185
alawaelafrica.com (1) 0 No data No data 509 376 65.108.234.151

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/Mswalvius@sheex.com Phishing
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/images/trace/managed/js/transpare (...) Phishing
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/orchestrat (...) Phishing
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/Mswalvius@sheex.com Phishing
2023-05-26 medium 0gpilhhtlb646b2a32a499c.ocupac.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/1 (...) Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 65.108.234.151
Date UQ / IDS / BL URL IP
2023-06-05 13:36:20 UTC 2 - 0 - 0 fananews.com/ghstmn/zcd0l7/YWJlcm1hbkBhbGxldm (...) 65.108.234.151
2023-06-05 06:53:08 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/YXZhbmJ1cmVuQHBv (...) 65.108.234.151
2023-06-02 20:52:38 UTC 2 - 0 - 0 fananews.com/ghstmn/lodywx/Ym1hbm5Aa2luZ2RvbW (...) 65.108.234.151
2023-05-30 15:22:40 UTC 2 - 0 - 1 fananews.com/ghstmn/xzrbpu/YXNldGhAZW5hYmxlY2 (...) 65.108.234.151
2023-05-29 17:21:38 UTC 2 - 0 - 0 fananews.com/ghstmn/wsbrnl/YXZpc2hhaS53b29sQG (...) 65.108.234.151


Last 5 reports on ASN: Hetzner Online GmbH
Date UQ / IDS / BL URL IP
2023-06-06 06:18:52 UTC 0 - 2 - 0 www.bizbuyorsellflorida.com/~hotelesm/start/s (...) 85.10.196.186
2023-06-06 06:04:54 UTC 0 - 6 - 0 hitmarket.com.ua/_exchange/opt/knewm%20ma/ide (...) 148.251.233.15
2023-06-06 06:03:51 UTC 0 - 0 - 2 apart-benidorm.es/nedsecur.stm/login.php?sess (...) 5.9.48.70
2023-06-06 06:03:37 UTC 0 - 5 - 0 hitmarket.com.ua/_exchange/opt/knewm%20ma/ide (...) 148.251.233.15
2023-06-06 05:41:01 UTC 0 - 0 - 1 incunabula.pavladev.gr/online/a1b2c3/3b234100 (...) 95.216.44.16


Last 5 reports on domain: alawaelafrica.com
Date UQ / IDS / BL URL IP
2023-06-05 06:53:08 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/YXZhbmJ1cmVuQHBv (...) 65.108.234.151
2023-05-26 17:35:24 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/Y3VydC5sYXduaWNr (...) 65.108.234.151
2023-05-26 16:08:20 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/Z2JhcnJldHRAZm1n (...) 65.108.234.151
2023-05-26 15:00:52 UTC 2 - 0 - 4 alawaelafrica.com/.ojnew/tmp/bGluZGFAbWVycmVs (...) 65.108.234.151
2023-05-26 14:15:16 UTC 2 - 0 - 5 alawaelafrica.com/.ojnew/tmp/c3dhbHZpdXNAc2hl (...) 65.108.234.151


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 06:05:59 UTC 0 - 0 - 0 swlwd.rinkle.ru/ 104.21.91.110
2023-06-06 05:57:39 UTC 0 - 4 - 0 agnes-nue.com/image/putty.exe 46.166.189.98
2023-06-06 04:23:26 UTC 0 - 1 - 0 yuen.de/UPS-Invoice-for-downloads-919/ 81.169.145.92
2023-06-06 04:22:55 UTC 0 - 1 - 2 212.83.186.136/setup-15.exe 212.83.186.136
2023-06-06 04:22:25 UTC 0 - 1 - 0 hansworst.xyz/Flappy%20Hans.exe 103.224.182.210

JavaScript

Executed Scripts (7)

Executed Evals (5)
#1 JavaScript::Eval (size: 13) - SHA256: 80b90237b40178e74c34d6652d95b3918d01b603ba83f9dce47ba6b19343c245
typeof module
#2 JavaScript::Eval (size: 15) - SHA256: db8d20f2dfaf9df3877967927de5ecb9648fecda131ab44bf854f8d72baa2b23
typeof pyimport
#3 JavaScript::Eval (size: 486) - SHA256: 3da9d2bb451fca7fd4aadb730d07ea805173e193500cda936f984602900a1e38
+((!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![] + []) + (!+[] + (!![]) - []) + (!+-[] + (+-!![]) + -[]) + (!+[] + (!![]) + (!![]) + !![]) + (-~~~[]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) - []) + (!+[] + (!![]) + (!![]))) / +((-~~~[] + []) + (!+[] + (!![]) + (!![]) + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![]) + (!+[] + (!![]) + (!![])) + (-~~~[]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) - []) + (!+-[] + (+-!![]) + -[]) + (!+[] + (!![]) + (!![]) + !![] + !![]))
#4 JavaScript::Eval (size: 2306) - SHA256: 31853ad30a56769a4e289454cfd56826bd26b51009986460d11aeee7f661c3f0
0,
function(OxmbZ2) {
    var u, d, e, f, g, h, i, j, k, l, m, n;
    if (u = b, function(o, p, t, q, r) {
            for (t = b, q = o(); !![];) try {
                if (r = -parseInt(t(476)) / 1 * (-parseInt(t(477)) / 2) + parseInt(t(508)) / 3 + parseInt(t(485)) / 4 * (parseInt(t(497)) / 5) + parseInt(t(490)) / 6 + parseInt(t(488)) / 7 * (-parseInt(t(478)) / 8) + parseInt(t(483)) / 9 + -parseInt(t(489)) / 10 * (parseInt(t(503)) / 11), r === p) break;
                else q.push(q.shift())
            } catch (s) {
                q.push(q.shift())
            }
        }(a, 887100), d = window[u(494)] || window[u(507)], e = window[u(480)] || window[u(484)], f = window[u(498)] || window[u(479)], g = typeof d !== u(496) && typeof e !== u(496) && typeof f !== u(496), !g) throw _cf_disableUiWithMessage(u(504)), new Error(u(499));
    h = atob(u(493)), i = new Function(u(481) + h)(), window[u(492)][window[u(492)][u(486)]].a1 = i()[u(491)](':'), j = u(487) + h + u(495), k = {}, k[u(482)] = u(506), l = new e([j], k), m = f[u(502)](l), n = new d(m), n[u(505)] = function(o, v) {
        v = u, window[v(492)][window[v(492)][v(486)]].a3 = o[v(500)].a3[v(491)](':'), OxmbZ2()
    }, n[u(501)]({}), window[u(492)][window[u(492)][u(486)]].a2 = i()[u(491)](':');

    function a(w) {
        return w = 'undefinedq5dIxjENqURLqWorkers not supportedqdataqpostMessageqcreateObjectURLq5302xPgXLfqoutdated_browserqonmessageqtext/javascriptqWebkitWorkerq3511407aJxLJjq1732867rIySecq2YGxbnxq8451784IemlhVqwebkitURLqBlobqreturn qtypeq13206933GupbbdqWebkitBlobq4183048aBFKDeqchCqonmessage = function(e) {var gsb = q7fwPxZLq97230usnyNKq7281144lkUItSqjoinq_cf_chl_ctxqZnVuY3Rpb24oKXsKICAgIHZhciBzaXplQSA9IDA7CiAgICB2YXIgc2l6ZUIgPSAwOwogICAgdmFyIGNvdW50ZXIgPSAwOwogICAgdHJ5IHsKICAgICAgICB2YXIgZm5fMSA9IGZ1bmN0aW9uICgpIHsKICAgICAgICAgICAgY291bnRlciArPSAxOwogICAgICAgICAgICBmbl8xKCk7CiAgICAgICAgfTsKICAgICAgICBmbl8xKCk7CiAgICB9CiAgICBjYXRjaCAoX2EpIHsKICAgICAgICBzaXplQSA9IGNvdW50ZXI7CiAgICAgICAgdHJ5IHsKICAgICAgICAgICAgY291bnRlciA9IDA7CiAgICAgICAgICAgIHZhciBmbl8yID0gZnVuY3Rpb24gKCkgewogICAgICAgICAgICAgICAgdmFyIGxvY2FsID0gMTsKICAgICAgICAgICAgICAgIGNvdW50ZXIgKz0gbG9jYWw7CiAgICAgICAgICAgICAgICBmbl8yKCk7CiAgICAgICAgICAgIH07CiAgICAgICAgICAgIGZuXzIoKTsKICAgICAgICB9CiAgICAgICAgY2F0Y2ggKF9iKSB7CiAgICAgICAgICAgIHNpemVCID0gY291bnRlcjsKICAgICAgICB9CiAgICB9CiAgICB2YXIgYnl0ZXMgPSAoc2l6ZUIgKiA4KSAvIChzaXplQSAtIHNpemVCKTsKICAgIHJldHVybiBbc2l6ZUEsIHNpemVCLCBieXRlc107Cn0=qWorkerq; postMessage({a3: gsb()})};'.split('q'), a = function() {
            return w
        }, a()
    }

    function b(c, d, e) {
        return e = a(), b = function(f, g, h) {
            return f = f - 476, h = e[f], h
        }, b(c, d)
    }
}
#5 JavaScript::Eval (size: 4) - SHA256: 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408
this

Executed Writes (1)
#1 JavaScript::Write (size: 3575) - SHA256: 36d48aeb87174dbf8b0ea333d2042d9e198797bd33c3f849597981eacd619515
< html > < head > < style > # pr1 {
    border: solid 2.715 px;border - color: green;padding: 3.98 px;margin - left: 12.12 px;
}
# pr2 {
    border: solid 2 px;border - color: purple;font - size: 30 px;margin - top: 200 px; - webkit - transform: skewY(23.1753218 deg); - moz - transform: skewY(23.1753218 deg); - ms - transform: skewY(23.1753218 deg); - o - transform: skewY(23.1753218 deg);transform: skewY(23.1753218 deg);
}
# pr3 {
    border: solid 2.89 px;border - color: orange;font - size: 45 px;transform: scale(100000000000000000000009999999999999.99, 1.89);margin - top: 50 px;
}
# pr4 {
    border: solid 2 px;border - color: silver;transform: matrix(1.11, 2.0001, -1.0001, 1.009, 150, 94.4); - webkit - transform: matrix(0.95559, 2.13329, -0.9842, 0.98423, 150, 95); - moz - transform: matrix(0.66371, 1.94587, -0.6987, 0.98423, 150, 103.238); - ms - transform: matrix(0.5478, 1.94587, -0.7383, 0.98423, 150, 100.569); - o - transform: matrix(0.4623, 1.83523, -0.6734, 0.81231, 150, 99.324);position: absolute;margin - top: 11.1331 px;margin - left: 12.1212 px;padding: 4.4545 px;left: 239.4141 px;top: 178.5050 px;
}
# pr5 {
    border: solid 2 pt;border - color: red;margin - left: 42.395 pt;
}
caption {
    border: solid 2 px;border - color: darkred;font - size: 20.99 px;margin - left: 20.8 px;
}
# pr6 {
    border: solid 2 px;border - color: darkblue; - webkit - transform: perspective(12890 px) translateZ(101.5 px); - moz - transform: perspective(12890 px) translateZ(101.5 px); - ms - transform: perspective(12890 px) translateZ(101.5 px); - o - transform: perspective(12890 px) translateZ(101.5 px);transform: perspective(12890 px) translateZ(101.5 px);padding: 12 px;
}
# pr7 {
    position: absolute;margin - top: -350.552 px;margin - left: 0.9099 rem;border: solid 2 px;border - color: burlywood;
}
# pr8 {
    position: absolute;margin - top: -150.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: sandybrown;
}
# pr9 {
    position: absolute;margin - top: -110.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: orchid;
}
# pr10 {
    position: absolute;margin - top: -315.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: turquoise;
} < /style></head > < body > < div id = "pr1" > Ssss tttt < /div>       <div id="pr2">TTTT tttt</div > < div id = "pr3" > WW & nbsp & nbsp; & nbsp; & nbsp; & nbsp; & nbsp;
ssss tttt < /div>       <div id="pr4">vvvv sssss ttttt tttt</div > < table id = "pr5" > < caption > ttttt cccc tttt < /caption>         <thead>         <tr>             <th>tttt hhhh</th > < /tr>         </thead > < tbody > < tr > < td > tttt bbbb < /td>         </tr > < /tbody>     </table > < div id = "pr6" > ttttt pppp tttt tttt < /div>     <div id="pr7">         <select>         <option>sss ooo</option > < /select>     </div > < div id = "pr8" > < details > < summary > dddd ssss < /summary>         </details > < /div>     <div id="pr9">         <progress value="49" max="100"></progress > < /div>     <div id="pr10">         <button type="button"></button > < /div>     <script>parent._cf_gcr();</script > < /body></html >


HTTP Transactions (13)


Request Response
                                        
                                            GET /.ojnew/tmp/c3dhbHZpdXNAc2hlZXguY29t HTTP/1.1 
Host: alawaelafrica.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             65.108.234.151
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:14:58 GMT
Server: Apache
Location: https://0gpilhhtlb646b2a32a499c.ocupac.ru/Mswalvius@sheex.com
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   106
Md5:    7a26c85f86f6707547c373b0e142fadf
Sha1:   f82a5a538e9bdd30b7db7c6cd0902e5b6efa7bc3
Sha256: 7fdbebd8a6e7617cef817f6af1b39d7cad80243cd7f3099fd1450f63d1cc8b26

urlquery:
  - Phishing - Microsoft Outlook
                                        
                                            GET /Mswalvius@sheex.com HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:14:59 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bE2RbtvmgQe2k4g4Z%2Fwq6isKlswLCggC54VcFH%2BzZaBgTYcQUSsE7DDlV2oEmKg9dyylB%2B3gPLq7uuitkEdLTxXLVp8NIP%2BmG1ghq9uaRcCKCg1qKzTEJuaVMdMv7neKM2%2BlhcwwEPSohLmr5enSm2ZfjmA%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6a0aaabbfb51b-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1747), with CRLF, LF line terminators
Size:   3591
Md5:    4cf46f514bd7d44542709764925fa8e3
Sha1:   dd174d22874e57e648eda57cee028aa44c644f7e
Sha256: 8d2b84cbb505858d527a8032cf7bc0105b1424e4bfea13c5e04d6ba882f2c858

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd6a0aaabbfb51b HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mswalvius@sheex.com
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Fri, 26 May 2023 14:14:59 GMT
Content-Length: 42
Connection: keep-alive
Last-Modified: Thu, 25 May 2023 08:39:03 GMT
ETag: "646f1ea7-2a"
Server: cloudflare
CF-RAY: 7cd6a0ac5c7ab518-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 26 May 2023 16:14:59 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd6a0aaabbfb51b HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mswalvius@sheex.com?__cf_chl_rt_tk=Jaht5GxO7ME0TnA7ekGtZTpmEMyq37Syg.2vLjXrN8U-1685110499-0-gaNycGzNBqU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:14:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: max-age=0, must-revalidate
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iqm%2FFBMo5SCDjObrMWbEncWuFuA8lvDKax%2FKH27%2B1af7P2t8%2FFQFnX3P5SPB1vVd0cwRFftlhN3%2FaiOlUND75wjSxxZDb6pla1q%2BCctxJtpO4pgXGu0xB%2FaC%2B5juLDY0BTVaFp2OAtk%2FU5%2BrXN%2BeVGEnSf4%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6a0ac5d5db4f7-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   54219
Md5:    99ad59dce087cfe5944e6dad7f292bd3
Sha1:   525bc93468186bfcfbe6cb98e52a3fb22794fb82
Sha256: 03e69932b129d6337f8e413af342403f771d8181bce02c9deebad2740e6fc299

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mswalvius@sheex.com?__cf_chl_rt_tk=Jaht5GxO7ME0TnA7ekGtZTpmEMyq37Syg.2vLjXrN8U-1685110499-0-gaNycGzNBqU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:14:59 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4wKlAS0nTjCoVeAQ7WqbK2C%2Bo%2FIlJIIdJAScYir%2Bi17iTMk8ujOmNZl689MoLWFbErv9Ok2u9BOj%2BFpvvPbndyLJp2yO%2BZTHglAYL06hCLQDGG1DowAbWJyHP1%2F52mYuILbZXstU%2FJlzBsw8a7nVxZLWEvs%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6a0ac9d97b4f7-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1833), with CRLF, LF line terminators
Size:   3654
Md5:    1104916bcdfe8014c3e78dc95aad4097
Sha1:   5291a125302ff3f23824147f68e21cf5143485a3
Sha256: 2c056bc9a2b909928ad06f0dd99c0deedb61a652ec9fa65fd76dff96b79f8217
                                        
                                            GET /Mswalvius@sheex.com HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.21.88.100
HTTP/2 403 Forbidden
content-type: text/html; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:14:58 GMT
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ajBusb%2F64csJXkAqnuViJZP0HRyyXNyu2KtQtf1Y%2Bi93ezA6ErV6PTMe1z1xVUSAp6sGVDPzki8BYHPJxsj8kFzDlfkfCzuacIs%2BhfnmxsoL4QAFP%2Bdj2ZAnzl%2B%2B3KDNxMVe7eHeVBj1zorQBvkXiuFxT4c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cd6a0a9a894b52d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3070), with CRLF, LF line terminators
Size:   15491
Md5:    6df6e8afce7790c89860cd48b7ceed10
Sha1:   098a35fe2a4d4bfd91c1a0bf731dbabb483d5f64
Sha256: f3b70f2b58bf4dc8a9ea35d95182401fadc563cf7dc9f4690246cb78ffe1955f

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/2sbwo/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.7.185
HTTP/3 200 OK
content-type: text/html; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:14:59 GMT
cache-control: max-age=0, must-revalidate
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 7cd6a0adde940b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (10899)
Size:   24085
Md5:    b55cf00036a4335edbd2e72bc67a0f78
Sha1:   0c0c53c68811283ac705ed5a949c9d1ee444e19d
Sha256: 1ad55fe6d9f25f4c2ad920ae79d45f6cae07d32a948dfb68f621ba02f9c6aa95
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/526707036:1685106511:5jP3fuVrMidGou1AOfDGTqHrdCWogY2EWgUj3mz-mGY/7cd6a0adde940b49/55838370366a627 HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/2sbwo/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 55838370366a627
Content-Length: 17875
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.7.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:15:02 GMT
cf-chl-gen: LUluXZAf5tJcH/PiFu4Z1eJU4F6lvY4XtR16VUc0Yx/zqed5vMuGLITGLJ60Lq+e$OSd3B4VgUr5XAaNR7A7g9Q==
server: cloudflare
cf-ray: 7cd6a0c37f790b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (13228), with no line terminators
Size:   13228
Md5:    74961955740f7a3136a58b798818011e
Sha1:   34d9aadcf10bcac034b08058198383d200140704
Sha256: 0e8b0f206054318ceb8114c48ef8ba7449599fc13e2e41ebadde1852457f3e05
                                        
                                            GET /turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.7.185
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:14:59 GMT
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cd6a0ad0c120afe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2



--- Additional Info ---
Magic:  ASCII text, with very long lines (15748)
Size:   15749
Md5:    2a1262ba5cd32899831d483322a28dd7
Sha1:   3805876db8773ed5820043e1f39b0b6c049f61b2
Sha256: 2e1e45b1d429b2d703676139932fe97b7ffc7986e6d0221653a7404e4c3032f0
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1148440378:1685106551:aHcZGWKCGjcxfqiMGZpv3fnc6IdAlNwlftHeamYnC08/7cd6a0aaabbfb51b/f914138245b4f36 HTTP/1.1 
Host: 0gpilhhtlb646b2a32a499c.ocupac.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://0gpilhhtlb646b2a32a499c.ocupac.ru/Mswalvius@sheex.com
Content-type: application/x-www-form-urlencoded
CF-Challenge: f914138245b4f36
Content-Length: 1803
Origin: http://0gpilhhtlb646b2a32a499c.ocupac.ru
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.21.88.100
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:14:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: cUtl3S5rA9wNRx4fo6BuVhZ5/RFO1UU9C0WepAn/fuf/zZcM6pwYYi0kYOuFLuwO$TGOGySuOS1dYrZldEQCw4g==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gAnuMyC20t0uU9s1IJXh9nH1xJjMAocA2ZKx488n0yJokV6esbCV0%2F6tt7sEa2F4HrJVd61mKch5EMIXFI0q9Q5EgrIbZrRNFziB8LJbdo1e2ngkS8ihrR7lCiP19wP7KjuQeG%2FzGQs9qr6S%2Fy4TWeIHkYo%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6a0ad8e12b518-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60



--- Additional Info ---
Magic:  ASCII text, with very long lines (7400), with no line terminators
Size:   7400
Md5:    45aac9bb517a83e2586cbd606cb71471
Sha1:   dcb3af087bdc94482273902a794158caa619fb76
Sha256: 7844b7c0bdf60daf58367db5ba32ef52c7619a2b5c9073fca4aba295c85222b9

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd6a0adde940b49 HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/2sbwo/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.7.185
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:14:59 GMT
cache-control: max-age=0, must-revalidate
server: cloudflare
cf-ray: 7cd6a0ae7f410b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   157788
Md5:    4462e16d820a446d580f2198f78f477b
Sha1:   2f5d4db276542541674316d4983537a58d0dba1d
Sha256: 6299b78bd663d1a084bbcc9a6f60426933b1cc791758967c80095cf949a904de
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/img/7cd6a0adde940b49/1685110499859/mW8YC5Otl1zD6wG HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/2sbwo/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.7.185
HTTP/3 200 OK
content-type: image/png
                                            
date: Fri, 26 May 2023 14:15:02 GMT
server: cloudflare
cf-ray: 7cd6a0c25e320b49-OSL
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  PNG image data, 11 x 78, 8-bit/color RGB, non-interlaced\012- data
Size:   61
Md5:    86fec8a33aeee8b58b32e17394106d0f
Sha1:   3c0ace5aefc5cf4fadf9cffbb05d77dbc53599fa
Sha256: 641531b9fe11a12f6056532c2332543ace11d0fcbb58bdcb5d451cdf09620c3c
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/526707036:1685106511:5jP3fuVrMidGou1AOfDGTqHrdCWogY2EWgUj3mz-mGY/7cd6a0adde940b49/55838370366a627 HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/2sbwo/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 55838370366a627
Content-Length: 2763
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.7.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:14:59 GMT
cf-chl-gen: kOZjvPTzdjGj5W60Q8eI9VBJVj0N70LjDt41coUqBm8OXZDKiP5yUnCeZc4j5cJdvkPeyXEXpRIpVsEgh7kOMnj/ZuE8ahpnkfEcjDceFhTK2hkgCAzSpg4wAvhtcmCVk+k8d7FI2pT0wxXFXDp2y9xD4p8+MbHk6Po+D15qn9+HtMeIYuXswcN7U8S7C9ZMzqPSLX8AG+K7uZFhjf/GvqGId66mpMuYwWt6wT5eso0kdR/uzxiG2lUdw7Kboz0sO3AXJmH0VM2CEFLIgsMvO06MIrNZ76TgWx7GWcELBc7ZSnzF9jeOEW1zoeCFAJRXwW+7HO3dwMjNE3youFYYJsJ6TLDeTlUjWtgZP+DsOb3XjgM7nRSPnKoLmxQMrow/faP9ii4L5PoxRqY1Pm5D21hkn+C2cH6khuInj1Fc9851zPg7h6JWLfBEZuMczBR3$RcqMSxNRRVekVIO70OZ/zg==
server: cloudflare
cf-ray: 7cd6a0aff90f0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   105880
Md5:    704e87ac842f6b68b4122eab8dac8cd8
Sha1:   b4327e553f77a82d9238231f3f9e2e00ce756ee3
Sha256: e197b3214588bc228a293f8da132761e8067ceb8d33606880a95af9c1faedad1