bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//indus-group.com.pk/WhctKKZPCQhcxBSHFVrhQMrpvbXBBZnzBPdMVS/BSHFVrhQBSHFVrhQMrpvbXBBZnzBPdMVSMrpvbXBBZnzBPdMVS/BSHFVrhQMrpvbXBBZnzBPdMVS/wpfile/2787/Lmitchell/bG1pdGNoZWxsQGplcnZpc3dlYmIuY29t
52.215.148.88 17 B URL bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//indus-group.com.pk/WhctKKZPCQhcxBSHFVrhQMrpvbXBBZnzBPdMVS/BSHFVrhQBSHFVrhQMrpvbXBBZnzBPdMVSMrpvbXBBZnzBPdMVS/BSHFVrhQMrpvbXBBZnzBPdMVS/wpfile/2787/Lmitchell/bG1pdGNoZWxsQGplcnZpc3dlYmIuY29t
IP 52.215.148.88:0
File type ASCII text, with no line terminators
Hash edf537e37d4549950774190c58f93b76
4e2078632eccec8993f151be9338bbcb88ce6f58
afff9c63cfeacd26e5d4000edf576f1386d6729dca783eb45004f484a73a3514
GET /r/?id=h2ccc12b,8d23fb3,492093b&p1=//indus-group.com.pk/WhctKKZPCQhcxBSHFVrhQMrpvbXBBZnzBPdMVS/BSHFVrhQBSHFVrhQMrpvbXBBZnzBPdMVSMrpvbXBBZnzBPdMVS/BSHFVrhQMrpvbXBBZnzBPdMVS/wpfile/2787/Lmitchell/bG1pdGNoZWxsQGplcnZpc3dlYmIuY29t HTTP/1.1
Host: bmwag-rt-prod2-t.campaign.adobe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Content-Type: text/plain; charset=utf-8
Date: Tue, 28 Nov 2023 12:44:31 GMT
Location: https:////indus-group.com.pk/WhctKKZPCQhcxBSHFVrhQMrpvbXBBZnzBPdMVS/BSHFVrhQBSHFVrhQMrpvbXBBZnzBPdMVSMrpvbXBBZnzBPdMVS/BSHFVrhQMrpvbXBBZnzBPdMVS/wpfile/2787/Lmitchell/bG1pdGNoZWxsQGplcnZpc3dlYmIuY29t
P3P: CP="CAO DSP COR CURa DEVa TAIa OUR BUS IND UNI COM NAV"
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
Referrer-Policy: strict-origin
Server: Apache
Set-Cookie: AMCV_B52D1CFE5330949C0A490D45%40AdobeOrg=MCMID%7C44489912828653731833888293129257746431; Domain=adobe.com; Path=/; Expires=Sun, 22-Dec-2024 12:44:31 GMT
nlid=2ccc12b|8d23fb3; Domain=adobe.com; Path=/
nllastdelid=8d23fb3; Domain=adobe.com; Path=/; Expires=Sun, 22-Dec-2024 12:44:31 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: noindex
Content-Length: 17
Connection: keep-alive
indus-group.com.pk/WhctKKZPCQhcxBSHFVrhQMrpvbXBBZnzBPdMVS/BSHFVrhQBSHFVrhQMrpvbXBBZnzBPdMVSMrpvbXBBZnzBPdMVS/BSHFVrhQMrpvbXBBZnzBPdMVS/wpfile/2787/Lmitchell/bG1pdGNoZWxsQGplcnZpc3dlYmIuY29t
203.124.43.229 0 B URL indus-group.com.pk/WhctKKZPCQhcxBSHFVrhQMrpvbXBBZnzBPdMVS/BSHFVrhQBSHFVrhQMrpvbXBBZnzBPdMVSMrpvbXBBZnzBPdMVS/BSHFVrhQMrpvbXBBZnzBPdMVS/wpfile/2787/Lmitchell/bG1pdGNoZWxsQGplcnZpc3dlYmIuY29t
IP 203.124.43.229:0
ASN #7590 Commission on Science and Technology for
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /WhctKKZPCQhcxBSHFVrhQMrpvbXBBZnzBPdMVS/BSHFVrhQBSHFVrhQMrpvbXBBZnzBPdMVSMrpvbXBBZnzBPdMVS/BSHFVrhQMrpvbXBBZnzBPdMVS/wpfile/2787/Lmitchell/bG1pdGNoZWxsQGplcnZpc3dlYmIuY29t HTTP/1.1
Host: indus-group.com.pk
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 28 Nov 2023 12:44:30 GMT
Server: Apache
refresh: 0;url=https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
104.17.24.14200 OK 28 kB URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
IP 104.17.24.14:443
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File type ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 28 Nov 2023 12:44:33 GMT
content-type: application/javascript; charset=utf-8
content-length: 27938
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "603e8adc-15d9d"
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 283171
expires: Sun, 17 Nov 2024 12:44:33 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wFFxWKn8DqhMXhmlfdFHzqOPhVVhmjvkRDKzoxLS0YeTV49zZh3NeYFv%2FdCgVFbhxCDb5sGusHeQ3LcwiVeS8t8vIMUxglrqCkm5lwQP9xoftJViX%2FVf4onxRwv7C6JFE8miqQO%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82d2b3f66f755688-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
bc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com/api/v3/auth
194.33.191.133200 OK 2 B URL OPTIONS HTTP/1.1 bc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com/api/v3/auth
IP 194.33.191.133:443
ASN #20668 Internet Resources Management SRL
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerLet's Encrypt
Subjectbc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com
FingerprintF2:13:D7:95:AC:ED:37:BF:EF:A8:16:6D:AA:F9:28:6C:22:8D:42:1C
ValidityFri, 10 Nov 2023 13:15:25 GMT - Thu, 08 Feb 2024 13:15:24 GMT
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /api/v3/auth HTTP/1.1
Host: bc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Origin: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Tue, 28 Nov 2023 12:44:17 GMT
server: uvicorn
vary: Origin
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-max-age: 600
access-control-allow-credentials: true
access-control-allow-origin: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io
access-control-allow-headers: content-type
content-length: 2
content-type: text/plain; charset=utf-8
bc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com/api/v3/auth
194.33.191.133200 OK 15 kB URL OPTIONS HTTP/1.1 bc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com/api/v3/auth
IP 194.33.191.133:443
ASN #20668 Internet Resources Management SRL
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerLet's Encrypt
Subjectbc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com
FingerprintF2:13:D7:95:AC:ED:37:BF:EF:A8:16:6D:AA:F9:28:6C:22:8D:42:1C
ValidityFri, 10 Nov 2023 13:15:25 GMT - Thu, 08 Feb 2024 13:15:24 GMT
File type JSON data\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (15432), with no line terminators
Hash fa7df42219c91834365a427217cf06b3
979bc3438505a9f9b43ca4f0821e4bc337207f26
c9d8ca96fa6a527d3ffe86b62bfbef2be514ddc0fd628d74fc02579711c2f0d9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /api/v3/auth HTTP/1.1
Host: bc1q0j2ytw8wx5rqszcfenx58lhhx69rz6.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 183
Origin: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
date: Tue, 28 Nov 2023 12:44:17 GMT
server: uvicorn
content-length: 15432
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
143.204.55.78200 OK 35 kB URL User Request GET HTTP/2 bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
IP 143.204.55.78:443
Certificate IssuerAmazon
Subject*.ipfs.nectarnode.io
Fingerprint82:D2:34:1D:00:DF:98:C5:3D:EB:AF:A9:A2:A9:49:92:99:63:55:C1
ValidityFri, 27 Oct 2023 00:00:00 GMT - Sun, 24 Nov 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (8866), with CRLF line terminators
Hash 134387512e68442065edc281794003e2
0fd59f37cc1c3a89f815a785da418335ee9f25bd
276f08b972fd514c96fe45e1f29de49428be8c7b508b34266eb1ec5221d4df63
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft Outlook
GET /?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com HTTP/1.1
Host: bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
date: Tue, 28 Nov 2023 12:44:33 GMT
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
etag: W/"bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu"
x-ipfs-path: /ipfs/bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu/
x-ipfs-roots: bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu
content-encoding: br
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 6cb1d4b545e7beb4ead790454f4807c6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: hV3ufpX02Li4DKErsfXR6n3Il2eHFRu-TYJgbsiS1E3opAoS205YIg==
X-Firefox-Spdy: h2
aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
13.107.246.53200 OK 20 kB URL GET HTTP/2 aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
IP 13.107.246.53:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (61177)
Hash ce26137fc0d9b7d7a0d52ebe3a186512
b9d7fb3fe7d08f46c2d1153bb47b13809375c663
1304c5090f063c677a5b3720fe7b97ef4d9ea102e2bdd837ce399df6057fe385
GET /ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: public, max-age=31536000
content-length: 19953
content-type: text/css
content-encoding: gzip
content-md5: xg2DER+s52egaL6bUXi4hw==
last-modified: Mon, 18 Apr 2022 21:18:26 GMT
etag: 0x8DA2180FA29F5AF
x-cache: TCP_HIT
x-ms-request-id: afb3f6b4-c01e-005b-42f9-207157000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0UPtkZQAAAACj77pr2uOuRaMWZfUTcK7vQU1TMDRFREdFMTgxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 0t+BlZQAAAADF+4nhCVe9RYbeHPExUkXeU1ZHMjBFREdFMDUxMAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 28 Nov 2023 12:44:39 GMT
X-Firefox-Spdy: h2
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css
152.199.23.37200 OK 20 kB URL GET HTTP/2 aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css
IP 152.199.23.37:443
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (61177)
Hash f0e5964f8bbedf73d2d3001623bb663b
aadf3504d5e5a93e678487eeb4a63398f2699341
9537f00ca371747a97a2acca388f7b2379a7fa7c59bde18c3d2621c0de8de492
GET /ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
age: 9916585
cache-control: public, max-age=31536000
content-md5: 9K2/nGCj75WAmmAI9nZNCA==
content-type: text/css
date: Tue, 28 Nov 2023 12:44:39 GMT
etag: 0x8DA7650B375AC9B
last-modified: Thu, 04 Aug 2022 19:37:00 GMT
server: ECAcc (ska/F7A0)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: fa2c5f86-601e-001d-18c7-c75323000000
x-ms-version: 2009-09-19
content-length: 19970
X-Firefox-Spdy: h2
aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
13.107.246.53200 OK 276 B URL GET HTTP/2 aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
IP 13.107.246.53:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (513), with no line terminators
Hash a9cc2824ef3517b6c4160dcf8ff7d410
8db9aebad84ca6e4225bfdd2458ff3821cc4f064
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: public, max-age=31536000
content-length: 276
content-type: image/svg+xml
content-encoding: gzip
content-md5: TjUQkZ0p0Y7rbj6LJofS9Q==
last-modified: Fri, 17 Jan 2020 19:28:34 GMT
etag: 0x8D79B8371B97A82
x-cache: TCP_HIT
x-ms-request-id: 4d8ee911-101e-0036-6042-0fec6e000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0SpZJZQAAAAAmBLZXYFfTSIPxFEjCT7FDQU1TMDRFREdFMTkxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 0t+BlZQAAAACx+KBJvMUAS6Zmwf87R/yGU1ZHMjBFREdFMDUxNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 28 Nov 2023 12:44:39 GMT
X-Firefox-Spdy: h2
aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
152.199.23.37200 OK 673 B URL GET HTTP/2 aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
IP 152.199.23.37:443
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1864), with no line terminators
Hash bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 14399439
cache-control: public, max-age=31536000
content-md5: DhdidjYrlCeaRJJRG/y9mA==
content-type: image/svg+xml
date: Tue, 28 Nov 2023 12:44:40 GMT
etag: 0x8D7B007297AE131
last-modified: Wed, 12 Feb 2020 22:01:50 GMT
server: ECAcc (ska/F732)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 68d21ab8-f01e-0076-6702-9f059f000000
x-ms-version: 2009-09-19
content-length: 673
X-Firefox-Spdy: h2
aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
152.199.23.37200 OK 17 kB URL GET HTTP/2 aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
IP 152.199.23.37:443
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT
File type MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors\012- data
Hash 12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
age: 15674972
cache-control: public, max-age=31536000
content-md5: EuPayFgGHQiAI7K9SOL6lg==
content-type: image/x-icon
date: Tue, 28 Nov 2023 12:44:40 GMT
etag: 0x8D8731240E548EB
last-modified: Sun, 18 Oct 2020 03:02:30 GMT
server: ECAcc (ska/F738)
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 003b7cc6-501e-0067-4768-9344ba000000
x-ms-version: 2009-09-19
content-length: 17174
X-Firefox-Spdy: h2
aadcdn.msftauthimages.net/dbd5a2dd-bihdro5qtoi6y0zuxij90wojidmjoy8oguuyqbxlt5a/logintenantbranding/0/bannerlogo?ts=636943314948117565
13.107.213.53200 OK 2.9 kB URL GET HTTP/2 aadcdn.msftauthimages.net/dbd5a2dd-bihdro5qtoi6y0zuxij90wojidmjoy8oguuyqbxlt5a/logintenantbranding/0/bannerlogo?ts=636943314948117565
IP 13.107.213.53:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjaWQiOiJiYWZ5YmVpYXJpaWdpcWVmd3lucHV2b2R6NDZ1Y2F6M2xiZWM0cmlwcm9qZXNha3pqZ3hxb2pqYmVydSIsInByb2plY3RfdXVpZCI6IjI4MjFmYzNhLTEwYWEtNDRlOC1hNTI3LWU3NWJiODk4NjZjYSIsImlhdCI6MTcwMDg0NDk4NCwic3ViIjoiSVBGUy10b2tlbiJ9.XqyCZUcujyXDemKeqF7D7Q8toguFU_f1aBR1YifBYTU&cfg=lmitchell@jerviswebb.com
Certificate IssuerMicrosoft Corporation
Subjectaadcdn.msftauthimages.net
FingerprintA6:84:2F:0D:AE:F4:A9:3C:2C:A6:39:BC:F9:0B:D2:12:9C:0E:A3:2A
ValiditySat, 25 Nov 2023 18:02:20 GMT - Tue, 19 Nov 2024 18:02:20 GMT
File type PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced\012- data
Hash a91d0d736e871b4b79c08deff6a93105
c88958b18354768593320ce0ccf39f8c31a111d2
fe5babb7a3aaa174749fa0aee53e9d03aeda2194294c977d49b8c399d78cf63c
GET /dbd5a2dd-bihdro5qtoi6y0zuxij90wojidmjoy8oguuyqbxlt5a/logintenantbranding/0/bannerlogo?ts=636943314948117565 HTTP/1.1
Host: aadcdn.msftauthimages.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bafybeiariigiqefwynpuvodz46ucaz3lbec4riprojesakzjgxqojjberu.ipfs.nectarnode.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: public, max-age=86400
content-length: 2897
content-type: image/*
content-md5: qR0Nc26HG0t5wI3v9qkxBQ==
last-modified: Fri, 24 May 2019 21:51:35 GMT
etag: 0x8D6E091FDC5C538
x-cache: TCP_MISS
x-ms-request-id: c7fcb901-d01e-0044-47f8-218d6c000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0uOBlZQAAAACB/hLlgoDFSKU11vTYnMtGQU1TMDRFREdFMTgxMwA1OTY2NTcxNS00MjZhLTRmMWMtYTA1OS1kNWRmZDQwYWU2Yjk=
x-azure-ref: 0uOBlZQAAAABPjbZKH/J6RKxLVFux8dE1U1ZHMjBFREdFMDYwOQA1OTY2NTcxNS00MjZhLTRmMWMtYTA1OS1kNWRmZDQwYWU2Yjk=
date: Tue, 28 Nov 2023 12:44:40 GMT
X-Firefox-Spdy: h2