Overview

URLdenizbanklogin-com.net/
IP 172.105.111.160 (Canada)
ASN#63949 Linode, LLC
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-11-26 11:14:17 UTC
StatusLoading report..
IDS alerts0
Blocklist alert13
urlquery alerts
17
Phishing - Deniz Bank
Phishing - Deniz Bank
Tags None

Domain Summary (8)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
r3.o.lencr.org (7) 344 No data No data 23.36.77.32
ocsp.digicert.com (2) 86 No data No data 93.184.220.29
firefox.settings.services.mozilla.com (2) 867 No data No data 34.102.187.140
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
contile.services.mozilla.com (1) 1114 No data No data 34.117.237.239
push.services.mozilla.com (1) 2140 No data No data 52.89.20.60
img-getpocket.cdn.mozilla.net (6) 1631 No data No data 34.120.237.76
denizbanklogin-com.net (19) 0 No data No data 172.105.111.160 Unknown ranking

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-11-26 2 denizbanklogin-com.net/ Phishing
2022-11-26 2 denizbanklogin-com.net/assets/img/login-footer-logo.svg Phishing
2022-11-26 2 denizbanklogin-com.net/assets/js/scripts.4be75bac532d103e7057.js Phishing
2022-11-26 2 denizbanklogin-com.net/assets/img/logo-light.svg Phishing
2022-11-26 2 denizbanklogin-com.net/assets/img/world.svg Phishing
2022-11-26 2 denizbanklogin-com.net/assets/font/opensans-regular-webfont.a66a53e7f788b1a (...) Phishing
2022-11-26 2 denizbanklogin-com.net/assets/font/opensans-semibold-webfont.1045337df148fc (...) Phishing
2022-11-26 2 denizbanklogin-com.net/assets/font/opensans-bold-webfont.7b013a311083176809 (...) Phishing
2022-11-26 2 denizbanklogin-com.net/assets/font/icomoon.6ed1082a54a66252e299.woff2?cujylf Phishing
2022-11-26 2 denizbanklogin-com.net/veri.php?ip=91.90.42.154 Phishing
2022-11-26 2 denizbanklogin-com.net/veri.php?ip=91.90.42.154 Phishing
2022-11-26 2 denizbanklogin-com.net/veri.php?ip=91.90.42.154 Phishing
2022-11-26 2 denizbanklogin-com.net/veri.php?ip=91.90.42.154 Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 172.105.111.160
Date UQ / IDS / BL URL IP
2023-01-07 14:22:32 +0000 0 - 0 - 11 denizbankonlinemobile-com.net/ 172.105.111.160
2022-12-31 01:30:18 +0000 0 - 0 - 3 bjmxhlk.net/ 172.105.111.160
2022-12-06 14:14:32 +0000 0 - 0 - 4 bjmzxjqll.net/ 172.105.111.160
2022-12-06 11:27:53 +0000 0 - 0 - 4 bjmzxjqll.net/ 172.105.111.160
2022-12-04 11:36:45 +0000 31 - 0 - 30 denizbankgirisimonline-com.net/ 172.105.111.160


Last 5 reports on ASN: Linode, LLC
Date UQ / IDS / BL URL IP
2023-02-03 18:55:23 +0000 0 - 0 - 2 collegerreadyplan.com/ 198.58.118.167
2023-02-03 18:26:17 +0000 0 - 2 - 1 absipdate.us-east-1.linodeobjects.com/absupda (...) 45.79.137.127
2023-02-03 18:18:30 +0000 0 - 4 - 0 lp.ivrika.ru/kurs-glagoli-ivrita-4_0/ 172.105.82.254
2023-02-03 17:52:07 +0000 0 - 2 - 1 absipdate.us-east-1.linodeobjects.com/absupda (...) 45.79.137.127
2023-02-03 17:31:23 +0000 0 - 1 - 0 errors.nodedomax.com/utility.gif?report=fdata (...) 45.33.18.44


Last 3 reports on domain: denizbanklogin-com.net
Date UQ / IDS / BL URL IP
2022-11-26 17:45:05 +0000 16 - 0 - 32 denizbanklogin-com.net/ 172.105.111.160
2022-11-26 12:05:20 +0000 16 - 0 - 12 denizbanklogin-com.net/ 172.105.111.160
2022-11-26 11:14:17 +0000 17 - 0 - 13 denizbanklogin-com.net/ 172.105.111.160


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2022-12-04 11:36:45 +0000 31 - 0 - 30 denizbankgirisimonline-com.net/ 172.105.111.160
2022-12-04 10:44:20 +0000 27 - 0 - 24 giris-denizmobil-com-tr.ml/ 20.224.56.236
2022-12-03 00:56:54 +0000 28 - 0 - 11 acikfirsatgunuburada.com/ 164.92.92.182
2022-12-02 16:26:35 +0000 32 - 0 - 24 denizbankonlinebankam-com.net/ 172.105.111.160
2022-12-02 16:15:20 +0000 32 - 0 - 24 denizbnkamonlineisjemler-com.net/ 172.105.111.160

JavaScript

Executed Scripts (4)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (39)


Request Response
                                        
                                            GET / HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 6826
content-encoding: gzip
vary: Accept-Encoding,User-Agent
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (381), with CRLF line terminators
Size:   6826
Md5:    a31e1d1f8b6f38b7794a444cbb020ffd
Sha1:   b8f079046e90fd790bb9a78da554122314edcfc3
Sha256: 3157d30d7deeaee968940868c4fe7afc969729e7ed8953d66c6c27d8dffe4faf

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "164D11173045B569CAFB32E300E4C1EC6D6AB177FD34D0414CC40C541268779F"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4676
Expires: Sat, 26 Nov 2022 12:32:02 GMT
Date: Sat, 26 Nov 2022 11:14:06 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4089
Cache-Control: 'max-age=158059'
Date: Sat, 26 Nov 2022 11:14:06 GMT
Last-Modified: Sat, 26 Nov 2022 10:05:57 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 26 Nov 2022 10:19:13 GMT
cache-control: public,max-age=3600
age: 3293
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    d130218d0e2841f39c99610fe1a2ab90
Sha1:   29fbe1e177ee55c7a61ae0a206afff271cf5f945
Sha256: 6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C9951A909F354174F0075A01C01C3C3AA6960983040E328BFBBBEA81AEB405C2"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7340
Expires: Sat, 26 Nov 2022 13:16:26 GMT
Date: Sat, 26 Nov 2022 11:14:06 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: 0KAIzA50mV8YVfSNCGM2/wS7Z0A4c3acJw7NY5QORemFo/F354+yZdceHuxtbSSc7VfFSTYXkr8=
x-amz-request-id: GFEKS0WWB111AK84
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 26 Nov 2022 10:41:10 GMT
age: 1976
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Sat, 26 Nov 2022 11:14:06 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /assets/css/styles.0fca6d11334e40b52585.css HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: text/css
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:25:28 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-length: 114373
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed


--- Additional Info ---
Magic:  ASCII text, with very long lines (678), with CRLF line terminators
Size:   114373
Md5:    5ef392c44843554f903eeb3da8b2b43b
Sha1:   43fba479957e3e5d9a469a585accae87b3aecf2e
Sha256: 24a1dc253fae8427ac59afa93da3d84d67a5a6721905aa5b7e0c4a2617a40280

Alerts:
  urlquery:
    - Phishing - Deniz Bank
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 26 Nov 2022 11:08:54 GMT
cache-control: public,max-age=3600
age: 312
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /assets/img/login-footer-logo.svg HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/svg+xml
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:12:52 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-length: 1178
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1863), with CRLF line terminators
Size:   1178
Md5:    7374bb584c51f152fa6c5cfc2a8f6052
Sha1:   0c3e21a743d035582343f2301509058e8b771c5d
Sha256: 28de3bf31be49d55d2000de18121c69bfefa41465633fa6e9d90517957ff3a85

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /assets/js/scripts.4be75bac532d103e7057.js HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: application/javascript
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Tue, 01 Nov 2022 09:31:22 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-length: 343315
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65448)
Size:   343315
Md5:    97a0b88152065f3a1082c91e3d241fd9
Sha1:   30dc03dcebb5fd2c1d0514f5c52b8b3cbf221f39
Sha256: 5d7a23f26ce6539b387a25acc217db19c43676c94d052cd0ce8200665f53e452

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /assets/img/enbd.png HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/png
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:12:48 GMT
accept-ranges: bytes
content-length: 3806
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  PNG image data, 186 x 72, 8-bit/color RGBA, non-interlaced\012- data
Size:   3806
Md5:    58cf11a4b5f8ebdc29ec2e7b787c8d69
Sha1:   cd2686b1f04cfa4afb69b228fd7177d65e907d32
Sha256: 1b74331ad061c583ad54561f95596a8481b95d863a431fc4daf3a9ee7d151975

Alerts:
  urlquery:
    - Phishing - Deniz Bank
                                        
                                            GET /assets/img/logo-light.svg HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/svg+xml
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:16:46 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-length: 8889
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1718), with CRLF line terminators
Size:   8889
Md5:    c50f1a1ac884061d0233dc0830eeb333
Sha1:   0a7c10606e47bbd82052a06c0593d59e2d499f16
Sha256: b735b682d389d57f440f92d49b93fae3954bedecfef58aabe7961fbccd37eab2

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /assets/img/qrPhoto.jpg HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/jpeg
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:12:58 GMT
accept-ranges: bytes
content-length: 11916
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 160x160, components 3\012- data
Size:   11916
Md5:    ef3712705a4047857e4f67b895d75bf1
Sha1:   d4bd05acd8bfb7d4a44dc9c36267ff799414cf23
Sha256: cf33092752054c7e93201ebd484c7e47a194635120a46cc3786b4107195edf1e

Alerts:
  urlquery:
    - Phishing - Deniz Bank
                                        
                                            GET /assets/img/world.svg HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/svg+xml
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:15:48 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-length: 697
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1206), with CRLF line terminators
Size:   697
Md5:    6aa75cfb5b8dbdee39b8a8784f9d52c6
Sha1:   9edd7412fe1025004b53b192c1b7e7308e66570f
Sha256: cd4206d2de6320faf5c6ce3ec401f65d1c207ac0976078dc09e28a31357b82a8

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /assets/font/opensans-regular-webfont.a66a53e7f788b1ab7e41.woff2 HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://denizbanklogin-com.net/assets/css/styles.0fca6d11334e40b52585.css

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: font/woff2
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:23:16 GMT
accept-ranges: bytes
content-length: 12552
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 12552, version 1.0\012- data
Size:   12552
Md5:    a66a53e7f788b1ab7e41429e94d5fecf
Sha1:   818f0d5a1110b0ae7c58104a51cde30f088fac84
Sha256: be3979aa66ab98b74f4c323b1c194cba444de65913e489d5786e0c7fd8f310c0

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5475
Cache-Control: max-age=170639
Date: Sat, 26 Nov 2022 11:14:07 GMT
Etag: "6381d72b-1d7"
Expires: Mon, 28 Nov 2022 10:38:06 GMT
Last-Modified: Sat, 26 Nov 2022 09:06:51 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /assets/font/opensans-semibold-webfont.1045337df148fc781940.woff2 HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://denizbanklogin-com.net/assets/css/styles.0fca6d11334e40b52585.css

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: font/woff2
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:23:50 GMT
accept-ranges: bytes
content-length: 12676
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 12676, version 1.0\012- data
Size:   12676
Md5:    1045337df148fc781940fc87f29361ba
Sha1:   0a68e64e217353efae512771a88ad6b0449db886
Sha256: a085c2f1e7df8cdded779fa68b0ce2e0d31d3352ed8d8238cb540f35fa20cf0d

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /assets/font/opensans-bold-webfont.7b013a3110831768093f.woff2 HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://denizbanklogin-com.net/assets/css/styles.0fca6d11334e40b52585.css

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: font/woff2
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:07 GMT
last-modified: Sun, 30 Oct 2022 04:23:56 GMT
accept-ranges: bytes
content-length: 12776
date: Sat, 26 Nov 2022 11:14:07 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 12776, version 1.0\012- data
Size:   12776
Md5:    7b013a3110831768093ffa40218ef434
Sha1:   e32cf89ddb775dff039fa59c84fbd6f5d350ceac
Sha256: b582e5e36135cfe697ec9cfbb06ff7407a7d89a9e4a1287cfdd905cc3f9669e5

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /assets/img/loading.gif HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/gif
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:06 GMT
last-modified: Sun, 30 Oct 2022 04:16:30 GMT
accept-ranges: bytes
content-length: 37840
date: Sat, 26 Nov 2022 11:14:06 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  GIF image data, version 89a, 96 x 96\012- data
Size:   37840
Md5:    a5ac552d6a23421d7697f897729a2def
Sha1:   836cb1e7a61967b762898a3ce32e64ca7713119c
Sha256: 4d54a976b6fa75c73ec219bf5ca96537d46c387c138842fe3d76be0d9e111e0a

Alerts:
  urlquery:
    - Phishing - Deniz Bank
                                        
                                            GET /assets/font/icomoon.6ed1082a54a66252e299.woff2?cujylf HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://denizbanklogin-com.net/assets/css/styles.0fca6d11334e40b52585.css

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: font/woff2
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:07 GMT
last-modified: Sun, 30 Oct 2022 04:25:38 GMT
accept-ranges: bytes
content-length: 45832
date: Sat, 26 Nov 2022 11:14:07 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 45832, version 1.0\012- data
Size:   45832
Md5:    6ed1082a54a66252e299dca90845546b
Sha1:   ce49c739245d09ce02845d0a9ea8885db7eaba85
Sha256: 3b8441a0eea69959d7a96ae3f548dcac1a7f8646facfffda3f5dc71c6a4d3d46

Alerts:
  urlquery:
    - Phishing - Deniz Bank
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST /veri.php?ip=91.90.42.154 HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: http://denizbanklogin-com.net
Connection: keep-alive
Referer: http://denizbanklogin-com.net/
Content-Length: 0

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 0
date: Sat, 26 Nov 2022 11:14:07 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 0/4sZ3fGnMngL6VGMzhMCA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         52.89.20.60
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: JOkGHAMTZFPeJ2hLlC0boiO/zcA=

                                        
                                            GET /assets/img/favicon.ico HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/x-icon
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:07 GMT
last-modified: Sun, 30 Oct 2022 04:13:48 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding,User-Agent
content-length: 371
date: Sat, 26 Nov 2022 11:14:07 GMT
server: LiteSpeed


--- Additional Info ---
Magic:  MS Windows icon resource - 1 icon, 16x16\012- data
Size:   371
Md5:    8989bfab9db886f00e526c678ef6a568
Sha1:   925f0f5523cc4a8b8b7b5d20de29d582c3fbbb80
Sha256: 66fc940456db280e5c1d05a2a841c02073c15ab7fc1983748e7ef509155dee54

Alerts:
  urlquery:
    - Phishing - Deniz Bank
                                        
                                            GET /assets/img/autumn.jpg HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://denizbanklogin-com.net/

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: image/jpeg
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Sat, 03 Dec 2022 11:14:07 GMT
last-modified: Sun, 30 Oct 2022 04:14:20 GMT
accept-ranges: bytes
content-length: 379018
date: Sat, 26 Nov 2022 11:14:07 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2560x1707, components 3\012- data
Size:   379018
Md5:    818ced852ca73ab7849232ff704d4e81
Sha1:   fbae534f6bdbdc8c8952f9f6cd1979a4f2391541
Sha256: a6b40cadc7a04a5580b6996ce951a114128475d91fe662ac24885960f0b5277e

Alerts:
  urlquery:
    - Phishing - Deniz Bank
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2819
Expires: Sat, 26 Nov 2022 12:01:07 GMT
Date: Sat, 26 Nov 2022 11:14:08 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2819
Expires: Sat, 26 Nov 2022 12:01:07 GMT
Date: Sat, 26 Nov 2022 11:14:08 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2819
Expires: Sat, 26 Nov 2022 12:01:07 GMT
Date: Sat, 26 Nov 2022 11:14:08 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2819
Expires: Sat, 26 Nov 2022 12:01:07 GMT
Date: Sat, 26 Nov 2022 11:14:08 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf04cc9f-ee4b-42fd-914f-cd86b9dc30eb.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3502
x-amzn-requestid: ca3f2610-e03c-48a7-abb3-fbbab76f63d2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cCvYUHO5IAMFqDA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637dc5ce-7e36137711dc4668278c1c94;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 07:03:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: QS3ZKYetcm87GNwSr34eRPF2d4r8ppwf3fT19aV-u84f7ObX4bU8wQ==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 07:13:26 GMT
age: 14442
etag: "61f9bed607e81606be78285596acdc5e0e4f4994"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3502
Md5:    a783df85f30f9c555f9df6b99f61744d
Sha1:   61f9bed607e81606be78285596acdc5e0e4f4994
Sha256: 19db42201d0fa059f680d890ede6683c04e893e6308a2256d0203f826a7f34de
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2819
Expires: Sat, 26 Nov 2022 12:01:07 GMT
Date: Sat, 26 Nov 2022 11:14:08 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffad04f54-f199-4bc1-a785-cf5c76640147.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11150
x-amzn-requestid: 0b773c28-feda-41a2-9de6-8b559bd773eb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLVC5EukoAMFxfA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63813545-3bfe118939abc352072c5af1;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:36:05 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: RBv0V5RyDoApQfc5QIHFxVzmasUJvYZ6X4-kTTfI9UhtdjUWitlkJA==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:46:24 GMT
etag: "845842c789e6e97fd1687e668d446bbb8309ffc7"
age: 48464
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11150
Md5:    d0f860248042a8499ffb1701a880b2ba
Sha1:   845842c789e6e97fd1687e668d446bbb8309ffc7
Sha256: 9eca5258c7b6e4e145ca6576a3f3791f1324714404ffd7a56a61961f81e7bd44
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F34ec689c-96b7-450b-b77e-e0ecb4d89c3c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9049
x-amzn-requestid: 6cbd9639-c29d-4ff4-8091-3168f64f4c78
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLVVGHzKoAMFSuA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638135ba-100ea4235fdf1df8491041c8;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:38:02 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: OJZkZ18TlSgdBWsmSroQPIcYIvBFvz5-7hu9_GravTcz6zqxKXHZrg==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:43:36 GMT
age: 48632
etag: "3d32bff85cb7ec118c4496d0c3802829fdc9af3b"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9049
Md5:    c8dc4b8a7e9f7f4f84f0da568b43392b
Sha1:   3d32bff85cb7ec118c4496d0c3802829fdc9af3b
Sha256: 4b0ffde427085c796a7a5823604b29a4af43dbb93e99ec41f34feb37f52ac7d9
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4309
x-amzn-requestid: 47c2739d-73c5-4d91-914c-fe635cb09772
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b1U8xGxgIAMF-qQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63786851-6fbe19dc5c4c20dd657604e3;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 05:23:29 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ezHvyK3va4SioabOjSittTiLQRs_Q8k4TPxkiGp_svtZ8omDPTUN-A==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 05:04:28 GMT
age: 22180
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    841a4b110022a99ddea6f7bf66df0fa1
Sha1:   126771b86638108050cf57c0d12faa27f80f0edb
Sha256: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6c125eba-03aa-443e-b99e-10c7890258e8.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9787
x-amzn-requestid: 51d9848a-868c-4e51-b1a8-30596d0108b6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLUfxHjToAMFeGA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63813464-749244df2aa06b23445d675c;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:32:20 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: mSCEUQ3aOXg6rxJV0iWPgFZ6TE2pCucWwOI3KAsdbu_EadcDDa5vwg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 559326ad73233233a9e52cb9e8601ede.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 22:07:47 GMT
age: 47181
etag: "afed98649590f2524a9e530c53eebbc1ba36da6a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9787
Md5:    95101ded0fe92a85649a086992948008
Sha1:   afed98649590f2524a9e530c53eebbc1ba36da6a
Sha256: 7f754cb2105494045efe657c47313e77bb26361ca45a6f8cbce1fdb52a15ba01
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F18e649ab-6d56-47c9-ab7e-c65d9bdfcffd.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6789
x-amzn-requestid: eede6332-5376-4f9c-83fc-f894430c1f4b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLWWYFFgoAMFhaQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6381375b-66d7ffc70f7d901420a503da;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:44:59 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: -6kE-HDfLIQMtzuaOuArCjtxgpQUgxMrpjcT7pDIdY7CDlJNK1GZWA==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:46:24 GMT
etag: "c47a3884465fc02b5c57faa5ffbd986ba29c64c2"
age: 48464
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6789
Md5:    926df9839ec3d924b563b55d8bccace8
Sha1:   c47a3884465fc02b5c57faa5ffbd986ba29c64c2
Sha256: a97cd625959aa81bc516024628315b2c6e2ce94f76cd579751a686a6611cc4d2
                                        
                                            POST /veri.php?ip=91.90.42.154 HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: http://denizbanklogin-com.net
Connection: keep-alive
Referer: http://denizbanklogin-com.net/
Content-Length: 0

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 0
date: Sat, 26 Nov 2022 11:14:09 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST /veri.php?ip=91.90.42.154 HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: http://denizbanklogin-com.net
Connection: keep-alive
Referer: http://denizbanklogin-com.net/
Content-Length: 0

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 0
date: Sat, 26 Nov 2022 11:14:12 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            POST /veri.php?ip=91.90.42.154 HTTP/1.1 
Host: denizbanklogin-com.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: http://denizbanklogin-com.net
Connection: keep-alive
Referer: http://denizbanklogin-com.net/
Content-Length: 0

search
                                         172.105.111.160
HTTP/1.1 200 OK
content-type: text/html; charset=UTF-8
                                        
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 0
date: Sat, 26 Nov 2022 11:14:14 GMT
server: LiteSpeed
vary: User-Agent


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - fortinet: Phishing