GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
104.18.94.41200 OK 86 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
IP 104.18.94.41:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
Hash 70c202196187ab3c11b4e094c20c6de1
9c52b959e74aee9d79cbc9f35d1f9f65a3b8c863
6255b9231d09ebe6aa1ac19ba46bdd81f3df58989c9ef2e11d6cd6e2e7b21643
GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:39 GMT
content-type: image/png
content-length: 86
priority: u=4,i=?0
server: cloudflare
cf-ray: 9471c3a5cf51568d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
104.18.94.41200 OK 238 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
IP 104.18.94.41:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 238 kB (237720 bytes)
Hash 9ca1aace81e416f094e2488e0524394a
a1bd21c179bf0b574f427e6334b403d10574b3b9
acc39bfbf2eb92e69525fa3e67c24eb01fba9c037f9525466a85a511b006ca84
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
cf-chl: TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 3475
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:39 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: 0o6oXumWeklnBpd9dELTDTaIIVAzpxwPfSkvk6MDmAhZObVWMdJrCJ+Q2f+j8+joo3BGGx7yTRt62etC2LgfHRz2jWtuOklpyIRNyYoDk+Ps1A/U9WwukxlqQle3NkN8FtxfvXFzBdaVT49CLobEW4HA0gWuPhnP4AGeyYf7AR8ehG7v6NWP10Q48rOqmFyr3uNpjymastSwmPinN1Io6GI6g1d9XwPwRTwSWR390ChQ2cQSNYekI+6+ZzCTo9IqHcz+uBaa3qo7FWZqPVr3DMliH7aIhbCljOI+UqQewVeNLFAcPYITLiSdw0QLdLLLdv1kaD7gedpMUlMxgrZSmvd6wDq+gWUHUtwPAWcYIneJtJpFzHKcxk6OLPF6g8e1B940dTM9TwIakKTriPp5LxBG4dfQTVe495RyK+kSURkMWbIcsot3gpP3/4eavmYB83fan8tTc+S2mBdMs63ClhARgrCeK7JxyAyaYAfC3hN2IJoaNsopi0LSBFA48m5sfW6efAYqcsowdpxRB+Ps8aJtBJGHoBh+WZ+7koqlh+JuiqcKY/hzqR6vO/jkwv+yicL8eiXkZALzE936juDlnkFr/ciGFK47JQJ2qIBrmS7tn1ARf3RFsYozQ0KB7F/TlX+SEh9x3Qvr4grEKrXl39KhfDdgE5Jiim8xxkPe5clsm7ssTNgrVMoztOMzEKiQGkMeVdmNqEFqkIGACQ3Gi5Lz5CvA+wMacN0MJeeL8VkiD8dUj2FaEYD1rCgtx5qkPnnmQ3+b//y13aRfOPN+GdKZqilFiS8TYUsKQNyYuhM=$8zBQ4xl4h3FyUjjA+8t85g==
priority: u=3,i=?0
server: cloudflare
cf-ray: 9471c3a878c6568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
104.18.94.41200 OK 4.7 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
IP 104.18.94.41:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type ASCII text, with very long lines (4716), with no line terminators
Hash 9ccac639ac3aa0fbd40d365c8a05b2b3
6bf0748d6faebc5bbda15f588057b78eab1b1a8c
35598e25634396c0f81ff89fe2081ced94cce53657e78c7f03021f99530f9ef2
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
cf-chl: TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 42756
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:50 GMT
content-type: text/html; charset=UTF-8
cf-chl-out-s: BttXCp3YsV5TRioXM5p2JMcsN9qg86KQjAk5sGgsATFyqaExru3L7ItONrK302bCiU7cFsNWwFEVqN3L5ait2LOjDvaJP1IV9IziXzxbcdpEiNmwqZcVD6COsFfKigIVvB0D72vf4wLVCDijTZwv+wIVliWIRcjn07NzUTNHMi3q9pNxrYdqmxHlJCF/2d1+N1t1PgGKYHsSvzsNmVtF/8sXCDrGVWLGOO0HGVGQ2pUMSvV/64t4hxWmi7aVYeRTZofVapP3deO8M6ZlsPjh4h6Timz8td+O4Gy8CpDRX0fdJh4rU6713p7cT4js2CBU9hR3a/QzteSluA8s77Sz6MnA1OPRU0KV0l+zxtQcCX+CDlr1efRtlQLb+QkJarvK5BE+JgpVRvQc0sqHdYgTRWzx3WVNzp/iBAPh24A5p0+zDAnWj8F+WYVf7lrf1jvyVqB6uJEEn7/zokuHFQnzuqE+p/SwBftKSrKajLhNjWcWb1MxqvEiF3n1r5CLwoZMbd+WBdixqRg8Tr9qRAqyK/ilZJNoQ/0pTCua3kkB/+5NtB73kwxxXvA2vljZNQ38KqyHrT/EwilcQAQqaOgeEyvB/r8NtYNHG07enKh5rFkvsG+h819DvODUuxtffz5VA/1vZn34+u9P9TMe0smBCQKXFoniwN3m7PEJrTgeJjRPwnm6V7Kr0C3DRgnLsxCxelTsLPd0pFLvuVUDJ3xcabNlS/LVlcSSuRPmbsYnGpGcHLDTpgJUV8XCCciSCJjXwSgrups6TLG2Fiiqn2nwWfxM3h/FdHg274JdO1x843gK+EDNf4/HX8yR6SeM3Bm6H7UDKvhRCvhfoYOZRRlU6N+d7McwdQjjwmafqTrXxgQ162gWY5uf2TvSXopwkBURoA1o/ue+KXVwW4ovH/4aM+JLYgufwHFtU1GEkfIbCyvHEVFHU4Vcd6ZB49lfpoJ2b2J5tQAU7KEd5emiKYgxCpymmjvFSF6TDbNTsuIlKSMMCp+cMIgRJ0fxppW+D0xL8DcLY1gfp3igSTsXIc6Xp/ijjc1aTIVGGqPouvrjpkuCuyhR0EaOWrNLXcLpYX7TXYr3rZsirM05ydd9u9V2xxxtyTLXJh8RhxKdbpY1fYbfV/DtZ1HVctuMOfGNQrX0eZeF5w0txHFPscrXbMHfBDauKr63CyLtAlFNXRefap3vqobWOge2X3sI8hzZl0KVWV6ZtTu80TSUTChW6v6CzEK89eeV68GsPhoII0oZ793+Gp+0hQGWaQXx6ATxHlxqFisLu1X7zYu1UONp9tYjH2lDMXuyq9FWPksjaUoBoU2E/uq/34U9STkyT62DGKWEmPmFrwnPgq+MVv9te0ZoUSM27IxOf3h6JuZ24oYYou5pI1Jfx5vI29wrWHiGAB8hERP4Mg0xc7OAZGWYBEQmvu3ncLsO7h2Dt6os5jM9WQ5R0b2WFJc7h+P1emMxUPy7$f3rTe7GeZwGKduV4uMXGEA==
cf-chl-out: yQ/oFBkqMSwG/Jud9trd3jRWuejb2qfwTVgX72OG1kX4xmQLm5tliVWQf7bPN/wa/FAr65QUGkB1FtH0A+iD5Q==$7x6NEyK1Q8i/p8q8DK2DPQ==
priority: u=3,i=?0
server: cloudflare
cf-ray: 9471c3e9cc73568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
104.17.25.14200 OK 19 kB URL GET cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
IP 104.17.25.14:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (19015)
Hash 70d3fda195602fe8b75e0097eed74dde
c3b977aa4b8dfb69d651e07015031d385ded964b
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://playback-voicenote.improved.it.com
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 29 May 2025 00:09:50 GMT
content-type: application/javascript; charset=utf-8
content-length: 6157
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 9471c3ed7d1a5689-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-4af4"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 526712
expires: Tue, 19 May 2026 00:09:50 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ThccKyUTmGT%2BNmZ6X7Q%2BhWCOJvbm6Z%2B4TN4b2uDK6ROW7JjLzQQfTmJCRy6A9qO1II%2BpuzF85CWkD%2F89xGesXiRWtR4v%2B8r963Msx79EdBMdN0kd5u1uY5%2BJvBMJv%2BjEr%2BJvqR91"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
142.250.74.170200 OK 86 kB URL GET ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
IP 142.250.74.170:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintE8:3A:D1:2C:16:97:56:94:8B:01:F8:ED:EB:81:17:F8:D7:6C:B2:41
ValidityTue, 29 Apr 2025 19:29:18 GMT - Tue, 22 Jul 2025 19:29:17 GMT
File type JavaScript source, ASCII text, with very long lines (32065)
Hash 2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30028
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 27 May 2025 12:29:07 GMT
expires: Wed, 27 May 2026 12:29:07 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 128444
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
104.18.10.207200 OK 51 kB URL GET stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
IP 104.18.10.207:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectbootstrapcdn.com
Fingerprint73:3E:54:5A:E7:0A:B5:3C:11:79:4A:9F:FE:64:7B:38:B7:15:03:C0
ValidityWed, 14 May 2025 02:01:13 GMT - Tue, 12 Aug 2025 03:00:50 GMT
File type JavaScript source, ASCII text, with very long lines (50758)
Hash 67176c242e1bdc20603c878dee836df3
27a71b00383d61ef3c489326b3564d698fc1227c
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 29 May 2025 00:09:50 GMT
content-type: application/javascript; charset=utf-8
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: US
vary: Accept-Encoding
access-control-allow-origin: *
cache-control: public, max-age=31919000
content-encoding: br
etag: "67176c242e1bdc20603c878dee836df3"
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 10/04/2024 02:53:43
cdn-edgestorageid: 1029
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requesttime: 1
cdn-requestid: c6c8a086d090f1d2baac8a7b0c894894
cdn-cache: HIT
cf-cache-status: HIT
age: 1627396
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 9471c3ed8aa35688-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET playback-voicenote.improved.it.com/VRftO
104.21.73.98301 Moved Permanently 2.6 kB URL User Request GET playback-voicenote.improved.it.com/VRftO
IP 104.21.73.98:443
Certificate IssuerGoogle Trust Services
Subjectimproved.it.com
Fingerprint12:CC:7A:9A:7E:AF:94:CC:22:CF:87:F5:D9:38:4C:33:3C:93:37:8F
ValidityWed, 07 May 2025 14:10:22 GMT - Tue, 05 Aug 2025 15:09:16 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - FlowerStorm Phishing Kit
GET /VRftO HTTP/1.1
Host: playback-voicenote.improved.it.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Thu, 29 May 2025 00:09:38 GMT
content-type: text/html; charset=iso-8859-1
location: http://playback-voicenote.improved.it.com/VRftO/
server: cloudflare
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QpouQyVRwDEEJOl2h1FNlV8yH0rPFPIoYrFxVhRPPdI2Jz9ert9Z89fq7z9w1s%2FJ9mACQ7hN8KOOWrYFoet3wNHc34gfk35NcY%2FKvC04XegrS%2FPOBWFwhTQTHYoX7Lrr"}]}
cf-ray: 9471c3a08973b4f1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/turnstile/v0/api.js
104.18.94.41302 Found 48 kB URL GET challenges.cloudflare.com/turnstile/v0/api.js
IP 104.18.94.41:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Thu, 29 May 2025 00:09:39 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/g/6fab0cec561d/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 9471c3a36a4956c5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET 5334635671-1317754460.cos.eu-frankfurt.myqcloud.com/bootstrap.min.js
43.158.112.114200 OK 559 kB URL GET 5334635671-1317754460.cos.eu-frankfurt.myqcloud.com/bootstrap.min.js
IP 43.158.112.114:443
ASN #132203 Tencent Building, Kejizhongyi Avenue
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGlobalSign nv-sa
Subject*.cos.eu-frankfurt.myqcloud.com
Fingerprint5D:6B:83:19:D3:CF:26:95:9A:15:AD:12:4C:FA:7A:A2:B5:80:79:D5
ValidityMon, 24 Feb 2025 08:16:09 GMT - Sat, 28 Mar 2026 08:16:08 GMT
File type JavaScript source, ASCII text, with very long lines (65474), with CRLF line terminators
Size 559 kB (559062 bytes)
Hash 5cd5c30bd3c18b2054c94d303e5e82ca
8441342fd36dda929ff892db8ff2e57266c094a0
3d03c684031cda0a22c2ec0697f2f9f5dbd1cad4d2764e55d79024353f628dfb
Analyzer Verdict Alert urlquery phishing Phishing - FlowerStorm Phishing Kit
GET /bootstrap.min.js HTTP/1.1
Host: 5334635671-1317754460.cos.eu-frankfurt.myqcloud.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 559062
Connection: keep-alive
Accept-Ranges: bytes
Content-Disposition: attachment
Date: Thu, 29 May 2025 00:09:52 GMT
ETag: "5cd5c30bd3c18b2054c94d303e5e82ca"
Last-Modified: Wed, 07 May 2025 19:20:06 GMT
Server: tencent-cos
x-cos-force-download: true
x-cos-hash-crc64ecma: 12068534500209866467
x-cos-request-id: NjgzN2E1Y2ZfZGEzMDMyMDlfMTM1ZGZfMjc5YzdkOQ==
POST 5334635671.cfd/next.php
162.241.121.156200 OK 16 B IP 162.241.121.156:443
ASN #19871 NETWORK-SOLUTIONS-HOSTING
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerLet's Encrypt
Subject5334635671.cfd
Fingerprint79:74:A6:01:B6:BE:A2:12:D2:EC:19:E5:49:EF:13:E7:15:49:76:85
ValidityWed, 07 May 2025 17:09:24 GMT - Tue, 05 Aug 2025 17:09:23 GMT
Hash 1f57cbd1f1a1ced8f62d34242408414c
52279c54b16f0a88d43d57b4cbb9813ea3cc39ab
c462d460eab61de19f36cc384c99666e5bf65eaeba0c12b8f594c5410c01f220
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - FlowerStorm Phishing Kit
POST /next.php HTTP/1.1
Host: 5334635671.cfd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://playback-voicenote.improved.it.com/
Content-Type: application/x-www-form-urlencoded
Content-Length: 13
Origin: https://playback-voicenote.improved.it.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 May 2025 00:09:52 GMT
Server: Apache
Access-Control-Allow-Origin: https://playback-voicenote.improved.it.com
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/9471c3a4dea8568d/1748477379939/04f74ac015dce5e60bfe3a8dd6e0cbbdd7980bc8a448fae89ce842b73e03d3f8/ote83bx6owPlTce
104.18.94.41401 Unauthorized 1 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/9471c3a4dea8568d/1748477379939/04f74ac015dce5e60bfe3a8dd6e0cbbdd7980bc8a448fae89ce842b73e03d3f8/ote83bx6owPlTce
IP 104.18.94.41:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type very short file (no magic)
Hash ff44570aca8241914870afbc310cdb85
58668e7669fd564d99db5d581fcdb6a5618440b5
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
GET /cdn-cgi/challenge-platform/h/g/pat/9471c3a4dea8568d/1748477379939/04f74ac015dce5e60bfe3a8dd6e0cbbdd7980bc8a448fae89ce842b73e03d3f8/ote83bx6owPlTce HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 401 Unauthorized
date: Thu, 29 May 2025 00:09:45 GMT
content-type: text/plain; charset=utf-8
content-length: 1
www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gBPdKwBXc5eYL_jqN1uDLvdeYC8ikSPronOhCtz4D0_gAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAscjm_UO_k901rNdCKgLw5bvI4i6M_jDNCIXpfs2LRbtxwLOrUyplqVvML_hVlB5tIDMuj0ihhaOFHose-Y0_UjQnNUGE_vol46VvGgscTMtTjU4xINriap8AMTIygvljEBt6my-nBwkUGhY3U9v5iKC-eWR5bTfvrqFsuIVxafkSfhHqDXB4KLGNjvOOV71GGJ9x4yxA-C2OcULZ1uDDKuvAaMhuiWdF6OzSTXruP9yPg1vmuteavOW1re0YDbCbtK16PhHdSzWym7v_FrvId-2zf26j50FlTd_vl_DcKNDVCgWDoU0uX3cU6V3rSQoVXREEqPr-2ywSGru8ZuXRoQIDAQAB", max-age=20, PrivateToken challenge="AAIAHXNhdC5wYXQtaXNzdWVyLmNsb3VkZmxhcmUuY29tIAT3SsAV3OXmC_46jdbgy73XmAvIpEj66JzoQrc-A9P4ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAsLS4HBnLGydwK-bLQGRCaoyMsrXBRrDgQVmxS06j3UF0nYSd6GdTGCKIu1WV60eg-tJtTttfEVq7wHVQf4vzjYBidmCh88ebzxKv2GB6PESSodf5MsEup9xd5dxpkYScgL1CCJq89kRrOQ_CS61bvkL_oGyZf4ffqG5THgaOsopqj8dFLH6_SMy9yf8EgMYqpyjxfKsD-1_qb1m1DRjJEKPWKIGwmHXIKQJUqsxZFm4_Inwkxx7QMpVP4GyqlTxFVz7stWwJRSkMLHjEM_IWLUYfPhuwIUVqmRjGsY1n8flA1bRfxaWHNDxoi25-M2BKTP9NkNNJBbTKErhrZ9LGywIDAQAB", max-age=20, PrivateToken challenge="AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIAT3SsAV3OXmC_46jdbgy73XmAvIpEj66JzoQrc-A9P4ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEA1r6z50Qwapjvi7gKQBPiehOkJb40cvj8RgN_zo7Ag1Zt0ItIZ08z6yBoyxcQd_a3O1eJagQvs0q2WZqQcXhBy3zBsvQBUQF8QxmVXDj3rgtzSqQSahQmiLHDl8Bcv0QZEdy4zOIIyDuI5UyRXhX7XZGrCVD8CZ90xBA5BKM69472-2BHpBla9Lbeh9YUrkZ5O98MUI_u6VEapusnXAf_lwrQA8tyF-9S11SxHG6uu9ywb9GCpVeaxdoonr9TgwPU5JgXSFuW_Ow1I_O2alIJcGt4Lb8SBKG-hKMrnxnwzFPje27Rczkpqu7PtgYXJvH_uDRKG-nqq_rghxAOH_kchwIDAQAB", max-age=20
priority: u=4,i=?0
server: cloudflare
cf-ray: 9471c3cc4d92568d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
104.18.94.41200 OK 28 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
IP 104.18.94.41:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type ASCII text, with very long lines (28076), with no line terminators
Hash c4e099de48c6720b61e6f0451b96190a
be3333a970af4c1aa9495feae19963187f9baa42
67ad9228e4c5e5e53f1e0f43c7720bfb2c6704555beae8c37cf31489498bfd3e
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1915962991:1748475252:bTjungZ--rSZQrcBastgXYJ7b0qaLg_aLYmSq_Tu2vs/9471c3a4dea8568d/TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
cf-chl: TW3yzXPB2K3nw_wd_PtelwLFq3I7XtYnlyIQqa8ZbxE-1748477379-1.2.1.1-9sUxLu5cdBdl_mzY8QYQ4iV8q3WTjrhSQRMUfDpVJ8tWHCdlNFt5FpSmP3kjXoN1
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 34117
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:46 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: FD4ltJxdrluUtEQqJrnMpZv0GKmwiGayShifVGo2ZJGtbvqHMfJlk6pe6imkftGf$sA1ZMjiMJKjdmfB5xSTg1w==
priority: u=3,i=?0
server: cloudflare
cf-ray: 9471c3cfdf5b568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET code.jquery.com/jquery-3.2.1.slim.min.js
151.101.194.137200 OK 70 kB URL GET code.jquery.com/jquery-3.2.1.slim.min.js
IP 151.101.194.137:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (32012)
Hash 5f48fc77cac90c4778fa24ec9c57f37d
9e89d1515bc4c371b86f4cb1002fd8e377c1829f
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
GET /jquery-3.2.1.slim.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://playback-voicenote.improved.it.com
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-10fdd"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 29 May 2025 00:09:51 GMT
age: 1940644
x-served-by: cache-lga21963-LGA, cache-hel1410024-HEL
x-cache: HIT, HIT
x-cache-hits: 38, 3853
x-timer: S1748477391.009753,VS0,VE0
vary: Accept-Encoding
content-length: 23856
X-Firefox-Spdy: h2
GET aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
13.107.246.53200 OK 1.6 kB URL GET aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
IP 13.107.246.53:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint38:05:DB:30:B5:83:1A:A0:A9:AD:24:B2:62:0F:E7:F6:60:9B:7C:00
ValidityTue, 29 Oct 2024 00:00:00 GMT - Wed, 29 Oct 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash 4e48046ce74f4b89d45037c90576bfac
4a41b3b51ed787f7b33294202da72220c7cd2c32
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 29 May 2025 00:10:03 GMT
content-type: image/svg+xml
content-length: 621
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Tue, 10 Nov 2020 03:41:24 GMT
etag: 0x8D8852A7FA6B761
x-ms-request-id: b4779ebc-301e-001a-33dd-cad536000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20250529T001003Z-15f95fb758cfn5vchC1SVGcnp80000000nqg000000005e5h
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/turnstile/v0/g/6fab0cec561d/api.js
104.18.94.41200 OK 48 kB URL GET challenges.cloudflare.com/turnstile/v0/g/6fab0cec561d/api.js
IP 104.18.94.41:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type JavaScript source, ASCII text, with very long lines (48199)
Hash 3946a8b345d6020f3f424ae5f37e818f
27267dd319814b647f04bfe0ae09e1ca51ddc896
a7fdcf655a6349724c367f366c852b2e0309e9ad7a25b376df82a48e1dd98482
GET /turnstile/v0/g/6fab0cec561d/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://playback-voicenote.improved.it.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 29 May 2025 00:09:39 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Mon, 12 May 2025 13:39:20 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 9471c3a38a6056c5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9471c3a4dea8568d&lang=auto
104.18.94.41200 OK 125 kB URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9471c3a4dea8568d&lang=auto
IP 104.18.94.41:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 125 kB (125330 bytes)
Hash 677e070b600e99df5290c4651bd7c2c5
7ff019338d6496709d9c32aed73e6477738e78d3
b7473fcf33dcc9ba9b3f21903e6cfe20146055977a5994cd8fa8cbddf09c0d03
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9471c3a4dea8568d&lang=auto HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:39 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
priority: u=3,i=?0
server: cloudflare
cf-ray: 9471c3a5ff65568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET playback-voicenote.improved.it.com/favicon.ico
104.21.73.98404 Not Found 196 B URL GET playback-voicenote.improved.it.com/favicon.ico
IP 104.21.73.98:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectimproved.it.com
Fingerprint12:CC:7A:9A:7E:AF:94:CC:22:CF:87:F5:D9:38:4C:33:3C:93:37:8F
ValidityWed, 07 May 2025 14:10:22 GMT - Tue, 05 Aug 2025 15:09:16 GMT
File type HTML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - FlowerStorm Phishing Kit
GET /favicon.ico HTTP/1.1
Host: playback-voicenote.improved.it.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/VRftO/
Cookie: PHPSESSID=c4h3bf0bdqhv1k5ajemt8kqacm
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Thu, 29 May 2025 00:09:39 GMT
content-type: text/html; charset=iso-8859-1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GN06sueg%2BVDEOw4gOtzgiGyvftmGG69ZVlfswzRX1P2v6DmheIQ7GeWmv0bcZ0vRcNuOJzrmT4cv%2Bk21W1LbnpQp2eQVQqtSKvGxu1QakT6Trh18qz4jjj%2BP0SOyVIrCKPuoYLbq%2BqBJeGAsbHlXR5hSaal3"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-cache-status: MISS
content-encoding: br
cf-ray: 9471c3a4dc02712a-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4165&min_rtt=864&rtt_var=2154&sent=127&recv=144&lost=0&retrans=0&sent_bytes=9994&recv_bytes=8347&delivery_rate=559477&cwnd=12000&unsent_bytes=0&cid=87d43664c55c4890&ts=681&x=80"
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/9471c3a4dea8568d/1748477379934/Utwhf0skNApE4OO
104.18.94.41200 OK 267 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/9471c3a4dea8568d/1748477379934/Utwhf0skNApE4OO
IP 104.18.94.41:443
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type PNG image data, 77 x 28, 8-bit/color RGBA, non-interlaced
Hash 962dfe1830932a43a7002a2065716619
35f1e5e2313844a0926fd41643316124d0ffeeb8
9b9b937d55e524bcb53e038f619c1df9255fa82d3a40f4c7893cc0155e27f4b6
GET /cdn-cgi/challenge-platform/h/g/d/9471c3a4dea8568d/1748477379934/Utwhf0skNApE4OO HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:45 GMT
content-type: image/png
content-length: 267
priority: u=4,i=?0
server: cloudflare
cf-ray: 9471c3c89bb2568d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST playback-voicenote.improved.it.com/VRftO/
104.21.73.98200 OK 7.8 kB URL User Request POST playback-voicenote.improved.it.com/VRftO/
IP 104.21.73.98:443
Certificate IssuerGoogle Trust Services
Subjectimproved.it.com
Fingerprint12:CC:7A:9A:7E:AF:94:CC:22:CF:87:F5:D9:38:4C:33:3C:93:37:8F
ValidityWed, 07 May 2025 14:10:22 GMT - Tue, 05 Aug 2025 15:09:16 GMT
File type JavaScript source, ASCII text, with very long lines (7672)
Hash 8f3727bb18f6b04c36a0389ad4119c21
d8e5888fffa58f83943dcfdce7955b05ebe9a206
2526e3a7e306d10f4dbe4675d9b0b573df381cd29efc6e44d46def45ded92cc1
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - FlowerStorm Phishing Kit
POST /VRftO/ HTTP/1.1
Host: playback-voicenote.improved.it.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 944
Origin: https://playback-voicenote.improved.it.com
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/VRftO/
Cookie: PHPSESSID=c4h3bf0bdqhv1k5ajemt8kqacm
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:50 GMT
content-type: text/html; charset=UTF-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9LoladCioM8nU1InZF2zU3WMjLi2gDnjOCmTX1Bj31RGEKesRs1uK0WqgzeVcOKkIrBaRmyveHsZO7UIOTXl7VTWFQFwIr3sQq98GIcV3sjgh2B91NSPdg6YVxRUoeMWwAqJkt2yDwDl18qyVxJ8DZwRh7Yx"}],"group":"cf-nel","max_age":604800}
x-powered-by: PHP/8.0.30
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
content-encoding: br
cf-ray: 9471c3ea6d4e712a-OSL
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4077&min_rtt=864&rtt_var=1791&sent=129&recv=147&lost=0&retrans=0&sent_bytes=10860&recv_bytes=9822&delivery_rate=559477&cwnd=12000&unsent_bytes=0&cid=87d43664c55c4890&ts=12143&x=80"
GET maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
104.18.10.207200 OK 49 kB URL GET maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
IP 104.18.10.207:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectbootstrapcdn.com
Fingerprint73:3E:54:5A:E7:0A:B5:3C:11:79:4A:9F:FE:64:7B:38:B7:15:03:C0
ValidityWed, 14 May 2025 02:01:13 GMT - Tue, 12 Aug 2025 03:00:50 GMT
File type JavaScript source, ASCII text, with very long lines (48664)
Hash 14d449eb8876fa55e1ef3c2cc52b0c17
a9545831803b1359cfeed47e3b4d6bae68e40e99
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://playback-voicenote.improved.it.com
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 29 May 2025 00:09:51 GMT
content-type: application/javascript; charset=utf-8
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
vary: Accept-Encoding
access-control-allow-origin: *
cache-control: public, max-age=31919000
content-encoding: br
etag: "14d449eb8876fa55e1ef3c2cc52b0c17"
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-cachedat: 03/22/2025 12:19:15
cdn-proxyver: 1.22
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1048
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requesttime: 0
cdn-requestid: 841981d279d073e4a9feea9aa0334927
cdn-cache: HIT
cf-cache-status: MISS
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 9471c3ed8b0db4ee-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET playback-voicenote.improved.it.com/favicon.ico
104.21.73.98404 Not Found 196 B URL GET playback-voicenote.improved.it.com/favicon.ico
IP 104.21.73.98:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectimproved.it.com
Fingerprint12:CC:7A:9A:7E:AF:94:CC:22:CF:87:F5:D9:38:4C:33:3C:93:37:8F
ValidityWed, 07 May 2025 14:10:22 GMT - Tue, 05 Aug 2025 15:09:16 GMT
File type HTML document, ASCII text
Hash 62962daa1b19bbcc2db10b7bfd531ea6
d64bae91091eda6a7532ebec06aa70893b79e1f8
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - FlowerStorm Phishing Kit
GET /favicon.ico HTTP/1.1
Host: playback-voicenote.improved.it.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/VRftO/
Cookie: PHPSESSID=c4h3bf0bdqhv1k5ajemt8kqacm
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Thu, 29 May 2025 00:09:52 GMT
content-type: text/html; charset=iso-8859-1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=18MyurMp5ddUCje%2FHBjUOhjR2I8mNMb5DpQgc68Fj3ifh9kPoS%2FRFvzVJOc9QllOEsyreWnXUnL3vKba7s1N9cFd939OarPVe%2BeGuDLyvJ4U88yEW4eCEV6I8yzEtA6YCwjgrVxQczbthHNS3weKzcn8GYal"}],"group":"cf-nel","max_age":604800}
age: 13
cache-control: max-age=14400
cf-cache-status: HIT
content-encoding: br
cf-ray: 9471c3f81d8c712a-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3704&min_rtt=864&rtt_var=2090&sent=136&recv=149&lost=0&retrans=0&sent_bytes=15184&recv_bytes=10207&delivery_rate=2762937&cwnd=12000&unsent_bytes=0&cid=87d43664c55c4890&ts=13957&x=80"
GET aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
184.31.15.178200 OK 1.9 kB URL GET aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
IP 184.31.15.178:443
ASN #20940 Akamai International B.V.
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerMicrosoft Corporation
Subjectidnaakamaicdn.msftauth.net
FingerprintDC:51:C1:FA:8A:C3:85:DA:8E:3C:1C:06:37:00:90:7A:B4:62:A9:DC
ValidityFri, 27 Dec 2024 18:21:36 GMT - Mon, 22 Dec 2025 18:21:36 GMT
File type SVG Scalable Vector Graphics image
Hash bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 673
content-type: image/svg+xml
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
last-modified: Wed, 15 Jan 2025 17:54:26 GMT
accept-ranges: bytes
etag: "0x8DD358DA72AAF33"
x-ms-request-id: 6471a91d-601e-0074-7d76-67603e000000
x-ms-version: 2018-03-28
access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version
access-control-allow-origin: *
cache-control: public, max-age=20022310
date: Thu, 29 May 2025 00:10:03 GMT
vary: Accept-Encoding
akamai-grn: 0.860f1fb8.1748477403.319a9cef
X-Firefox-Spdy: h2
GET playback-voicenote.improved.it.com/VRftO/
104.21.73.98301 Moved Permanently 2.6 kB URL User Request GET playback-voicenote.improved.it.com/VRftO/
IP 104.21.73.98:80
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - FlowerStorm Phishing Kit
GET /VRftO/ HTTP/1.1
Host: playback-voicenote.improved.it.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Thu, 29 May 2025 00:09:38 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 29 May 2025 01:09:38 GMT
Location: https://playback-voicenote.improved.it.com/VRftO/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFF1QriIbgpbLbwOWkPwkt6n8SjhXGCDFik6tCo5FiytYFIUsXCXR2tlQx6HMWVSXSpcHE61r0mYg%2Fv0O3%2BH374D03bGBRm4vXEh6EGqFt3T%2B09g70EmLdzfce0FOf%2FRV%2FDOoMK0yRBZUI4OY13NZOJBoH7N"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 9471c3a0f90656bd-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=423&min_rtt=423&rtt_var=211&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=425&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
GET playback-voicenote.improved.it.com/VRftO/
104.21.73.98200 OK 2.6 kB URL User Request GET playback-voicenote.improved.it.com/VRftO/
IP 104.21.73.98:443
Certificate IssuerGoogle Trust Services
Subjectimproved.it.com
Fingerprint12:CC:7A:9A:7E:AF:94:CC:22:CF:87:F5:D9:38:4C:33:3C:93:37:8F
ValidityWed, 07 May 2025 14:10:22 GMT - Tue, 05 Aug 2025 15:09:16 GMT
File type HTML document, ASCII text
Hash 550250e3ea5fb8e572a054f8062e5653
1be9e0cd4f38ebc396b8ec2be34049e20b6df63d
5c739bc07e3512eab25d48ad03724fa7fd4310f14a45b2294f8659c7f1abcdb7
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - FlowerStorm Phishing Kit
GET /VRftO/ HTTP/1.1
Host: playback-voicenote.improved.it.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 29 May 2025 00:09:38 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
x-powered-by: PHP/8.0.30
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XZYBJEcwi0vbdiI%2BUpaHMKITuBUTm2qHi14NG02fl0g3vlfUGL8FOAuvifUKM1ipXTciAvGsW00aKzYP6kdhB70ZORyvejEASyJt%2BZjaKMcB8datFVV64oMwsecNd1WF"}]}
content-encoding: br
set-cookie: PHPSESSID=c4h3bf0bdqhv1k5ajemt8kqacm; Path=/
cf-ray: 9471c3a119c8b4f1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
104.18.94.41200 OK 28 kB URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/
IP 104.18.94.41:443
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
Fingerprint66:48:DF:B4:8B:9D:6A:8C:3A:B7:0F:CF:92:C7:AF:56:B9:3D:A2:1C
ValidityTue, 29 Apr 2025 17:49:00 GMT - Mon, 28 Jul 2025 18:48:58 GMT
File type HTML document, ASCII text, with very long lines (22245)
Hash 8f8f6b310438bff1ca76b2446cb87f57
a57a9979cfa1b8e22e1e573fa4ec173872cd27e0
42955771918df936c27feadab58fd120886f32cf769e32690633f732a5c56aad
GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/hcd3k/0x4AAAAAABbV9LNCnCnaB5ev/auto/fbE/new/normal/auto/ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 29 May 2025 00:09:39 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
content-security-policy: default-src 'none'; script-src 'nonce-hKLZHakWm46mx6yX' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
referrer-policy: same-origin
document-policy: js-profiling
priority: u=4,i=?0
server: cloudflare
cf-ray: 9471c3a4dea8568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
13.107.246.53200 OK 17 kB URL GET aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
IP 13.107.246.53:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://playback-voicenote.improved.it.com/VRftO/
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint38:05:DB:30:B5:83:1A:A0:A9:AD:24:B2:62:0F:E7:F6:60:9B:7C:00
ValidityTue, 29 Oct 2024 00:00:00 GMT - Wed, 29 Oct 2025 23:59:59 GMT
File type MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Hash 12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
GET /ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://playback-voicenote.improved.it.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 29 May 2025 00:10:03 GMT
content-type: image/x-icon
content-length: 17174
cache-control: public, max-age=604800
last-modified: Fri, 02 Nov 2018 20:25:25 GMT
etag: 0x8D6410152A9D7E1
x-ms-request-id: cf1fd13b-f01e-000d-0eec-ca0b82000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20250529T001003Z-15f95fb758cfn5vchC1SVGcnp80000000nqg000000005e5k
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2