Overview

URLd3qvh4.ellissu.ru/Mjchiasson@triparishinc.com/
IP 188.114.96.1 (Colombia)
ASN#13335 CLOUDFLARENET
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-26 14:49:39 UTC
StatusLoading report..
IDS alerts0
Blocklist alert2
urlquery alerts No alerts detected
Tags None

Domain Summary (2)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
challenges.cloudflare.com (6) 0 2021-10-20 07:02:03 2023-05-26 08:33:42 3858 335391 104.18.6.185
d3qvh4.ellissu.ru (5) 0 2023-05-15 21:57:09 2023-05-24 07:30:34 2462 74178 188.114.97.1

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-26 medium d3qvh4.ellissu.ru/Mjchiasson@triparishinc.com/ Phishing
2023-05-26 medium d3qvh4.ellissu.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/1118774366:168511 (...) Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 188.114.96.1
Date UQ / IDS / BL URL IP
2023-06-06 04:58:21 UTC 0 - 2 - 0 nameline24.top/ 188.114.96.1
2023-06-06 04:55:30 UTC 0 - 2 - 0 ydkb.io/YDKBs-reflash.zip 188.114.96.1
2023-06-06 04:42:06 UTC 0 - 2 - 0 yamileth98bluarejhen.bluemandolinrejhen.life/ (...) 188.114.96.1
2023-06-06 04:00:51 UTC 0 - 1 - 0 realityelaboration.top/ 188.114.96.1
2023-06-06 03:34:12 UTC 0 - 10 - 5 watchpsychonline.net/ 188.114.96.1


Last 5 reports on ASN: CLOUDFLARENET
Date UQ / IDS / BL URL IP
2023-06-06 05:32:32 UTC 0 - 0 - 1 wizedeal.com/click/v2/mj/rd/?step=noref&tg2=6 (...) 172.67.211.54
2023-06-06 05:31:40 UTC 0 - 0 - 4 fgrju.com/hittest.php?a=rhaFjkYOm2RJaJa&id=0/ 104.21.20.164
2023-06-06 05:30:58 UTC 0 - 3 - 0 arms-group.org/ 104.21.60.21
2023-06-06 05:17:14 UTC 2 - 0 - 0 cdn.discordapp.com/attachments/11142840217829 (...) 162.159.135.233
2023-06-06 05:26:27 UTC 0 - 2 - 0 batut.ua/country/crmbofa/36bd4242fe299147a2c5 (...) 172.67.170.38


Last 1 reports on domain: triparishinc.com
Date UQ / IDS / BL URL IP
2023-05-26 14:49:39 UTC 0 - 0 - 2 d3qvh4.ellissu.ru/Mjchiasson@triparishinc.com/ 188.114.96.1


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 04:23:26 UTC 0 - 1 - 0 yuen.de/UPS-Invoice-for-downloads-919/ 81.169.145.92
2023-06-06 04:22:55 UTC 0 - 1 - 2 212.83.186.136/setup-15.exe 212.83.186.136
2023-06-06 04:22:25 UTC 0 - 1 - 0 hansworst.xyz/Flappy%20Hans.exe 103.224.182.210
2023-06-06 04:14:09 UTC 0 - 6 - 0 cdd.net.ua/apothecary/login.php?action=proces (...) 89.184.88.6
2023-06-06 04:12:45 UTC 0 - 0 - 2 sispar4cbms.com/huntington/login.php?online_i (...) 138.128.170.234

JavaScript

Executed Scripts (7)

Executed Evals (2)
#1 JavaScript::Eval (size: 562) - SHA256: 63d62b5b9b253681f643f9c47990b91cced5e132d69737d3fbe5eb34309ed101
+((!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![] + []) + (!+[] + (!![]) - []) + (!+-[] + (+-!![]) + -[]) + (!+[] + (!![]) + (!![]) + !![]) + (-~~~[]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) - []) + (!+[] + (!![]) + (!![]))) / +((!+[] + (!![]) + (!![]) + !![] + !![] + []) + (-~~~[]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![] + !![] + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![]) + (!+[] + (!![]) + (!![]) + !![] + !![]) + (!+[] + (!![]) + (!![]) + !![]))
#2 JavaScript::Eval (size: 4) - SHA256: 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408
this

Executed Writes (1)
#1 JavaScript::Write (size: 3575) - SHA256: 36d48aeb87174dbf8b0ea333d2042d9e198797bd33c3f849597981eacd619515
< html > < head > < style > # pr1 {
    border: solid 2.715 px;border - color: green;padding: 3.98 px;margin - left: 12.12 px;
}
# pr2 {
    border: solid 2 px;border - color: purple;font - size: 30 px;margin - top: 200 px; - webkit - transform: skewY(23.1753218 deg); - moz - transform: skewY(23.1753218 deg); - ms - transform: skewY(23.1753218 deg); - o - transform: skewY(23.1753218 deg);transform: skewY(23.1753218 deg);
}
# pr3 {
    border: solid 2.89 px;border - color: orange;font - size: 45 px;transform: scale(100000000000000000000009999999999999.99, 1.89);margin - top: 50 px;
}
# pr4 {
    border: solid 2 px;border - color: silver;transform: matrix(1.11, 2.0001, -1.0001, 1.009, 150, 94.4); - webkit - transform: matrix(0.95559, 2.13329, -0.9842, 0.98423, 150, 95); - moz - transform: matrix(0.66371, 1.94587, -0.6987, 0.98423, 150, 103.238); - ms - transform: matrix(0.5478, 1.94587, -0.7383, 0.98423, 150, 100.569); - o - transform: matrix(0.4623, 1.83523, -0.6734, 0.81231, 150, 99.324);position: absolute;margin - top: 11.1331 px;margin - left: 12.1212 px;padding: 4.4545 px;left: 239.4141 px;top: 178.5050 px;
}
# pr5 {
    border: solid 2 pt;border - color: red;margin - left: 42.395 pt;
}
caption {
    border: solid 2 px;border - color: darkred;font - size: 20.99 px;margin - left: 20.8 px;
}
# pr6 {
    border: solid 2 px;border - color: darkblue; - webkit - transform: perspective(12890 px) translateZ(101.5 px); - moz - transform: perspective(12890 px) translateZ(101.5 px); - ms - transform: perspective(12890 px) translateZ(101.5 px); - o - transform: perspective(12890 px) translateZ(101.5 px);transform: perspective(12890 px) translateZ(101.5 px);padding: 12 px;
}
# pr7 {
    position: absolute;margin - top: -350.552 px;margin - left: 0.9099 rem;border: solid 2 px;border - color: burlywood;
}
# pr8 {
    position: absolute;margin - top: -150.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: sandybrown;
}
# pr9 {
    position: absolute;margin - top: -110.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: orchid;
}
# pr10 {
    position: absolute;margin - top: -315.552 px;margin - left: 15.9099 rem;border: solid 2 px;border - color: turquoise;
} < /style></head > < body > < div id = "pr1" > Ssss tttt < /div>       <div id="pr2">TTTT tttt</div > < div id = "pr3" > WW & nbsp & nbsp; & nbsp; & nbsp; & nbsp; & nbsp;
ssss tttt < /div>       <div id="pr4">vvvv sssss ttttt tttt</div > < table id = "pr5" > < caption > ttttt cccc tttt < /caption>         <thead>         <tr>             <th>tttt hhhh</th > < /tr>         </thead > < tbody > < tr > < td > tttt bbbb < /td>         </tr > < /tbody>     </table > < div id = "pr6" > ttttt pppp tttt tttt < /div>     <div id="pr7">         <select>         <option>sss ooo</option > < /select>     </div > < div id = "pr8" > < details > < summary > dddd ssss < /summary>         </details > < /div>     <div id="pr9">         <progress value="49" max="100"></progress > < /div>     <div id="pr10">         <button type="button"></button > < /div>     <script>parent._cf_gcr();</script > < /body></html >


HTTP Transactions (11)


Request Response
                                        
                                            GET /Mjchiasson@triparishinc.com/ HTTP/1.1 
Host: d3qvh4.ellissu.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.97.1
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:49:22 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F33%2BzW1Q4LUuf%2F1NKsc2m9LgRc1khFd9yjVFH0NZJ76SSpVpsfAspKHXiIRDDNLaSe5wNRuLZn4O6mZcTB95tVWtU8qKZsshAt1OzG14G%2BY3XZWawajb5W9erudduk8Rei3dLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6d30949e4b50f-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1747), with CRLF, LF line terminators
Size:   3587
Md5:    945d8afab361493f5d448fa338d1341e
Sha1:   72b12f888fdcaac1663db52222c81f821089fbd1
Sha256: 54737f54067255f9f8ce11015f88a84ab97560eb9ef7fee15a22f0e8255cde7e

Blocklists:
  - fortinet: Phishing
                                        
                                            GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cd6d30949e4b50f HTTP/1.1 
Host: d3qvh4.ellissu.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://d3qvh4.ellissu.ru/Mjchiasson@triparishinc.com/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.96.1
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Fri, 26 May 2023 14:49:22 GMT
Content-Length: 42
Connection: keep-alive
Last-Modified: Thu, 25 May 2023 08:39:03 GMT
ETag: "646f1ea7-2a"
Server: cloudflare
CF-RAY: 7cd6d30ae950b505-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 26 May 2023 16:49:22 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7cd6d30949e4b50f HTTP/1.1 
Host: d3qvh4.ellissu.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://d3qvh4.ellissu.ru/Mjchiasson@triparishinc.com/?__cf_chl_rt_tk=8ulREkzzJjGOF3x5i5tXLVnkXhTo0fssQrtimGsrAko-1685112562-0-gaNycGzNBqU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.96.1
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:49:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: max-age=0, must-revalidate
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rjXDBEP%2BeaxAHiAI9LnUGvQySc43%2FmB5VVMp2mhgqaO5eoLpwNnxv13kwkQLXeyFDflmZZAihf1YEPS79Eh21vaJR1cPFmACR9qtihIdy%2BJjMW5kPXb8Q4n0lmM9YLQnwuflPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6d30ae94eb505-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   55326
Md5:    e38d5ddff979ed43e45f0ef5e5bb0831
Sha1:   11e0cf4908a93b4c09083dc6b3b1b5c656b81fad
Sha256: 4611daf006cd8f4f157ba5aa4d7bf4e75f61b04827282c024610af7718372a91
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: d3qvh4.ellissu.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://d3qvh4.ellissu.ru/Mjchiasson@triparishinc.com/?__cf_chl_rt_tk=8ulREkzzJjGOF3x5i5tXLVnkXhTo0fssQrtimGsrAko-1685112562-0-gaNycGzNBqU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             188.114.96.1
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:49:22 GMT
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=adEpxVEIfC%2FdTiPSUUStDy%2BNP75xPxAQyYqdQqD%2FSe90Oll1FK6zTK1aWtm2SbUlozyhxujWYwInLunK%2BqAVgAPMfM%2FEpBXE0%2FlWfFOoTp7ts%2FpD36AXspLmDfE4H8aI8xb5pQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7cd6d30b2990b505-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1811), with CRLF, LF line terminators
Size:   3599
Md5:    41951a4171010ae294a0a7e21e8ebe88
Sha1:   52652e74025ba2349eca49648f917c0a8a0ab45c
Sha256: b8870163e292d6dca246f4e1d66d0b280cb1e956c042c1908db049a48b5cb57c
                                        
                                            GET /turnstile/v0/b/938e2b5c/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://d3qvh4.ellissu.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             104.18.6.185
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:49:22 GMT
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cd6d30b7dd0067b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (15748)
Size:   11010
Md5:    2a1262ba5cd32899831d483322a28dd7
Sha1:   3805876db8773ed5820043e1f39b0b6c049f61b2
Sha256: 2e1e45b1d429b2d703676139932fe97b7ffc7986e6d0221653a7404e4c3032f0
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1118774366:1685110128:Yiejw4pzBr5MWlJ2Y8X5d1hbcF4MTxh0Ypz734jRFt0/7cd6d30949e4b50f/d8b7524c4fd625b HTTP/1.1 
Host: d3qvh4.ellissu.ru
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://d3qvh4.ellissu.ru/Mjchiasson@triparishinc.com/
Content-type: application/x-www-form-urlencoded
CF-Challenge: d8b7524c4fd625b
Content-Length: 1783
Origin: http://d3qvh4.ellissu.ru
DNT: 1
Connection: keep-alive
Cookie: cf_chl_2=d8b7524c4fd625b
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             188.114.96.1
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                            
Date: Fri, 26 May 2023 14:49:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: /silIZ3UiasycZwgBDXwOvmtbgPz+FvbOgSDcfzoFVHF1+lCMEUJghKJ1wNb68pz$JD7dqKm4lOjGC3dM9PF74w==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UJEKQGmjBo%2BTanpuZ9sf61WOSvXykfr6P3KZ4MH1Fg45883VE4Z5F5xw9v8wE1nKM8EanxLS6rlS51%2Btj1%2Bi6PWRWc77dBQ7GtkFI5%2FIRVI6fDSoI50IL8qcU6iNZQhdJbYjkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7cd6d30c1aa5b505-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60



--- Additional Info ---
Magic:  ASCII text, with very long lines (7400), with no line terminators
Size:   7400
Md5:    28c80b8690f299c0036049ce5d042fde
Sha1:   1c4ab982408bffb163deb33c5a8d4e42ab15eb59
Sha256: 120f394336a06224ec3a4c3881b4f9ccc5ff20c45a107b220fe00d6d257241a8

Blocklists:
  - fortinet: Phishing
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/883541410:1685110177:Lpc0iM-PQnE3rSvLR2YpcwENIvj8ptcOo_caSsNGpKI/7cd6d30c5802b4fd/d8d29f16712afcc HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/v4mro/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: d8d29f16712afcc
Content-Length: 2744
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:49:23 GMT
cf-chl-gen: OLuPxXV21fNn63Dd1xrZ4X4fGX4FW1M3kBp1dk3nMazXGz9KDdgGJAru2h0NkHMyxW+dHYgccR9eW+D+h08Pdr3Hd4lLNPKRsU5i/Wp6ckUrkGMMomRzB4fA6h+35CqTST0SRsqD33Ok/4jQuXsNgeve1DhQc8NA5zP93Wd4+o5LexMld3/h4iC9w7zXr/z43liqTSKNqIGJRJgFgKGgbPcCbgd77qqh2AmlsnsuycJOW9B37CMPbwwKGhC1DMgfIs2L2pJm/FH0XNUhkmasJMqMtkzKwBZ9Ug9tmFu2M0ZlCjgqpRlIGRqLLpzVc7iUbV2/+Xe0kvnW4byL6QJOihTzlyCLotW2GNo/Sq2qzkU0QD21Z/M5Bhmh2LZMmvVhjP0DetYlJH/UG1+QLcnEWsD6vuvqeSyaefx+MKnccRgFxB+JFBCg1SZpcllL6URd$jde8OYk2orrOyMBNJt8qgg==
server: cloudflare
cf-ray: 7cd6d30eeb4fb4fd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   122920
Md5:    94ac9e77044e25405789ca68181999c9
Sha1:   d733468c8047ac5d5f4a9fb89e419223aaa8df11
Sha256: 667e56b54158de0370336779837c424df643b99929fcfbe5d330d94c8ea6518d
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/img/7cd6d30c5802b4fd/1685112563042/WzZ4oLwUNYs9M0C HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/v4mro/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: image/png
                                            
date: Fri, 26 May 2023 14:49:23 GMT
server: cloudflare
cf-ray: 7cd6d3119fd3b4fd-OSL
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  PNG image data, 7 x 66, 8-bit/color RGB, non-interlaced\012- data
Size:   61
Md5:    5900b6e3c75d9f83be9f810a0d7f7c38
Sha1:   9b8dd917be29249e092e3f7ab6fd2e54bd1d19dc
Sha256: 9146479073fb5495c4127b9e69990a4a32c0a005ebb347abe593119ae38dd294
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/v4mro/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/html; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:49:22 GMT
cache-control: max-age=0, must-revalidate
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 7cd6d30c5802b4fd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (10899)
Size:   24085
Md5:    efbaa3e6b7047263264978028c4ca3a4
Sha1:   bc8cfc019828907b0082e03c24bd821c789db480
Sha256: 6f9dd47eecf707b29a1247df1b0b07d0ebc88dcab15f7d8ef5b02da69637dcb2
                                        
                                            GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7cd6d30c5802b4fd HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/v4mro/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:49:22 GMT
cache-control: max-age=0, must-revalidate
server: cloudflare
cf-ray: 7cd6d30da9acb4fd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   161572
Md5:    e3e141321d7ae471044d3e9bad72a42b
Sha1:   ffa266f1331cde73c3295d972c7c404242cc370e
Sha256: 8ccfd220507824376ddd23a628f915496875624bf97716dbd6e2dab89b888961
                                        
                                            POST /cdn-cgi/challenge-platform/h/b/flow/ov1/883541410:1685110177:Lpc0iM-PQnE3rSvLR2YpcwENIvj8ptcOo_caSsNGpKI/7cd6d30c5802b4fd/d8d29f16712afcc HTTP/1.1 
Host: challenges.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/v4mro/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: d8d29f16712afcc
Content-Length: 17824
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache


                                        
                                             104.18.6.185
HTTP/3 200 OK
content-type: text/plain; charset=UTF-8
                                            
date: Fri, 26 May 2023 14:49:23 GMT
cf-chl-gen: QDI0e2BhE3LZfpQraUkRD5j0TAqd9fFFIFNRP074gZ65KrErkD2wYN5vN3HGBEja$BF/xy9UrVpkO/W8GRwwCvg==
server: cloudflare
cf-ray: 7cd6d3141b3bb4fd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400



--- Additional Info ---
Magic:  ASCII text, with very long lines (13232), with no line terminators
Size:   13232
Md5:    4e0ef72d8a27876ba677dc9356f76fc3
Sha1:   0d183f2b933de97e2b66b9669cc95da42708d2c0
Sha256: 94b9ed9d7d573f3336b5af3be8921f5d93ac59e327f8e50628e1b4808208bc95