r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash aabe410b4bbe4d8beb0e4561d3aa158e
e1788632902ddea62cdd9e7ad6009a75ffb69788
ad535e27b201e92670770b2b868c58f7c05633ec66490a41ef4592f062834c1f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AD535E27B201E92670770B2B868C58F7C05633EC66490A41EF4592F062834C1F"
Last-Modified: Wed, 09 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12295
Expires: Wed, 09 Nov 2022 19:31:49 GMT
Date: Wed, 09 Nov 2022 16:06:54 GMT
Connection: keep-alive
ocsp.globalsign.com/gsgccr3dvtlsca2020
104.18.21.226200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsgccr3dvtlsca2020
IP 104.18.21.226:0
Hash e06730bad47e13357398f3563e3d24dd
0774eac8f4e3784f7ebd7c4b1dfefed6f6211d01
2cc4ed15f1a648cef852ba92d45013b348dd6cda68a10796653ff205414b1f4f
POST /gsgccr3dvtlsca2020 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 09 Nov 2022 16:06:54 GMT
Content-Type: application/ocsp-response
Content-Length: 1414
Connection: keep-alive
Expires: Sun, 13 Nov 2022 15:21:34 GMT
ETag: "0774eac8f4e3784f7ebd7c4b1dfefed6f6211d01"
Last-Modified: Wed, 09 Nov 2022 15:21:35 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 123
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7677cc5e9af1b4ee-OSL
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 4c6e4047ec266b87485610e26a85bb6f
cd543757597609d7309d02652318359078a965c2
d8aff7a24f3274782b4f41d6dbd181ba817f5a562d992a3a82966481c91f8a90
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4552
Cache-Control: max-age=157202
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:54 GMT
Etag: "636b8168-1d7"
Expires: Fri, 11 Nov 2022 11:46:56 GMT
Last-Modified: Wed, 09 Nov 2022 10:31:04 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 2b57492bf85f4ae6abbd1641b17dc9ab
008e71ec05d47bf025ca64e17da2ea1bd8e71111
17894427c471f7fa02ca274795dc55df1bfc99d7bd83f9ee36249394035110fd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "17894427C471F7FA02CA274795DC55DF1BFC99D7BD83F9EE36249394035110FD"
Last-Modified: Wed, 09 Nov 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8259
Expires: Wed, 09 Nov 2022 18:24:33 GMT
Date: Wed, 09 Nov 2022 16:06:54 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: AseaKnFywMIq0V7YGPHBXpaqDIWQ37synNiruqqYwF+5k89iIyPt6HaZR6Spe2a/LjJjPAA3D0TkpaTDpWfgpQ==
x-amz-request-id: F860BM1SNB4S6SE6
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 09 Nov 2022 15:11:46 GMT
age: 3308
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/exec.js
5.23.50.26200 OK 144 B URL HTTP/2 cu17817.tmweb.ru/bin/exec.js
IP 5.23.50.26:0
File type ASCII text, with no line terminators
Hash e7fe3e96d2e6c828c4e52af5d94b338d
6c9be0d34539084a9677cde7cd15827d142f2787
661e7bd7e2b6ffc300a30ea6720c147cccebb197c4b87714aa88894382c845db
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/exec.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
content-length: 144
last-modified: Tue, 08 Nov 2022 13:36:25 GMT
etag: "636a5b59-90"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/1929.js
5.23.50.26200 OK 771 B URL HTTP/2 cu17817.tmweb.ru/bin/1929.js
IP 5.23.50.26:0
File type ASCII text, with very long lines (509)
Hash 3f25bf0a82b68e1c76f694c5a4d7e5b3
3a17a172c379a5cb302bc15b05a01bca516160b6
48d78a43e9bf99db5daedb39e7b9b06d5358d470bdb45cc6bfd98afad3ac8c83
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/1929.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
content-length: 771
last-modified: Tue, 08 Nov 2022 13:36:12 GMT
etag: "636a5b4c-303"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/1928.js
5.23.50.26200 OK 771 B URL HTTP/2 cu17817.tmweb.ru/bin/1928.js
IP 5.23.50.26:0
File type ASCII text, with very long lines (509)
Hash a2637b70441909b18037e57fa9889054
a934ef5dcdb1bba73646354db8ddbd7d7c6e40e5
c11d68f4a06808e2fa28fd43c648b16865253b8235117b26f04f471d3ab8b5a3
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/1928.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
content-length: 771
last-modified: Tue, 08 Nov 2022 13:36:11 GMT
etag: "636a5b4b-303"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/1938.js
5.23.50.26200 OK 766 B URL HTTP/2 cu17817.tmweb.ru/bin/1938.js
IP 5.23.50.26:0
File type ASCII text, with very long lines (765)
Hash af0050e67a79f169a5affc39ed8a547e
f715d28bd14eb8c3a633f74a82905fe44adfd83b
87f8580d2648332c05e7f77442a7243c4769102e18ce0224df9e5d3ff173c575
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/1938.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
content-length: 766
last-modified: Tue, 08 Nov 2022 13:36:12 GMT
etag: "636a5b4c-2fe"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/insight.min.js
5.23.50.26200 OK 965 B URL HTTP/2 cu17817.tmweb.ru/bin/insight.min.js
IP 5.23.50.26:0
File type ASCII text, with very long lines (964)
Hash 1682c15c32a384857cf7bb18701fd5cf
bd8f13bc5354c361fecf6b487f8a5dd68f3bbdab
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/insight.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
content-length: 965
last-modified: Tue, 08 Nov 2022 13:36:38 GMT
etag: "636a5b66-3c5"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 3b26e900b9be930a07101e0d5f5de579
fc84082e3eef2e000f255f1cbd4cf45b694a2118
1dff9aae4984871070d193b60d41548a8a816f0ba20839d41d6e73a08e548afe
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cu17817.tmweb.ru/bin/insight.beta.min.js
5.23.50.26200 OK 46 kB URL HTTP/2 cu17817.tmweb.ru/bin/insight.beta.min.js
IP 5.23.50.26:0
Hash 33bf25ac6d4d65467ffcbb368a6c2322
2816321d1ff26a24f9ad214ddbfc43437946b22e
3cee8fbcefaf79c5803b7881b02c6bbfba2e1397dcbde791441ec087bd2f85f4
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/insight.beta.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:36 GMT
vary: Accept-Encoding
etag: W/"636a5b64-100a"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/css
5.23.50.26200 OK 5.4 kB IP 5.23.50.26:0
Hash 31bf65bad488ba7dba0c772f144f2877
c97f8e58ed66c1db55d658386c36dceeadade24c
9062b283108aee3d80a32cada8435bd6e2b642f3532de4ec9460136e98d6bc3e
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 5380
last-modified: Tue, 08 Nov 2022 13:36:22 GMT
etag: "1504-5ecf5a03c28cb"
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 3b26e900b9be930a07101e0d5f5de579
fc84082e3eef2e000f255f1cbd4cf45b694a2118
1dff9aae4984871070d193b60d41548a8a816f0ba20839d41d6e73a08e548afe
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cstatic.weborama.fr/iframe/external_ids_sync.html?d.r=1668010011629
93.184.221.133200 OK 289 B URL HTTP/2 cstatic.weborama.fr/iframe/external_ids_sync.html?d.r=1668010011629
IP 93.184.221.133:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash c343cdad3faf63f0951df1ec2b6c4c25
8c7459f1769f6284b5781cd4555ccc4e1f11dc0b
b8e71e64106a9ac6970fff552ded05de7fc5d3dc95555b4f5d37f7febea08541
GET /iframe/external_ids_sync.html?d.r=1668010011629 HTTP/1.1
Host: cstatic.weborama.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
age: 487049
cache-control: max-age=604800
content-type: text/html
date: Wed, 09 Nov 2022 16:06:55 GMT
etag: "3554162603+gzip"
expires: Wed, 16 Nov 2022 16:06:55 GMT
last-modified: Tue, 24 Aug 2021 08:05:01 GMT
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
server: ECAcc (ska/F7A6)
vary: Accept-Encoding
x-cache: HIT
content-length: 289
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash ec3ac033fa2b7a2221fd7457b7348028
2542e34b63442d2a3b97ee340b401f0c935ce318
0c4f7fe714af959bfcd69ac63ea2a2e6b60c8faa3e092f36fc87161fe43f9f9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0C4F7FE714AF959BFCD69AC63EA2A2E6B60C8FAA3E092F36FC87161FE43F9F9B"
Last-Modified: Tue, 08 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14177
Expires: Wed, 09 Nov 2022 20:03:12 GMT
Date: Wed, 09 Nov 2022 16:06:55 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash ec3ac033fa2b7a2221fd7457b7348028
2542e34b63442d2a3b97ee340b401f0c935ce318
0c4f7fe714af959bfcd69ac63ea2a2e6b60c8faa3e092f36fc87161fe43f9f9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0C4F7FE714AF959BFCD69AC63EA2A2E6B60C8FAA3E092F36FC87161FE43F9F9B"
Last-Modified: Tue, 08 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14177
Expires: Wed, 09 Nov 2022 20:03:12 GMT
Date: Wed, 09 Nov 2022 16:06:55 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash ec3ac033fa2b7a2221fd7457b7348028
2542e34b63442d2a3b97ee340b401f0c935ce318
0c4f7fe714af959bfcd69ac63ea2a2e6b60c8faa3e092f36fc87161fe43f9f9b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0C4F7FE714AF959BFCD69AC63EA2A2E6B60C8FAA3E092F36FC87161FE43F9F9B"
Last-Modified: Tue, 08 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14177
Expires: Wed, 09 Nov 2022 20:03:12 GMT
Date: Wed, 09 Nov 2022 16:06:55 GMT
Connection: keep-alive
cu17817.tmweb.ru/bin/iadvize.js
5.23.50.26200 OK 17 kB URL HTTP/2 cu17817.tmweb.ru/bin/iadvize.js
IP 5.23.50.26:0
File type Unicode text, UTF-8 text, with very long lines (29912)
Hash 8d7ce3a73e75a6dd2315a2aa4ccf26e0
d17bd9f827e6a46e9f17ed0b295a302827fb1f47
be8e6a2eaee4c3d13145674574a4bfcd185e59c84f359fa8edbec485654b3365
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/iadvize.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:32 GMT
vary: Accept-Encoding
etag: W/"636a5b60-c732"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/0
5.23.50.26200 OK 0 B IP 5.23.50.26:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/0 HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 0
last-modified: Tue, 08 Nov 2022 13:36:10 GMT
etag: "0-5ecf59f7fce49"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/tro.js
5.23.50.26200 OK 5.1 kB URL HTTP/2 cu17817.tmweb.ru/bin/tro.js
IP 5.23.50.26:0
File type ASCII text, with very long lines (529)
Hash 03869579c2657881d8e10292bd392ee8
facb340a6135abf3b4faa69d2570079d4fd79478
bae3fa0e17b495252237167d254aa3bddd18a6ea0d80b348bd86a18e771a5cf3
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/tro.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:37:00 GMT
vary: Accept-Encoding
etag: W/"636a5b7c-3cde"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
tgt.mmtro.com/t?&tagid=6550672-db22507a7e49c14c1eb9aa1ea269b70a&zid=1928&cb=promoUpdate&output=js
83.150.244.138200 OK 0 B URL HTTP/1.1 tgt.mmtro.com/t?&tagid=6550672-db22507a7e49c14c1eb9aa1ea269b70a&zid=1928&cb=promoUpdate&output=js
IP 83.150.244.138:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /t?&tagid=6550672-db22507a7e49c14c1eb9aa1ea269b70a&zid=1928&cb=promoUpdate&output=js HTTP/1.1
Host: tgt.mmtro.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
date: Wed, 09 Nov 2022 16:06:55 GMT
content-type: text/javascript; charset=utf-8
content-length: 0
cache-control: no-store, no-cache, private
pragma: no-cache
p3p: policyref="http://mmtro.com/w3c/p3p.xml", CP="ALL DSP LAW CUR TAIi PSAi PSDi IVAi IVDi OUR BUS UNI"
expires: Wed, 23 Feb 2000 00:00:01 GMT
x-rid: 636bd01f3ca62bb45991816a
strict-transport-security: max-age=15724800; includeSubDomains
x-envoy-upstream-service-time: 12
server: envoy
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1e5a66a4ffdf1227285a9263e8159e8e
9a7f37021235e44cc621208aef4c476808360118
5f1bcebfe2da03e360485eb21ecaa7961cc5a245902bb30d3648abaf5da637da
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5F1BCEBFE2DA03E360485EB21ECAA7961CC5A245902BB30D3648ABAF5DA637DA"
Last-Modified: Tue, 08 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6230
Expires: Wed, 09 Nov 2022 17:50:45 GMT
Date: Wed, 09 Nov 2022 16:06:55 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 3fd3a3910ff028a1b8a1f72bc93e91f5
9ac0351ab9a803e9647882880b4f56693fd769ed
d881fb422e3eaa5ec00a7f6aaed965ac8bd93b2e14970db59c37ee0ba66b0f80
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cu17817.tmweb.ru/bin/space-cowboy.css
5.23.50.26200 OK 19 kB URL HTTP/2 cu17817.tmweb.ru/bin/space-cowboy.css
IP 5.23.50.26:0
File type Unicode text, UTF-8 text, with very long lines (39441)
Hash e2e8794ed6ac4c01c1e964822b3ccd2b
15bd94cd772dfdc14bc948f5b1fd2226fe35f86a
d0977f53d3762df79c055bd9ed08c8f8bc38ef7bc9029f3d47ca67fd6f47863f
Analyzer Verdict Alert openphish La Banque postale
GET /bin/space-cowboy.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/css
last-modified: Tue, 08 Nov 2022 13:36:52 GMT
vary: Accept-Encoding
etag: W/"636a5b74-99b0"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/all.js
5.23.50.26200 OK 9.7 kB URL HTTP/2 cu17817.tmweb.ru/bin/all.js
IP 5.23.50.26:0
File type ASCII text, with very long lines (29415)
Hash 126c345f45e6c6447a380d01afed480a
9998678fdd81b9fec064ced223d43c6e2fbc89fa
1746e33d8c2d1fe42beab6d00b3938684a267f7418e50269818e96cdbad5a71f
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/all.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:18 GMT
vary: Accept-Encoding
etag: W/"636a5b52-7318"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
6927651.fls.doubleclick.net/activityi;src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F?
142.250.74.70200 OK 237 B URL HTTP/2 6927651.fls.doubleclick.net/activityi;src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F?
IP 142.250.74.70:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (451), with no line terminators
Hash 1642ffc49965b98884355a23a0843bcf
6b7466e1d455d67b56f4099ad6d9fea528d36703
0b57b6609fba0df4339c51b1dd8e59076628917c7974e9e5b13f233f13d6bd19
GET /activityi;src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F? HTTP/1.1
Host: 6927651.fls.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:06:55 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 237
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 09-Nov-2022 16:21:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash c59d06092401e375df491b06ee8e6dbc
2e27b8ff7c08a5349e27969bc2a08e5e19d0c1da
23ee4ab633fcf67dc5d4d1931450e365cec8d436ef1f9ba5f46b6bab974724c4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6233
Cache-Control: max-age=153827
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Etag: "636b6da9-1d7"
Expires: Fri, 11 Nov 2022 10:50:42 GMT
Last-Modified: Wed, 09 Nov 2022 09:06:49 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 62d835d5c67b5c11824d794b8f69cd59
4d51e3cb378f22b82e1bb79bf7a0430679ab39c2
bafb9e7627b08ccd0bf68fe0e5f0865ed2682005673c5fa8672b5c4a576d746e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 5c4c9c21e826ed9dd1520ac96dea393c
106bc7d84ae02a77a4006f2cae1cf7b5093d36c0
1201a34924da1af919077623ac06926d89f890b33b843d30e1e129fee007783f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
adservice.google.com/ddm/fls/i/src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F
216.58.211.2200 OK 236 B URL HTTP/2 adservice.google.com/ddm/fls/i/src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F
IP 216.58.211.2:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (450), with no line terminators
Hash 5e182f186acc8dc7e2234805a6220b55
7a07923fe45d1c0850f217ea893036fd1a3c3362
cc89bd8d01de72729c5f98bcd2eecec38e726da8ceb5ed6b98bf2fd6f84ff391
GET /ddm/fls/i/src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F HTTP/1.1
Host: adservice.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6927651.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:06:55 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: br
server: cafe
content-length: 236
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 5c4c9c21e826ed9dd1520ac96dea393c
106bc7d84ae02a77a4006f2cae1cf7b5093d36c0
1201a34924da1af919077623ac06926d89f890b33b843d30e1e129fee007783f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 4784079f08e5276b7bd670aed075be5c
997cfb14816a90e340a5f391257d3f8157bc220b
5b88bc0709a5c7a375c380199d49f76e3beedfddf895b80abc3699d73bdf142a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
adservice.google.no/ddm/fls/i/src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F
142.250.74.162302 Found 0 B URL HTTP/2 adservice.google.no/ddm/fls/i/src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F
IP 142.250.74.162:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ddm/fls/i/src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F HTTP/1.1
Host: adservice.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:06:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
location: https://6927651.fls.doubleclick.net/ddm/fls/r/src=6927651;type=invmedia;cat=laban000;ord=8048028295519;gtm=2odb70;auiddc=1732862693.1668010012;~oref=https%3A%2F%2Fcu17817.tmweb.ru%2F
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 4784079f08e5276b7bd670aed075be5c
997cfb14816a90e340a5f391257d3f8157bc220b
5b88bc0709a5c7a375c380199d49f76e3beedfddf895b80abc3699d73bdf142a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cu17817.tmweb.ru/bin/uwt.js
5.23.50.26200 OK 2.0 kB URL HTTP/2 cu17817.tmweb.ru/bin/uwt.js
IP 5.23.50.26:0
File type ASCII text, with very long lines (5160), with no line terminators
Hash e8a0565c3285dd985150b4f68901c6e8
aa4139af89a2e1089e49a577f941e77e7b037953
d1ffe2771c87ab0174518b51fe21f88660335fde2ec198f074eb3dbe352a0e16
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/uwt.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:37:01 GMT
vary: Accept-Encoding
etag: W/"636a5b7d-1428"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 95f494f864a0b905f0b559b8aac9e32c
90868276c65ed46ccbf7b59d901c33f7e1d371ca
d7ab495a9b3dff99b6f283fc09cf0fffc4eef742fd6d9b36435ae83e0fd8138b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googleadservices.com/pagead/conversion.js
142.250.74.98200 OK 17 kB URL HTTP/2 www.googleadservices.com/pagead/conversion.js
IP 142.250.74.98:0
File type ASCII text, with very long lines (2153)
Hash 7fb611e9135563a54404650360f6b1de
d571cf307921d8a9eb21faca0d2ec61ba023c860
5b46cba6934b2c89bb884ba63a77c2f7b23a1bad80a0a8b10f12c46397f173db
GET /pagead/conversion.js HTTP/1.1
Host: www.googleadservices.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6927651.fls.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 09 Nov 2022 16:06:55 GMT
expires: Wed, 09 Nov 2022 16:06:55 GMT
cache-control: private, max-age=3600
content-type: text/javascript; charset=UTF-8
etag: 14253518212129236209
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 16836
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/inbenta-km-sdk.js
5.23.50.26200 OK 130 kB URL HTTP/2 cu17817.tmweb.ru/bin/inbenta-km-sdk.js
IP 5.23.50.26:0
Size 130 kB (130015 bytes)
Hash e7eaeec3c98d6ea91873afca2b524f5f
3e003af27adb95c4afeed6d9aa1fff74c921e0dd
f15ed975896a88c3938531c759d67a31709ad44849ffac707a96937a472cb6f0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/inbenta-km-sdk.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:35 GMT
vary: Accept-Encoding
etag: W/"636a5b63-69840"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
www.googleadservices.com/pagead/conversion/852773421/?random=1668010012297&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4
142.250.74.98200 OK 1.2 kB URL HTTP/2 www.googleadservices.com/pagead/conversion/852773421/?random=1668010012297&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4
IP 142.250.74.98:0
File type ASCII text, with very long lines (1946), with no line terminators
Hash a0609d0e2c110dd2ba1548605ca649f4
f9750f8ddc50a6a9d34b733c95ff01f73b669376
21434467bfec5ebee98dcbf938b002a1e49703b7226640b0c5309c6dde9952e6
GET /pagead/conversion/852773421/?random=1668010012297&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4 HTTP/1.1
Host: www.googleadservices.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6927651.fls.doubleclick.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:06:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 1159
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash d044f3e2fc14a96cc5752446b440b143
d0d278c9eee46eb43a3f91e8fa55db206a78c93a
a0aa7ecc56cdd27079c14e17f3f790b3c01584379a519e8f7760eb81a781a02a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
googleads.g.doubleclick.net/pagead/viewthroughconversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=H9BrY7WjLoubywXWq4zICw&sscte=1&crd=
216.58.211.2302 Found 42 B URL HTTP/2 googleads.g.doubleclick.net/pagead/viewthroughconversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=H9BrY7WjLoubywXWq4zICw&sscte=1&crd=
IP 216.58.211.2:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/viewthroughconversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=H9BrY7WjLoubywXWq4zICw&sscte=1&crd= HTTP/1.1
Host: googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6927651.fls.doubleclick.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/2 302 Found
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:06:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
location: https://www.google.com/pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 09-Nov-2022 16:21:55 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash d044f3e2fc14a96cc5752446b440b143
d0d278c9eee46eb43a3f91e8fa55db206a78c93a
a0aa7ecc56cdd27079c14e17f3f790b3c01584379a519e8f7760eb81a781a02a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash dee3039809fc2026852697eaa005560c
f4f6b76cf09e0a9e756ab6b9b8be26cb6e15b2c7
8091750102499bbd5d92ea3e89cf364e833df30e186963d67a0d66a13751ef8a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO
142.250.74.164302 Found 42 B URL HTTP/2 www.google.com/pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO
IP 142.250.74.164:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://6927651.fls.doubleclick.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:06:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
location: https://www.google.no/pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO&ipr=y&prhg=0
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.google.no/pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO&ipr=y&prhg=0
142.250.74.35200 OK 42 B URL HTTP/2 www.google.no/pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO&ipr=y&prhg=0
IP 142.250.74.35:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-conversion/852773421/?random=693545200&cv=9&fst=1668010012297&num=1&label=Hio2CMbqvosBEK2U0ZYD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1024&u_w=1280&u_ah=1002&u_aw=1280&u_cd=24&u_his=1&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6927651.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fsrc%3D6927651%3Btype%3Dinvmedia%3Bcat%3Dlaban000%3Bord%3D8048028295519%3Bgtm%3D2odb70%3Bauiddc%3D1732862693.1668010012%3B~oref%3Dhttps%253A%252F%252Fcu17817.tmweb.ru%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=H9BrY7WjLoubywXWq4zICw&random=1082022549&resp=GooglemKTybQhCsO&ipr=y&prhg=0 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://6927651.fls.doubleclick.net/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:06:56 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/clientlib-iadvize.min.js
5.23.50.26200 OK 345 B URL HTTP/2 cu17817.tmweb.ru/bin/clientlib-iadvize.min.js
IP 5.23.50.26:0
Hash 0cb83389e176a4bc2d657cb1b9796a54
7aaefa9d5e60c115eca0f95a5dc4f31aea62ca35
806aad512868056b5b26505bbb2d2396198c8baac280e959c2fe1858b59dda22
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/clientlib-iadvize.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
content-length: 345
last-modified: Tue, 08 Nov 2022 13:36:22 GMT
etag: "636a5b56-159"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1b6e55fb9c16b8ec503ca6fb935f650f
1e392159765235158a218248677dc21c46bc4f42
89cc50a881ff8fae94b7bfa2732d133df59bae06680f6d2147281ee7bf8ab00b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89CC50A881FF8FAE94B7BFA2732D133DF59BAE06680F6D2147281EE7BF8AB00B"
Last-Modified: Tue, 08 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9131
Expires: Wed, 09 Nov 2022 18:39:07 GMT
Date: Wed, 09 Nov 2022 16:06:56 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1b6e55fb9c16b8ec503ca6fb935f650f
1e392159765235158a218248677dc21c46bc4f42
89cc50a881ff8fae94b7bfa2732d133df59bae06680f6d2147281ee7bf8ab00b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89CC50A881FF8FAE94B7BFA2732D133DF59BAE06680F6D2147281EE7BF8AB00B"
Last-Modified: Tue, 08 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9131
Expires: Wed, 09 Nov 2022 18:39:07 GMT
Date: Wed, 09 Nov 2022 16:06:56 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1b6e55fb9c16b8ec503ca6fb935f650f
1e392159765235158a218248677dc21c46bc4f42
89cc50a881ff8fae94b7bfa2732d133df59bae06680f6d2147281ee7bf8ab00b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89CC50A881FF8FAE94B7BFA2732D133DF59BAE06680F6D2147281EE7BF8AB00B"
Last-Modified: Tue, 08 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9131
Expires: Wed, 09 Nov 2022 18:39:07 GMT
Date: Wed, 09 Nov 2022 16:06:56 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1b6e55fb9c16b8ec503ca6fb935f650f
1e392159765235158a218248677dc21c46bc4f42
89cc50a881ff8fae94b7bfa2732d133df59bae06680f6d2147281ee7bf8ab00b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89CC50A881FF8FAE94B7BFA2732D133DF59BAE06680F6D2147281EE7BF8AB00B"
Last-Modified: Tue, 08 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9131
Expires: Wed, 09 Nov 2022 18:39:07 GMT
Date: Wed, 09 Nov 2022 16:06:56 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1b6e55fb9c16b8ec503ca6fb935f650f
1e392159765235158a218248677dc21c46bc4f42
89cc50a881ff8fae94b7bfa2732d133df59bae06680f6d2147281ee7bf8ab00b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89CC50A881FF8FAE94B7BFA2732D133DF59BAE06680F6D2147281EE7BF8AB00B"
Last-Modified: Tue, 08 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9131
Expires: Wed, 09 Nov 2022 18:39:07 GMT
Date: Wed, 09 Nov 2022 16:06:56 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4e2853cc6ec6223160471401e6871f4b
f052e1f8b2bf4a8eeecfa5b82e27ada1b7719a0c
bf4b9145ea043d87a30fd3aeeae21a1a0aa27004cd2467e7aa843bc894ae1f60
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10462
x-amzn-requestid: 43480a38-fd89-4c47-b8c4-e6ba90b1321c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aMF6oEz_oAMF8Hg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634e5043-6617fd2e59cab00135301cdd;Sampled=0
x-amzn-remapped-date: Tue, 18 Oct 2022 07:05:39 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: C7GYpM3mXSf0hVyGO9Zzlxa3IHXHdyPlXsvr3i0GoQnaPZF6lO-OwA==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 09 Nov 2022 06:24:20 GMT
age: 34956
etag: "f052e1f8b2bf4a8eeecfa5b82e27ada1b7719a0c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff66bafec-6420-4aea-8b22-96b8fe0d292b.jpeg
34.120.237.76200 OK 8.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff66bafec-6420-4aea-8b22-96b8fe0d292b.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c69b19d2273c3ade32fd0797921c0459
8cafda5659f5b36c855a2bbcaeb03aa715ddeebd
d78b92e1175207b1179c85f9490f937e1647aeae3fe95cf8b3dc336db232945e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff66bafec-6420-4aea-8b22-96b8fe0d292b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8154
x-amzn-requestid: 1d9d6e13-69a4-473d-af4b-ef3d4382f3ca
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bTTU2EyZoAMF94w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636acc1e-0dec203434f42df01d9a1182;Sampled=0
x-amzn-remapped-date: Tue, 08 Nov 2022 21:37:34 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 5sq7XRYInS334VVDEtCJNlf_O9FTHn2G4u-WAIygFZ-SALN0flMwew==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 08 Nov 2022 22:02:14 GMT
age: 65082
etag: "8cafda5659f5b36c855a2bbcaeb03aa715ddeebd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F609c6c88-4535-488a-8bf4-de0e93b9ae31.jpeg
34.120.237.76200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F609c6c88-4535-488a-8bf4-de0e93b9ae31.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 86ec3f22045de1a100eccf27d91593ae
e26769d82108f89057b05096061f1276d34e223a
b863d19ab12945922b4d014c517f5ffe349cefe2bbe1c2f16661371f22378cbd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F609c6c88-4535-488a-8bf4-de0e93b9ae31.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10822
x-amzn-requestid: 730ec36d-2d1d-4a0f-90c8-dd819811bdd1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bM39VEZkIAMF7lg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636839ee-6e75e34c64d489ca25765e67;Sampled=0
x-amzn-remapped-date: Sun, 06 Nov 2022 22:49:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: R2JUiJdMAsIbCHDmMMHyN0sKaVBZMDRh2WOfBPUWZpnMBVOcI40Y3w==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 09 Nov 2022 11:14:53 GMT
age: 17523
etag: "e26769d82108f89057b05096061f1276d34e223a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1b197dc2-1415-4c19-8d36-1fa334168ba5.jpeg
34.120.237.76200 OK 9.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1b197dc2-1415-4c19-8d36-1fa334168ba5.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 29429581f8dc762c69c5916009f70080
9265cae98aa663a5498925b70079abdd8e7031fd
c3deee74c80905a1e92b84868b9987cb30ad7a210dca066b97c325cc2c83872e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1b197dc2-1415-4c19-8d36-1fa334168ba5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9313
x-amzn-requestid: be3f6b0f-cf61-4bec-ad1a-87abdbc45d73
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bTTTwF5AoAMFZAw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636acc17-5ca45b5b1065a4ea492f2ac6;Sampled=0
x-amzn-remapped-date: Tue, 08 Nov 2022 21:37:27 GMT
x-amz-cf-pop: SEA19-C3, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 9lVY7YgQQ0FAP3ItgCSWePY0Msd4RIyBz4eNPc-K51BtnWUjOObv6g==
via: 1.1 31dfa94142c6eaf975b0e5454c00340a.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Tue, 08 Nov 2022 21:43:31 GMT
etag: "9265cae98aa663a5498925b70079abdd8e7031fd"
content-type: image/jpeg
age: 66205
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8786d2a2-d21a-4bb6-916d-7fce27ea08f2.jpeg
34.120.237.76200 OK 4.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8786d2a2-d21a-4bb6-916d-7fce27ea08f2.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 39446652ee66d20bd73df20f1a29589c
349ea78f3ad0f2f7376ba22e417226b2e06806d7
655a00944a319ba167e99b43055044cb18bc48d53605ff0d1b6c8b1ba8ee8237
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8786d2a2-d21a-4bb6-916d-7fce27ea08f2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4737
x-amzn-requestid: ad230e08-9f4e-46cf-9a86-f8e013a1c498
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bQBFkEhLIAMFq_g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63697bbd-7e8b686a23a84c5d473c9ef5;Sampled=0
x-amzn-remapped-date: Mon, 07 Nov 2022 21:42:21 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: FoOPmZEjC6nhw801dgqENVL-9-aC0pyFAF-fMS57XzQyfxck2GGUvA==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Tue, 08 Nov 2022 21:49:16 GMT
age: 65860
etag: "349ea78f3ad0f2f7376ba22e417226b2e06806d7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84109408-bbc7-4166-8974-df4b4fbbf1c1.jpeg
34.120.237.76200 OK 6.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84109408-bbc7-4166-8974-df4b4fbbf1c1.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 11ef1d34ac2d42662fe53fc58c882fdf
16f1e048895ed1ee0c0c071e3939e741113e4969
61c42bae12654cf9bd1e7ca0f616164ff4139dc470fb6c1033176374444d6bda
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84109408-bbc7-4166-8974-df4b4fbbf1c1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6272
x-amzn-requestid: 7287a2fe-853d-497f-a63e-1d521dd5326e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bG3dSGEIIAMF7Kg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6365d2bb-4c6803ad2d4ea46e68abd386;Sampled=0
x-amzn-remapped-date: Sat, 05 Nov 2022 03:04:27 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: HorGiakcVRB2pttVHMwYarPgVp3mK2Fk1uf5dagcCPOWw184ZD4A8A==
via: 1.1 6a6653dfb47ccc5082f2a5b9d0d168ce.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 09 Nov 2022 09:37:53 GMT
age: 23343
etag: "16f1e048895ed1ee0c0c071e3939e741113e4969"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
cu17817.tmweb.ru/
5.23.50.26200 OK 15 kB IP 5.23.50.26:0
Hash 635e85c2c407a6a6b6601dac78b56164
622020004bbaa3d5a515875b07ea6d348ef4d652
6902d32c983cbd85621157646ddbfe420ec627af96fed3244e1db2d344e73f96
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET / HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/t(1)
5.23.50.26200 OK 125 B URL HTTP/2 cu17817.tmweb.ru/bin/t(1)
IP 5.23.50.26:0
File type ASCII text, with no line terminators
Hash 3c430265f71b3c001056d14bd575cda6
51ab4d0247f0bdfca17d0fdf87cb3db43c481e26
f82ed62e62790f6ed3bdd94e80de9141f537f304e826b88c269f7bcb9eef49ce
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/t(1) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 125
last-modified: Tue, 08 Nov 2022 13:36:53 GMT
etag: "7d-5ecf5a2105b90"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/t(2)
5.23.50.26200 OK 122 B URL HTTP/2 cu17817.tmweb.ru/bin/t(2)
IP 5.23.50.26:0
File type ASCII text, with no line terminators
Hash 293c9021be400c34e79b22f963f94bd8
12359dcc8a220cf1da51f5ab2acf06c9b68a855e
e7c188508104cf9ccb2af7394cb581ac38dc539352db381ca713d04701828965
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/t(2) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 122
last-modified: Tue, 08 Nov 2022 13:36:55 GMT
etag: "7a-5ecf5a22a2ce7"
accept-ranges: bytes
X-Firefox-Spdy: h2
sync.adotmob.com/user
185.183.112.148200 OK 24 B IP 185.183.112.148:0
ASN #60350 Vente-privee.com SA
File type ASCII text, with no line terminators
Hash c1cb781e01cac5fd1324c6606e2fed00
fb86262b7d4ab48a95aec1f8cba1fe8fb61360f6
a71a5bee1fa662135c8819a567ca073e0c2480adfe27a35f0fee277632fcc7ab
GET /user HTTP/1.1
Host: sync.adotmob.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
x-powered-by: Express
access-control-allow-origin: https://cu17817.tmweb.ru
vary: Origin
access-control-allow-credentials: true
set-cookie: uid=085a220425b7577cf20d5aaf; Domain=.adotmob.com; Path=/; Expires=Sat, 09 Dec 2023 16:06:57 GMT; Secure; SameSite=None
uuid=085a220425b7577cf20d5aaf; Domain=.adotmob.com; Path=/; Expires=Sat, 09 Dec 2023 16:06:57 GMT; Secure; SameSite=None
partners=AYL%3A1668010017499%3BAPN%3A1668010017499%3BDMX%3A1668010017499%3BGOO%3A1668010017499%3BQUA%3A1668010017499%3BRUB%3A1668010017499%3BSCM%3A1668010017499%3BSMA%3A1668010017499%3BSTI%3A1668010017499%3BTEA%3A1668010017499; Domain=.adotmob.com; Path=/; Expires=Sat, 09 Dec 2023 16:06:57 GMT; Secure; SameSite=None
content-type: text/plain; charset=utf-8
date: Wed, 09 Nov 2022 16:06:57 GMT
keep-alive: timeout=5
content-length: 24
cu17817.tmweb.ru/bin/js(1)
5.23.50.26200 OK 98 kB URL HTTP/2 cu17817.tmweb.ru/bin/js(1)
IP 5.23.50.26:0
File type ASCII text, with very long lines (2644)
Hash a93246ee4de93d6f2a179bf82cca1b49
95a48d9826bf172a38e200325978ee4c7ae66a1d
e782699a2a2c513fc27bcd7edd8928220f9088b871eba715223ab991020e8562
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/js(1) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 98175
last-modified: Tue, 08 Nov 2022 13:36:41 GMT
etag: "17f7f-5ecf5a155e56e"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/js
5.23.50.26200 OK 98 kB IP 5.23.50.26:0
File type ASCII text, with very long lines (2644)
Hash 4e78cad5fb261a43d1dd6ed338af990d
9df806b71fe2eab302a45fd99e4a880e63fab42d
07abb29dfdcaa1050b7f8070e5c4c77dc1bba0ca504175a74e875007cc19f082
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 98197
last-modified: Tue, 08 Nov 2022 13:36:40 GMT
etag: "17f95-5ecf5a14e82d0"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/iframe_api
5.23.50.26200 OK 810 B URL HTTP/2 cu17817.tmweb.ru/bin/iframe_api
IP 5.23.50.26:0
File type CSV text\012- , ASCII text, with very long lines (507)
Hash 2c7c0978cb581d95ad74c550d29a29be
9b7dae9fe842924dbb0083589867545c29891358
3688bd001b9e577922afc541fb6930088841b6e4bc1ae80ddd6e3dea3802c745
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/iframe_api HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 810
last-modified: Tue, 08 Nov 2022 13:36:33 GMT
etag: "32a-5ecf5a0d858f7"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/bsd
5.23.50.26200 OK 17 B IP 5.23.50.26:0
File type ASCII text, with no line terminators
Hash e5704dfa7641dfd171ce12e90e86454e
97e96054fa38107d18a484b97c86e2f484a3e268
33e91ef748f0af8ef6ee182576422ffdac615b0611a46823d2df553142755b7c
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/bsd HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 17
last-modified: Tue, 08 Nov 2022 13:36:22 GMT
etag: "11-5ecf5a03293ae"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/js(2)
5.23.50.26200 OK 98 kB URL HTTP/2 cu17817.tmweb.ru/bin/js(2)
IP 5.23.50.26:0
File type ASCII text, with very long lines (2644)
Hash 76e2196811d136faa194b49cc6ef4e89
11cd46ff645c5c945c4f8687bae24eedda3daa07
fd547a91734a5e83ce8bca354eb75a64b920fd64efec4feffefc3effb53f1ff5
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/js(2) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 98177
last-modified: Tue, 08 Nov 2022 13:36:42 GMT
etag: "17f81-5ecf5a15e9fcb"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/2135.js(1)
5.23.50.26200 OK 7.1 kB URL HTTP/2 cu17817.tmweb.ru/bin/2135.js(1)
IP 5.23.50.26:0
File type ASCII text, with very long lines (518)
Hash a8abc02c39b7287b0f19d82b533bbb31
ea31ae5d5508ebc6becbc825440410a9afde3bf5
1306b25aace96607b313f03fd25f8bd7185ba2d8c622913cb76c7d5cfa0964f5
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/2135.js(1) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 7101
last-modified: Tue, 08 Nov 2022 13:36:13 GMT
etag: "1bbd-5ecf59fa641fd"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/getuid
5.23.50.26200 OK 53 B URL HTTP/2 cu17817.tmweb.ru/bin/getuid
IP 5.23.50.26:0
File type ASCII text, with no line terminators
Hash 6c9dc9d94d596e868f65b714b5dbb2a3
0cc7ba4d73c740a5687d52c5d020f82c7d290513
162deaa82c91c8e2e585d87de183b7c5c7c1ac33793a50e6c775077af8733267
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/getuid HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 53
last-modified: Tue, 08 Nov 2022 13:36:28 GMT
etag: "35-5ecf5a092f36e"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/2135.js(2)
5.23.50.26200 OK 7.1 kB URL HTTP/2 cu17817.tmweb.ru/bin/2135.js(2)
IP 5.23.50.26:0
File type ASCII text, with very long lines (518)
Hash a8abc02c39b7287b0f19d82b533bbb31
ea31ae5d5508ebc6becbc825440410a9afde3bf5
1306b25aace96607b313f03fd25f8bd7185ba2d8c622913cb76c7d5cfa0964f5
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/2135.js(2) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 7101
last-modified: Tue, 08 Nov 2022 13:36:14 GMT
etag: "1bbd-5ecf59fb739b7"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/libs/granite/csrf/token.json
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/libs/granite/csrf/token.json
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /libs/granite/csrf/token.json HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:55 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash c3b67d20e1be5a66eb381efc5abf0bcb
fa4b377d6a9d637e879318e1a6b6dc7e343443a2
89d5682f8bbbddd9f86117e4e5506c769e1697328bb65c9fe68b078fce2b378e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89D5682F8BBBDDD9F86117E4E5506C769E1697328BB65C9FE68B078FCE2B378E"
Last-Modified: Tue, 08 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7590
Expires: Wed, 09 Nov 2022 18:13:28 GMT
Date: Wed, 09 Nov 2022 16:06:58 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash c3b67d20e1be5a66eb381efc5abf0bcb
fa4b377d6a9d637e879318e1a6b6dc7e343443a2
89d5682f8bbbddd9f86117e4e5506c769e1697328bb65c9fe68b078fce2b378e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89D5682F8BBBDDD9F86117E4E5506C769E1697328BB65C9FE68B078FCE2B378E"
Last-Modified: Tue, 08 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7590
Expires: Wed, 09 Nov 2022 18:13:28 GMT
Date: Wed, 09 Nov 2022 16:06:58 GMT
Connection: keep-alive
labanquepostale.admo.tv/server/receptor.php
137.74.28.230410 Gone 143 B URL HTTP/2 labanquepostale.admo.tv/server/receptor.php
IP 137.74.28.230:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash e6b697d8023614937267e65eabff0ad7
5da4f7f95d2d9364337244160251adb47d6dd927
da01da7dd4b3c678d5d90614b8082f0a8b76394698eb50de19fce6b6754b298a
POST /server/receptor.php HTTP/1.1
Host: labanquepostale.admo.tv
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 75
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 410 Gone
server: nginx/1.18.0
date: Wed, 09 Nov 2022 16:06:58 GMT
content-type: text/html
content-length: 143
X-Firefox-Spdy: h2
labanquepostale.admo.tv/server/receptor.php
137.74.28.230410 Gone 143 B URL HTTP/2 labanquepostale.admo.tv/server/receptor.php
IP 137.74.28.230:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash e6b697d8023614937267e65eabff0ad7
5da4f7f95d2d9364337244160251adb47d6dd927
da01da7dd4b3c678d5d90614b8082f0a8b76394698eb50de19fce6b6754b298a
POST /server/receptor.php HTTP/1.1
Host: labanquepostale.admo.tv
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 113
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 410 Gone
server: nginx/1.18.0
date: Wed, 09 Nov 2022 16:06:58 GMT
content-type: text/html
content-length: 143
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/loader.svg
5.23.50.26200 OK 735 B URL HTTP/2 cu17817.tmweb.ru/bin/loader.svg
IP 5.23.50.26:0
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document, ASCII text
Hash ae288b0f3be3c78cb580d9961a07699b
36e56e6bd5122559bcacf65b6041d7e4053ba424
e82a16b354398501c46036cab262369b7868839e751d53d80e58a032ce5ab701
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/loader.svg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/svg+xml
content-length: 735
last-modified: Tue, 08 Nov 2022 13:36:47 GMT
etag: "636a5b6f-2df"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/logo-lbp.png
5.23.50.26200 OK 4.8 kB URL HTTP/2 cu17817.tmweb.ru/bin/logo-lbp.png
IP 5.23.50.26:0
File type PNG image data, 140 x 140, 8-bit colormap, non-interlaced\012- data
Hash d319def83abb4b0868a2c6cae43ccca3
15a7ec3b9fca0c16aae0d39053bb340e7885f200
6c2ecc8d8ed497ccfd5de46495d86ec26eb29234a7b65a48cb3bb60ea1519a0a
Analyzer Verdict Alert openphish La Banque postale
GET /bin/logo-lbp.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 4818
last-modified: Tue, 08 Nov 2022 13:36:48 GMT
etag: "636a5b70-12d2"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/3639-citoyenne.png
5.23.50.26200 OK 4.0 kB URL HTTP/2 cu17817.tmweb.ru/bin/3639-citoyenne.png
IP 5.23.50.26:0
File type PNG image data, 363 x 139, 8-bit colormap, non-interlaced\012- data
Hash 5ab747a0f1485a7fb9721bb545956131
0fcbe52eaf5f99d02cdd7dc2aff0121d215d9634
3d95b45cc5877442dca599e880b56df2ce5de8b440f41817a6046f4b7f403b12
Analyzer Verdict Alert openphish La Banque postale
GET /bin/3639-citoyenne.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 4031
last-modified: Tue, 08 Nov 2022 13:36:14 GMT
etag: "636a5b4e-fbf"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/Interstitiel_stmarphone.png
5.23.50.26200 OK 33 kB URL HTTP/2 cu17817.tmweb.ru/bin/Interstitiel_stmarphone.png
IP 5.23.50.26:0
File type PNG image data, 310 x 592, 8-bit colormap, non-interlaced\012- data
Hash 2c70a0821722ed030244ecd8ed49fc65
a2fb2bc26fd456707ac72afbf157be96dcbb2e6a
d598e785f0c08fb9984bd847e1cfc15a4cbd620de68f455174ada1627b0ce99f
Analyzer Verdict Alert openphish La Banque postale
GET /bin/Interstitiel_stmarphone.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 32759
last-modified: Tue, 08 Nov 2022 13:36:39 GMT
etag: "636a5b67-7ff7"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/Interstitiel_tablette.png
5.23.50.26200 OK 64 kB URL HTTP/2 cu17817.tmweb.ru/bin/Interstitiel_tablette.png
IP 5.23.50.26:0
File type PNG image data, 750 x 573, 8-bit colormap, non-interlaced\012- data
Hash e6a7db5b2aeef4018fc8612041927c28
0ee6a1492759eb4fead49765c6095fa9ca600211
81e3cb15ea36ad13a06a9b67c66ea31522bc8b4c92cc27ad848526ef2ef05560
Analyzer Verdict Alert openphish La Banque postale
GET /bin/Interstitiel_tablette.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 63511
last-modified: Tue, 08 Nov 2022 13:36:39 GMT
etag: "636a5b67-f817"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/lbp-app-android.png
5.23.50.26200 OK 12 kB URL HTTP/2 cu17817.tmweb.ru/bin/lbp-app-android.png
IP 5.23.50.26:0
File type PNG image data, 310 x 91, 8-bit/color RGBA, non-interlaced\012- data
Hash 760e212125b4ba47678fdfe132bf758f
d7e6f00af2a1bac11dcdd634ab64a4b21fac872b
89770d6bb0c7f868fc89cb4a3f498e26dbdc4224c533d1ad3e5275e0856be5fc
Analyzer Verdict Alert openphish La Banque postale
GET /bin/lbp-app-android.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 11936
last-modified: Tue, 08 Nov 2022 13:36:42 GMT
etag: "636a5b6a-2ea0"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 61a9432317cba5908c0a73266e8b8a62
c8bc872f016956cbb5569d7727bdfd46d64146c6
fafa5e76a4ed086616cce2f8e5af613630b11221ec9001d30cac72f6c1f350de
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cu17817.tmweb.ru/bin/lbp-app-ios.png
5.23.50.26200 OK 8.6 kB URL HTTP/2 cu17817.tmweb.ru/bin/lbp-app-ios.png
IP 5.23.50.26:0
File type PNG image data, 310 x 91, 8-bit/color RGBA, non-interlaced\012- data
Hash ff6f443dec165d98cce21be0968d76f3
83b3ba54a0d093afeac60079503c2a68e1cb17d0
ad870bae449ef6b31ff821d333b78ae01783d988b94b60e8c11c81844dd882a1
Analyzer Verdict Alert openphish La Banque postale
GET /bin/lbp-app-ios.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 8586
last-modified: Tue, 08 Nov 2022 13:36:42 GMT
etag: "636a5b6a-218a"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/lbp-app-windows.png
5.23.50.26200 OK 6.3 kB URL HTTP/2 cu17817.tmweb.ru/bin/lbp-app-windows.png
IP 5.23.50.26:0
File type PNG image data, 310 x 91, 8-bit/color RGBA, non-interlaced\012- data
Hash 9887f88bde4ea7a37358d5142ace04db
e3f4b1e027a8cd6b536dc1bde41f6653c89c8de1
89ef0383ca4523cbac45fe1203a10f4fd83138015e91e86680c2a1d2d15d5e09
Analyzer Verdict Alert openphish La Banque postale
GET /bin/lbp-app-windows.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 6345
last-modified: Tue, 08 Nov 2022 13:36:42 GMT
etag: "636a5b6a-18c9"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 4dc4a177d25f666a9ba1cf6225354467
8975f2e5cc9cadc4a1e369da45471eb1f0830c5e
6c9e54a13abc265cac7bdee51c6fa49e5e7590fec7a1cc99096c384dabef31be
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 4dc4a177d25f666a9ba1cf6225354467
8975f2e5cc9cadc4a1e369da45471eb1f0830c5e
6c9e54a13abc265cac7bdee51c6fa49e5e7590fec7a1cc99096c384dabef31be
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 61a9432317cba5908c0a73266e8b8a62
c8bc872f016956cbb5569d7727bdfd46d64146c6
fafa5e76a4ed086616cce2f8e5af613630b11221ec9001d30cac72f6c1f350de
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXg.woff2
216.58.207.195200 OK 24 kB URL HTTP/2 fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXg.woff2
IP 216.58.207.195:0
File type Web Open Font Format (Version 2), TrueType, length 23484, version 1.0\012- data
Hash b4d2c4c39853ee244272c04999b230ba
c82e22dde9716c40ba20e6c7ed03a1b66556de15
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
GET /s/lato/v17/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23484
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 07 Nov 2022 00:33:36 GMT
expires: Tue, 07 Nov 2023 00:33:36 GMT
cache-control: public, max-age=31536000
age: 228803
last-modified: Tue, 15 Sep 2020 18:10:46 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/LBP-inondation-maison-picto.jpg
5.23.50.26200 OK 18 kB URL HTTP/2 cu17817.tmweb.ru/bin/LBP-inondation-maison-picto.jpg
IP 5.23.50.26:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 300x300, components 3\012- data
Hash cf9bab2efc22e019910ac35d39b8ea16
4abcdad66a94f5c178b5817ae5fe8e9b15418c74
5780d7821d7d08f3f3cfdb922b4739739e761bb16769ad5be92cd4474c584548
Analyzer Verdict Alert openphish La Banque postale
GET /bin/LBP-inondation-maison-picto.jpg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/jpeg
content-length: 17634
last-modified: Tue, 08 Nov 2022 13:36:43 GMT
etag: "636a5b6b-44e2"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI9w2_Gwft.woff2
216.58.207.195200 OK 18 kB URL HTTP/2 fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI9w2_Gwft.woff2
IP 216.58.207.195:0
File type Web Open Font Format (Version 2), TrueType, length 17640, version 1.0\012- data
Hash a21767e20d27a9c06007c981a8e5f827
a9130de32c87c3fc72b963df80267b1144864b51
afdd5b03f94d18d31b86e4bdf19ad063f6917233f5605f2e4b34d055a2502b0e
GET /s/lato/v17/S6u_w4BMUTPHjxsI9w2_Gwft.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17640
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 05 Nov 2022 05:16:31 GMT
expires: Sun, 05 Nov 2023 05:16:31 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 15 Sep 2020 18:10:31 GMT
content-type: font/woff2
age: 384628
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ.woff2
216.58.207.195200 OK 23 kB URL HTTP/2 fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ.woff2
IP 216.58.207.195:0
File type Web Open Font Format (Version 2), TrueType, length 22992, version 1.0\012- data
Hash 1efbd38aa76ddae2580fedf378276333
8a49976f2470ba2a1db6144245355d3b889312e4
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
GET /s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 22992
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 08 Nov 2022 05:40:17 GMT
expires: Wed, 08 Nov 2023 05:40:17 GMT
cache-control: public, max-age=31536000
age: 124002
last-modified: Tue, 15 Sep 2020 18:12:12 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh7USSwiPGQ.woff2
216.58.207.195200 OK 23 kB URL HTTP/2 fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh7USSwiPGQ.woff2
IP 216.58.207.195:0
File type Web Open Font Format (Version 2), TrueType, length 23248, version 1.0\012- data
Hash 98d8cf792834c0bef59c2be99dc3533d
f48e6d698147781b82f573a71f904355274015cd
9194059997d722ec01e41980dffbff03ebe00808b1cdd164a7fd18a561bc312a
GET /s/lato/v17/S6u9w4BMUTPHh7USSwiPGQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23248
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 04 Nov 2022 01:50:50 GMT
expires: Sat, 04 Nov 2023 01:50:50 GMT
cache-control: public, max-age=31536000
age: 483369
last-modified: Tue, 15 Sep 2020 18:12:05 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh50XSwiPGQ.woff2
216.58.207.195200 OK 23 kB URL HTTP/2 fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh50XSwiPGQ.woff2
IP 216.58.207.195:0
File type Web Open Font Format (Version 2), TrueType, length 22572, version 1.0\012- data
Hash 947e87c53b5765bfc8982613ccd789e9
521905bb4c4ce849285620eb0db5969d14d557ba
7d4243c8e973ec0cfc707904891ae4e3efc03dbc8923acb9755f9a35c92269a6
GET /s/lato/v17/S6u9w4BMUTPHh50XSwiPGQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 22572
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 04 Nov 2022 22:50:45 GMT
expires: Sat, 04 Nov 2023 22:50:45 GMT
cache-control: public, max-age=31536000
age: 407774
last-modified: Tue, 15 Sep 2020 18:10:30 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/2135.js
5.23.50.26200 OK 3.1 kB URL HTTP/2 cu17817.tmweb.ru/bin/2135.js
IP 5.23.50.26:0
Hash 2e45f5bbb172e43c2444c81469d1d96c
05945f8e62a057a1c271a40352b5093a1bf9f58f
4ce3719fed1880fb2fb248e36749bffb9b6d66dc77cb4a79c6fe4677213cc5be
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/2135.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:13 GMT
vary: Accept-Encoding
etag: W/"636a5b4d-1bbd"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash 4dc4a177d25f666a9ba1cf6225354467
8975f2e5cc9cadc4a1e369da45471eb1f0830c5e
6c9e54a13abc265cac7bdee51c6fa49e5e7590fec7a1cc99096c384dabef31be
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
halc.iadvize.com/iadvize.js?sid=null&tpl=laposte2&lang=fr
54.230.111.32302 Found 127 B URL HTTP/2 halc.iadvize.com/iadvize.js?sid=null&tpl=laposte2&lang=fr
IP 54.230.111.32:0
File type HTML document, ASCII text
Hash 7e747f60db0654eeeed4ef31e7fb7193
4c1d7edb7d780ab4892846fb4749c232574b404b
9d9012516325c7e757db76ed24ea7399e1c82d7b5fd1e92f6b37e872ce3d93a9
GET /iadvize.js?sid=null&tpl=laposte2&lang=fr HTTP/1.1
Host: halc.iadvize.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
content-type: text/html; charset=utf-8
content-length: 127
location: https://halc.iadvize.com/static/livechat/94c8687177ee2e44e5231d66d8c1e421ef9e2036/live.js
date: Wed, 09 Nov 2022 16:06:59 GMT
access-control-allow-origin: *
content-encoding: gzip
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
server: d21c5ded-a4dc-ccef-ae12-062d2ebf51ea
strict-transport-security: max-age=31536000;
vary: Accept-Encoding, Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: FCj51loy4Gk9RilIOTjBlxJI9XhgtinLdZllQpG9A5sNcIrEloKX8Q==
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/icomoon-library/icons.ttf?9h9ppi
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/bin/icomoon-library/icons.ttf?9h9ppi
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/icomoon-library/icons.ttf?9h9ppi HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/base.min.css
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
status.thawte.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 2a6a5677e745a4603f14710632da74b4
61ac1996f58534c85d449239a41fbf9606eb7f2d
4590c221102c57f26f80e50081cce24a0393c81dd18023e3d969de2390fb9290
POST / HTTP/1.1
Host: status.thawte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6162
Cache-Control: max-age=127853
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:59 GMT
Etag: "636b087e-1d7"
Expires: Fri, 11 Nov 2022 03:37:52 GMT
Last-Modified: Wed, 09 Nov 2022 01:55:10 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 471
status.thawte.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 5a97bcbc739b64a23bfe11c3de3b8bcd
ee42bcb364e55f8819cd47bfc64bf4f52653e22b
88dcab1db428199fc83510158f63e851b79f2e55d4fbd3bb6253646198ac4e3b
POST / HTTP/1.1
Host: status.thawte.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5836
Cache-Control: max-age=102654
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:06:59 GMT
Etag: "636aa755-1d7"
Expires: Thu, 10 Nov 2022 20:37:53 GMT
Last-Modified: Tue, 08 Nov 2022 19:00:37 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 471
privacy.trustcommander.net/privacy-consent/
15.237.76.179200 OK 43 B URL HTTP/1.1 privacy.trustcommander.net/privacy-consent/
IP 15.237.76.179:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash 325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
POST /privacy-consent/ HTTP/1.1
Host: privacy.trustcommander.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 163
Origin: https://cu17817.tmweb.ru
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Wed, 09 Nov 2022 16:06:59 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Cache-Control: private, max-age=486000, pre-check=486000
Pragma: private
Expires: Tue, 07 Feb 2023 16:06:59 GMT
Access-Control-Allow-Origin: https://cu17817.tmweb.ru
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Vary: Origin
cu17817.tmweb.ru/bin/dispatch.html
5.23.50.26200 OK 48 kB URL HTTP/2 cu17817.tmweb.ru/bin/dispatch.html
IP 5.23.50.26:0
Hash 6abdd4fd061b36f82caf40b676601376
693a227b2217006bc6a039a18d8eda7bc2d51c22
f995ed8ffeb488ae8c9919c39ba05a9dde59cede597e280f424b10cb5947f247
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/dispatch.html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 13:36:25 GMT
etag: W/"28844-5ecf5a060f69f"
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/saved_resource.html
5.23.50.26200 OK 568 B URL HTTP/2 cu17817.tmweb.ru/bin/saved_resource.html
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash 1e422c96667d2accc671798ee8229f8e
d51b22b4d095821ec15993e199d6459804d516d9
2e4405ceaf5d2f7d56ac932547524e81ddd70b6e88974cd696e310615f55852f
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/saved_resource.html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
content-length: 568
last-modified: Tue, 08 Nov 2022 13:36:51 GMT
etag: "238-5ecf5a1e7a5bd"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/new-homepage/commerciale/AFMTelethon_LBP_HP_30ko.jpg
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/new-homepage/commerciale/AFMTelethon_LBP_HP_30ko.jpg
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
GET /content/dam/refonte_Particulier/Home/new-homepage/commerciale/AFMTelethon_LBP_HP_30ko.jpg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/1000-mercis/mea-ps-740x430-credit-conso-defaut.jpg
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/1000-mercis/mea-ps-740x430-credit-conso-defaut.jpg
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
GET /content/dam/refonte_Particulier/Home/1000-mercis/mea-ps-740x430-credit-conso-defaut.jpg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/new-homepage/commerciale/mea-hp-740x430-nba-playground.png
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/new-homepage/commerciale/mea-hp-740x430-nba-playground.png
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
GET /content/dam/refonte_Particulier/Home/new-homepage/commerciale/mea-hp-740x430-nba-playground.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/1000-mercis/mea-ps-740x430-argent-quotidien-ouvrir-compte-defaut.jpg
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/content/dam/refonte_Particulier/Home/1000-mercis/mea-ps-740x430-argent-quotidien-ouvrir-compte-defaut.jpg
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
GET /content/dam/refonte_Particulier/Home/1000-mercis/mea-ps-740x430-argent-quotidien-ouvrir-compte-defaut.jpg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
engage.commander1.com/reach?tc_firsttime=1&tc_s=2623
15.236.121.196200 OK 43 B URL HTTP/1.1 engage.commander1.com/reach?tc_firsttime=1&tc_s=2623
IP 15.236.121.196:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash 325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
GET /reach?tc_firsttime=1&tc_s=2623 HTTP/1.1
Host: engage.commander1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Cookie: TCID=202211091706593660753000; WID=61366a22-aa3b-44cf-bd68-046fa7314f62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
set-cookie: TCID=202211091706593660753000; Domain=commander1.com; Path=/; Expires=Thu, 09 Nov 2023 16:07:00 GMT; HttpOnly; Secure; SameSite=None
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
cache-control: private, max-age=486000, pre-check=486000
pragma: private
expires: Tue, 07 Feb 2023 16:07:00 GMT
cu17817.tmweb.ru/bin/LBP-senior-rachat-credits-picto.jpg
5.23.50.26200 OK 8.7 kB URL HTTP/2 cu17817.tmweb.ru/bin/LBP-senior-rachat-credits-picto.jpg
IP 5.23.50.26:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 200x200, components 3\012- data
Hash 732e4dbda226c7f6b53c5c329d1d8f12
fbf52fcd4ef7b79180872bcc1941d783a568e991
172b6549f2e5fa8f607629409e63a358c9b307e47f734f54633fec2940da634b
Analyzer Verdict Alert openphish La Banque postale
GET /bin/LBP-senior-rachat-credits-picto.jpg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/jpeg
content-length: 8652
last-modified: Tue, 08 Nov 2022 13:36:43 GMT
etag: "636a5b6b-21cc"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/LBP-TalentBooster-Epargne-jeunes-Picto-Header.png
5.23.50.26200 OK 6.9 kB URL HTTP/2 cu17817.tmweb.ru/bin/LBP-TalentBooster-Epargne-jeunes-Picto-Header.png
IP 5.23.50.26:0
File type PNG image data, 200 x 200, 8-bit colormap, non-interlaced\012- data
Hash f072f8d0f780badf63e355b486c57349
679b4686b7e08e090dbbab206c09c8d5ffb98a01
b092e6a5a411f3f39bb19b7e986424d26bedabbaccc9029d8dcafbb7d22c0257
Analyzer Verdict Alert openphish La Banque postale
GET /bin/LBP-TalentBooster-Epargne-jeunes-Picto-Header.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 6934
last-modified: Tue, 08 Nov 2022 13:36:44 GMT
etag: "636a5b6c-1b16"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/assets/inbenta-common/css/inbenta-core.min.css
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/assets/inbenta-common/css/inbenta-core.min.css
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
GET /assets/inbenta-common/css/inbenta-core.min.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cu17817.tmweb.ru/assets/inbenta-common/js/inbenta-core.min.js
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/assets/inbenta-common/js/inbenta-core.min.js
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /assets/inbenta-common/js/inbenta-core.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/icomoon-library/icons.woff?9h9ppi
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/bin/icomoon-library/icons.woff?9h9ppi
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
GET /bin/icomoon-library/icons.woff?9h9ppi HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/base.min.css
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/i.html
5.23.50.26200 OK 487 B URL HTTP/2 cu17817.tmweb.ru/bin/i.html
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash d9f887cd58be496aa241ecba634ddc4e
58e06f29287c7325769c350824a5dc03c28d2044
311f560d35311e24e7432b398e9a2a853ea519b0b5749b0b5e82000c593cecd8
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/i.html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
content-length: 487
last-modified: Tue, 08 Nov 2022 13:36:31 GMT
etag: "1e7-5ecf5a0c55d9d"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/i(3).html
5.23.50.26200 OK 490 B URL HTTP/2 cu17817.tmweb.ru/bin/i(3).html
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash ea6349e971a579be396e2d3d3ebc0540
8deec2db1993d304a402cfe9882d0085ef42f656
b90f1b2c364e7953e0d10c216c065513e54eba3681c5af5191d25b54eb38e26c
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/i(3).html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
content-length: 490
last-modified: Tue, 08 Nov 2022 13:36:31 GMT
etag: "1ea-5ecf5a0bc16a1"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/i(4).html
5.23.50.26200 OK 490 B URL HTTP/2 cu17817.tmweb.ru/bin/i(4).html
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 8b4f20ad110982814f6cf32d157b43a7
2418eb15bdec528231c7ae8c88639fa895df028a
29641d72e8c6ecf6e51da8240daab138dd8dc7557b9a708b82c970d2e05cf1e9
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/i(4).html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
content-length: 490
last-modified: Tue, 08 Nov 2022 13:36:31 GMT
etag: "1ea-5ecf5a0c359fe"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/saved_resource(3).html
5.23.50.26200 OK 516 B URL HTTP/2 cu17817.tmweb.ru/bin/saved_resource(3).html
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text
Hash f87ce425ba9aaeebd3f6a9e580a1452b
b6c5e48b4928db04805e7fb04b5c6699caffb92e
e04425820e4cac243fb387f3352ecd596c39ac332506e58746aab0e263d23262
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/saved_resource(3).html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
content-length: 516
last-modified: Tue, 08 Nov 2022 13:36:50 GMT
etag: "204-5ecf5a1e5c15e"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/base-edito-fonts/resources/svg/icon-interface-chevron-right.svg
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/bin/base-edito-fonts/resources/svg/icon-interface-chevron-right.svg
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/base-edito-fonts/resources/svg/icon-interface-chevron-right.svg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/base.min.css
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/LBP-TalentBooster-mode-de-vie-responsable-environnement-Picto-Header.png
5.23.50.26200 OK 12 kB URL HTTP/2 cu17817.tmweb.ru/bin/LBP-TalentBooster-mode-de-vie-responsable-environnement-Picto-Header.png
IP 5.23.50.26:0
File type PNG image data, 200 x 200, 8-bit/color RGB, non-interlaced\012- data
Hash 7555cd04e48b67cd560737bd35d5574c
71f3d5a452651fd50fef7245eb9b1461c1ee5211
616afc2ed861c109bc192ec6b727a5a80f3bd16ad5e5450ae321158b6dcc9b8e
Analyzer Verdict Alert openphish La Banque postale
GET /bin/LBP-TalentBooster-mode-de-vie-responsable-environnement-Picto-Header.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 12166
last-modified: Tue, 08 Nov 2022 13:36:44 GMT
etag: "636a5b6c-2f86"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/LBP-TB-Reorientation-PictoHeader.png
5.23.50.26200 OK 3.3 kB URL HTTP/2 cu17817.tmweb.ru/bin/LBP-TB-Reorientation-PictoHeader.png
IP 5.23.50.26:0
File type PNG image data, 200 x 200, 8-bit colormap, non-interlaced\012- data
Hash 74c9fa6557ee5f9c8af1df2f571b6b2e
6cd3450dabce032624640fba73bc5dc464c53992
9306276d1e48c6fa3951832a30aa1f06cff7640379caf820d4f55b375cf9c6e1
Analyzer Verdict Alert openphish La Banque postale
GET /bin/LBP-TB-Reorientation-PictoHeader.png HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/png
content-length: 3280
last-modified: Tue, 08 Nov 2022 13:36:45 GMT
etag: "636a5b6d-cd0"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/saved_resource
5.23.50.26200 OK 43 B URL HTTP/2 cu17817.tmweb.ru/bin/saved_resource
IP 5.23.50.26:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/saved_resource HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 43
last-modified: Tue, 08 Nov 2022 13:36:49 GMT
etag: "2b-5ecf5a1d352a4"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/saved_resource(1)
5.23.50.26200 OK 43 B URL HTTP/2 cu17817.tmweb.ru/bin/saved_resource(1)
IP 5.23.50.26:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/saved_resource(1) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-length: 43
last-modified: Tue, 08 Nov 2022 13:36:50 GMT
etag: "2b-5ecf5a1dc5b21"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/vignette-semaine-finance-responsable.jpg
5.23.50.26200 OK 108 kB URL HTTP/2 cu17817.tmweb.ru/bin/vignette-semaine-finance-responsable.jpg
IP 5.23.50.26:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=628, bps=158, PhotometricIntepretation=RGB, orientation=upper-left, width=1200], progressive, precision 8, 639x625, components 3\012- data
Size 108 kB (107718 bytes)
Hash 4235c1d5ebb3b8a8db43943feae93b9f
e2f4a50c0c8696717924dba3493ff13522a80238
a1764810cf4826872534fd86d38ca39a58ed4eb6a9adbab218f34ad7218318fe
Analyzer Verdict Alert openphish La Banque postale
GET /bin/vignette-semaine-finance-responsable.jpg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: image/jpeg
content-length: 107718
last-modified: Tue, 08 Nov 2022 13:37:03 GMT
etag: "636a5b7f-1a4c6"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/loader.css
5.23.50.26200 OK 810 B URL HTTP/2 cu17817.tmweb.ru/bin/loader.css
IP 5.23.50.26:0
Hash f2e62554a43fe17a192ae7bb5a92b323
7723e5e220192c0a942d1a3fc3862f8ab9cf3bd6
e3ebf05fee61aec7ad4bcc656d1b40e37b6d4a5388ee63cf078d96199af7138c
Analyzer Verdict Alert openphish La Banque postale
GET /bin/loader.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/identif.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: text/css
content-length: 810
last-modified: Tue, 08 Nov 2022 13:36:46 GMT
etag: "636a5b6e-32a"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
accept-ranges: bytes
X-Firefox-Spdy: h2
www.youtube.com/s/player/a3726513/www-widgetapi.vflset/www-widgetapi.js
142.250.74.78200 OK 37 kB URL HTTP/2 www.youtube.com/s/player/a3726513/www-widgetapi.vflset/www-widgetapi.js
IP 142.250.74.78:0
File type ASCII text, with very long lines (1165)
Hash 3e0d9ddabcc84ec21518d872b3b2d1be
9f06cb642cf14a3304ada1e86f08b01f48472525
1e2ef8aa166357bb5c080ae458d3333ef979bfddb03498bf9944815f5572e70a
GET /s/player/a3726513/www-widgetapi.vflset/www-widgetapi.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 36745
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 06 Nov 2022 15:13:03 GMT
expires: Mon, 06 Nov 2023 15:13:03 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Nov 2020 01:15:18 GMT
content-type: text/javascript
age: 262437
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/identif.html
5.23.50.26200 OK 2.6 kB URL HTTP/2 cu17817.tmweb.ru/bin/identif.html
IP 5.23.50.26:0
Hash 03e8d910d1b52fce309486e899af6a25
fd5f51c535438c569bf36e70dde043a88faa90bc
26cfd77495702d1954c933b6d2049aeac4fe4fd019142b1025c7e53a82e90fb5
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/identif.html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 13:36:32 GMT
etag: W/"210a-5ecf5a0ced37a"
content-encoding: gzip
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash fdf559c8bad28ec8ea8defc49eb5b8a5
835a4f0bc877f18a2b38c64ab87dd76dfb77a7ad
13fec41dca7539275def6a64a6f43e60967f65d6f170661554ae6bad6f35f4f3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:07:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
snap.licdn.com/li.lms-analytics/insight.old.min.js
23.36.76.210200 OK 3.1 kB URL HTTP/2 snap.licdn.com/li.lms-analytics/insight.old.min.js
IP 23.36.76.210:0
ASN #20940 Akamai International B.V.
File type ASCII text, with very long lines (7751)
Hash 57efbbeb3e1d23c82b677511c67c8b0e
f927ba115ef4be362694c22850ddbdd1c1b054d1
873b38d80c8ff1ffcac23ecdb7fb2d17413ae3c217236d8e1e24574b1c4707c6
GET /li.lms-analytics/insight.old.min.js HTTP/1.1
Host: snap.licdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
last-modified: Mon, 24 Oct 2022 21:02:26 GMT
accept-ranges: bytes
content-type: application/x-javascript;charset=utf-8
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=44115
date: Wed, 09 Nov 2022 16:07:00 GMT
content-length: 3063
x-cdn: AKAM
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/dc_pre=CJC3o8SFku0CFco14AodkgkIAQ
5.23.50.26200 OK 42 B URL HTTP/2 cu17817.tmweb.ru/bin/dc_pre=CJC3o8SFku0CFco14AodkgkIAQ
IP 5.23.50.26:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/dc_pre=CJC3o8SFku0CFco14AodkgkIAQ HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/activityi.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-length: 42
last-modified: Tue, 08 Nov 2022 13:36:24 GMT
etag: "2a-5ecf5a04e9785"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/i(1)
5.23.50.26200 OK 48 B URL HTTP/2 cu17817.tmweb.ru/bin/i(1)
IP 5.23.50.26:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d8b1e5906a77a303b516c9a0f3e4bcaf
174178028c07150b75086abc291a5bb94601a89e
2c366efc13702d5bf379b6d5d072ff66fe1d602a6c3185ddd6d6009390fea0f5
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/i(1) HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/i(3).html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-length: 48
last-modified: Tue, 08 Nov 2022 13:36:30 GMT
etag: "30-5ecf5a0b2b064"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/i
5.23.50.26200 OK 48 B IP 5.23.50.26:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d8b1e5906a77a303b516c9a0f3e4bcaf
174178028c07150b75086abc291a5bb94601a89e
2c366efc13702d5bf379b6d5d072ff66fe1d602a6c3185ddd6d6009390fea0f5
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/i HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/i.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-length: 48
last-modified: Tue, 08 Nov 2022 13:36:30 GMT
etag: "30-5ecf5a0af7445"
accept-ranges: bytes
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/orchestrator.39e27e60.js.t%C3%A9l%C3%A9chargement
5.23.50.26404 Not Found 196 B URL HTTP/2 cu17817.tmweb.ru/bin/orchestrator.39e27e60.js.t%C3%A9l%C3%A9chargement
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/orchestrator.39e27e60.js.t%C3%A9l%C3%A9chargement HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/saved_resource(3).html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: text/html; charset=iso-8859-1
content-length: 196
X-Firefox-Spdy: h2
cdn.tradelab.fr/fseg/2135.js?add=12608265
152.195.132.24200 OK 2.6 kB URL HTTP/2 cdn.tradelab.fr/fseg/2135.js?add=12608265
IP 152.195.132.24:0
File type ASCII text, with very long lines (518)
Hash e8e2acc1934a78e938bb2f88981f126c
04e508ff2ef2b20c1edabb2861528cb353ee7775
c33fd65b0d81fa1bfb50c0e3ff4ac82c26aa752ea196874322466bed02496acd
GET /fseg/2135.js?add=12608265 HTTP/1.1
Host: cdn.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
access-control-allow-origin: *
age: 1298
cache-control: max-age=1800
content-type: application/javascript
date: Wed, 09 Nov 2022 16:07:00 GMT
etag: "1bbd-59ff7646fd68a-gzip"
expires: Wed, 09 Nov 2022 16:37:00 GMT
last-modified: Tue, 03 Mar 2020 18:22:54 GMT
server: ECAcc (ska/F73F)
vary: Accept-Encoding
x-cache: HIT
content-length: 2594
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/cvs_all.css
5.23.50.26200 OK 4.5 kB URL HTTP/2 cu17817.tmweb.ru/bin/cvs_all.css
IP 5.23.50.26:0
Hash 313668a3374a6bc25987d57402ea60dc
fb0b5cb7843b4986989452bd71cfab9fae36eb08
aa955b826d289b69bbe589f786038804477888e6424baedc85d0191609c24524
Analyzer Verdict Alert openphish La Banque postale
GET /bin/cvs_all.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/identif.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: text/css
last-modified: Tue, 08 Nov 2022 13:36:23 GMT
vary: Accept-Encoding
etag: W/"636a5b57-1a93"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/cvs_portable.css
5.23.50.26200 OK 601 B URL HTTP/2 cu17817.tmweb.ru/bin/cvs_portable.css
IP 5.23.50.26:0
Hash 22695c6fb87b579f2f0932d3be1ea6e5
2f4abb31ccd288170f7d5ace35c93db8d61f3be5
8c7c8719cfc14dbb003178e58a0c1fe643c460c19167914fd9cb77c5f46bd6ef
Analyzer Verdict Alert openphish La Banque postale
GET /bin/cvs_portable.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/identif.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: text/css
last-modified: Tue, 08 Nov 2022 13:36:24 GMT
vary: Accept-Encoding
etag: W/"636a5b58-438"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/
5.23.50.26200 OK 13 kB IP 5.23.50.26:0
Hash 878e0451893eca5dea3f99017cd7f2bc
37248a1e40355f12d39e50561f81124ce14bb748
201cee2939c446062aad4d704bb85bbc7b3d53aae03d723a1d9feca59516a1b0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET / HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
ib.adnxs.com/getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991002%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22c%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
185.89.210.46307 Redirection 0 B URL HTTP/1.1 ib.adnxs.com/getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991002%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22c%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991002%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22c%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Redirection
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: https://ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991002%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522c%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
AN-X-Request-Uuid: 3277996d-823a-40bb-a78a-5423e68281a9
Set-Cookie: uuid2=7340376559262006215; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 07-Feb-2023 16:07:00 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
www.google.ci/pagead/1p-user-list/993136125/?random=1605906937161&cv=9&fst=1605906000000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=834&u_aw=1536&u_cd=24&u_his=12&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oab41&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.labanquepostale.fr%2F&ref=https%3A%2F%2Ftransverse.labanquepostale.fr%2F&tiba=La%20Banque%20Postale%20-%20Banque%20et%20Assurance%20en%20ligne%20%E2%80%93%20La%20Banque%20Postale&async=1&fmt=3&is_vtc=1&random=954080410&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
216.58.207.227200 OK 42 B URL HTTP/2 www.google.ci/pagead/1p-user-list/993136125/?random=1605906937161&cv=9&fst=1605906000000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=834&u_aw=1536&u_cd=24&u_his=12&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oab41&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.labanquepostale.fr%2F&ref=https%3A%2F%2Ftransverse.labanquepostale.fr%2F&tiba=La%20Banque%20Postale%20-%20Banque%20et%20Assurance%20en%20ligne%20%E2%80%93%20La%20Banque%20Postale&async=1&fmt=3&is_vtc=1&random=954080410&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
IP 216.58.207.227:0
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /pagead/1p-user-list/993136125/?random=1605906937161&cv=9&fst=1605906000000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=834&u_aw=1536&u_cd=24&u_his=12&u_tz=0&u_java=false&u_nplug=3&u_nmime=4>m=2oab41&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.labanquepostale.fr%2F&ref=https%3A%2F%2Ftransverse.labanquepostale.fr%2F&tiba=La%20Banque%20Postale%20-%20Banque%20et%20Assurance%20en%20ligne%20%E2%80%93%20La%20Banque%20Postale&async=1&fmt=3&is_vtc=1&random=954080410&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y HTTP/1.1
Host: www.google.ci
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 09 Nov 2022 16:07:00 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ib.adnxs.com/getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991001%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
185.89.210.46307 Redirection 0 B URL HTTP/1.1 ib.adnxs.com/getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991001%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991001%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Redirection
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: https://ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991001%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
AN-X-Request-Uuid: 16a40342-bbc9-4425-8188-c3463710b73f
Set-Cookie: uuid2=3760642472050663148; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 07-Feb-2023 16:07:00 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
secure.adnxs.com/px?id=991000&t=2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/px?id=991000&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px?id=991000&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
AN-X-Request-Uuid: 3fbddf8f-0c8f-47bb-b5d7-9ef4e010cf11
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
ib.adnxs.com/getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991000%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8178278%2C8178332%2C8217168%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
185.89.210.46307 Redirection 0 B URL HTTP/1.1 ib.adnxs.com/getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991000%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8178278%2C8178332%2C8217168%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /getuid?//its.tradelab.fr/?type=convr&x=1&uuid2=$UID&cdata=%7B%22a%22%3A991000%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8178278%2C8178332%2C8217168%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Redirection
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: https://ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991000%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8178278%252C8178332%252C8217168%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
AN-X-Request-Uuid: ad2f2a68-5bb2-400d-b46b-221ec1ca08ef
Set-Cookie: uuid2=2250823354529092056; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 07-Feb-2023 16:07:00 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1668010011650&url=https%3A%2F%2Fcu17817.tmweb.ru%2F
13.107.42.14200 OK 0 B URL HTTP/2 px.ads.linkedin.com/collect?v=2&fmt=js&pid=&time=1668010011650&url=https%3A%2F%2Fcu17817.tmweb.ru%2F
IP 13.107.42.14:0
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /collect?v=2&fmt=js&pid=&time=1668010011650&url=https%3A%2F%2Fcu17817.tmweb.ru%2F HTTP/1.1
Host: px.ads.linkedin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript
set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=ads.linkedin.com; Secure
bcookie="v=2&9a354abd-53e9-44d8-8a9a-df72469cc2a5"; domain=.linkedin.com; Path=/; Secure; Expires=Thu, 09-Nov-2023 16:07:00 GMT; SameSite=None
lidc="b=VGST09:s=V:r=V:a=V:p=V:g=2427:u=1:x=1:i=1668010020:t=1668096420:v=2:sig=AQEbd8otcqmEyikvLd1CQpjy9AvKHipQ"; Expires=Thu, 10 Nov 2022 16:07:00 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
linkedin-action: 1
x-li-fabric: prod-lva1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lva1-x
x-li-proto: http/2
x-li-uuid: AAXtC9i/d/ZqNN2ZHO+Hgw==
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: CA996DBF8719474DACF22786D1D28C0A Ref B: OSL30EDGE0118 Ref C: 2022-11-09T16:07:00Z
date: Wed, 09 Nov 2022 16:06:59 GMT
content-length: 0
X-Firefox-Spdy: h2
cdn.tradelab.fr/conv/991000.js
152.195.132.24200 OK 2.0 kB URL HTTP/2 cdn.tradelab.fr/conv/991000.js
IP 152.195.132.24:0
File type ASCII text, with very long lines (832)
Hash 866cef51cc7a1af978bd63d062ad7597
fc1a7e138eff4b50c0a722a777684720ff1a1450
339200fc612e99e909baf07bd33255243a505dbbb0b92ebe802b0ec89c843053
GET /conv/991000.js HTTP/1.1
Host: cdn.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
access-control-allow-origin: *
age: 1175
cache-control: max-age=1800
content-type: application/javascript
date: Wed, 09 Nov 2022 16:07:00 GMT
etag: "15a7-5c445be4e9274-gzip"
expires: Wed, 09 Nov 2022 16:37:00 GMT
last-modified: Tue, 08 Jun 2021 18:58:28 GMT
server: ECAcc (ska/F753)
vary: Accept-Encoding
x-cache: HIT
content-length: 2034
X-Firefox-Spdy: h2
secure.adnxs.com/px?id=1003722&t=2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/px?id=1003722&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px?id=1003722&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
AN-X-Request-Uuid: c25c135b-6efc-40f1-910c-16d80cddbfd5
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
cu17817.tmweb.ru/bin/activityi.html
5.23.50.26200 OK 706 B URL HTTP/2 cu17817.tmweb.ru/bin/activityi.html
IP 5.23.50.26:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash ee20b1b7e5cdd78d4ff4d74ecfe2bf06
35a6f833d687941f1e106c2d5a72383b9cc76acb
00bb9687de461afbb278a89f7cb5d0613f41eaf4c2e27ab073114a840a7b9cf1
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/activityi.html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 13:36:17 GMT
etag: W/"476-5ecf59fe761c7"
content-encoding: gzip
X-Firefox-Spdy: h2
secure.adnxs.com/px?id=991001&t=2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/px?id=991001&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px?id=991001&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
AN-X-Request-Uuid: 47bf6f9c-67de-4ff6-97b7-0d8893d451a9
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
secure.adnxs.com/seg?add=2491894:09&t=2
185.89.210.46307 Redirection 0 B URL HTTP/1.1 secure.adnxs.com/seg?add=2491894:09&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /seg?add=2491894:09&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Redirection
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D2491894%3A09%26t%3D2
AN-X-Request-Uuid: 20064f5f-653b-4f98-b575-15e13f14629e
Set-Cookie: uuid2=5944946980078799865; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 07-Feb-2023 16:07:00 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
secure.adnxs.com/px?id=991002&t=2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/px?id=991002&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px?id=991002&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
AN-X-Request-Uuid: 220aad05-e7fb-4757-b7fe-56c96a388bf9
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
secure.adnxs.com/px?id=996576&t=2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/px?id=996576&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px?id=996576&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
AN-X-Request-Uuid: 2a583b8a-aaf0-43d4-9ad9-3c43a2377515
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
px.ads.linkedin.com/collect/?pid=1365721&conversionId=1259489&fmt=gif
13.107.42.14302 Found 0 B URL HTTP/2 px.ads.linkedin.com/collect/?pid=1365721&conversionId=1259489&fmt=gif
IP 13.107.42.14:0
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /collect/?pid=1365721&conversionId=1259489&fmt=gif HTTP/1.1
Host: px.ads.linkedin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
location: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D1365721%26conversionId%3D1259489%26fmt%3Dgif%26liSync%3Dtrue
set-cookie: UserMatchHistory=AQIpmWeL6jJlHgAAAYRdJQ5VKTHeFheMuWOu06mwVNMcmrA_rQ6ZWUSKrPkFlIg-Y31riy28JOq_VQ; Max-Age=2592000; Expires=Fri, 09 Dec 2022 16:07:00 GMT; SameSite=None; Path=/; Domain=.linkedin.com; Secure
AnalyticsSyncHistory=AQIP8tN5aW7_MAAAAYRdJQ5VdXAoGCmibrrd8W6gpa84gGwR0A83IyBpegFI1Q32E4TM_ozWldyt33CH0OKTHQ; Max-Age=2592000; Expires=Fri, 09 Dec 2022 16:07:00 GMT; SameSite=None; Path=/; Domain=.linkedin.com; Secure
lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=ads.linkedin.com; Secure
bcookie="v=2&3a78523f-78cb-4e6b-8901-c1efbd08ce36"; domain=.linkedin.com; Path=/; Secure; Expires=Thu, 09-Nov-2023 16:07:00 GMT; SameSite=None
lidc="b=TGST09:s=T:r=T:a=T:p=T:g=2413:u=1:x=1:i=1668010020:t=1668096420:v=2:sig=AQGAM0GiRc5fBNq-C5UnfV30qTZOmQoK"; Expires=Thu, 10 Nov 2022 16:07:00 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
linkedin-action: 1
x-li-fabric: prod-ltx1
x-li-pop: afd-prod-ltx1-x
x-li-proto: http/2
x-li-uuid: AAXtC9i/1AoocnFjdZQfpQ==
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: 4D3CD6D5705742CEBDC121C9440C35E7 Ref B: OSL30EDGE0118 Ref C: 2022-11-09T16:07:00Z
date: Wed, 09 Nov 2022 16:07:00 GMT
content-length: 0
X-Firefox-Spdy: h2
ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dtlsync%26uuid2%3D%24UID%26callback%3Dtl_sync
185.89.210.46302 Found 0 B URL HTTP/1.1 ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dtlsync%26uuid2%3D%24UID%26callback%3Dtl_sync
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dtlsync%26uuid2%3D%24UID%26callback%3Dtl_sync HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: //its.tradelab.fr/?type=tlsync&uuid2=0&callback=tl_sync
AN-X-Request-Uuid: d30b2eab-91da-45b5-ac6b-acdaba5c2acc
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash fdf559c8bad28ec8ea8defc49eb5b8a5
835a4f0bc877f18a2b38c64ab87dd76dfb77a7ad
13fec41dca7539275def6a64a6f43e60967f65d6f170661554ae6bad6f35f4f3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Nov 2022 16:07:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991002%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522c%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
185.89.210.46302 Found 0 B URL HTTP/1.1 ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991002%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522c%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991002%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522c%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: //its.tradelab.fr/?type=convr&x=1&uuid2=0&cdata={"a":991002,"l":[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],"i":1,"c":7,"t":"c","m":"null","vi":0,"vc":0,"hf":0,"x":{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={"c":{"ref_url":"","ref_ts":0,"page_url":"","dm":""},"v":{"vis_cnt":0,"frst_vis_ts":1668010012,"prev_vis_ts":0,"curr_vis_ts":1668010012,"total_page_cnt":0,"prev_page_cnt":0,"curr_page_cnt":1}}
AN-X-Request-Uuid: 5188211e-f0c2-4b5e-9f4d-025311175fa0
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991001%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
185.89.210.46302 Found 0 B URL HTTP/1.1 ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991001%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991001%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: //its.tradelab.fr/?type=convr&x=1&uuid2=0&cdata={"a":991001,"l":[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8239623,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],"i":1,"c":7,"t":"h","m":"null","vi":0,"vc":0,"hf":0,"x":{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={"c":{"ref_url":"","ref_ts":0,"page_url":"","dm":""},"v":{"vis_cnt":0,"frst_vis_ts":1668010012,"prev_vis_ts":0,"curr_vis_ts":1668010012,"total_page_cnt":0,"prev_page_cnt":0,"curr_page_cnt":1}}
AN-X-Request-Uuid: a83fa7a4-abe2-4e17-9c3e-a0c6a62ec680
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991000%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8178278%252C8178332%252C8217168%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
185.89.210.46302 Found 0 B URL HTTP/1.1 ib.adnxs.com/bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991000%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8178278%252C8178332%252C8217168%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fgetuid%3F%2F%2Fits.tradelab.fr%2F%3Ftype%3Dconvr%26x%3D1%26uuid2%3D%24UID%26cdata%3D%257B%2522a%2522%253A991000%252C%2522l%2522%253A%255B6129654%252C6129670%252C6129677%252C6129705%252C6140244%252C6140246%252C6140363%252C6141029%252C6205745%252C6205752%252C6205755%252C6205762%252C6220830%252C8124214%252C8124594%252C8124968%252C8124973%252C8125344%252C8141760%252C8141763%252C8141816%252C8141850%252C8141875%252C8141880%252C8141931%252C8141938%252C8176847%252C8176869%252C8176878%252C8178278%252C8178332%252C8217168%252C8239623%252C8245529%252C8245533%252C8245537%252C8245540%252C8260100%252C8445392%252C8505468%252C8505515%252C9271738%252C9271745%252C9271969%252C9272093%252C9272160%252C9272905%252C9408323%252C9408407%252C9408587%252C9408663%252C9408768%252C9511553%252C9611699%252C9611846%252C9683342%252C9683349%252C9719394%252C10005812%252C10226877%252C10226889%252C10226919%252C10244639%252C10381193%252C10480996%252C12967986%252C12968507%252C12968515%252C12968543%252C12968782%252C12968784%252C13104005%252C13259085%255D%252C%2522i%2522%253A1%252C%2522c%2522%253A7%252C%2522t%2522%253A%2522h%2522%252C%2522m%2522%253A%2522null%2522%252C%2522vi%2522%253A0%252C%2522vc%2522%253A0%252C%2522hf%2522%253A0%252C%2522x%2522%253A%257B%257D%257D%26advid%3D2602146%26xur%3Dcu17817.tmweb.ru%252F%26adata%3D%257B%2522c%2522%253A%257B%2522ref_url%2522%253A%2522%2522%252C%2522ref_ts%2522%253A0%252C%2522page_url%2522%253A%2522%2522%252C%2522dm%2522%253A%2522%2522%257D%252C%2522v%2522%253A%257B%2522vis_cnt%2522%253A0%252C%2522frst_vis_ts%2522%253A1668010012%252C%2522prev_vis_ts%2522%253A0%252C%2522curr_vis_ts%2522%253A1668010012%252C%2522total_page_cnt%2522%253A0%252C%2522prev_page_cnt%2522%253A0%252C%2522curr_page_cnt%2522%253A1%257D%257D HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: //its.tradelab.fr/?type=convr&x=1&uuid2=0&cdata={"a":991000,"l":[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8178278,8178332,8217168,8239623,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],"i":1,"c":7,"t":"h","m":"null","vi":0,"vc":0,"hf":0,"x":{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={"c":{"ref_url":"","ref_ts":0,"page_url":"","dm":""},"v":{"vis_cnt":0,"frst_vis_ts":1668010012,"prev_vis_ts":0,"curr_vis_ts":1668010012,"total_page_cnt":0,"prev_page_cnt":0,"curr_page_cnt":1}}
AN-X-Request-Uuid: 70bb87c4-7716-44c4-93e7-43e66617e899
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 4716b9a189999e9aba7a1cdc026cac8b
327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767
dcca736fa4bc33ee0d60df6478a30eb056a945a28e4009f38388551b5eff8e28
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Tue, 08 Nov 2022 20:24:26 GMT
Expires: Wed, 09 Nov 2022 20:24:26 GMT
ETag: "327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 4716b9a189999e9aba7a1cdc026cac8b
327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767
dcca736fa4bc33ee0d60df6478a30eb056a945a28e4009f38388551b5eff8e28
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Tue, 08 Nov 2022 20:24:26 GMT
Expires: Wed, 09 Nov 2022 20:24:26 GMT
ETag: "327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 4716b9a189999e9aba7a1cdc026cac8b
327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767
dcca736fa4bc33ee0d60df6478a30eb056a945a28e4009f38388551b5eff8e28
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Tue, 08 Nov 2022 20:24:26 GMT
Expires: Wed, 09 Nov 2022 20:24:26 GMT
ETag: "327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
secure.adnxs.com/px?id=991000&t=2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/px?id=991000&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px?id=991000&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
AN-X-Request-Uuid: d604f9d8-03fd-4859-87f7-b0bac296d4ad
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
secure.adnxs.com/seg?add=12608265&t=2
185.89.210.46307 Redirection 0 B URL HTTP/1.1 secure.adnxs.com/seg?add=12608265&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /seg?add=12608265&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Redirection
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D12608265%26t%3D2
AN-X-Request-Uuid: 587ee656-81d4-478e-b16e-d25472b9659b
Set-Cookie: uuid2=3464049945825609095; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 07-Feb-2023 16:07:00 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
its.tradelab.fr/?type=convr&x=0&cdata=%7B%22a%22%3A1156839%2C%22l%22%3A%5B8176878%2C8245540%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=convr&x=0&cdata=%7B%22a%22%3A1156839%2C%22l%22%3A%5B8176878%2C8245540%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=convr&x=0&cdata=%7B%22a%22%3A1156839%2C%22l%22%3A%5B8176878%2C8245540%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid=1692389659082160462; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node2.tradelab.fr
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 4716b9a189999e9aba7a1cdc026cac8b
327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767
dcca736fa4bc33ee0d60df6478a30eb056a945a28e4009f38388551b5eff8e28
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Tue, 08 Nov 2022 20:24:26 GMT
Expires: Wed, 09 Nov 2022 20:24:26 GMT
ETag: "327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
its.tradelab.fr/?type=convr&x=1&cdata=%7B%22a%22%3A1156839%2C%22l%22%3A%5B8176878%2C8245540%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=convr&x=1&cdata=%7B%22a%22%3A1156839%2C%22l%22%3A%5B8176878%2C8245540%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=convr&x=1&cdata=%7B%22a%22%3A1156839%2C%22l%22%3A%5B8176878%2C8245540%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid=9322425344640410791; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node4.tradelab.fr
its.tradelab.fr/?type=convr&x=1&cdata=%7B%22a%22%3A996576%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=convr&x=1&cdata=%7B%22a%22%3A996576%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=convr&x=1&cdata=%7B%22a%22%3A996576%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid=9978804400696180424; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node5.tradelab.fr
secure.adnxs.com/bounce?%2Fseg%3Fadd%3D2491894%3A09%26t%3D2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/bounce?%2Fseg%3Fadd%3D2491894%3A09%26t%3D2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fseg%3Fadd%3D2491894%3A09%26t%3D2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
AN-X-Request-Uuid: 68940e48-cb35-4e66-8036-783587dccd1d
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
its.tradelab.fr/?type=tlsync&uuid2=0&callback=tl_sync
62.212.64.229200 OK 35 B URL HTTP/1.1 its.tradelab.fr/?type=tlsync&uuid2=0&callback=tl_sync
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type ASCII text, with no line terminators
Hash 595b956d55cdef9ddee2285e6238008d
bf8d1d24250c67648034453be7532c1765f30043
a939a9a772a72527e7b39be1f011974c71a645e1369aabaadf834d4e3edf41a3
GET /?type=tlsync&uuid2=0&callback=tl_sync HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid2=0; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
uuid=2570113545060609299; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0,post-check=0,pre-check=0
Access-Control-Allow-Origin: *
P3p: CP="CAO PSA OUR"
cu17817.tmweb.ru/bin/val_keypad_cvvs-unifie.js
5.23.50.26200 OK 3.5 kB URL HTTP/2 cu17817.tmweb.ru/bin/val_keypad_cvvs-unifie.js
IP 5.23.50.26:0
Hash 65ad26a200631cd0e48ca58a3db1a392
df14efbeeeabf6739b8ff89aac3b48c94ebd49c5
edbb085ad82064ad4813484235877cef7c49135e897552b199d994d0ba5e5c03
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/val_keypad_cvvs-unifie.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/identif.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:37:02 GMT
vary: Accept-Encoding
etag: W/"636a5b7e-289a"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/val_keypad_cvvs-commun-unifie.js
5.23.50.26200 OK 3.7 kB URL HTTP/2 cu17817.tmweb.ru/bin/val_keypad_cvvs-commun-unifie.js
IP 5.23.50.26:0
Hash 54a96e4cc0c6372fa40bcf7ad9e5413e
95bb1e033cdcecb2d2a7239a3041c369e08232f0
c826210d8758d6c975c7b2155b82e8579aa91e4ac9803ec68b02f846fe302757
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/val_keypad_cvvs-commun-unifie.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/identif.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:37:01 GMT
vary: Accept-Encoding
etag: W/"636a5b7d-3264"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
its.tradelab.fr/?type=convr&x=0&cdata=%7B%22a%22%3A991000%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8178278%2C8178332%2C8217168%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%2C13477519%2C14058054%2C14058197%2C14058205%2C14058228%2C14069494%2C14069497%2C14069560%2C14069565%2C14069590%2C14069626%2C14074179%2C14112662%2C14130392%2C14212376%2C14212411%2C14212419%2C14212455%2C14212467%2C14212692%2C14212694%2C14570528%2C14570544%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=convr&x=0&cdata=%7B%22a%22%3A991000%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8178278%2C8178332%2C8217168%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%2C13477519%2C14058054%2C14058197%2C14058205%2C14058228%2C14069494%2C14069497%2C14069560%2C14069565%2C14069590%2C14069626%2C14074179%2C14112662%2C14130392%2C14212376%2C14212411%2C14212419%2C14212455%2C14212467%2C14212692%2C14212694%2C14570528%2C14570544%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=convr&x=0&cdata=%7B%22a%22%3A991000%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8178278%2C8178332%2C8217168%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%2C13477519%2C14058054%2C14058197%2C14058205%2C14058228%2C14069494%2C14069497%2C14069560%2C14069565%2C14069590%2C14069626%2C14074179%2C14112662%2C14130392%2C14212376%2C14212411%2C14212419%2C14212455%2C14212467%2C14212692%2C14212694%2C14570528%2C14570544%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid=5816034867739126462; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node4.tradelab.fr
its.tradelab.fr/?type=convr&x=1&cdata=%7B%22a%22%3A1003722%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=convr&x=1&cdata=%7B%22a%22%3A1003722%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=convr&x=1&cdata=%7B%22a%22%3A1003722%2C%22l%22%3A%5B6129654%2C6129670%2C6129677%2C6129705%2C6140244%2C6140246%2C6140363%2C6141029%2C6205745%2C6205752%2C6205755%2C6205762%2C6220830%2C8124214%2C8124594%2C8124968%2C8124973%2C8125344%2C8141760%2C8141763%2C8141816%2C8141850%2C8141875%2C8141880%2C8141931%2C8141938%2C8176847%2C8176869%2C8176878%2C8239623%2C8245529%2C8245533%2C8245537%2C8245540%2C8260100%2C8445392%2C8505468%2C8505515%2C9271738%2C9271745%2C9271969%2C9272093%2C9272160%2C9272905%2C9408323%2C9408407%2C9408587%2C9408663%2C9408768%2C9511553%2C9611699%2C9611846%2C9683342%2C9683349%2C9719394%2C10005812%2C10226877%2C10226889%2C10226919%2C10244639%2C10381193%2C10480996%2C12967986%2C12968507%2C12968515%2C12968543%2C12968782%2C12968784%2C13104005%2C13259085%5D%2C%22i%22%3A1%2C%22c%22%3A7%2C%22t%22%3A%22h%22%2C%22m%22%3A%22null%22%2C%22vi%22%3A0%2C%22vc%22%3A0%2C%22hf%22%3A0%2C%22x%22%3A%7B%7D%7D&advid=2602146&xur=cu17817.tmweb.ru%2F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A0%2C%22page_url%22%3A%22%22%2C%22dm%22%3A%22%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A0%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A0%2C%22curr_vis_ts%22%3A1668010012%2C%22total_page_cnt%22%3A0%2C%22prev_page_cnt%22%3A0%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid=9583408593090353606; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node4.tradelab.fr
its.tradelab.fr/?type=fseg&uuid2=4801858766581308409&sid=12608265&val=undefined&fun=2135&step=1&siev=12608262&fp=0&advid=2602146&isregen=0&ua=Mozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A105.0)%2520Gecko%252F20100101%2520Firefox%252F105.0&ur=https%253A%252F%252Fcu17817.tmweb.ru%252F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=fseg&uuid2=4801858766581308409&sid=12608265&val=undefined&fun=2135&step=1&siev=12608262&fp=0&advid=2602146&isregen=0&ua=Mozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A105.0)%2520Gecko%252F20100101%2520Firefox%252F105.0&ur=https%253A%252F%252Fcu17817.tmweb.ru%252F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=fseg&uuid2=4801858766581308409&sid=12608265&val=undefined&fun=2135&step=1&siev=12608262&fp=0&advid=2602146&isregen=0&ua=Mozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64%253B%2520rv%253A105.0)%2520Gecko%252F20100101%2520Firefox%252F105.0&ur=https%253A%252F%252Fcu17817.tmweb.ru%252F&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid2=4801858766581308409; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
uuid=4801858766581308409; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
iev0=eJxlyzEOgDAIheG7vNkBUInhKsZJq+lijFWXpne31cHB7ecDIkRJuFFYxHyusD7CTzAI1y0qBLfkgfNVJ/qAd9cnUuRwW5EnA4xVO2IiIW0p27gesBLTub+Rxb8VtrJLQ4X995rSDUNyKIE=; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node3.tradelab.fr
its.tradelab.fr/?type=convr&x=1&uuid2=0&cdata={%22a%22:991000,%22l%22:[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8178278,8178332,8217168,8239623,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],%22i%22:1,%22c%22:7,%22t%22:%22h%22,%22m%22:%22null%22,%22vi%22:0,%22vc%22:0,%22hf%22:0,%22x%22:{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={%22c%22:{%22ref_url%22:%22%22,%22ref_ts%22:0,%22page_url%22:%22%22,%22dm%22:%22%22},%22v%22:{%22vis_cnt%22:0,%22frst_vis_ts%22:1668010012,%22prev_vis_ts%22:0,%22curr_vis_ts%22:1668010012,%22total_page_cnt%22:0,%22prev_page_cnt%22:0,%22curr_page_cnt%22:1}}
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=convr&x=1&uuid2=0&cdata={%22a%22:991000,%22l%22:[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8178278,8178332,8217168,8239623,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],%22i%22:1,%22c%22:7,%22t%22:%22h%22,%22m%22:%22null%22,%22vi%22:0,%22vc%22:0,%22hf%22:0,%22x%22:{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={%22c%22:{%22ref_url%22:%22%22,%22ref_ts%22:0,%22page_url%22:%22%22,%22dm%22:%22%22},%22v%22:{%22vis_cnt%22:0,%22frst_vis_ts%22:1668010012,%22prev_vis_ts%22:0,%22curr_vis_ts%22:1668010012,%22total_page_cnt%22:0,%22prev_page_cnt%22:0,%22curr_page_cnt%22:1}}
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=convr&x=1&uuid2=0&cdata={%22a%22:991000,%22l%22:[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8178278,8178332,8217168,8239623,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],%22i%22:1,%22c%22:7,%22t%22:%22h%22,%22m%22:%22null%22,%22vi%22:0,%22vc%22:0,%22hf%22:0,%22x%22:{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={%22c%22:{%22ref_url%22:%22%22,%22ref_ts%22:0,%22page_url%22:%22%22,%22dm%22:%22%22},%22v%22:{%22vis_cnt%22:0,%22frst_vis_ts%22:1668010012,%22prev_vis_ts%22:0,%22curr_vis_ts%22:1668010012,%22total_page_cnt%22:0,%22prev_page_cnt%22:0,%22curr_page_cnt%22:1}} HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid2=0; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
uuid=5730063680226090022; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node3.tradelab.fr
secure.adnxs.com/bounce?%2Fseg%3Fadd%3D12608265%26t%3D2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/bounce?%2Fseg%3Fadd%3D12608265%26t%3D2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fseg%3Fadd%3D12608265%26t%3D2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
AN-X-Request-Uuid: 50af613d-acac-4990-94e1-3da34f9ddf66
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
its.tradelab.fr/?type=convr&x=1&uuid2=0&cdata={%22a%22:991002,%22l%22:[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],%22i%22:1,%22c%22:7,%22t%22:%22c%22,%22m%22:%22null%22,%22vi%22:0,%22vc%22:0,%22hf%22:0,%22x%22:{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={%22c%22:{%22ref_url%22:%22%22,%22ref_ts%22:0,%22page_url%22:%22%22,%22dm%22:%22%22},%22v%22:{%22vis_cnt%22:0,%22frst_vis_ts%22:1668010012,%22prev_vis_ts%22:0,%22curr_vis_ts%22:1668010012,%22total_page_cnt%22:0,%22prev_page_cnt%22:0,%22curr_page_cnt%22:1}}
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=convr&x=1&uuid2=0&cdata={%22a%22:991002,%22l%22:[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],%22i%22:1,%22c%22:7,%22t%22:%22c%22,%22m%22:%22null%22,%22vi%22:0,%22vc%22:0,%22hf%22:0,%22x%22:{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={%22c%22:{%22ref_url%22:%22%22,%22ref_ts%22:0,%22page_url%22:%22%22,%22dm%22:%22%22},%22v%22:{%22vis_cnt%22:0,%22frst_vis_ts%22:1668010012,%22prev_vis_ts%22:0,%22curr_vis_ts%22:1668010012,%22total_page_cnt%22:0,%22prev_page_cnt%22:0,%22curr_page_cnt%22:1}}
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=convr&x=1&uuid2=0&cdata={%22a%22:991002,%22l%22:[6129654,6129670,6129677,6129705,6140244,6140246,6140363,6141029,6205745,6205752,6205755,6205762,6220830,8124214,8124594,8124968,8124973,8125344,8141760,8141763,8141816,8141850,8141875,8141880,8141931,8141938,8176847,8176869,8176878,8245529,8245533,8245537,8245540,8260100,8445392,8505468,8505515,9271738,9271745,9271969,9272093,9272160,9272905,9408323,9408407,9408587,9408663,9408768,9511553,9611699,9611846,9683342,9683349,9719394,10005812,10226877,10226889,10226919,10244639,10381193,10480996,12967986,12968507,12968515,12968543,12968782,12968784,13104005,13259085],%22i%22:1,%22c%22:7,%22t%22:%22c%22,%22m%22:%22null%22,%22vi%22:0,%22vc%22:0,%22hf%22:0,%22x%22:{}}&advid=2602146&xur=cu17817.tmweb.ru/&adata={%22c%22:{%22ref_url%22:%22%22,%22ref_ts%22:0,%22page_url%22:%22%22,%22dm%22:%22%22},%22v%22:{%22vis_cnt%22:0,%22frst_vis_ts%22:1668010012,%22prev_vis_ts%22:0,%22curr_vis_ts%22:1668010012,%22total_page_cnt%22:0,%22prev_page_cnt%22:0,%22curr_page_cnt%22:1}} HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid2=0; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
uuid=2366923406133529932; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node5.tradelab.fr
secure.adnxs.com/seg?add=2491894:0&t=2
185.89.210.46307 Redirection 0 B URL HTTP/1.1 secure.adnxs.com/seg?add=2491894:0&t=2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /seg?add=2491894:0&t=2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Redirection
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D2491894%3A0%26t%3D2
AN-X-Request-Uuid: 2ca31082-2bd8-4ae5-a568-2c77f1b0d307
Set-Cookie: uuid2=2166006729282898896; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue, 07-Feb-2023 16:07:00 GMT; Domain=.adnxs.com; Secure; HttpOnly
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
ocsp.godaddy.com/
192.124.249.23200 OK 1.8 kB IP 192.124.249.23:0
Hash 4716b9a189999e9aba7a1cdc026cac8b
327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767
dcca736fa4bc33ee0d60df6478a30eb056a945a28e4009f38388551b5eff8e28
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19023
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Tue, 08 Nov 2022 20:24:26 GMT
Expires: Wed, 09 Nov 2022 20:24:26 GMT
ETag: "327ec2a382cb4c68aa21a6272ef3bb3ec2a9a767"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
secure.adnxs.com/bounce?%2Fseg%3Fadd%3D2491894%3A0%26t%3D2
185.89.210.46200 OK 0 B URL HTTP/1.1 secure.adnxs.com/bounce?%2Fseg%3Fadd%3D2491894%3A0%26t%3D2
IP 185.89.210.46:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /bounce?%2Fseg%3Fadd%3D2491894%3A0%26t%3D2 HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.21.3
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
AN-X-Request-Uuid: ed7145b9-6d38-4ac6-8f6c-7a33e76b75a5
X-Proxy-Origin: 91.90.42.154; 91.90.42.154; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
its.tradelab.fr/?type=tp&advid=2602146&uuid=0&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D
62.212.64.229302 Found 0 B URL HTTP/1.1 its.tradelab.fr/?type=tp&advid=2602146&uuid=0&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?type=tp&advid=2602146&uuid=0&adata=%7B%22c%22%3A%7B%22ref_url%22%3A%22%22%2C%22ref_ts%22%3A1668010017%2C%22page_url%22%3A%22cu17817.tmweb.ru%2F%22%2C%22dm%22%3A%22www.labanquepostale.fr%22%7D%2C%22v%22%3A%7B%22vis_cnt%22%3A1%2C%22frst_vis_ts%22%3A1668010012%2C%22prev_vis_ts%22%3A1668010012%2C%22curr_vis_ts%22%3A1668010017%2C%22total_page_cnt%22%3A1%2C%22prev_page_cnt%22%3A1%2C%22curr_page_cnt%22%3A1%7D%7D HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid=5117224732188392789; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
iev0=eJyrVjIyMzAyNDFTsqpWKiopVrIyNDOzMDA0MDAyMDcy0lEqSs4rUbIyADJSSosgDKBIJoRVXACSq60FAHf5EwM=; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Access-Control-Allow-Origin: *
X-Powered-By: Tradelab ITS / node5.tradelab.fr
Location: https://cm.g.doubleclick.net/pixel?google_nid=tradelab_dmp&google_cm
www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D1365721%26conversionId%3D1259489%26fmt%3Dgif%26liSync%3Dtrue
13.107.42.14302 Found 0 B URL HTTP/2 www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D1365721%26conversionId%3D1259489%26fmt%3Dgif%26liSync%3Dtrue
IP 13.107.42.14:0
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D1365721%26conversionId%3D1259489%26fmt%3Dgif%26liSync%3Dtrue HTTP/1.1
Host: www.linkedin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
cache-control: no-cache, no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://px.ads.linkedin.com/collect?pid=1365721&conversionId=1259489&fmt=gif&liSync=true
set-cookie: lang=v=2&lang=en-us; Domain=linkedin.com; Path=/; Secure; SameSite=None
bcookie="v=2&de7fdde9-6120-487c-8c37-cf853b9806a2"; Domain=.linkedin.com; Expires=Thu, 09-Nov-2023 16:07:00 GMT; Path=/; Secure; SameSite=None
bscookie="v=1&202211091607000deabb70-d4a1-4173-815b-172a47eeac99AQEyPAZ5nEE4ecOxac2GiU2z_DZVsaiM"; Domain=.www.linkedin.com; Expires=Thu, 09-Nov-2023 16:07:00 GMT; Path=/; HttpOnly; Secure; SameSite=None
li_gc=MTswOzE2NjgwMTAwMjA7MjswMjEB1ygTxQFhwWDqKudn8BUxvGqQUNpKgUhfYDmIC7ItaA==; Domain=.linkedin.com; Expires=Mon, 08 May 2023 16:07:00 GMT; Path=/; Secure; SameSite=None
lidc="b=OGST09:s=O:r=O:a=O:p=O:g=2371:u=1:x=1:i=1668010020:t=1668096420:v=2:sig=AQGnhmWsN9kshoL-JWfLAHVdY3FblrCk"; Expires=Thu, 10 Nov 2022 16:07:00 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
linkedin-action: 1
content-security-policy: default-src *; connect-src 'self' media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/status linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com *.qualtrics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' teams.microsoft.com client.learningapp.microsoft.com; report-uri /security/csp?e=p&f=t
x-frame-options: sameorigin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-li-fabric: prod-lor1
x-li-pop: afd-prod-lor1-x
x-li-proto: http/2
x-li-uuid: AAXtC9jDy+vTsGk9yK+mcQ==
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: 013501393E84453B98F73FD15C3ED0C5 Ref B: OSL30EDGE0118 Ref C: 2022-11-09T16:07:00Z
date: Wed, 09 Nov 2022 16:07:00 GMT
content-length: 0
X-Firefox-Spdy: h2
cm.g.doubleclick.net/pixel?google_nid=tradelab_dmp&google_cm
142.250.74.162302 Found 285 B URL HTTP/2 cm.g.doubleclick.net/pixel?google_nid=tradelab_dmp&google_cm
IP 142.250.74.162:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Hash 99eacce2df6348525adbb66179b6a122
9ae2089704548b1c8545021a9de724f71fa8fb84
cd793d1e2bdcc66fa07e118627012f0d24684aa085f149eed09b86a06ade7384
GET /pixel?google_nid=tradelab_dmp&google_cm HTTP/1.1
Host: cm.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=tradelab_dmp&google_cm=&google_tc=
date: Wed, 09 Nov 2022 16:07:00 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 285
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 09-Nov-2022 16:22:00 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cm.g.doubleclick.net/pixel?google_nid=tradelab_dmp&google_cm=&google_tc=
142.250.74.162302 Found 256 B URL HTTP/2 cm.g.doubleclick.net/pixel?google_nid=tradelab_dmp&google_cm=&google_tc=
IP 142.250.74.162:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Hash 71887a73cc8a27e417a04a9a689586c0
d3128cba3bfccf3eb54562cccc344d30ca175703
86083e6edab8fa44c3d8b0b5ff3a7292f6bdf16e2a3046f90a285f036b0ce96b
GET /pixel?google_nid=tradelab_dmp&google_cm=&google_tc= HTTP/1.1
Host: cm.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
location: https://its.tradelab.fr/?type=tlsync_dbm&google_error=3
date: Wed, 09 Nov 2022 16:07:00 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 256
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
its.tradelab.fr/?type=tlsync_dbm&google_error=3
62.212.64.229200 OK 43 B URL HTTP/1.1 its.tradelab.fr/?type=tlsync_dbm&google_error=3
IP 62.212.64.229:0
ASN #60781 LeaseWeb Netherlands B.V.
File type GIF image data, version 89a, 1 x 1\012- data
Hash 45cf913e5d9d3c9b2058033056d3dd23
30cb5d44e276505b1d4c053c8b25525da228db30
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
GET /?type=tlsync_dbm&google_error=3 HTTP/1.1
Host: its.tradelab.fr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Wed, 09 Nov 2022 16:07:00 GMT
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uuid=1082002503070557123; Max-Age=7776000; Domain=.tradelab.fr; Path=/; Expires=Tue, 07 Feb 2023 16:07:00 GMT; Secure; SameSite=None
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: *
X-Powered-By: Tradelab ITS / node3.tradelab.fr
px.ads.linkedin.com/collect?pid=1365721&conversionId=1259489&fmt=gif&liSync=true
13.107.42.14200 OK 65 B URL HTTP/2 px.ads.linkedin.com/collect?pid=1365721&conversionId=1259489&fmt=gif&liSync=true
IP 13.107.42.14:0
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
File type GIF image data, version 89a, 1 x 1\012- data
Hash 8b0d5b18476ae12e2476f3621d54c4a5
2ad669e9d207fbb37e84dda25766dbaeb66d792c
2d7244b6960d26ae56f048f162f02949ca7858be19d9349ec82906e56dfa3cfe
GET /collect?pid=1365721&conversionId=1259489&fmt=gif&liSync=true HTTP/1.1
Host: px.ads.linkedin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 65
content-type: image/gif
content-encoding: gzip
vary: Accept-Encoding
set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=ads.linkedin.com; Secure
bcookie="v=2&5120c61c-2ce9-4a28-84a1-8d8b7944ad45"; domain=.linkedin.com; Path=/; Secure; Expires=Thu, 09-Nov-2023 16:07:00 GMT; SameSite=None
lidc="b=TGST09:s=T:r=T:a=T:p=T:g=2413:u=1:x=1:i=1668010020:t=1668096420:v=2:sig=AQGAM0GiRc5fBNq-C5UnfV30qTZOmQoK"; Expires=Thu, 10 Nov 2022 16:07:00 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
linkedin-action: 1
x-li-fabric: prod-ltx1
x-li-pop: afd-prod-ltx1-x
x-li-proto: http/2
x-li-uuid: AAXtC9jHBvrTVkm4zJfwjA==
x-cache: CONFIG_NOCACHE
x-msedge-ref: Ref A: C7D7326604CF4FDDB5A91B2F559A505A Ref B: OSL30EDGE0118 Ref C: 2022-11-09T16:07:00Z
date: Wed, 09 Nov 2022 16:07:00 GMT
X-Firefox-Spdy: h2
halc.iadvize.com/static/livechat/94c8687177ee2e44e5231d66d8c1e421ef9e2036/live.js
54.230.111.32200 OK 0 B URL HTTP/2 halc.iadvize.com/static/livechat/94c8687177ee2e44e5231d66d8c1e421ef9e2036/live.js
IP 54.230.111.32:0
GET /static/livechat/94c8687177ee2e44e5231d66d8c1e421ef9e2036/live.js HTTP/1.1
Host: halc.iadvize.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cu17817.tmweb.ru/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript
date: Mon, 07 Nov 2022 09:37:16 GMT
accept-ranges: bytes
access-control-allow-origin: *
cache-control: public, max-age=31536000
content-encoding: gzip
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: W/"380b1efad0b22d9838924660ac3cf5e2"
last-modified: Fri, 04 Nov 2022 09:02:57 GMT
server: 1ed0121f-f1a9-a28c-2eeb-8d22d42b140d, AmazonS3
strict-transport-security: max-age=31536000;
x-amz-server-side-encryption: AES256
x-amz-version-id: null
vary: Accept-Encoding,Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: rp2CUre2JLuE7q5-BqrG6Ld5cimysqsHH8pKSdi0fF9uPq8BXTS3Sg==
age: 196183
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/wreport_wcm.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/wreport_wcm.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/wreport_wcm.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:37:04 GMT
vary: Accept-Encoding
etag: W/"636a5b80-32de"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/e1e16f7b41.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/e1e16f7b41.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/e1e16f7b41.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:24 GMT
vary: Accept-Encoding
etag: W/"636a5b58-4b10"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/tc_5.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/tc_5.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/tc_5.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:58 GMT
vary: Accept-Encoding
etag: W/"636a5b7a-4bf4f"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/targeting.c6d2c504.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/targeting.c6d2c504.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/targeting.c6d2c504.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:56 GMT
vary: Accept-Encoding
etag: W/"636a5b78-47238"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/bat.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/bat.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/bat.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:22 GMT
vary: Accept-Encoding
etag: W/"636a5b56-6d92"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/inbenta-core.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/inbenta-core.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/inbenta-core.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:34 GMT
vary: Accept-Encoding
etag: W/"636a5b62-8375"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/f.txt
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/f.txt
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/f.txt HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/plain; charset=utf-8
last-modified: Tue, 08 Nov 2022 13:36:28 GMT
vary: Accept-Encoding
etag: W/"636a5b5c-7826"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/base-footer.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/base-footer.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/base-footer.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:20 GMT
vary: Accept-Encoding
etag: W/"636a5b54-c86dd"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/991001.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/991001.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/991001.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:16 GMT
vary: Accept-Encoding
etag: W/"636a5b50-14c0"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/inbenta-prod.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/inbenta-prod.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/inbenta-prod.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:35 GMT
vary: Accept-Encoding
etag: W/"636a5b63-820"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/jquery-3.4.1.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/jquery-3.4.1.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/jquery-3.4.1.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/identif.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:40 GMT
vary: Accept-Encoding
etag: W/"636a5b68-15851"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/base.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/base.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/base.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:21 GMT
vary: Accept-Encoding
etag: W/"636a5b55-54e5"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/1003722.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/1003722.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/1003722.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:10 GMT
vary: Accept-Encoding
etag: W/"636a5b4a-14d3"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/inbenta-common.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/inbenta-common.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/inbenta-common.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:33 GMT
vary: Accept-Encoding
etag: W/"636a5b61-1183"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/base.min.css
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/base.min.css
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
GET /bin/base.min.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/css
last-modified: Tue, 08 Nov 2022 13:36:21 GMT
vary: Accept-Encoding
etag: W/"636a5b55-7f266"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/6545227.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/6545227.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/6545227.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:15 GMT
vary: Accept-Encoding
etag: W/"636a5b4f-18abf"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/tc_4.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/tc_4.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/tc_4.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:56 GMT
vary: Accept-Encoding
etag: W/"636a5b78-df03"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/script.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/script.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/script.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:51 GMT
vary: Accept-Encoding
etag: W/"636a5b73-67e"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/inbenta-search-sdk.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/inbenta-search-sdk.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/inbenta-search-sdk.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:38 GMT
vary: Accept-Encoding
etag: W/"636a5b66-ce85a"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/storage.html
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/storage.html
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/storage.html HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 08 Nov 2022 13:36:52 GMT
etag: W/"7ba-5ecf5a1fc5696"
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/wamfactory_dpm.laposte.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/wamfactory_dpm.laposte.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/wamfactory_dpm.laposte.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:37:03 GMT
vary: Accept-Encoding
etag: W/"636a5b7f-2304"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/f(1).txt
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/f(1).txt
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/f(1).txt HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/plain; charset=utf-8
last-modified: Tue, 08 Nov 2022 13:36:26 GMT
vary: Accept-Encoding
etag: W/"636a5b5a-9aa"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/f(2).txt
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/f(2).txt
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/f(2).txt HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/activityi.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: text/plain; charset=utf-8
last-modified: Tue, 08 Nov 2022 13:36:27 GMT
vary: Accept-Encoding
etag: W/"636a5b5b-753b"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/f(3).txt
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/f(3).txt
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/f(3).txt HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/bin/activityi.html
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:07:00 GMT
content-type: text/plain; charset=utf-8
last-modified: Tue, 08 Nov 2022 13:36:27 GMT
vary: Accept-Encoding
etag: W/"636a5b5b-792"
expires: Sat, 10 Dec 2022 16:07:00 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/tc_6.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/tc_6.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/tc_6.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:58 GMT
vary: Accept-Encoding
etag: W/"636a5b7a-255b7"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/inbenta-search-sdk-space-cowboy.min.css
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/inbenta-search-sdk-space-cowboy.min.css
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
GET /bin/inbenta-search-sdk-space-cowboy.min.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/css
last-modified: Tue, 08 Nov 2022 13:36:36 GMT
vary: Accept-Encoding
etag: W/"636a5b64-b8f0"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/991000.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/991000.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/991000.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:15 GMT
vary: Accept-Encoding
etag: W/"636a5b4f-14d8"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/996576.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/996576.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/996576.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:16 GMT
vary: Accept-Encoding
etag: W/"636a5b50-14c0"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/etc/designs/commons/clientlibs/images/svg-icons.svg
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/etc/designs/commons/clientlibs/images/svg-icons.svg
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /etc/designs/commons/clientlibs/images/svg-icons.svg HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Cookie: _gcl_au=1.1.1732862693.1668010012; tCdebugLib=1; TCPID=1221131665112024118341; cikneeto_uuid=id:dbed657a-38f2-41ad-b38d-e3f6989a2be5
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:59 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Nov 2022 13:39:39 GMT
vary: Accept-Encoding
etag: W/"636a5c1b-42e49"
expires: Sat, 10 Dec 2022 16:06:59 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/script.min.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/script.min.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/script.min.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:51 GMT
vary: Accept-Encoding
etag: W/"636a5b73-480d"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/base-footer.min.css
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/base-footer.min.css
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
GET /bin/base-footer.min.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/css
last-modified: Tue, 08 Nov 2022 13:36:18 GMT
vary: Accept-Encoding
etag: W/"636a5b52-6191"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/privacy_v2_3.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/privacy_v2_3.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/privacy_v2_3.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:49 GMT
vary: Accept-Encoding
etag: W/"636a5b71-9f6c"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/1156839.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/1156839.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/1156839.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:11 GMT
vary: Accept-Encoding
etag: W/"636a5b4b-1383"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/inbenta-core.min.css
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/inbenta-core.min.css
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
GET /bin/inbenta-core.min.css HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: text/css
last-modified: Tue, 08 Nov 2022 13:36:33 GMT
vary: Accept-Encoding
etag: W/"636a5b61-2c92"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2
cu17817.tmweb.ru/bin/991002.js
5.23.50.26200 OK 0 B URL HTTP/2 cu17817.tmweb.ru/bin/991002.js
IP 5.23.50.26:0
Analyzer Verdict Alert openphish La Banque postale
fortinet Phishing
GET /bin/991002.js HTTP/1.1
Host: cu17817.tmweb.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cu17817.tmweb.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx/1.20.2
date: Wed, 09 Nov 2022 16:06:54 GMT
content-type: application/x-javascript
last-modified: Tue, 08 Nov 2022 13:36:17 GMT
vary: Accept-Encoding
etag: W/"636a5b51-14b8"
expires: Sat, 10 Dec 2022 16:06:54 GMT
cache-control: max-age=2678400
content-encoding: gzip
X-Firefox-Spdy: h2