Report - bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

Report Overview

URL

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/
IP

162.222.226.70

ASN

#394695 PUBLIC-DOMAIN-REGISTRY
Submitted

2023-02-09T15:34:57Z

Access
Tags

netflix phishing
urlquery detections

Phishing - Netflix

Detections

urlquery

4
Network Intrusion Detection

0
Threat Detection Systems

5

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	54.149.229.221
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	61530	34.120.237.76
r3.o.lencr.org (6)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2028	5318	23.36.77.32
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782	2372	35.241.9.150
bontlem.co.za (12)	unknown	2016-04-06T04:38:18Z	2023-03-12T10:26:49Z	5452	74023	162.222.226.70
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5844	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-09	medium	bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/	Phishing
2023-02-09	medium	bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819	Phishing
2023-02-09	medium	bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/cleve.js	Phishing
2023-02-09	medium	bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/main.js?rand=1335101428	Phishing
2023-02-09	medium	bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/assets/img/icon.ico	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

HTTP Transactions (29)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

b7407cc102d62a5acd5e61f8a79bed36

c2f4890a62454e514962b55b7fc14228339c8e90

be282de92da261128a7c8471f3067466aa9930fd0ab2a2cdda8cd2d6ce2bbd74

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE282DE92DA261128A7C8471F3067466AA9930FD0AB2A2CDDA8CD2D6CE2BBD74"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13562
Expires: Thu, 09 Feb 2023 19:20:48 GMT
Date: Thu, 09 Feb 2023 15:34:46 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

565c1bbc5c1c40be1988b3bf6fd9dc1a

cfdba5bc597130461dd67bf6cda53183be592493

60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2283
Expires: Thu, 09 Feb 2023 16:12:49 GMT
Date: Thu, 09 Feb 2023 15:34:46 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

ff250d3ef3fa45322bf05039a0122a9f

b3e7a2c383bce1bab807dbe1a03c375258b51f1d

d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 09 Feb 2023 15:34:16 GMT
content-type: application/json
age: 30
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

50a2f8cdbbd1059f5318753155bba7ef

405e63ea4683be44f876feae34b5cb645ff751f2

f6ac743a5a17d64d2858fec5791050d2dc8074ddd823826c93e67bffdb2f0868

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6AC743A5A17D64D2858FEC5791050D2DC8074DDD823826C93E67BFFDB2F0868"
Last-Modified: Thu, 09 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8402
Expires: Thu, 09 Feb 2023 17:54:48 GMT
Date: Thu, 09 Feb 2023 15:34:46 GMT
Connection: keep-alive

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

162.222.226.70

200 OK

3104

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1057), with CRLF line terminators

Size

3104
Hash

2637388876cf329e143a6c71c9d53a0f

67bf53a77f4f11558fd95473d4e64b6836e07181

20138ec74f7d378b6263a59414dfe92d46d0480da3c00805807144d76b7203c3

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/ HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:46 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3104
Keep-Alive: timeout=5, max=75
Content-Type: text/html; charset=UTF-8

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

e76071a28ee566dababb3834f46d68ed

aebb4e68c1ba2de0f90025283e8ed8470944fde0

78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: Pu7Li3p2pevJ0WSafmjX2alk7Az4tEOC0YHy2lL4XiJPYOWztvah2F8NzhhRqaUvucCWeUAZBXU=
x-amz-request-id: V3QP995XW1XBY3QA
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 09 Feb 2023 14:46:26 GMT
age: 2900
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Thu, 09 Feb 2023 15:34:46 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819

162.222.226.70

200 OK

2331

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

ASCII text, with CRLF line terminators

Size

2331
Hash

f7d39e5091069b899a1151f6cba793de

4ca2a195f7fe4ac4072b77db6a20d904133e125b

6e6495373c4ba09e51e88119b88d360bd8ce2703415a76b01746411bdf3df020

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819 HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:46 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2331
Keep-Alive: timeout=5, max=75
Content-Type: text/css

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Content-Type, Expires, Pragma, Retry-After, Last-Modified, ETag, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 09 Feb 2023 15:14:53 GMT
age: 1194
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/loading-btn.css

162.222.226.70

200 OK

697

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/loading-btn.css
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

ASCII text, with CRLF line terminators

Size

697
Hash

c6847f774f9e99517588542288a858f9

e8f101d996bf645c26c037fde326aace6815684b

420e5df9bf3a1516baf4f49086a65cc38d43b7943513a45062911c93e48eaa1d

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/loading-btn.css HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 697
Keep-Alive: timeout=5, max=75
Content-Type: text/css

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/cleve.js

162.222.226.70

200 OK

6839

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/cleve.js
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

ASCII text, with very long lines (18095), with CRLF line terminators

Size

6839
Hash

33b8aaf1a25a746030da813cc18b239f

afe16e4d39ae007f153e9db80b5a070b659c49df

422f4580b8ee5324eec23242b041af9874723513305beeaa8c37bfdbfa4289e7

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/cleve.js HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 6839
Keep-Alive: timeout=5, max=75
Content-Type: application/javascript

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/main.js?rand=1335101428

162.222.226.70

200 OK

4988

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/main.js?rand=1335101428
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

ASCII text, with very long lines (420)

Size

4988
Hash

b68f0f4eb017c2dd7432ae6bc94d51c6

de005602994684073c9f20891d8430dcc932b0c8

84f924d68af9f7433c2ae7262bca12e812a813bb494d2fc8c8b65d9eb4ab04fa

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/js/main.js?rand=1335101428 HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4988
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Content-Type: application/javascript

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/animate.css

162.222.226.70

200 OK

8500

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/animate.css
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

ASCII text, with CRLF line terminators

Size

8500
Hash

63440df864b2582deaded6b749c6d599

a514b2801a40cbdb2ea4feb15a7016dd21790165

e12025627b01fa1e954b01241fac61f7b22a23a403d11038926f1d5f382230e4

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/animate.css HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 8500
Keep-Alive: timeout=5, max=75
Content-Type: text/css

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/loading.css

162.222.226.70

200 OK

20001

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/loading.css
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

Unicode text, UTF-8 text, with very long lines (353), with CRLF line terminators

Size

20001
Hash

78cf545b81b6917af68946111791f5a6

98444e12c5f84bd38c9b5a6752279361d1b74709

22d54540fec8dbb9abf8ee918ee2d6d87644a2264cb6d1783af5602279ee6ff9

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/loading.css HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:46 GMT
Server: Apache
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20001
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Content-Type: text/css

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/assets/img/icon.ico

162.222.226.70

200 OK

16958

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/assets/img/icon.ico
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel\012- data

Size

16958
Hash

41b45fdce09bd6acd07c7a8949da675e

931e18dfc6e7d950dc2f2bbdfe31e1ea720acf7c

abe8012eb65c0dc0ac3e87dcc1e60e1908ebd8f12b7c47a5df1856f7a7bb1edd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix
fortinet	Phishing

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/assets/img/icon.ico HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Content-Length: 16958
Cache-Control: max-age=604800
Expires: Thu, 16 Feb 2023 15:34:47 GMT
Keep-Alive: timeout=5, max=75
Content-Type: image/x-icon

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

248ce16379b12f11927ecc3142aec450

fa5b189f2d9182479170cb61cc1723571e437bd2

a8d259b331bdefb00625b9bf057d44d0b3290fda0734c57eda187b04e23d59d4

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A8D259B331BDEFB00625B9BF057D44D0B3290FDA0734C57EDA187B04E23D59D4"
Last-Modified: Wed, 08 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12631
Expires: Thu, 09 Feb 2023 19:05:18 GMT
Date: Thu, 09 Feb 2023 15:34:47 GMT
Connection: keep-alive

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/shield.png

162.222.226.70

200 OK

3535

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/shield.png
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced\012- data

Size

3535
Hash

2b5e239e8b71f1abc5d52e788ae4aba9

ebddc44281f0697b84cdd2fd9e93225f6700df2e

43a600f9e33d65f6596e98057dbf0ae18b049671749b19a6c59058bfc975a196

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/shield.png HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Content-Length: 3535
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Content-Type: image/png

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/globe.png

162.222.226.70

200 OK

2499

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/globe.png
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

PNG image data, 60 x 60, 8-bit gray+alpha, non-interlaced\012- data

Size

2499
Hash

a03ca7b8bee20ac670f38a00c8adfda0

ffbed949e9bd5deda0d24acf89ee4eee28942b2f

61534c5fc273f1d899927470c30ee2419258f28ff6b584553e2543a551732a87

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/globe.png HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Content-Length: 2499
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Content-Type: image/png

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/drop.png

162.222.226.70

200 OK

478

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/drop.png
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

PNG image data, 64 x 64, 8-bit gray+alpha, non-interlaced\012- data

Size

478
Hash

b47cf30632a724896c3599be9e52fe98

f2b0564f5b7f2759fcc5149de6570205b41c2ea6

d20ca4c5f157e2475bdc2cd10843b8e4bc7b5e99f925f9d6c2441dda958596b6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/drop.png HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Content-Length: 478
Keep-Alive: timeout=5, max=73
Connection: Keep-Alive
Content-Type: image/png

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/tick.png

162.222.226.70

200 OK

686

URL HTTP/1.1

bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/tick.png
IP

162.222.226.70:0
ASN

#394695 PUBLIC-DOMAIN-REGISTRY

Magic

PNG image data, 60 x 60, 8-bit colormap, non-interlaced\012- data

Size

686
Hash

1e67e1a8b50623197524c1db2abde760

5a286fa29d4ba8cc1542709a8c06047d9e9c4081

4801bf781679e30457faed26adaa4522c403d74d9f06d1d63233fee1e4868bfc

HTTP Headers

                                        GET /wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/img/tick.png HTTP/1.1
Host: bontlem.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://bontlem.co.za/wp/wp-content/uploads/Netflix/62d2b7ba91f34c0ac08aa11c359a8d2c/account/assets/css/master.css?rand=1952709819

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:34:47 GMT
Server: Apache
Last-Modified: Sun, 15 Jan 2023 07:37:04 GMT
Accept-Ranges: bytes
Content-Length: 686
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Content-Type: image/png

push.services.mozilla.com/

54.149.229.221

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

54.149.229.221:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 1e2YiLRAG7Rt3v49Zs7ihg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: jx7ubqlVH5Bm7nG8LaQIcCk8mI8=

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

1d885cfc22a04f1216c98dd64df5338a

589916a844b81fac40af88a772865b8e28dfb64e

40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4815
Expires: Thu, 09 Feb 2023 16:55:03 GMT
Date: Thu, 09 Feb 2023 15:34:48 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

1d885cfc22a04f1216c98dd64df5338a

589916a844b81fac40af88a772865b8e28dfb64e

40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4815
Expires: Thu, 09 Feb 2023 16:55:03 GMT
Date: Thu, 09 Feb 2023 15:34:48 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg

34.120.237.76

200 OK

7450

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

7450
Hash

ce710ab5746832fe637fada3e6d63abf

d545c85d4a8cf92dc8b88db0a056623d1ef7a943

40bae4a2fb9dd60e9339d15ad0838f3ca83b5b6275c35cd22878b6783fcd6247

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 7450
x-amzn-requestid: 7e2b1875-ecf9-4ee9-8d5a-a911fdd28d16
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AColKGwOIAMFyqA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e42153-097b982244d3ad7b6f49a392;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 22:25:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Uvdg9MhYDsR9aC-s_chZDKp7_5RzhQfTwXZ0epZVW7TUVdrdADUEfQ==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 09 Feb 2023 03:49:25 GMT
age: 42323
etag: "d545c85d4a8cf92dc8b88db0a056623d1ef7a943"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10472

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ec996f6-8867-41f0-9850-ad04d05e22e6.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

10472
Hash

464812429ec9f5c766def4ac26e86e4f

170a5d6fcaa69c78896ed8a37442a27c6309c09a

1248df6127626b254420b6ddabba6fba12066c9b7f314386c25ac51781f59060

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ec996f6-8867-41f0-9850-ad04d05e22e6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 10472
x-amzn-requestid: 6948a391-6553-40ec-8373-4c3b5c95c7e3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ACoE9EgaoAMFRFA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e42085-275d22cb2435af874715be99;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 22:21:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: rj8wiiICVx4rJ0-InAUgGVx5E6VrRDV9MndpdsDgwnQJw_I2Up_XmA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 09 Feb 2023 09:12:10 GMT
age: 22958
etag: "170a5d6fcaa69c78896ed8a37442a27c6309c09a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8150

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc03326d1-bbfd-4654-a9db-ac431757b9f6.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

8150
Hash

764b732e88dd1e9c1824529b24b3dffc

2ba954a51c2972b267ae0536e343e608aa9aa7f4

a1efdf03b14bb05cf8e407b92476592c35fa2d27c5e66705322abdb4c6412a06

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc03326d1-bbfd-4654-a9db-ac431757b9f6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 8150
x-amzn-requestid: 3834493a-4162-4cc9-b67c-541cc9be895b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fwD8IH0TIAMFWqQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dcb380-3746ff7b0a6894366efa848e;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 07:10:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: I3qmC4D6qdsheK8VO3oKbPDU7XV1r9_XEPMcExKnvATDkVUsJHjHbg==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Thu, 09 Feb 2023 01:59:42 GMT
age: 48906
etag: "2ba954a51c2972b267ae0536e343e608aa9aa7f4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8637

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb92005b3-7a69-411c-9afb-60b86ab8c5da.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

8637
Hash

b0c5e12696e3ee13041d043084828210

c48927fb23f59e0949d388086c197699c8f19d1b

47838e958555ff6799d4d1d3994913943726daba5294cd89afe9036628ef6fdb

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb92005b3-7a69-411c-9afb-60b86ab8c5da.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 8637
x-amzn-requestid: fa797448-32c3-4438-a192-5291c48b1d85
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AChJKFq9oAMFgog=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e4156d-46ff32923a2763b45a5194f4;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 21:34:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2olwTLHKbCas7GcQiRz22bk_I646VcTxN3Yv_ObBVgeGC0l73GNh8A==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:34:37 GMT
etag: "c48927fb23f59e0949d388086c197699c8f19d1b"
content-type: image/jpeg
age: 64811
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8717

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F844d5320-b850-4dd9-87c4-2b4f17eb895e.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

8717
Hash

82ed633b05ccadc8b87e83413641f1ef

aafed39990cf6a3391d53355085d816167a500fa

c9202e36b231d0a9a9cba1ff8f570e5b0fbba215eb6b28e3989fd442ee7f5835

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F844d5320-b850-4dd9-87c4-2b4f17eb895e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 8717
x-amzn-requestid: dbb8b5a2-d3f6-42e2-8778-da19de081cb8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f2c0LHaiIAMF5cA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63df41b4-309b6b1f651f68453dd52f55;Sampled=0
x-amzn-remapped-date: Sun, 05 Feb 2023 05:42:12 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hBfl0rPzn_iOD9xRlc236_IEvyGlK5WteH1y4cd0aYxlFzd3RVfgkQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:34:46 GMT
age: 64802
etag: "aafed39990cf6a3391d53355085d816167a500fa"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11760

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3ab2faf0-d9a7-41a6-b5cf-bf6189f66342.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

11760
Hash

9203cfb9f0c1c958dd008eac55a9d3c4

6bdd1047590dd3fb54c15d5d6d38e7c86274b203

09770229be5ff3037708543e3204c66de84253b3a858a83a0e1672a04c0e9cb1

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3ab2faf0-d9a7-41a6-b5cf-bf6189f66342.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 11760
x-amzn-requestid: b2863a01-4714-4554-a478-5402467b3448
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AChJKHc_oAMFwlw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e4156d-1c5a3edf37bc7cc937c800d2;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 21:34:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: y-1zzLzVegi0T-SAyTpUuFD6iVVYbuL5u71dc74BY2l7PrxVu-am5w==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:34:37 GMT
etag: "6bdd1047590dd3fb54c15d5d6d38e7c86274b203"
content-type: image/jpeg
age: 64811
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

#1 JS:Script (size: 18267)

#2 JS:Script (size: 20914)

HTTP Transactions (29)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN