51.89.105.170 29 kB IP 51.89.105.170:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5180), with CRLF line terminators
Hash e6a9196a39316696aa8c7e09ead4a9bc
c07d7c54e14d448f6de07e4f47000bacb07db3a0
21d7579b5b7d351e245b32baa71866d1a494f0da53c81c45e6e2c70fd4a7c357
Analyzer Verdict Alert OpenPhish phishing Libero
GET / HTTP/1.1
Host: ip170.ip-51-89-105.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:42:51 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
ip170.ip-51-89-105.eu/js/zlIY73HV9ZcD.js
51.89.105.170200 OK 5.9 kB URL GET HTTP/1.1 ip170.ip-51-89-105.eu/js/zlIY73HV9ZcD.js
IP 51.89.105.170:80
Requested by http://ip170.ip-51-89-105.eu/
Hash a74c4931e8922eb02ded30aa554978a9
70a7aed0372bf2e164f9d487e240c30e23c53a2d
ba622f81f692dd7f4b54e5379346086874eff141a501881982c5a5b3b2370df8
Analyzer Verdict Alert OpenPhish phishing Libero
GET /js/zlIY73HV9ZcD.js HTTP/1.1
Host: ip170.ip-51-89-105.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:42:51 GMT
Server: Apache
Last-Modified: Mon, 14 Nov 2022 10:52:22 GMT
Accept-Ranges: bytes
Content-Length: 5930
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1
213.209.30.161200 OK 210 B URL GET HTTP/2 www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1
IP 213.209.30.161:443
ASN #8660 Italiaonline S.p.A.
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerSectigo Limited
Subjectwww.iolam.it
FingerprintA5:E9:20:AE:57:1F:C9:1B:75:65:95:B5:97:7B:CA:29:60:9C:05:A9
ValidityMon, 09 Jan 2023 00:00:00 GMT - Sat, 03 Feb 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 2a8493a54137dc4532d7392911cd4f61
f667738299a487ad82cf3027fcbe92ef2a12c0cc
606315b40c15180b8b9d101016f918871acaf49378a95cefc759169a1830c0d7
GET /js/iam2.0.js?ns=libero/web/webmail/login/1.1 HTTP/1.1
Host: www.iolam.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Tue, 21 Nov 2023 02:42:51 GMT
Server: Apache
Content-Length: 210
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
ip170.ip-51-89-105.eu/js/0sBN1QtxZSRY.js
51.89.105.170200 OK 46 kB URL GET HTTP/1.1 ip170.ip-51-89-105.eu/js/0sBN1QtxZSRY.js
IP 51.89.105.170:80
Requested by http://ip170.ip-51-89-105.eu/
File type ASCII text, with very long lines (32029)
Hash 10fd38d35c7d0ffd25b63da5cb552fdb
999634b63d59cb76162ddfe39d03f3bf8bc6d2dd
17e49df09dd14c40d50c5e4693c448e99cfee8ee79aa5a9c5bd2be5be3105562
Analyzer Verdict Alert OpenPhish phishing Libero
GET /js/0sBN1QtxZSRY.js HTTP/1.1
Host: ip170.ip-51-89-105.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:42:51 GMT
Server: Apache
Last-Modified: Mon, 14 Nov 2022 10:52:19 GMT
Accept-Ranges: bytes
Content-Length: 46107
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
ip170.ip-51-89-105.eu/fonts/wpJ0jqagdDSx.svg
51.89.105.170200 OK 4.8 kB URL GET HTTP/1.1 ip170.ip-51-89-105.eu/fonts/wpJ0jqagdDSx.svg
IP 51.89.105.170:80
Requested by http://ip170.ip-51-89-105.eu/
File type SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (4827), with no line terminators
Hash d22db58fef29f1762d01762c332f01bd
886710819c12dc8cf160a55646c955119fb6b2a6
54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9
Analyzer Verdict Alert OpenPhish phishing Libero
GET /fonts/wpJ0jqagdDSx.svg HTTP/1.1
Host: ip170.ip-51-89-105.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:42:51 GMT
Server: Apache
Last-Modified: Mon, 14 Nov 2022 10:52:18 GMT
Accept-Ranges: bytes
Content-Length: 4827
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml
ip170.ip-51-89-105.eu/images/1WVfw4Yw8xor.png
51.89.105.170200 OK 1.2 kB URL GET HTTP/1.1 ip170.ip-51-89-105.eu/images/1WVfw4Yw8xor.png
IP 51.89.105.170:80
Requested by http://ip170.ip-51-89-105.eu/
File type PNG image data, 68 x 20, 8-bit colormap, non-interlaced\012- data
Hash 9a60dbd6e77cf0cec47a9dd6205dad98
b83e1607441db0704dcbf503f9fbf82f48801869
8239d985179b5598a3b76db41bbd8842530e4e37e82665dc6449ed97b20c6227
Analyzer Verdict Alert OpenPhish phishing Libero
GET /images/1WVfw4Yw8xor.png HTTP/1.1
Host: ip170.ip-51-89-105.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:42:51 GMT
Server: Apache
Last-Modified: Mon, 14 Nov 2022 10:52:19 GMT
Accept-Ranges: bytes
Content-Length: 1154
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1
213.209.30.161200 OK 32 kB URL GET HTTP/2 www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1
IP 213.209.30.161:443
ASN #8660 Italiaonline S.p.A.
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerSectigo Limited
Subjectwww.iolam.it
FingerprintA5:E9:20:AE:57:1F:C9:1B:75:65:95:B5:97:7B:CA:29:60:9C:05:A9
ValidityMon, 09 Jan 2023 00:00:00 GMT - Sat, 03 Feb 2024 23:59:59 GMT
File type C source, ASCII text, with very long lines (65507)
Hash db3dc092a3c0d5eb454459364128f483
3e89fe9caf87fb9193187c4668c96d1e50469088
bab579eb63de66ef6e1da663a09365752e647b34edbaf15a65ef8477817b55a2
GET /js/iam2.0.js?ns=libero/web/webmail/login/1.1 HTTP/1.1
Host: www.iolam.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 21 Nov 2023 02:42:51 GMT
server: Apache
strict-transport-security: max-age=63072000;
accept-ranges: bytes
cache-control: max-age=86400
expires: Wed, 22 Nov 2023 02:42:51 GMT
vary: Accept-Encoding
content-encoding: gzip
content-length: 31766
content-type: application/javascript
X-Firefox-Spdy: h2
www.iolam.it/js/prebid.js
213.209.30.161200 OK 154 kB URL GET HTTP/1.1 www.iolam.it/js/prebid.js
IP 213.209.30.161:80
ASN #8660 Italiaonline S.p.A.
Requested by http://ip170.ip-51-89-105.eu/
File type ASCII text, with very long lines (64693)
Size 154 kB (153608 bytes)
Hash 986c761ce904004ac8ad4a556375b68e
df1e90ac7fbe2c8f2e800e0db30b42c68afdaafc
bf04cc3daa882029d0bec76c3444dda192ce1779eb69642ca66440c72c5cc31f
GET /js/prebid.js HTTP/1.1
Host: www.iolam.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:42:51 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Cache-Control: max-age=86400
Expires: Wed, 22 Nov 2023 02:42:51 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: application/javascript
fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap
142.250.74.106200 OK 1.2 kB URL GET HTTP/2 fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap
IP 142.250.74.106:443
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type gzip compressed data, max compression\012- data
Hash 5f110245564b6b1ca13856e6352fcb8f
f1c62416ce9339798d62d2cda85b6b3aea0e1801
daa6a85c3d4a4138ecd1cbed69844acbc379b9657ce82a74810a33c8f96adb86
GET /css2?family=Roboto:wght@300;400;500&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i1.plug.it/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 21 Nov 2023 02:42:52 GMT
date: Tue, 21 Nov 2023 02:42:52 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
216.58.207.227200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP 216.58.207.227:443
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://ip170.ip-51-89-105.eu
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 Nov 2023 04:57:34 GMT
expires: Fri, 15 Nov 2024 04:57:34 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 423918
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
216.58.207.227200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP 216.58.207.227:443
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://ip170.ip-51-89-105.eu
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 Nov 2023 17:28:13 GMT
expires: Fri, 15 Nov 2024 17:28:13 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
age: 378879
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
rumcdn.geoedge.be/grumi-ip.js
54.230.111.4200 OK 6.1 kB URL GET HTTP/1.1 rumcdn.geoedge.be/grumi-ip.js
IP 54.230.111.4:80
Requested by http://ip170.ip-51-89-105.eu/
File type HTML document, ASCII text, with very long lines (15451), with no line terminators
Hash 4c4f4bf824d2aa120a5e0b665b4c9828
755309710c76c46798a0675970e429e23b299447
ccf7b12ecc8e9e8ffdde253ba24560e0b8742463ad4868c7659fc90968ffcb3a
GET /grumi-ip.js HTTP/1.1
Host: rumcdn.geoedge.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 21 Nov 2023 02:34:06 GMT
Last-Modified: Sat, 30 Sep 2023 14:56:14 GMT
ETag: W/"4c4f4bf824d2aa120a5e0b665b4c9828"
x-amz-server-side-encryption: AES256
Cache-Control: public, max-age=14400, stale-while-revalidate=14400, immutable
x-amz-version-id: UsDbhp3DKJzQFkiO2rZfweKkBkl0vF1S
Server: AmazonS3
Content-Encoding: gzip
X-Cache: Hit from cloudfront
Via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: dqiieUsvAYySX2h4Nmmf-P3s5UOgZUx5UJzhzoJt2QOmj2PrvOXGKA==
Age: 527
Vary: Accept-Encoding, Origin
i.plug.it/iplug/js/lib/iol/analytics/ads/banners/_adv.js?_t=1700534574191
143.204.55.72200 OK 45 B URL GET HTTP/1.1 i.plug.it/iplug/js/lib/iol/analytics/ads/banners/_adv.js?_t=1700534574191
IP 143.204.55.72:80
Requested by http://ip170.ip-51-89-105.eu/
File type ASCII text, with no line terminators
Hash 71cf8419f164dc0a17189bd5ca53bb40
59e4285963c836eee0fa20b8d2b08cf45c846af9
0718476f9aeec1cbd746c569d6768a28c021163de52ceb5c7d89005484f16b8e
GET /iplug/js/lib/iol/analytics/ads/banners/_adv.js?_t=1700534574191 HTTP/1.1
Host: i.plug.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Tue, 21 Nov 2023 02:42:52 GMT
Access-Control-Allow-Methods: GET, POST, HEAD, OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1200
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Pd3SkQg5T9yTmwi9c8jn1G77XGAANb9WvgiUQOLFsPOnsrKgFP7lhw==
italiaonline01.wt-eu02.net/215973748390194/wt?p=433,libero.web.messaging.smart.login.step1,1,1280x1024,24,1,1700534574117,0,1280x1024,0&pu=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.4320331638110667&la=en&tz=0&cg1=libero&cg2=web&cg3=messaging&cg4=smart&cg5=login&cg6=step1&cg7=libero.web.messaging.smart.login.step1&cp1=no-referrer&cp2=no-referrer&cp4=no-refresh&cp7=utf-8&cp9=1.4.04&cp10=20220927140300&cp11=Libero%20Mail%20-%20login&cp12=web&cp24=email&cp25=http%3A&cp26=ip170.ip-51-89-105.eu&cp47=&cp103=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.4320331638110667
185.54.150.20200 43 B URL GET HTTP/1.1 italiaonline01.wt-eu02.net/215973748390194/wt?p=433,libero.web.messaging.smart.login.step1,1,1280x1024,24,1,1700534574117,0,1280x1024,0&pu=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.4320331638110667&la=en&tz=0&cg1=libero&cg2=web&cg3=messaging&cg4=smart&cg5=login&cg6=step1&cg7=libero.web.messaging.smart.login.step1&cp1=no-referrer&cp2=no-referrer&cp4=no-refresh&cp7=utf-8&cp9=1.4.04&cp10=20220927140300&cp11=Libero%20Mail%20-%20login&cp12=web&cp24=email&cp25=http%3A&cp26=ip170.ip-51-89-105.eu&cp47=&cp103=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.4320331638110667
IP 185.54.150.20:443
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerSectigo Limited
Subject*.wt-eu02.net
Fingerprint92:9A:6C:25:26:F6:C2:BA:56:0A:8B:D4:47:43:79:30:51:2D:91:7A
ValidityFri, 13 Jan 2023 00:00:00 GMT - Tue, 13 Feb 2024 23:59:59 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 325472601571f31e1bf00674c368d335
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
GET /215973748390194/wt?p=433,libero.web.messaging.smart.login.step1,1,1280x1024,24,1,1700534574117,0,1280x1024,0&pu=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.4320331638110667&la=en&tz=0&cg1=libero&cg2=web&cg3=messaging&cg4=smart&cg5=login&cg6=step1&cg7=libero.web.messaging.smart.login.step1&cp1=no-referrer&cp2=no-referrer&cp4=no-refresh&cp7=utf-8&cp9=1.4.04&cp10=20220927140300&cp11=Libero%20Mail%20-%20login&cp12=web&cp24=email&cp25=http%3A&cp26=ip170.ip-51-89-105.eu&cp47=&cp103=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.4320331638110667 HTTP/1.1
Host: italiaonline01.wt-eu02.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Set-Cookie: wteid_215973748390194=4170053457200561432; Max-Age=15552000; Expires=Sun, 19 May 2024 02:42:52 GMT; Secure; SameSite=None
wtsid_215973748390194=1; Secure; SameSite=None
wt_nbg_Q3=!cJZdtnRYk9R+I9k8AP7SORvNY+Kz1PcOpTpvjeYaAENWrq5w9JxJPad2/xAL8lGC2JD1vn6oU+obFw==; path=/; Httponly; Secure; SameSite=None
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, private, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Tue, 21 Nov 2023 02:42:52 GMT
P3P: policyref="https://q3.webtrekk.net/w3c/p3p.xml", CP="NOI DSP IND COM NAV INT"
X-Robots-Tag: noindex, nofollow, noarchive
Content-Type: image/gif;charset=UTF-8
Content-Length: 43
Date: Tue, 21 Nov 2023 02:42:52 GMT
Keep-Alive: timeout=30
Connection: keep-alive
Server: c20ad4d7
rumcdn.geoedge.be/4415fe16-b37d-46de-ac5c-69d63c72d5ee/grumi.js
54.230.111.4200 OK 70 kB URL GET HTTP/1.1 rumcdn.geoedge.be/4415fe16-b37d-46de-ac5c-69d63c72d5ee/grumi.js
IP 54.230.111.4:80
Requested by http://ip170.ip-51-89-105.eu/
File type ASCII text, with very long lines (65436)
Hash 8fcc551219a24e7fa6d1425a2181b4ca
126ed0113f28ff8751cf058b2e1d7591ac7dd994
ede158d96e9ee7ea0334c2e6d709d887121b6c3d0772809ed883977b720ba5c6
GET /4415fe16-b37d-46de-ac5c-69d63c72d5ee/grumi.js HTTP/1.1
Host: rumcdn.geoedge.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 21 Nov 2023 02:34:20 GMT
Last-Modified: Tue, 21 Nov 2023 01:54:30 GMT
ETag: W/"8fcc551219a24e7fa6d1425a2181b4ca"
x-amz-server-side-encryption: AES256
Cache-Control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
x-amz-version-id: LXhtrFGLSSiT1W3HT7kcWYWRLaTCrqqj
Server: AmazonS3
Content-Encoding: gzip
X-Cache: Hit from cloudfront
Via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 491Gpem2aOhlhPTKS5tzjlW9FbyVwbaqj12mIZJqOeiX8sdWhnnomA==
Age: 512
Vary: Accept-Encoding, Origin
ip170.ip-51-89-105.eu/0tTymf1AqEtS.ico
51.89.105.170200 OK 1.2 kB URL GET HTTP/1.1 ip170.ip-51-89-105.eu/0tTymf1AqEtS.ico
IP 51.89.105.170:80
Requested by http://ip170.ip-51-89-105.eu/
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash c7343b24a765be9d966a0b3b865b86b0
5d82987600804c6d1b5ec6dc8e20f37b85d0beca
fba1ebd847c9826cd1bb0482cb11ba739012cd4b4003af92ab28b8b559a8e8de
Analyzer Verdict Alert OpenPhish phishing Libero
GET /0tTymf1AqEtS.ico HTTP/1.1
Host: ip170.ip-51-89-105.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.4320331638110667
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:42:52 GMT
Server: Apache
Last-Modified: Mon, 14 Nov 2022 10:52:18 GMT
Accept-Ranges: bytes
Content-Length: 1150
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/x-icon
fundingchoicesmessages.google.com/i/pub-2033535132705533?ers=1
216.58.211.14200 OK 9.4 kB URL GET HTTP/2 fundingchoicesmessages.google.com/i/pub-2033535132705533?ers=1
IP 216.58.211.14:443
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type gzip compressed data, max compression\012- data
Hash 1af629bcf2282fd8f6d50fc4c9824a9d
e030cfb607234a63ebb65380aa92229d799a0551
ea89f37041ad621cf283a7fb8188e111e3f8421d5b4c7302b1acd80c489f8539
GET /i/pub-2033535132705533?ers=1 HTTP/1.1
Host: fundingchoicesmessages.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 21 Nov 2023 02:42:52 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'nonce-136L_4pDDouucMtv9pBfmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.4320331638110667
51.89.105.170 29 kB URL ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.4320331638110667
IP 51.89.105.170:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5180), with CRLF line terminators
Hash e6a9196a39316696aa8c7e09ead4a9bc
c07d7c54e14d448f6de07e4f47000bacb07db3a0
21d7579b5b7d351e245b32baa71866d1a494f0da53c81c45e6e2c70fd4a7c357
Analyzer Verdict Alert OpenPhish phishing Libero
GET /?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.4320331638110667 HTTP/1.1
Host: ip170.ip-51-89-105.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 21 Nov 2023 02:43:05 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
i1.plug.it/mail/login/2020/libero/img/logo.svg
143.204.55.63200 OK 4.8 kB URL GET HTTP/2 i1.plug.it/mail/login/2020/libero/img/logo.svg
IP 143.204.55.63:443
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerSectigo Limited
Subject*.plug.it
FingerprintAB:A5:B9:1D:85:77:25:A6:B0:F7:0F:CD:25:1E:DE:60:BC:A1:66:CE
ValidityMon, 05 Dec 2022 00:00:00 GMT - Fri, 05 Jan 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- HTML document text\012- HTML document, ASCII text, with very long lines (4913), with no line terminators
Hash 24b7dd916d7a8d15825ef0ac5ffbb064
f414ae6a4bd2c4348b4458357ac5a2b959b07512
01358108084f70dee5826fcf2c3e6a456c4023efdfc26f736ca78c8e40842505
GET /mail/login/2020/libero/img/logo.svg HTTP/1.1
Host: i1.plug.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i1.plug.it/mail/login/2020/libero/css/style.css?01022022
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/svg+xml
server: nginx
last-modified: Mon, 28 Jun 2021 12:10:08 GMT
content-encoding: gzip
date: Mon, 20 Nov 2023 06:11:57 GMT
cache-control: public, max-age=86400
etag: W/"60d9bc20-12db"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: l62dmw3uBltWMeupAjkvmQbSSTIaTac-DdsGDvNzjeCzpCSL8KEHuw==
age: 73855
X-Firefox-Spdy: h2
i1.plug.it/mail/login/2020/libero/css/style.css?01022022
143.204.55.63200 OK 26 kB URL GET HTTP/2 i1.plug.it/mail/login/2020/libero/css/style.css?01022022
IP 143.204.55.63:443
Requested by http://ip170.ip-51-89-105.eu/
Certificate IssuerSectigo Limited
Subject*.plug.it
FingerprintAB:A5:B9:1D:85:77:25:A6:B0:F7:0F:CD:25:1E:DE:60:BC:A1:66:CE
ValidityMon, 05 Dec 2022 00:00:00 GMT - Fri, 05 Jan 2024 23:59:59 GMT
Hash 856b9eec63979d52eae32d42d0a5f600
932f1834ff3d667caec087517a9b4225940d275f
eb97f750d5607e2544524de92d09cf088fee2d4484d14eeb16184448100df690
GET /mail/login/2020/libero/css/style.css?01022022 HTTP/1.1
Host: i1.plug.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ip170.ip-51-89-105.eu/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
date: Tue, 21 Nov 2023 02:42:17 GMT
cache-control: public, max-age=86400
content-encoding: br
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 410f51195842d9b592b15d6588c36654.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: zFaHOGaaGLupOfTHKjYAVEPAERHmCRC9Wbk109kSWjqexQfim4kQoQ==
age: 34
X-Firefox-Spdy: h2