monitor.clickcease.com/tracker/tracker.aspx?id=n9H6JfyJnlUpOi&kw=&nw=d&url=https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t&cpn=693542602&device=c&ccpturl=dreamstime.com&pl=www.aconvert.com&gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
414 B URL monitor.clickcease.com/tracker/tracker.aspx?id=n9H6JfyJnlUpOi&kw=&nw=d&url=https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t&cpn=693542602&device=c&ccpturl=dreamstime.com&pl=www.aconvert.com&gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (342), with CRLF line terminators
Hash 240c2edab2c7cc687197f4ae87168e7b
238697e1ae8dd940985718c16b1df82f2e8cb567
d38b96bf67e346271c1c0f250bae1ad70239e4ba40d6a1ba59c6ca90c0ce7e63
GET /tracker/tracker.aspx?id=n9H6JfyJnlUpOi&kw=&nw=d&url=https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t&cpn=693542602&device=c&ccpturl=dreamstime.com&pl=www.aconvert.com&gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE HTTP/1.1
Host: monitor.clickcease.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
content-type: text/html; charset=utf-8
location: /tracker/tracker?id=n9H6JfyJnlUpOi&kw=&nw=d&url=https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t&cpn=693542602&device=c&ccpturl=dreamstime.com&pl=www.aconvert.com&gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
vm: 10.1.0.11
date: Thu, 05 Oct 2023 17:49:23 GMT
content-length: 414
X-Firefox-Spdy: h2
monitor.clickcease.com/tracker/tracker?id=n9H6JfyJnlUpOi&kw=&nw=d&url=https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t&cpn=693542602&device=c&ccpturl=dreamstime.com&pl=www.aconvert.com&gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
10 kB URL monitor.clickcease.com/tracker/tracker?id=n9H6JfyJnlUpOi&kw=&nw=d&url=https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t&cpn=693542602&device=c&ccpturl=dreamstime.com&pl=www.aconvert.com&gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (348), with CRLF line terminators
Hash 6a2f1035cc310006ea2c83fc4bd1d2ea
ff9ccefe342cbaa21647f39a89aed80adf6c47ab
28505d82c7286c554585696dcc340bbe6a8c0ede6d60c7fbc02c825ad4920a6a
GET /tracker/tracker?id=n9H6JfyJnlUpOi&kw=&nw=d&url=https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t&cpn=693542602&device=c&ccpturl=dreamstime.com&pl=www.aconvert.com&gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE HTTP/1.1
Host: monitor.clickcease.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
cache-control: private
content-type: text/html; charset=utf-8
location: https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
vm: 10.1.0.11
date: Thu, 05 Oct 2023 17:49:23 GMT
content-length: 10043
X-Firefox-Spdy: h2
monitor.clickcease.com/
10 B IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
File type ASCII text, with no line terminators
Hash 4ad4e567a41c472ad8a349b9540a999d
f9fd81a344f626de1e12516a7de682b0ac90280f
b7b2b55778b62e54627e8fd442cc9e6664a6aa854ea1fb9039ca205defa4bea7
GET / HTTP/1.1
Host: monitor.clickcease.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
VM: 10.1.0.11
Date: Thu, 05 Oct 2023 17:49:25 GMT
Content-Length: 10
kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
335 B URL kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash d303f4fc3579e587cee8bb0ef8e8303f
e2ca7133fa6c61681df8775bf11183d9499d2a12
60e2a8310840d0d7af5dfe259b7208bb593fb752d45d53d0f0c8a6383ae84632
GET /wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE HTTP/1.1
Host: kalamos.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Thu, 05 Oct 2023 17:50:15 GMT
Server: Apache/2.4.57 (cPanel) OpenSSL/1.1.1w mod_bwlimited/1.4
Location: https://kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
Content-Length: 335
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
0 B URL kalamos.com/wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /wp-ncewap/auth/a2/c4dazo/YWlydmluQGNlcm0uY29t?gclid=EAIaIQobChMIxve2joPIgQMVfKcAAB2nsgYsEAEYASABEgKAKfD_BwE HTTP/1.1
Host: kalamos.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 05 Oct 2023 17:50:21 GMT
Server: Apache/2.4.57 (cPanel) OpenSSL/1.1.1w mod_bwlimited/1.4
X-Powered-By: PHP/5.5.38
refresh: 0;url=https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/#airvin@cerm.com
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/favicon.ico
404 Not Found 191 B URL GET HTTP/2 bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/favicon.ico
IP
Requested by https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/#airvin@cerm.com
Certificate IssuerLet's Encrypt
Subjectdweb.link
FingerprintDC:9D:6C:D8:0D:F2:9C:6C:A8:73:22:4E:0D:D5:B5:9B:81:78:F1:39
ValiditySat, 26 Aug 2023 17:15:50 GMT - Fri, 24 Nov 2023 17:15:49 GMT
Hash 36881ebb248f35e6f31170996a7b7827
f59b007d6698c84006e5f17802db53aaa6c7c714
0ba974ee50879fabe5d0ed6de592548be88de777a2b6509522ae59b0feb2b592
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
server: openresty
date: Thu, 05 Oct 2023 17:49:33 GMT
content-type: text/plain; charset=utf-8
content-length: 191
access-control-allow-methods: GET, HEAD, OPTIONS, GET, POST, OPTIONS
x-content-type-options: nosniff
x-ipfs-gateway-host: ipfs-bank2-fr2
x-ipfs-path: /ipfs/bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe/favicon.ico
x-ipfs-pop: ipfs-bank2-fr2
timing-allow-origin: *
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
x-ipfs-lb-pop: gateway-bank1-fr2
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
code.jquery.com/jquery-1.9.1.js
200 OK 80 kB URL GET HTTP/2 code.jquery.com/jquery-1.9.1.js
IP
Requested by https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/#airvin@cerm.com
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
Hash 08c235d357750c657ac1db7d1cf656a9
9257afd2d46c3a189ec0d40a45722701d47e9ca5
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
GET /jquery-1.9.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4185d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 05 Oct 2023 17:49:34 GMT
age: 1727551
x-served-by: cache-lga21952-LGA, cache-bma1664-BMA
x-cache: HIT, HIT
x-cache-hits: 62, 20619
x-timer: S1696528174.016696,VS0,VE0
vary: Accept-Encoding
content-length: 79506
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 14 kB URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/#airvin@cerm.com
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File type ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 05 Oct 2023 17:49:34 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 17589517
expires: Tue, 24 Sep 2024 17:49:34 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2NrZIViV25oq7K0dZOxEkIs0GUWCjqpP1nrFRKIRMy55xiRtWirtgoxLG10%2FpL8vvqQIhGAmQ0COOOrNjfeshDnPksQhrh4rVIEoXYWslPlS6brNik3koFUxbHBaEG0ta%2Fp5KpcS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8117807fad3956aa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash f647b422e81c74b734bbdfb4e2685e58
ad4b78832939629718cf955fcfb85eb0f84a68fa
640feeda9243594e135a9de52b550b77c6f554b33084de31566f95689beeb788
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Oct 2023 17:49:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash f647b422e81c74b734bbdfb4e2685e58
ad4b78832939629718cf955fcfb85eb0f84a68fa
640feeda9243594e135a9de52b550b77c6f554b33084de31566f95689beeb788
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Oct 2023 17:49:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
lh3.googleusercontent.com/pw/AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
200 OK 330 B URL GET HTTP/2 lh3.googleusercontent.com/pw/AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
IP
Requested by https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/#airvin@cerm.com
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type PNG image data, 128 x 128, 8-bit colormap, non-interlaced\012- data
Hash 79cf1efdbfaf6aff7e32ad13bfa4bbed
0e07b7f718f59b81246dcd059d9da90acbe2da60
fea8fbaec75213e1af8005edfcdc94e7b5d7dca6ddb4e262d66e4756bda96d54
GET /pw/AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/png
cross-origin-resource-policy: cross-origin
vary: Origin
access-control-expose-headers: Content-Length
etag: "v30"
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: private, max-age=86400, no-transform
content-disposition: inline;filename="logo-off-1.png"
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 17:49:34 GMT
server: fife
content-length: 330
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
lh3.googleusercontent.com/pw/AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no?authuser=0
200 OK 197 kB URL GET HTTP/2 lh3.googleusercontent.com/pw/AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no?authuser=0
IP
Requested by https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/#airvin@cerm.com
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint25:24:05:0B:D2:5F:DF:ED:3B:BE:B8:47:80:C5:AE:2B:51:94:69:F5
ValidityMon, 04 Sep 2023 08:23:19 GMT - Mon, 27 Nov 2023 08:23:18 GMT
File type GIF image data, version 89a, 1580 x 720\012- data
Size 197 kB (197044 bytes)
Hash 5a82b5eee228b42593eb49c3a2d830ea
a958abaf7781997bfee5cf4a8bca6d3013dbb95a
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
GET /pw/AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no?authuser=0 HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/gif
cross-origin-resource-policy: cross-origin
vary: Origin
access-control-expose-headers: Content-Length
etag: "v51"
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: private, max-age=86400, no-transform
content-disposition: inline;filename="Flashback - Jul 5, 2023 00_04_12.gif"
x-content-type-options: nosniff
date: Thu, 05 Oct 2023 17:49:34 GMT
server: fife
content-length: 197044
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash f647b422e81c74b734bbdfb4e2685e58
ad4b78832939629718cf955fcfb85eb0f84a68fa
640feeda9243594e135a9de52b550b77c6f554b33084de31566f95689beeb788
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 05 Oct 2023 17:49:34 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/
200 OK 29 kB URL User Request GET HTTP/2 bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link/
IP
Certificate IssuerLet's Encrypt
Subjectdweb.link
FingerprintDC:9D:6C:D8:0D:F2:9C:6C:A8:73:22:4E:0D:D5:B5:9B:81:78:F1:39
ValiditySat, 26 Aug 2023 17:15:50 GMT - Fri, 24 Nov 2023 17:15:49 GMT
File type HTML document, ASCII text, with very long lines (28604), with no line terminators
Hash 82cd7ef0bc0192fcb5a6939250d351fd
5a409dcfa58d10b6674c54820326700fdd67bc73
33d794c0a4380a76879205f98b3bfa44d87fbe83d8c36d40d33f0646a60f7d81
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
Quad9 DNS malicious Sinkholed
GET / HTTP/1.1
Host: bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe.ipfs.dweb.link
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Thu, 05 Oct 2023 17:49:33 GMT
content-type: text/html
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS, GET, POST, OPTIONS
cache-control: public, max-age=29030400, immutable
etag: W/"bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe"
x-ipfs-gateway-host: ipfs-bank6-fr2
x-ipfs-path: /ipfs/bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe/
x-ipfs-roots: bafkreibt26kmbjbybj3ipeqf7gftx6se3b735a6yynwubuz7azdkmd35qe
x-ipfs-pop: ipfs-bank6-fr2
timing-allow-origin: *
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
x-ipfs-lb-pop: gateway-bank1-fr2
x-proxy-cache: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
20.234.104.33
104.17.25.14
0.0.0.0