go.redirectingat.com/?id=803X112721&xcust=06-3696717-11-0000000&sref=https://www.techadvisor.co.uk/new-product/mobile-phone/oneplus-7-3696717/&xs=1&url=https://lmdswersd.com/osasco/omasco/4vd7a30653bWZ48JXMZUMP////bWd1ZXJyZXJvQGJlcmdtYW5rcHJzLmNvbQ==
35.190.25.30 0 B URL go.redirectingat.com/?id=803X112721&xcust=06-3696717-11-0000000&sref=https://www.techadvisor.co.uk/new-product/mobile-phone/oneplus-7-3696717/&xs=1&url=https://lmdswersd.com/osasco/omasco/4vd7a30653bWZ48JXMZUMP////bWd1ZXJyZXJvQGJlcmdtYW5rcHJzLmNvbQ==
IP 35.190.25.30:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?id=803X112721&xcust=06-3696717-11-0000000&sref=https://www.techadvisor.co.uk/new-product/mobile-phone/oneplus-7-3696717/&xs=1&url=https://lmdswersd.com/osasco/omasco/4vd7a30653bWZ48JXMZUMP////bWd1ZXJyZXJvQGJlcmdtYW5rcHJzLmNvbQ== HTTP/1.1
Host: go.redirectingat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: openresty/1.19.9.1
date: Mon, 27 Nov 2023 18:43:35 GMT
content-type: text/plain
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: *
strict-transport-security: max-age=31536000
x-skimhost: cookie-dealer-waypoint-56d7795867-85ndz
location: https://lmdswersd.com/osasco/omasco/4vd7a30653bWZ48JXMZUMP////bWd1ZXJyZXJvQGJlcmdtYW5rcHJzLmNvbQ==
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
lmdswersd.com/osasco/omasco/4vd7a30653bWZ48JXMZUMP////bWd1ZXJyZXJvQGJlcmdtYW5rcHJzLmNvbQ==
91.209.70.135 0 B URL lmdswersd.com/osasco/omasco/4vd7a30653bWZ48JXMZUMP////bWd1ZXJyZXJvQGJlcmdtYW5rcHJzLmNvbQ==
IP 91.209.70.135:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /osasco/omasco/4vd7a30653bWZ48JXMZUMP////bWd1ZXJyZXJvQGJlcmdtYW5rcHJzLmNvbQ== HTTP/1.1
Host: lmdswersd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 18:43:35 GMT
Server: Apache
refresh: 0;url=https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html
104.18.2.35 22 kB URL pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html
IP 104.18.2.35:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65131), with CRLF line terminators
Hash e227f3bdae3d966fe1e0e1ed8d11f71a
badc4a9302c911cb8cd536fc300b9dcda9d438d5
f3b8895484596b06bb54ffcb8965abf0329648d6b011d17856b2c30a41e0edaa
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /osama.html HTTP/1.1
Host: pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 18:43:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"e227f3bdae3d966fe1e0e1ed8d11f71a"
Last-Modified: Fri, 24 Nov 2023 15:00:04 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82cc84848d5056c4-OSL
Content-Encoding: gzip
code.jquery.com/jquery-3.1.1.min.js
151.101.130.137200 OK 30 kB URL GET HTTP/2 code.jquery.com/jquery-3.1.1.min.js
IP 151.101.130.137:443
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File type ASCII text, with very long lines (32030)
Hash e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Mon, 27 Nov 2023 18:43:36 GMT
age: 6310015
x-served-by: cache-lga21947-LGA, cache-bma1636-BMA
x-cache: HIT, HIT
x-cache-hits: 119, 94922
x-timer: S1701110616.137026,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2
aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
152.199.23.37200 OK 1.4 kB URL GET HTTP/2 aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
IP 152.199.23.37:443
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (3651), with no line terminators
Hash ee5c8d9fb6248c938fd0dc19370e90bd
d01a22720918b781338b5bbf9202b241a5f99ee4
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
age: 27382754
cache-control: public, max-age=31536000
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
content-type: image/svg+xml
date: Mon, 27 Nov 2023 18:43:36 GMT
etag: 0x8D79A1B9F5E121A
last-modified: Thu, 16 Jan 2020 00:32:52 GMT
server: ECAcc (ska/F7B5)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: fc3f3f64-801e-006c-6456-2890f5000000
x-ms-version: 2009-09-19
content-length: 1435
X-Firefox-Spdy: h2
aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
13.107.246.53200 OK 276 B URL GET HTTP/2 aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
IP 13.107.246.53:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (513), with no line terminators
Hash a9cc2824ef3517b6c4160dcf8ff7d410
8db9aebad84ca6e4225bfdd2458ff3821cc4f064
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: public, max-age=31536000
content-length: 276
content-type: image/svg+xml
content-encoding: gzip
content-md5: TjUQkZ0p0Y7rbj6LJofS9Q==
last-modified: Fri, 17 Jan 2020 19:28:34 GMT
etag: 0x8D79B8371B97A82
x-cache: TCP_HIT
x-ms-request-id: 4d8ee911-101e-0036-6042-0fec6e000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0SpZJZQAAAAAmBLZXYFfTSIPxFEjCT7FDQU1TMDRFREdFMTkxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 0WONkZQAAAAAiA/AW/VNYSKAI2iimzw0BU1ZHMjBFREdFMDYxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Mon, 27 Nov 2023 18:43:35 GMT
X-Firefox-Spdy: h2
aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
13.107.246.53200 OK 621 B URL GET HTTP/2 aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
IP 13.107.246.53:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (1592), with no line terminators
Hash 4e48046ce74f4b89d45037c90576bfac
4a41b3b51ed787f7b33294202da72220c7cd2c32
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: public, max-age=31536000
content-length: 621
content-type: image/svg+xml
content-encoding: gzip
content-md5: R2FAVxfpONfnQAuxVxXbHg==
last-modified: Tue, 10 Nov 2020 03:41:24 GMT
etag: 0x8D8852A7FA6B761
x-cache: TCP_HIT
x-ms-request-id: 355048b0-001e-0013-74ad-1ffa57000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0PPBjZQAAAAAc5iDSiZlLQoCCU2Kma9urQU1TMDRFREdFMTgxNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 0WONkZQAAAAAbie7vI9HOTocGCe+AC/SUU1ZHMjBFREdFMDYxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Mon, 27 Nov 2023 18:43:35 GMT
X-Firefox-Spdy: h2
aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
152.199.23.37200 OK 673 B URL GET HTTP/2 aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
IP 152.199.23.37:443
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1864), with no line terminators
Hash bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 14334575
cache-control: public, max-age=31536000
content-md5: DhdidjYrlCeaRJJRG/y9mA==
content-type: image/svg+xml
date: Mon, 27 Nov 2023 18:43:36 GMT
etag: 0x8D7B007297AE131
last-modified: Wed, 12 Feb 2020 22:01:50 GMT
server: ECAcc (ska/F732)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 68d21ab8-f01e-0076-6702-9f059f000000
x-ms-version: 2009-09-19
content-length: 673
X-Firefox-Spdy: h2
pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/favicon.ico
104.18.2.35404 Not Found 6.5 kB URL GET HTTP/1.1 pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/favicon.ico
IP 104.18.2.35:443
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint91:F0:8B:D3:AA:FC:86:18:F9:F2:29:EB:98:8C:D8:5A:3A:76:5C:CF
ValidityWed, 11 Oct 2023 17:13:53 GMT - Tue, 09 Jan 2024 17:13:52 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (611)
Hash df3d48946e8d3f5a83608308edbb4b86
47b9c40c97abf2658df96b1c06109324e15e1a00
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
GET /favicon.ico HTTP/1.1
Host: pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Mon, 27 Nov 2023 18:43:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82cc84892cc956c4-OSL
Content-Encoding: gzip
prisonedgefoundation.org/normal/prv.php?id=mguerrero@bergmankprs.com
91.209.70.135200 OK 248 B URL GET HTTP/1.1 prisonedgefoundation.org/normal/prv.php?id=mguerrero@bergmankprs.com
IP 91.209.70.135:443
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerLet's Encrypt
Subjectcpcontacts.prisonedgefoundation.org
Fingerprint44:9C:F9:C6:5C:ED:83:CA:3D:D4:FB:CC:1C:C2:C7:F6:20:37:F1:74
ValidityThu, 23 Nov 2023 11:32:16 GMT - Wed, 21 Feb 2024 11:32:15 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 2ea78fa8e2519c2cd9b71b93156626c3
461d1bc1d762cd01f56dcf2482cfd21a451d04da
7c4921287b48e4dec59d157258a5426d0be48f30a6cb78d7a58b63e8d5bd931a
GET /normal/prv.php?id=mguerrero@bergmankprs.com HTTP/1.1
Host: prisonedgefoundation.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 18:43:36 GMT
Server: Apache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
aadcdn.msauthimages.net/dbd5a2dd-g61rnghi9gwg80fzxeo2zx7xr-n7kuak9jlyzx2-gjq/logintenantbranding/0/bannerlogo?ts=638100935774082259
152.199.23.72200 OK 8.5 kB URL GET HTTP/2 aadcdn.msauthimages.net/dbd5a2dd-g61rnghi9gwg80fzxeo2zx7xr-n7kuak9jlyzx2-gjq/logintenantbranding/0/bannerlogo?ts=638100935774082259
IP 152.199.23.72:443
Requested by https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html#mguerrero@bergmankprs.com
Certificate IssuerMicrosoft Corporation
Subjectaadcdn.msauthimages.net
Fingerprint6B:EB:AC:06:FC:06:82:11:17:1C:6B:72:7D:B5:95:2D:CF:E7:A3:5D
ValidityWed, 08 Mar 2023 11:16:34 GMT - Sat, 02 Mar 2024 11:16:34 GMT
File type PNG image data, 1215 x 233, 8-bit/color RGBA, non-interlaced\012- data
Hash f2e696466b503a6cd0f93000c45885b8
f5a7a50d04b3976070170804a6de6280b63739b5
e201cb4e8705e3c0bdf52043dd7632a13bb77630cd99f590b74284758902bb60
GET /dbd5a2dd-g61rnghi9gwg80fzxeo2zx7xr-n7kuak9jlyzx2-gjq/logintenantbranding/0/bannerlogo?ts=638100935774082259 HTTP/1.1
Host: aadcdn.msauthimages.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
content-md5: 8uaWRmtQOmzQ+TAAxFiFuA==
content-type: image/*
date: Mon, 27 Nov 2023 18:43:36 GMT
etag: 0x8DAFD6B97D9C8DD
last-modified: Mon, 23 Jan 2023 17:59:37 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 6a99f39a-f01e-0037-3661-21914e000000
x-ms-version: 2009-09-19
content-length: 8473
X-Firefox-Spdy: h2
pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html
104.18.2.35200 OK 114 kB URL User Request GET HTTP/1.1 pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev/osama.html
IP 104.18.2.35:443
Certificate IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint91:F0:8B:D3:AA:FC:86:18:F9:F2:29:EB:98:8C:D8:5A:3A:76:5C:CF
ValidityWed, 11 Oct 2023 17:13:53 GMT - Tue, 09 Jan 2024 17:13:52 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65131), with CRLF line terminators
Size 114 kB (114284 bytes)
Hash e227f3bdae3d966fe1e0e1ed8d11f71a
badc4a9302c911cb8cd536fc300b9dcda9d438d5
f3b8895484596b06bb54ffcb8965abf0329648d6b011d17856b2c30a41e0edaa
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /osama.html HTTP/1.1
Host: pub-c3f1d6428b3c4a36a4c4f5985ac2b132.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 18:43:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"e227f3bdae3d966fe1e0e1ed8d11f71a"
Last-Modified: Fri, 24 Nov 2023 15:00:04 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82cc84848d5056c4-OSL
Content-Encoding: gzip