r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17871
Expires: Fri, 02 Dec 2022 13:51:58 GMT
Date: Fri, 02 Dec 2022 08:54:07 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 0c748388899e8a8d3680355da2ea5020
903c620cd137613daafb0da0508c37b2f4a67212
39eab80e022a9a1732872d9926b0ace80f818ec5c535e36a18b539ea63786fb2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4324
Cache-Control: max-age=96549
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 08:54:07 GMT
Etag: "63888270-1d7"
Expires: Sat, 03 Dec 2022 11:43:16 GMT
Last-Modified: Thu, 01 Dec 2022 10:31:12 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14784
Expires: Fri, 02 Dec 2022 13:00:31 GMT
Date: Fri, 02 Dec 2022 08:54:07 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 02 Dec 2022 08:19:54 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2053
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: +vfdhDeiwrdz9OsSjtejUoWQZM4Or2bxUhT8iV/vpXUOeVPdUgdXH8wAQ7YZX1fgrOGRRZUVA8H2jMyYSwtDGA==
x-amz-request-id: G9TPNSYFXFVRH5J8
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 02 Dec 2022 08:46:38 GMT
age: 449
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 08:54:07 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.instachaat.com/2/index.php?cep=xsmqyjdkQK7QRekucPVFgSAesXaeWCAxXsQhOWS6Kxd095Odjy2mYTQHniEwZOecpjjTMpqfVx6Svi4MaCSupQ84jWul8sQDsirD0Gu1bakMUVa0Zsx0ANHUn9bUoCpsZrSjPq-VXgqEf_WejJ_CVy3er3aJwvsFod3H4zTi5Z1LvS32n9bmaSRKGrb4Xvq_Mft2skhDk-eLdeVmvt7wDIonMVjtuFDBfiLGRru-chbW505C5ps6xBq6jbzGXgD4WdIf_qTD92f5Ra8kVEZTzUFtEwK4vrCBUqIGv2Mb0ulxugt1VCdHfZ6MpbUbf3fu4m1K69eX4ZUb0Q-_W4_P_HeDelB45QVhw1_6NXoF-beDWZUw0Z8jeFPiSCdTWrlQDrH5DP8efUvr7H9uje_Kc-Hpxt9w3uA4FpXOxsQ7gCM&lptoken=16c269f6974330dd342d
34.100.154.146301 Moved Permanently 886 B URL HTTP/1.1 www.instachaat.com/2/index.php?cep=xsmqyjdkQK7QRekucPVFgSAesXaeWCAxXsQhOWS6Kxd095Odjy2mYTQHniEwZOecpjjTMpqfVx6Svi4MaCSupQ84jWul8sQDsirD0Gu1bakMUVa0Zsx0ANHUn9bUoCpsZrSjPq-VXgqEf_WejJ_CVy3er3aJwvsFod3H4zTi5Z1LvS32n9bmaSRKGrb4Xvq_Mft2skhDk-eLdeVmvt7wDIonMVjtuFDBfiLGRru-chbW505C5ps6xBq6jbzGXgD4WdIf_qTD92f5Ra8kVEZTzUFtEwK4vrCBUqIGv2Mb0ulxugt1VCdHfZ6MpbUbf3fu4m1K69eX4ZUb0Q-_W4_P_HeDelB45QVhw1_6NXoF-beDWZUw0Z8jeFPiSCdTWrlQDrH5DP8efUvr7H9uje_Kc-Hpxt9w3uA4FpXOxsQ7gCM&lptoken=16c269f6974330dd342d
IP 34.100.154.146:0
ASN #396982 GOOGLE-CLOUD-PLATFORM
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (553)
Hash a9d935dad83d564d20927e2487bf8783
0a87adba6dccec7cec0ff81235df58e639495a57
40a3e33626b725ec09e5fb71f3e6c87c49b1a4803f5953c3b471782a6615eacb
GET /2/index.php?cep=xsmqyjdkQK7QRekucPVFgSAesXaeWCAxXsQhOWS6Kxd095Odjy2mYTQHniEwZOecpjjTMpqfVx6Svi4MaCSupQ84jWul8sQDsirD0Gu1bakMUVa0Zsx0ANHUn9bUoCpsZrSjPq-VXgqEf_WejJ_CVy3er3aJwvsFod3H4zTi5Z1LvS32n9bmaSRKGrb4Xvq_Mft2skhDk-eLdeVmvt7wDIonMVjtuFDBfiLGRru-chbW505C5ps6xBq6jbzGXgD4WdIf_qTD92f5Ra8kVEZTzUFtEwK4vrCBUqIGv2Mb0ulxugt1VCdHfZ6MpbUbf3fu4m1K69eX4ZUb0Q-_W4_P_HeDelB45QVhw1_6NXoF-beDWZUw0Z8jeFPiSCdTWrlQDrH5DP8efUvr7H9uje_Kc-Hpxt9w3uA4FpXOxsQ7gCM&lptoken=16c269f6974330dd342d HTTP/1.1
Host: www.instachaat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 02 Dec 2022 08:54:07 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 886
Connection: keep-alive
Location: https://www.instachaat.com/2/index.php?cep=xsmqyjdkQK7QRekucPVFgSAesXaeWCAxXsQhOWS6Kxd095Odjy2mYTQHniEwZOecpjjTMpqfVx6Svi4MaCSupQ84jWul8sQDsirD0Gu1bakMUVa0Zsx0ANHUn9bUoCpsZrSjPq-VXgqEf_WejJ_CVy3er3aJwvsFod3H4zTi5Z1LvS32n9bmaSRKGrb4Xvq_Mft2skhDk-eLdeVmvt7wDIonMVjtuFDBfiLGRru-chbW505C5ps6xBq6jbzGXgD4WdIf_qTD92f5Ra8kVEZTzUFtEwK4vrCBUqIGv2Mb0ulxugt1VCdHfZ6MpbUbf3fu4m1K69eX4ZUb0Q-_W4_P_HeDelB45QVhw1_6NXoF-beDWZUw0Z8jeFPiSCdTWrlQDrH5DP8efUvr7H9uje_Kc-Hpxt9w3uA4FpXOxsQ7gCM&lptoken=16c269f6974330dd342d
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
34.102.187.140200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, ETag, Alert, Expires, Cache-Control, Backoff, Content-Length, Content-Type, Pragma, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 02 Dec 2022 08:08:57 GMT
cache-control: public,max-age=3600
age: 2710
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 1f88399f3fdd89dbb9ca1229cb67143a
325c9dbfd932cf9a6fb9fab2dd8e27083f55a9a3
831ecd45dcd2d5ae2ae86cd63ea5e94ecd85281b7e51054af5df9a6386fb8d79
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4322
Cache-Control: max-age=91484
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 08:54:07 GMT
Etag: "63886ea9-1d7"
Expires: Sat, 03 Dec 2022 10:18:51 GMT
Last-Modified: Thu, 01 Dec 2022 09:06:49 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
52.43.61.95101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 52.43.61.95:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: MTFhzZRFuB4S1uCY6ZtqGA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 83KYvF8vw6anayeTvRrJhG0XJGA=
ocsp.r2m01.amazontrust.com/
54.230.80.227200 OK 471 B URL HTTP/1.1 ocsp.r2m01.amazontrust.com/
IP 54.230.80.227:0
Hash 752414d76752268cdb10c687ea063943
51bca0ce9af44743c109a0e52eafa572ef7aa3bf
6298273654aa78362335f836a56bdc5f692090fac3fd4a3b0b025a280e862b02
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: 'max-age=158059'
Date: Fri, 02 Dec 2022 08:54:08 GMT
Server: ECS (dcb/7EA7)
X-Cache: Miss from cloudfront
Via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: OpvPDFubyxbVMncv3cMqp0UUFF-6xs3lqDsopua72zAZQsRIGY5y6A==
ae.etisalatt.com/prizewheel/fonts/SuisseIntl-Regular.woff2
54.230.111.41200 OK 80 kB URL HTTP/2 ae.etisalatt.com/prizewheel/fonts/SuisseIntl-Regular.woff2
IP 54.230.111.41:0
File type Web Open Font Format (Version 2), TrueType, length 79768, version 1.0\012- data
Hash 0cb2891ce4f48dff7e5c080eda8183bc
21b194737d3729714edac200d045a7db779ede56
b07af22f80a5af0f4c1487766d15c7f93ef0943b0044e10220422f14512094db
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/fonts/SuisseIntl-Regular.woff2 HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 79768
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:40 GMT
etag: "0cb2891ce4f48dff7e5c080eda8183bc"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: w5iJMrXqiSicljJmXudscM8pu0slVrBRURIeyFpKR8F3oReIQtD6qw==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/fonts/SuisseIntl-SemiBold.woff2
54.230.111.41200 OK 52 kB URL HTTP/2 ae.etisalatt.com/prizewheel/fonts/SuisseIntl-SemiBold.woff2
IP 54.230.111.41:0
File type Web Open Font Format (Version 2), TrueType, length 52304, version 1.0\012- data
Hash 3ad99a5c100306be6c2ec31e047fcf1f
549718e3a8da70946c6b5b0bf7ee9817d7477327
2c8fbf5368e55ff0e5a02e4cf5bb9b827f9659af23485f8b064678f07f6ab7f6
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/fonts/SuisseIntl-SemiBold.woff2 HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 52304
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:40 GMT
etag: "3ad99a5c100306be6c2ec31e047fcf1f"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 1AERe_QriUCNYbcqxzf4jlS2vNRuJYtFCKIF1dlyOd95dla_wEnYZA==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/search.svg
54.230.111.41200 OK 368 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/search.svg
IP 54.230.111.41:0
File type SVG Scalable Vector Graphics image\012- , ASCII text
Hash 2d2cb719b2a957b1948e70a9444781a3
9ca28ea6c081a2339e2cf32ba1b03431d2b396a9
d0d99424026d78e5e5c9cf56ba72836e7d52faf2ea898e69f1b89ee98d24e103
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/search.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 368
last-modified: Thu, 17 Nov 2022 07:12:38 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 01 Dec 2022 13:52:51 GMT
etag: "2d2cb719b2a957b1948e70a9444781a3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: OAtJ8b1DOfWWdQTvXsfFbNTxdXVEiiAMZe2gcvibeEAZGwmU7Pi46Q==
age: 68478
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/uae.svg
54.230.111.41200 OK 325 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/uae.svg
IP 54.230.111.41:0
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with CRLF line terminators
Hash 8ae6708cbab0fe2eeddb8152d87e302c
4356a8be735e79a9b77261d53d0ebbd0ada77b2c
5e8518b8716de2fbd27c171d1626e100cff78483c33b50d4b91f37f2780f297a
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/uae.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 325
last-modified: Thu, 17 Nov 2022 07:12:39 GMT
accept-ranges: bytes
server: AmazonS3
date: Fri, 02 Dec 2022 07:57:05 GMT
etag: "8ae6708cbab0fe2eeddb8152d87e302c"
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: d5W9Sju5KADpaRXzSqAZApqLcLHYXgFpeQADxd_HRzkVKzbWKIUdKg==
age: 26257
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/prizewheel.webp
54.230.111.41200 OK 31 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/prizewheel.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash 4248a5c6c2063318cebff6fcd8d9a890
4b91d45199382e7faa8fd44c4aec09f455bf20f4
d46c09c521e1d4ff4aa70e3697b673ab7c746644bd58ccabf011cafa312d9a27
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/prizewheel.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 30582
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:37 GMT
etag: "4248a5c6c2063318cebff6fcd8d9a890"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: usVKXcNMetT9pLXkTnudJHYQcJiChOSTIAPueT3MYrJCvZ7vUsTabw==
age: 45232
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/iphone-13-pro.webp
54.230.111.41200 OK 14 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/iphone-13-pro.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash f38d9716425e68a47a2344619f9a8544
37cd461d83845e693f695cd41d54184e314ab2d2
213bbef0df4e8023d6cc1233ce04c873c7895ff7daa8835759717446ef2e674e
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/iphone-13-pro.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 14536
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:35 GMT
etag: "f38d9716425e68a47a2344619f9a8544"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: pmeG9EVX5I2dJN-zxtyia5nTxp_cveEWAn_ajgbeXoGssvsvU6juZw==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/amex-card.svg
54.230.111.41200 OK 728 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/amex-card.svg
IP 54.230.111.41:0
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (442)
Hash 1e98590c575d77cfe48fc31435d023f8
71eae56d1544692141c2915b7bfb22b2a216f428
95c4f695e62afe789334a5d7daf5787632c66d9383e98a587daa06f4a8126f48
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/amex-card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 728
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:34 GMT
etag: "1e98590c575d77cfe48fc31435d023f8"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 6M4yXpfG8e36Oa0VXcHQrChdBNFJvX38dIG1Ev_-arPRlakPVbnMMw==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/card.svg
54.230.111.41200 OK 394 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/card.svg
IP 54.230.111.41:0
File type SVG Scalable Vector Graphics image\012- , ASCII text
Hash 4e5e506bb14a57f7d811018693925919
d52fcc5757c13cc50828a95bc668d6048d8b753c
4a2b069397940679ab99f94c81bf8c6f321640a4eae150bf11ad8ffde21b7386
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
content-length: 394
date: Thu, 01 Dec 2022 20:20:16 GMT
last-modified: Thu, 17 Nov 2022 07:12:34 GMT
etag: "4e5e506bb14a57f7d811018693925919"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: q0dXUWQuJw7gY88o8mVCuFUfWFDV-1B0Pzbiy15KrLEX6zHo3LiMAw==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/master-card.svg
54.230.111.41200 OK 14 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/master-card.svg
IP 54.230.111.41:0
Hash 361de61cc284491c92ed75996ebb3b56
fecf2649476fc250df6c60edfada9acdf1d2dbbc
110e1047b4a9e146cc066e24df97c35efc46f7ea8febac2dec126f94d5b54ce6
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/master-card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
date: Fri, 02 Dec 2022 01:36:32 GMT
last-modified: Thu, 17 Nov 2022 07:12:37 GMT
etag: W/"383d03288df6951e039f2d64cb85b250"
server: AmazonS3
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: olZS_CORZlXacHZNTVtEBnUMUvHOLw8gLim07zPfLXERCBHSW2HTKw==
age: 26257
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16375
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 08:54:08 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16375
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 08:54:08 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16375
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 08:54:08 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16375
Expires: Fri, 02 Dec 2022 13:27:03 GMT
Date: Fri, 02 Dec 2022 08:54:08 GMT
Connection: keep-alive
ae.etisalatt.com/prizewheel/img/visa-card.svg
54.230.111.41200 OK 3.5 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/visa-card.svg
IP 54.230.111.41:0
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (813)
Hash 03353f8763231ff6e1ec3d63040076b6
e5da89780857b252b4d593cf31f7c60eaf2e8ac5
3bd5497ba9352eb1e5755bde2c9a89b04e7bfa983ddf2e7abd05fb1b21f7a110
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/visa-card.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Thu, 17 Nov 2022 07:12:39 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:24:53 GMT
etag: W/"cae299f35ae42f860950fe24b886acc4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: HrOCZlbSz6L0Gy4cMLQStgMzk_81qGr-ZozB0QqKrj15Ph0Fj7sv7A==
age: 52156
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F449f29d0-f60b-4dec-8b5b-0a1971bab406.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F449f29d0-f60b-4dec-8b5b-0a1971bab406.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4c7113338bc3310b13d23ca415c177e2
2cb4edc6b161c6d2d5b47aa498ae54e677966466
3a83adce869dd7eb064c583bf7ff93c57fabd7ea2da872f7d1f7d868b8a492e9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F449f29d0-f60b-4dec-8b5b-0a1971bab406.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10270
x-amzn-requestid: ac2d2825-2ec4-435e-9921-3ea6524df1dc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfG1nEvYoAMFliA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891e8a-4419423112b5723e3dba46ea;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:37:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: NQ21d2_5JO2Ym-LEnDecub9bK6wUyvM2zUf_XpfMGag83fVWlMjT8w==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:50:09 GMT
age: 39839
etag: "2cb4edc6b161c6d2d5b47aa498ae54e677966466"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg
34.120.237.76200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 498ab4412ed5cf977bc23e4e870894b0
23753fe8af09ec8ffa10eed4d201a71833885c99
036042656f15e42b4d1537c45f5b8e7190c70305fa9a69c1287c6739ad0b7122
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7334
x-amzn-requestid: a6b8b420-8394-496b-8be8-26dee52e3887
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoHJOoAMF75g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-0b38d07f518c8b3134457df2;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 17nFm7AQdmRYS_af-EJ4XBVw8l3YudcphlpcZMveuVjvjhhYdkAQsw==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:33:10 GMT
age: 37258
etag: "23753fe8af09ec8ffa10eed4d201a71833885c99"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/logo.svg
54.230.111.41200 OK 12 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/logo.svg
IP 54.230.111.41:0
File type SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash a9eff6c18121ce934d688aff65083dfc
e3a0b0d198f455768f7de29f6e4190e73da48d74
971fc4d9dbeb6e5d8491968143ff7f8067d9a217abab07eaf750271018d1af7a
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/logo.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Thu, 17 Nov 2022 07:12:36 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:24:53 GMT
etag: W/"adf96b2af4c33acd7e2f1baaaa4736aa"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: OXovIcnfIc6e1N53aetKm51sqpcdcRyXtBBsolLICzVG4hNpNdGVMg==
age: 52156
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F356e23df-cb76-452a-b299-da5410086837.png
34.120.237.76200 OK 16 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F356e23df-cb76-452a-b299-da5410086837.png
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 82ea44d6cb116fb1f5752ce9bb87e345
f799dfd89a4f5a452dc837b8616549f578fb4184
e9087e7fce332289d67d4d5646d0233c2f2d871cc88dc1c51d5ea1e9f2fb5abd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F356e23df-cb76-452a-b299-da5410086837.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 15495
x-amzn-requestid: 977cdbce-3a9c-4006-a5a1-5c4c82bd4a94
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfHDIFxzIAMFzEw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891ee0-4b2cb3a16ca745537a8caf8c;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:38:40 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nwKxQKsw8g5zCzfMFu_XpOac5rhImez29TKrycGJzozZyHTzoCHASw==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:20:06 GMT
age: 38042
etag: "f799dfd89a4f5a452dc837b8616549f578fb4184"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg
34.120.237.76200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b986f9fcbeca91ed5c8d58fbfaf47d19
6e6c8bd2bce144cc4da1cd7be375b046b60dca79
07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 00:54:54 GMT
age: 28754
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcca8556b-b044-489f-bc74-086aad62b062.webp
34.120.237.76200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcca8556b-b044-489f-bc74-086aad62b062.webp
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d147ccb10bda82b153a596c3c967cd6a
ffd0763f997e71a8c1458523fc17cafe8849dfdf
1cfeb90a4ba027195f903d938d4a0aac418a1c2f0b52215ec023263f15905971
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcca8556b-b044-489f-bc74-086aad62b062.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7591
x-amzn-requestid: e179862e-f840-4e50-a9dc-09f325479b9a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGgMFRZIAMFl7g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891e01-676a1571459f2d83488f2765;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:57 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: oB5K_ZCWWwCltMx8FQSjDdXRMzSTSyRLSYSLAooQXuCrUxadLUiWkA==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:08:56 GMT
etag: "ffd0763f997e71a8c1458523fc17cafe8849dfdf"
content-type: image/jpeg
age: 38712
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/001.webp
54.230.111.41200 OK 4.6 kB URL HTTP/2 ae.etisalatt.com/prizewheel/profile/001.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash cbcbae1c4221bae18207c5a4b1fb92c7
26a4c72e0c3423cf093102c44807a5bff2cec5e6
85f9561d0f2e0169aaf46364b76ed893be8836f003d18e3256686638f29238d0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/001.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 4636
last-modified: Thu, 17 Nov 2022 07:12:30 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 01 Dec 2022 16:37:23 GMT
etag: "cbcbae1c4221bae18207c5a4b1fb92c7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: JvXFooNzUU0yx0l2szvp4w6dvqsD3f6xDNuCs7Yjh_lwZoOlVcmKwQ==
age: 58607
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/002.webp
54.230.111.41200 OK 746 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/002.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash d408e6a5447573b7fe391e13bf90993b
943e29a7857d3e374c7bf833f538143698b4c9d6
e2b8564b25c3345c3f35b91d9b23f0b8634622cbb9a5aa6b11328ef94f157415
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/002.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 746
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:30 GMT
etag: "d408e6a5447573b7fe391e13bf90993b"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: DvpvH6rqjyktza3YTw2jRs7AaJ8hdBxstq0PnndCSOKZPjVFN_B94w==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/003.webp
54.230.111.41200 OK 1.6 kB URL HTTP/2 ae.etisalatt.com/prizewheel/profile/003.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash b3bc9451c2ec692eb1acd27af41217fd
84d8b211525c2d13c3942094f27fe170d332e49a
72b87e4a02658ddea2609db003787433dc4e25687abf66add082c60f2255de3c
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/003.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 1618
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:31 GMT
etag: "b3bc9451c2ec692eb1acd27af41217fd"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: baWKqeThawiZd6rhJicrudQNDJCc6Fuly3kxQaMuSMk7pIyZVA8V0g==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/004.webp
54.230.111.41200 OK 844 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/004.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 69d268d0aefc87f40a5dc7511996e4b3
2d6736aefa2c14a12f2cf3d11a453a5b4c73cc04
5bf6ed337a2677aabf8c18b9803a223f8355d3fc4f5502f30372e8213073b068
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/004.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 844
last-modified: Thu, 17 Nov 2022 07:12:31 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 01 Dec 2022 09:04:12 GMT
etag: "69d268d0aefc87f40a5dc7511996e4b3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: cbskBYbCZinVf0VgAGGE-qNp4pWKOVlANuAEt3bNA9AujYVr06mbeQ==
age: 85798
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/005.webp
54.230.111.41200 OK 550 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/005.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash eea3d6e3d24609790bbc352794acc8d1
7821649a541c7e9f19e00d905eccb679a5007a50
43429df5d87a8bacaef1c0403b1435f001d20959df564211a42dee11422b192d
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/005.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 550
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:32 GMT
etag: "eea3d6e3d24609790bbc352794acc8d1"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: qwbVrC7K3Tn3JdyV245YGhmZzoNCYKP8-WtP4JFcGwtQH03D3GF8zQ==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/proof.webp
54.230.111.41200 OK 107 kB URL HTTP/2 ae.etisalatt.com/prizewheel/img/proof.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 675x999, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Size 107 kB (106552 bytes)
Hash 7a41c57a5f20f59df0c86a456df03b73
3af18f77f0c86315713cd2813364df2955b53ce9
2a73f37536709b848382998dcb9f0d83412d4f6287e9d08cfb2a7fc3a849efb1
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/proof.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 106552
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:38 GMT
etag: "7a41c57a5f20f59df0c86a456df03b73"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: HLEtEvslT6jZv-8w-fa7bCx0gdJn7aDTcc6p1V7j5Md9U0FkttD9hg==
age: 45233
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/006.webp
54.230.111.41200 OK 4.2 kB URL HTTP/2 ae.etisalatt.com/prizewheel/profile/006.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image\012- data
Hash 69284801ce9f9b405a549996d5a1c430
f03477f2889ba5b4a7b4a208589926e3aa65e020
e987099e2192f064e85639dbe8d688cafc230b55ce69672d100b31fd3a37e093
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/006.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 4196
date: Fri, 02 Dec 2022 01:36:33 GMT
last-modified: Thu, 17 Nov 2022 07:12:32 GMT
etag: "69284801ce9f9b405a549996d5a1c430"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: iakDRsAI4eOiW8zdEkU5PTBzAhglXu0CyYyhHaOfVS5tHvvn5ILBWw==
age: 26257
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/007.webp
54.230.111.41200 OK 832 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/007.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 6f81c766e00137c85cf67b14980650e5
6f2bf6b5b23739baa3d857d3d215d4bdec9826c9
cd4bd93d59f8db1ee2d2be6a3ee251f6f3bfbd87370634f56913e9694bedceb7
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/007.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 832
last-modified: Thu, 17 Nov 2022 07:12:33 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 01 Dec 2022 17:22:00 GMT
etag: "6f81c766e00137c85cf67b14980650e5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 676Ds6-tceje--Ozh3eZ0OoZgQrOTjzuu41vO93y4zdIyp5H_m8j4g==
age: 55930
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/profile/008.webp
54.230.111.41200 OK 670 B URL HTTP/2 ae.etisalatt.com/prizewheel/profile/008.webp
IP 54.230.111.41:0
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash b9ef42055973840578c52f466cc7798e
fc46fcdfb9433f24432609297a3c26e704bba129
d9d9c952d9c4ed5d1c8b9a6de53451458d638c7612c5f9ac91cb0f526bc255d7
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/profile/008.webp HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/webp
content-length: 670
date: Thu, 01 Dec 2022 20:20:17 GMT
last-modified: Thu, 17 Nov 2022 07:12:33 GMT
etag: "b9ef42055973840578c52f466cc7798e"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 57EgfFvYM3cuk9nk_abu-IqZ91DEz9OkyGeATUzJfk_w0y-C8tNijA==
age: 45233
X-Firefox-Spdy: h2
ocsp.r2m01.amazontrust.com/
54.230.80.227200 OK 471 B URL HTTP/1.1 ocsp.r2m01.amazontrust.com/
IP 54.230.80.227:0
Hash 752414d76752268cdb10c687ea063943
51bca0ce9af44743c109a0e52eafa572ef7aa3bf
6298273654aa78362335f836a56bdc5f692090fac3fd4a3b0b025a280e862b02
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=142220
Date: Fri, 02 Dec 2022 08:54:08 GMT
Etag: "638945bc-1d7"
Expires: Sun, 04 Dec 2022 00:24:28 GMT
Last-Modified: Fri, 02 Dec 2022 00:24:28 GMT
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: kYcrKtEzSwnkrm-1fMK5IShxbvjaQIY3e2cs41s-dBnVz6oJlffoIg==
link.etisalatt.com/d/.js?lpref=&lpurl=https%3A%2F%2Fae.etisalatt.com%2Fprizewheel%2Findex.html%3Fcpid%3D9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82%26lpid%3D435ea389-2042-42b8-b48b-e6293e001196%23&lpt=Etisalat%20UAE&vtm=1669971247389
3.69.133.112200 OK 3.9 kB URL HTTP/2 link.etisalatt.com/d/.js?lpref=&lpurl=https%3A%2F%2Fae.etisalatt.com%2Fprizewheel%2Findex.html%3Fcpid%3D9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82%26lpid%3D435ea389-2042-42b8-b48b-e6293e001196%23&lpt=Etisalat%20UAE&vtm=1669971247389
IP 3.69.133.112:0
File type ASCII text, with very long lines (1887)
Hash 36760b6adedda12b3e4d9c559ddfc9e4
7fea171a20ac66cfd85177c70839761cc806301f
473fdf46085fd96ba274ed7f84e83254141078195ed92db4a661a70f36699c20
GET /d/.js?lpref=&lpurl=https%3A%2F%2Fae.etisalatt.com%2Fprizewheel%2Findex.html%3Fcpid%3D9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82%26lpid%3D435ea389-2042-42b8-b48b-e6293e001196%23&lpt=Etisalat%20UAE&vtm=1669971247389 HTTP/1.1
Host: link.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 08:54:09 GMT
content-type: application/javascript;charset=UTF-8
content-length: 3915
access-control-allow-origin: *
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: 9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82-v4=yEgerg2T2ZuVYkF62Ve8MSJ7p3mwOMTkoVxW2CQr_Mo; Max-Age=86400; Expires=Sat, 03-Dec-2022 08:54:09 GMT; Domain=link.etisalatt.com; Path=/; Secure; HttpOnly;SameSite=None
cep-v4=yiIyIGUCGIG3JB-qHJwDpr84_gp8GngqXjb13Jg5YUymCYrI8B8BJGo_QMrGES3HDETgh3RpL-tKGR92n8dX6i7NMsPiAtdwpvz7ifoAmiChIeLvPrb4i22cfzbFaI_P3Ie84nRlwRGBZJo137SSxLswJbcH4uD0HCMzzJJh4iOrGPRNNY6Lke2n72RqIKQuNo7LHP0zJiT-xz0ZREjJlSDt9Q6ohgWMKkr7EnA0YkWA0f7qBQ3D88oSP4Qpu7dj1AZo0-x3oo5qLLhTMLCG2yKkNEpcbznPtq3diiUYVbI4VqMySv28f4PvhGFTW5vpA0GfWrTqaFCxOrN-gjrx-2Y1omql0yaG6iTCURKEW9Qxd3XtrIF9kj-TjALeBP2X; Max-Age=86400; Expires=Sat, 03-Dec-2022 08:54:09 GMT; Domain=link.etisalatt.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2
push.m-android.com/js/pub.min.js
108.178.23.116200 OK 1.5 kB URL HTTP/2 push.m-android.com/js/pub.min.js
IP 108.178.23.116:0
File type ASCII text, with very long lines (2752)
Hash 31c303586c1b78e33984bd252b8e2644
8083e2aad4cbf8242a4e6fb53657d49552b85f82
d2c713c2734353dc0ef2896d057021e9b04f35bb7c851d920d390941769c66be
Analyzer Verdict Alert fortinet Malware
GET /js/pub.min.js HTTP/1.1
Host: push.m-android.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 08:54:09 GMT
content-type: application/javascript
content-length: 1482
last-modified: Fri, 09 Sep 2022 11:46:08 GMT
vary: Accept-Encoding
etag: "631b2780-5ca"
content-encoding: gzip
expires: Sat, 03 Dec 2022 08:54:09 GMT
cache-control: max-age=86400
strict-transport-security: max-age=31536000; includeSubdomains;
X-Firefox-Spdy: h2
push.m-android.com/sw.js
108.178.23.116200 OK 776 B IP 108.178.23.116:0
Hash f72a11763f13b05c1f2379d13387dd05
002fbf7672d3f4655b89b6413d160e4185ce9900
70d744bbd19a0cc35c8d9f1d8ba181c6cdc902f95799ac750da4adc3ad987b11
Analyzer Verdict Alert fortinet Malware
GET /sw.js HTTP/1.1
Host: push.m-android.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 08:54:09 GMT
content-type: application/javascript
content-length: 776
last-modified: Mon, 03 Oct 2022 07:40:54 GMT
vary: Accept-Encoding
etag: "633a9206-308"
content-encoding: gzip
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1250c1e7-37f4-4697-8233-d05f398cb066.jpeg
34.120.237.76200 OK 6.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1250c1e7-37f4-4697-8233-d05f398cb066.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f0fc684e61682c4078a82ee3d901ae52
ea65ad98933ec58afa3fa5c7642491d77db7e6c2
5e953012dba2b85cfda5befe2448ab87fbc2432a071e11a33b44be4f5148a4a4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1250c1e7-37f4-4697-8233-d05f398cb066.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 6752
x-amzn-requestid: f398ce98-353e-4783-aa42-dbf1ad036ab7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGepE6roAMF4zw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-0753d209291e197e7c6422a6;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: JZAFwGz7kAWplsA1qeraQTjirrZb29JTnUPii5BcPg5tzxcBLtt0WA==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:24:25 GMT
etag: "ea65ad98933ec58afa3fa5c7642491d77db7e6c2"
content-type: image/jpeg
age: 37790
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/script.js
54.230.111.41200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/script.js
IP 54.230.111.41:0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/script.js HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: application/javascript
last-modified: Thu, 17 Nov 2022 07:12:29 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:36:23 GMT
etag: W/"916dcb4886c7cd4afa6996f6dfb76cb3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 0BF3gf8N-0j7dYxTexbw9t2JwMxYmEWKaMd9HWP9oul_lDGfqB708A==
age: 51466
X-Firefox-Spdy: h2
www.instachaat.com/2/index.php?cep=xsmqyjdkQK7QRekucPVFgSAesXaeWCAxXsQhOWS6Kxd095Odjy2mYTQHniEwZOecpjjTMpqfVx6Svi4MaCSupQ84jWul8sQDsirD0Gu1bakMUVa0Zsx0ANHUn9bUoCpsZrSjPq-VXgqEf_WejJ_CVy3er3aJwvsFod3H4zTi5Z1LvS32n9bmaSRKGrb4Xvq_Mft2skhDk-eLdeVmvt7wDIonMVjtuFDBfiLGRru-chbW505C5ps6xBq6jbzGXgD4WdIf_qTD92f5Ra8kVEZTzUFtEwK4vrCBUqIGv2Mb0ulxugt1VCdHfZ6MpbUbf3fu4m1K69eX4ZUb0Q-_W4_P_HeDelB45QVhw1_6NXoF-beDWZUw0Z8jeFPiSCdTWrlQDrH5DP8efUvr7H9uje_Kc-Hpxt9w3uA4FpXOxsQ7gCM&lptoken=16c269f6974330dd342d
34.100.154.146302 Found 0 B URL HTTP/2 www.instachaat.com/2/index.php?cep=xsmqyjdkQK7QRekucPVFgSAesXaeWCAxXsQhOWS6Kxd095Odjy2mYTQHniEwZOecpjjTMpqfVx6Svi4MaCSupQ84jWul8sQDsirD0Gu1bakMUVa0Zsx0ANHUn9bUoCpsZrSjPq-VXgqEf_WejJ_CVy3er3aJwvsFod3H4zTi5Z1LvS32n9bmaSRKGrb4Xvq_Mft2skhDk-eLdeVmvt7wDIonMVjtuFDBfiLGRru-chbW505C5ps6xBq6jbzGXgD4WdIf_qTD92f5Ra8kVEZTzUFtEwK4vrCBUqIGv2Mb0ulxugt1VCdHfZ6MpbUbf3fu4m1K69eX4ZUb0Q-_W4_P_HeDelB45QVhw1_6NXoF-beDWZUw0Z8jeFPiSCdTWrlQDrH5DP8efUvr7H9uje_Kc-Hpxt9w3uA4FpXOxsQ7gCM&lptoken=16c269f6974330dd342d
IP 34.100.154.146:0
ASN #396982 GOOGLE-CLOUD-PLATFORM
GET /2/index.php?cep=xsmqyjdkQK7QRekucPVFgSAesXaeWCAxXsQhOWS6Kxd095Odjy2mYTQHniEwZOecpjjTMpqfVx6Svi4MaCSupQ84jWul8sQDsirD0Gu1bakMUVa0Zsx0ANHUn9bUoCpsZrSjPq-VXgqEf_WejJ_CVy3er3aJwvsFod3H4zTi5Z1LvS32n9bmaSRKGrb4Xvq_Mft2skhDk-eLdeVmvt7wDIonMVjtuFDBfiLGRru-chbW505C5ps6xBq6jbzGXgD4WdIf_qTD92f5Ra8kVEZTzUFtEwK4vrCBUqIGv2Mb0ulxugt1VCdHfZ6MpbUbf3fu4m1K69eX4ZUb0Q-_W4_P_HeDelB45QVhw1_6NXoF-beDWZUw0Z8jeFPiSCdTWrlQDrH5DP8efUvr7H9uje_Kc-Hpxt9w3uA4FpXOxsQ7gCM&lptoken=16c269f6974330dd342d HTTP/1.1
Host: www.instachaat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 302 Found
server: nginx
date: Fri, 02 Dec 2022 08:54:07 GMT
content-type: text/html; charset=UTF-8
location: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
54.230.111.41200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
IP 54.230.111.41:0
GET /prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196 HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
content-type: text/html
last-modified: Tue, 22 Nov 2022 14:44:58 GMT
server: AmazonS3
content-encoding: gzip
date: Fri, 02 Dec 2022 07:57:05 GMT
etag: W/"5737d3553d7e35e28fa0bbfdb24ecc16"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 9TDS2ULyK-E2ABb4SJst6MTUKr8vgpPVmeJbI1l5JM-lpMAxsIk6uw==
age: 52849
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/style.css
54.230.111.41200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/style.css
IP 54.230.111.41:0
GET /prizewheel/style.css HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: text/css
last-modified: Thu, 17 Nov 2022 07:12:30 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 16:37:22 GMT
etag: W/"b40373fb05795bc162f91d9d78aff281"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: xFf2Omf4EC5O61AIvT2PX-BQ6lc3TDPJCJNXKLINlviqplBaicfnYw==
age: 58607
X-Firefox-Spdy: h2
ae.etisalatt.com/prizewheel/img/cart.svg
54.230.111.41200 OK 0 B URL HTTP/2 ae.etisalatt.com/prizewheel/img/cart.svg
IP 54.230.111.41:0
Analyzer Verdict Alert fortinet Phishing
GET /prizewheel/img/cart.svg HTTP/1.1
Host: ae.etisalatt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ae.etisalatt.com/prizewheel/index.html?cpid=9191b8c3-9e1f-4ebf-b7a8-6d9be69a3a82&lpid=435ea389-2042-42b8-b48b-e6293e001196
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
last-modified: Thu, 17 Nov 2022 07:12:34 GMT
server: AmazonS3
content-encoding: br
date: Thu, 01 Dec 2022 18:36:25 GMT
etag: W/"ad8a3c2c7aa3989adac1b8c8958c328d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: GFNWe1Faz3rzWU8XfJymQru3VpwIyA36HjociVTwWpuQ3zCREMrivA==
age: 51464
X-Firefox-Spdy: h2