Report - 114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/

Report Overview

Submitted URL
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/
IP
114.141.253.232
ASN
#38701 Piranha Systems
Submitted
2022-11-20 03:30:58
Access
Website Title
Final URL
Tags
None
urlquery detections
Phishing - Netflix
Phishing - Netflix

Detections

urlquery
11
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-10T05:09:10Z	2.4 kB	6.2 kB	23.36.76.226
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-10T13:49:44Z	682 B	1.6 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-10T05:10:00Z	782 B	2.4 kB	34.102.187.140
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-10T05:12:35Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-10T05:10:00Z	333 B	229 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-10T05:10:02Z	606 B	127 B	35.160.184.41
114.141.253.232	unknown	2015-08-18T02:44:20Z	2023-02-18T11:56:26Z	4.7 kB	268 kB	114.141.253.232
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-10T05:10:04Z	3.8 kB	82 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-11-19	medium	114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/	Netflix Inc.

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-20	medium	114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/	Phishing
2022-11-20	medium	114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/icon.ico	Phishing
2022-11-20	medium	114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/check.png?s	Phishing
2022-11-20	medium	114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/globe.png?s	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/js/main.js?rand=13301	4.9 kB	2023-03-07	2024-04-14
Pretty URL 114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/js/main.js?rand=13301 IP 114.141.253.232 ASN #38701 Piranha Systems Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:58:28 Last Seen2024-04-14 05:20:31 Times Seen67 Hash e608dc9046742747917a828578555373 70e38cfaaceae08d868ca02ac18d6e68bc081472 f940ec3ed8c80227019e6a43361a8963e8c398f57ea5f4e8e238c21bf42ec319 Loading...

HTTP Transactions (31)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
eb76c0b3adf4098ad8a9d1e38250758f
99610ddb2b4ec6d04250ac244f966951695d4f00
01ed8c191c175471aee23cbc196d558e5bf5209f166806fc97db08eb06544bab

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "01ED8C191C175471AEE23CBC196D558E5BF5209F166806FC97DB08EB06544BAB"
Last-Modified: Sat, 19 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2974
Expires: Sun, 20 Nov 2022 04:20:19 GMT
Date: Sun, 20 Nov 2022 03:30:45 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
f732c50f6a2482aeea20552e0370c2d0
6f33119d5c38e92a0a62f3a46766ff86014e4d68
a47e38c199c5fecd5594544a3889e1cfca5547d85f19056f06eaeeadf17f4fe9

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5098
Cache-Control: max-age=116726
Content-Type: application/ocsp-response
Date: Sun, 20 Nov 2022 03:30:45 GMT
Etag: "6378b071-1d7"
Expires: Mon, 21 Nov 2022 11:56:11 GMT
Last-Modified: Sat, 19 Nov 2022 10:31:13 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
567df7db606cf5d0871aa5bc9311b6da
4263faac7cbab2fcaf6661911dcad5091c06be17
e9650e1fdc46fc8678708ddcc37ab369c7a6d50489a004be896f20c7a3a644b0

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 20 Nov 2022 02:44:58 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2747
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e7724a1f27dc1b5b2fb63c7e486f74db
ef0ea648ce8bc189d31382baec4b181c724af93b
2a46916079563d95fa6a695104ebf41829ee95a156d6e4d45b9aef7231a8a80e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A46916079563D95FA6A695104EBF41829EE95A156D6E4D45B9AEF7231A8A80E"
Last-Modified: Fri, 18 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2569
Expires: Sun, 20 Nov 2022 04:13:34 GMT
Date: Sun, 20 Nov 2022 03:30:45 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: 9T5Wg2yLGTSSf5hFYoHhkeoOOqw4MAZGiRSIpnOq8fpu/JI0LBPg2BYa8q+n17nth+8clUda6kM=
x-amz-request-id: T77RASKY9H1GWSY8
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 20 Nov 2022 02:41:32 GMT
age: 2953
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sun, 20 Nov 2022 03:30:46 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 20 Nov 2022 03:25:03 GMT
cache-control: public,max-age=3600
age: 343
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
060d538b33e370fcd033339830d33a42
4a37d427988358eb318e18e2678c3484ef4a5ebd
efa33f92547243814b5bd3bca4f94d26055d590a4431611b3ba251a8d774bfbb

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6094
Cache-Control: max-age=112660
Content-Type: application/ocsp-response
Date: Sun, 20 Nov 2022 03:30:46 GMT
Etag: "63789cac-1d7"
Expires: Mon, 21 Nov 2022 10:48:26 GMT
Last-Modified: Sat, 19 Nov 2022 09:06:52 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

35.160.184.41

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.160.184.41:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: WGhoE0m+L6+r3GR8AYPTZA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: k7V8ZQzcDqErfBcPrg1BtgzibQ8=

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/

114.141.253.232

200 OK

3.1 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
3.1 kB (3070 bytes)
Hash
a546083709bf9be74e38660b1b0d2a4a
b9bfcd8dae1eae981a44e6e1700c7dfdf5cce6c7
44d0c1d218dd057665ab39b274c0269567d2f76a33a44ed36136ea0675e7f059

Detections

Analyzer	Verdict	Alert
openphish	Netflix Inc.
fortinet	Phishing

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/ HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: PHP/5.5.38
Set-Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2; path=/
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 3070

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/js/main.js?rand=13301

114.141.253.232

200 OK

4.9 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/js/main.js?rand=13301
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
ASCII text, with very long lines (4868)
Size
4.9 kB (4869 bytes)
Hash
e608dc9046742747917a828578555373
70e38cfaaceae08d868ca02ac18d6e68bc081472
f940ec3ed8c80227019e6a43361a8963e8c398f57ea5f4e8e238c21bf42ec319

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/js/main.js?rand=13301 HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: application/javascript
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "5247e15eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 4869

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252

114.141.253.232

200 OK

6.8 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
ASCII text, with CRLF line terminators
Size
6.8 kB (6830 bytes)
Hash
694d478d9ae3e562fc746dc459dd0167
6c1d9eddc4eb9d4c95ccb89533a4ef9ec14d2851
c69a818f75b13a1a14452fea83d4c25b1e8606ea34095b32dabdfa0dce255eae

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252 HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: text/css
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "9b82dc5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 6830

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/icon.ico

114.141.253.232

200 OK

17 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/icon.ico
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel\012- data
Size
17 kB (16958 bytes)
Hash
41b45fdce09bd6acd07c7a8949da675e
931e18dfc6e7d950dc2f2bbdfe31e1ea720acf7c
abe8012eb65c0dc0ac3e87dcc1e60e1908ebd8f12b7c47a5df1856f7a7bb1edd

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix
fortinet	Phishing

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/icon.ico HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: image/x-icon
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "fee4de5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 16958

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/check.png?s

114.141.253.232

200 OK

577 B

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/check.png?s
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
PNG image data, 60 x 60, 8-bit gray+alpha, non-interlaced\012- data
Size
577 B (577 bytes)
Hash
5dad6d86fb620671bb4920cfc7de5444
0643cf2d26dfeefb4a75ea02b580999ac2c8a902
f556fb3c64c1e81e81311450d0993f90dd52484410c8b19f7fe25501a1fb56c4

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix
fortinet	Phishing

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/check.png?s HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "fee4de5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 577

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/logo.png

114.141.253.232

200 OK

8.7 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/logo.png
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
PNG image data, 600 x 300, 8-bit/color RGBA, non-interlaced\012- data
Size
8.7 kB (8717 bytes)
Hash
ed0265f59f0af5ca84c4e0caa17d8562
1a974e812b534924bc17850df81f18fae4176fc1
4d4054a533373a85d24d65f5290ca306133f3c22f0b2d7b71a742a277d0f7a49

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/logo.png HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "fee4de5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 8717

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/fb.png

114.141.253.232

200 OK

1.5 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/fb.png
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
PNG image data, 57 x 57, 8-bit/color RGBA, non-interlaced\012- data
Size
1.5 kB (1455 bytes)
Hash
a33ca47ef110b6e3ec5086b8776407d3
dff5bbbe61b4920a23fb21a7fca69ca9e94dcb6c
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/fb.png HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "fee4de5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 1455

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
798ef0955be535268547903e74dacfcd
782823486f9ded693609cade264d1950e816f7d0
75df3810e787be95774282d4851ce350bba5c326843f1bd02348746355866e95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "75DF3810E787BE95774282D4851CE350BBA5C326843F1BD02348746355866E95"
Last-Modified: Sat, 19 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5821
Expires: Sun, 20 Nov 2022 05:07:49 GMT
Date: Sun, 20 Nov 2022 03:30:48 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
798ef0955be535268547903e74dacfcd
782823486f9ded693609cade264d1950e816f7d0
75df3810e787be95774282d4851ce350bba5c326843f1bd02348746355866e95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "75DF3810E787BE95774282D4851CE350BBA5C326843F1BD02348746355866E95"
Last-Modified: Sat, 19 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5821
Expires: Sun, 20 Nov 2022 05:07:49 GMT
Date: Sun, 20 Nov 2022 03:30:48 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
798ef0955be535268547903e74dacfcd
782823486f9ded693609cade264d1950e816f7d0
75df3810e787be95774282d4851ce350bba5c326843f1bd02348746355866e95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "75DF3810E787BE95774282D4851CE350BBA5C326843F1BD02348746355866E95"
Last-Modified: Sat, 19 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5821
Expires: Sun, 20 Nov 2022 05:07:49 GMT
Date: Sun, 20 Nov 2022 03:30:48 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
798ef0955be535268547903e74dacfcd
782823486f9ded693609cade264d1950e816f7d0
75df3810e787be95774282d4851ce350bba5c326843f1bd02348746355866e95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "75DF3810E787BE95774282D4851CE350BBA5C326843F1BD02348746355866E95"
Last-Modified: Sat, 19 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5821
Expires: Sun, 20 Nov 2022 05:07:49 GMT
Date: Sun, 20 Nov 2022 03:30:48 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
798ef0955be535268547903e74dacfcd
782823486f9ded693609cade264d1950e816f7d0
75df3810e787be95774282d4851ce350bba5c326843f1bd02348746355866e95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "75DF3810E787BE95774282D4851CE350BBA5C326843F1BD02348746355866E95"
Last-Modified: Sat, 19 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5821
Expires: Sun, 20 Nov 2022 05:07:49 GMT
Date: Sun, 20 Nov 2022 03:30:48 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F175348d8-bd72-46a1-a737-9e442ab4231c.jpeg

34.120.237.76

200 OK

9.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F175348d8-bd72-46a1-a737-9e442ab4231c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.8 kB (9798 bytes)
Hash
a41f9693b9247dcce6c2340bb5c02828
e982a3a8a8c6baac9d1676ad93646d6c4cd9f58e
aa23cead1d44bf9db22654eb14113ef356d4ac972d301969c02803964418d556

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F175348d8-bd72-46a1-a737-9e442ab4231c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9798
x-amzn-requestid: abab4eb2-0a35-4113-8a52-e07c08f069cd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bkiY2HXCoAMFVrQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371b105-1cb176423ca3231a093cc4c7;Sampled=0
x-amzn-remapped-date: Mon, 14 Nov 2022 03:07:49 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: sCEwyGN6h_P0abZJGEY8PJNE7j1Nmz62-wvzWWO5gbFwA1auACXtJw==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 17:23:16 GMT
age: 36452
etag: "e982a3a8a8c6baac9d1676ad93646d6c4cd9f58e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

14 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ec00dd4-9302-4378-82e1-eb2f8686bdc7.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
14 kB (13671 bytes)
Hash
6653147acce57a88af20de89d4f40239
d097755b7cafd14d6dcf18fe09d0a3237a1057dd
5d0166eacfa748026865e4461b1a1c0fb7373e0fb7de16b266f3eee6b816f5f6

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5ec00dd4-9302-4378-82e1-eb2f8686bdc7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 13671
x-amzn-requestid: 26e11776-b559-4325-9082-df4b9366715e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3jWaFEZoAMFb3w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794c28-0117d3a633ab918d6179fa87;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:35:36 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: q120_eM0o2PJMeCTmOBb-NpGFdTXdljRcLfytw7e9jv9CrwAqDKkzQ==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 22:08:06 GMT
age: 19362
etag: "d097755b7cafd14d6dcf18fe09d0a3237a1057dd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64411994-ce94-4835-bad8-24abaa432570.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.1 kB (8075 bytes)
Hash
5593e699e3ad885d28a62a096cb47c88
c7250ea98c481d07a42e9ff7b766265e15d248c5
b124c3e45aaf0472258e8db44ba6377e120a6b013fca967d46898d52b8225a5e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64411994-ce94-4835-bad8-24abaa432570.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8075
x-amzn-requestid: 7546025f-7c0b-4037-98b4-5414cd35c9bd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3i5fFbmoAMFXuQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794b6f-643208e92bb964a6256b13b1;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:32:31 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: ZNAijuabYcnrmkJSYQBfVS0Raw8z-f4lGoir9eRqLz0xc5Hf-bQJwA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 22:06:47 GMT
age: 19441
etag: "c7250ea98c481d07a42e9ff7b766265e15d248c5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac98a873-8b46-43f5-9ac0-fc1cc1a0cd81.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11249 bytes)
Hash
481c033b9ffd030ff0de6e35cf788b47
85d3baad9217af2b5d75c019d2ef95dbb919a788
02443c7869914c2b29892deb0c645395bcf4e8379da3cf20974614ff9c92893b

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac98a873-8b46-43f5-9ac0-fc1cc1a0cd81.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11249
x-amzn-requestid: 65a3db77-b2e6-40b9-a776-021c2e9b56d0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bubSsHbZoAMFZNg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6375a5aa-1286b97968cc2e4c7fe8ab29;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 03:08:26 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: s1153EpshSWYGLcN7Zzzs4PgXl9cddZ20gTwh5bK2HOBu4e_PSNCpQ==
via: 1.1 38eecd3ca21bf068d69a2f9cfe668d14.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 03:36:46 GMT
age: 86042
etag: "85d3baad9217af2b5d75c019d2ef95dbb919a788"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff1fe6564-e0ba-4c81-b868-04fa596cddaa.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.0 kB (7968 bytes)
Hash
a8f1dddf91a53f8f28d70565d1a3458b
9d026c2c53629648cfda4a324eadae6e33de0d55
c352216d126382d7b588ff6e5a3ed6ab12d92dc5e58216cc5883c27bf612a7d9

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff1fe6564-e0ba-4c81-b868-04fa596cddaa.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7968
x-amzn-requestid: 0dc9cfbf-7e72-45a7-9496-49a5cf1a4465
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3jZmEwboAMF1tQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794c3d-1f40770e29ad853b31a3aa23;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:35:57 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: UM4MVSwb8F1uv2jbbdeh8bhV3KJNhqiN9wJj1Yua8h4x762uD8UKyQ==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 ee330666adf9f04c8c30094f8ddcd004.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 21:41:44 GMT
age: 20944
etag: "9d026c2c53629648cfda4a324eadae6e33de0d55"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F655b8993-0bce-4e6f-91dc-bf1be7821320.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11861 bytes)
Hash
ab1011435c84b1d143e3daccdc3cf271
b82d5e707f1a4538531a43acc89ca6f9aef854a3
0ef1ed157670d2d6bce29f1205a0478f48b404e0ef7a4e430dec932f6bec14da

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F655b8993-0bce-4e6f-91dc-bf1be7821320.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11861
x-amzn-requestid: 2915027b-f1ea-4f75-89c3-6a5bbd69ad31
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3jXDH_loAMFgeg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794c2c-3f0acb680850e4de2225b6fd;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:35:40 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: nkE_EIP6MzoADA7hH_3BF82XOs1LXhWoPWH2buOnoKVLhl_ybr_zdQ==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 22:20:59 GMT
age: 18589
etag: "b82d5e707f1a4538531a43acc89ca6f9aef854a3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/down.png

114.141.253.232

200 OK

634 B

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/down.png
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
PNG image data, 60 x 60, 8-bit gray+alpha, non-interlaced\012- data
Size
634 B (634 bytes)
Hash
7df34e49f20a6ff3335b357e8833395e
4daf672970638dce7a18aeaf3cd8372f2e301f27
76fda49610478440b5b123d15bb4d3510ab771ab27b0b881565887b7bcf6a0c6

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/down.png HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "fee4de5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:53 GMT
Content-Length: 634

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/globe.png?s

114.141.253.232

200 OK

2.5 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/globe.png?s
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
PNG image data, 60 x 60, 8-bit gray+alpha, non-interlaced\012- data
Size
2.5 kB (2540 bytes)
Hash
8200b2cd56e0e58b411215804c51144f
16143fc516f831afab8df9d634c74204fbdffddd
4442aacdd8b7f2368c235a92f6559b1d807231cb30c9409abe8a0f744dc9e8c5

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix
fortinet	Phishing

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/globe.png?s HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "fee4de5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:53 GMT
Content-Length: 2540

114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/background-medium.jpg

114.141.253.232

200 OK

220 kB

URL HTTP/1.1
114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/background-medium.jpg
IP
114.141.253.232:0
ASN
#38701 Piranha Systems

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2000x1125, components 3\012- data
Size
220 kB (220400 bytes)
Hash
f9eb0728c81335944cc74b2686eec94c
37a0c0f36f56425c0e0221bb8df7eda65857fe59
847566a3fa53dae674a15ccd5dcb40087e2cf1935a1a9a6294702be812c0df53

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - Netflix

HTTP Headers

GET /data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/img/background-medium.jpg HTTP/1.1
Host: 114.141.253.232
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://114.141.253.232/data/cache/css/net/f84d465177e84bb4e756a8319443cdcb/assets/css/main.css?rand=23252
Cookie: PHPSESSID=9f1114rbb61d5hfnmg3vbjput2

HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Sat, 19 Nov 2022 00:17:55 GMT
Accept-Ranges: bytes
ETag: "fee4de5eacfbd81:0"
Server: Microsoft-IIS/8.5
Date: Sun, 20 Nov 2022 03:30:52 GMT
Content-Length: 220400

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19c1a99-6290-4f30-afcf-c426abf8c229.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11562 bytes)
Hash
907cdf495815b066cbeaccd9c862c544
6082de99b599bc3c9ce14e2641a2bf60f9f187d8
fbccb495391bba54b463e8c4eaf3207af00b098c4b5f816011d240257aa56f6c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb19c1a99-6290-4f30-afcf-c426abf8c229.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
content-length: 11562
x-amzn-requestid: f01b0409-b43d-4d9c-92c0-0023c5e49d58
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b3jV_GDmIAMFvqA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63794c26-69366c73760dcd5b72634f73;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 21:35:34 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: pvgyUJPVgG_PrCetQXIXLgxyEBar2nMFywc6HracpnEsn2tiCw_Pfg==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google
date: Sat, 19 Nov 2022 21:42:03 GMT
age: 20931
etag: "6082de99b599bc3c9ce14e2641a2bf60f9f187d8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (31)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size