benjamin296.uni.cc/ssms.exe
200 OK 487 B URL HTTP/1.1 benjamin296.uni.cc/ssms.exe
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (487), with no line terminators
Hash 5a4ae0c210aeac199d6485cb9cefe25d
2d780e2c09758a1ce6f8d063eb2fcfd6ce6dfb83
aafb13590d9b93561f116234007b2121fd39c7de5d1088c50f5adb36f47d6c21
Analyzer Verdict Alert fortinet Malware
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.uni.cc domain
GET /ssms.exe HTTP/1.1
Host: benjamin296.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 487
content-type: text/html; charset=utf-8
date: Mon, 27 Feb 2023 01:14:36 GMT
server: nginx
set-cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1; path=/; domain=.uni.cc; expires=Sat, 17 Mar 2091 04:28:44 GMT; max-age=2147483647; HttpOnly
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 666c7f3c3342b2fdca31a2355ee20bea
09bd5cbacba34412f5fff9d44f97e46c8c76d001
cb3a380fc71bc65dfde35069f0fc441400974afcf28c0fbb6fec8f41e16f70c8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CB3A380FC71BC65DFDE35069F0FC441400974AFCF28C0FBB6FEC8F41E16F70C8"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13447
Expires: Mon, 27 Feb 2023 04:58:44 GMT
Date: Mon, 27 Feb 2023 01:14:37 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash bc3cacbc6c565bf2955b507302b8fb41
7b773e19aff1d4904cec328c456513e80f917ba4
b45c582b42efef5e8bd5744333a137f13e94a93cafbaace39b36cfa1eeb041bd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B45C582B42EFEF5E8BD5744333A137F13E94A93CAFBAACE39B36CFA1EEB041BD"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9760
Expires: Mon, 27 Feb 2023 03:57:17 GMT
Date: Mon, 27 Feb 2023 01:14:37 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 7f03faaba3392caae6dae54467bfdf6d
57ea1f14e8bfbcca8190c706d708c9fda12442c1
02ac551ba61fcbc6b04f244df065948b181a8a258db5c2e197aae66fdfcea8ee
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Content-Type, Backoff, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 27 Feb 2023 01:07:54 GMT
content-type: application/json
age: 403
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 955732a866f4168dcaaa1dbcfb06e776
24161b6d53bbf84abc87c943f67daadd7fbcc9f4
ac3d306cc00fcafe5d6fadd5bc1c4398ca87dec499fd0e4ffe60d0e1c3535578
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AC3D306CC00FCAFE5D6FADD5BC1C4398CA87DEC499FD0E4FFE60D0E1C3535578"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12959
Expires: Mon, 27 Feb 2023 04:50:36 GMT
Date: Mon, 27 Feb 2023 01:14:37 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash b5ba6334e73496995e3e3a9ecd0eb323
ad80d3b7718c28364e8c2004fb38a13a1747e462
aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: xZrU77eLsC75Lx8Z7mjwhNvNZQSxz6CMInUJDPzw6sfXbMc2n4Od3aSxnxaXYz4r0X2yDuLqSSc=
x-amz-request-id: RRTEX45M7AN82XT2
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 27 Feb 2023 00:31:36 GMT
age: 2581
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 27 Feb 2023 01:14:37 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
benjamin296.uni.cc/ssms.exe?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3NzQ2NzY3NywiaWF0IjoxNjc3NDYwNDc3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydDNvaXFsMWxxNm9wNjF2OTAwdXZvYzMiLCJuYmYiOjE2Nzc0NjA0NzcsInRzIjoxNjc3NDYwNDc3MjkwODE2fQ.CQV-XCdDfvKu3NR1eCKwRS9CDnaV8CDUQufuGv-nySQ&sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
302 Found 11 B URL HTTP/1.1 benjamin296.uni.cc/ssms.exe?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3NzQ2NzY3NywiaWF0IjoxNjc3NDYwNDc3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydDNvaXFsMWxxNm9wNjF2OTAwdXZvYzMiLCJuYmYiOjE2Nzc0NjA0NzcsInRzIjoxNjc3NDYwNDc3MjkwODE2fQ.CQV-XCdDfvKu3NR1eCKwRS9CDnaV8CDUQufuGv-nySQ&sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
IP
File type ASCII text, with no line terminators
Hash 32682312d17c7cbf18e73594f5570319
60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.uni.cc domain
GET /ssms.exe?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3NzQ2NzY3NywiaWF0IjoxNjc3NDYwNDc3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydDNvaXFsMWxxNm9wNjF2OTAwdXZvYzMiLCJuYmYiOjE2Nzc0NjA0NzcsInRzIjoxNjc3NDYwNDc3MjkwODE2fQ.CQV-XCdDfvKu3NR1eCKwRS9CDnaV8CDUQufuGv-nySQ&sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1 HTTP/1.1
Host: benjamin296.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://benjamin296.uni.cc/ssms.exe
Cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Mon, 27 Feb 2023 01:14:37 GMT
location: http://ww1.uni.cc/?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
server: nginx
set-cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1; path=/; domain=.uni.cc; expires=Sat, 17 Mar 2091 04:28:44 GMT; max-age=2147483647; HttpOnly
benjamin296.uni.cc/favicon.ico
404 Not Found 9 B URL HTTP/1.1 benjamin296.uni.cc/favicon.ico
IP
File type ASCII text, with no line terminators
Hash d8f4a1993546cc4b850cde3599e27aec
094b763b4cfcc0b05e5d040581cd513c3ca08067
907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.uni.cc domain
GET /favicon.ico HTTP/1.1
Host: benjamin296.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://benjamin296.uni.cc/ssms.exe
Cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
HTTP/1.1 404 Not Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 9
date: Mon, 27 Feb 2023 01:14:37 GMT
server: nginx
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Expires, Last-Modified, Cache-Control, ETag, Backoff, Content-Type, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 27 Feb 2023 01:12:24 GMT
age: 133
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 85cbb48f071581b644dd200623699bd6
0c9d7c3ca38562a97a4a6af3fb96f68982027594
d83caa4c6791e3b475a8ae8c255b84dc0bf0a8d06b65e5e6195af4f66e47eb86
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D83CAA4C6791E3B475A8AE8C255B84DC0BF0A8D06B65E5E6195AF4F66E47EB86"
Last-Modified: Sat, 25 Feb 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8431
Expires: Mon, 27 Feb 2023 03:35:09 GMT
Date: Mon, 27 Feb 2023 01:14:38 GMT
Connection: keep-alive
ww1.uni.cc/?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
200 OK 6.7 kB URL HTTP/1.1 ww1.uni.cc/?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2318)
Hash 96eb6a0a4466e0c8cdafee08c57f0ac9
67ed61854ef5fca830ea61e0d911f8817182b9f6
58263c55222b041431a4dfdfa87dacbc1d138106512de6357d8dc68d8a6c2c8c
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.uni.cc domain
GET /?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1 HTTP/1.1
Host: ww1.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://benjamin296.uni.cc/
Connection: keep-alive
Cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 01:14:38 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Buckets: bucket103
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_mBz6CkltAhSI2gbYi/OENKCOVlL9+zg0tuxS9B7nw8C10SwU1E+p5Km/970ztvHMcn1CMc7oqG6g05NL0oqBWw==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Domain: uni.cc
X-Subdomain: ww1
Content-Encoding: gzip
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 1gf+CDCeWJbUi1Wv/8KI8Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Ok+1/g5tbqrZpvwRpafPJ2UlurU=
www.google.com/adsense/domains/caf.js?abp=1
200 OK 53 kB URL HTTP/1.1 www.google.com/adsense/domains/caf.js?abp=1
IP
File type ASCII text, with very long lines (1745)
Hash 5bca5ca2462b8f1367f61e6723a1d418
39436a725147c233d8b7616949c4615e421b8875
74681dc7640bd040d178fa8f9ff493253d629af9c30dd99c649e0a69be14a0a4
GET /adsense/domains/caf.js?abp=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.uni.cc/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Mon, 27 Feb 2023 01:14:38 GMT
Expires: Mon, 27 Feb 2023 01:14:38 GMT
Cache-Control: private, max-age=3600
ETag: "13273924206232045155"
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0
ww1.uni.cc/track.php?domain=uni.cc&toggle=browserjs&uid=MTY3NzQ2MDQ3OC40NjYxOmNiOTRhOTE4ZjYyMjk5NjYyNDQ3YjhmMzEyN2Q5N2YxOTRlYjJjM2U3ZmFlNWFiZjAzODNjYWEyMDg4NjdhMzI6NjNmYzAzZmU3MWNkMQ%3D%3D
200 OK 20 B URL HTTP/1.1 ww1.uni.cc/track.php?domain=uni.cc&toggle=browserjs&uid=MTY3NzQ2MDQ3OC40NjYxOmNiOTRhOTE4ZjYyMjk5NjYyNDQ3YjhmMzEyN2Q5N2YxOTRlYjJjM2U3ZmFlNWFiZjAzODNjYWEyMDg4NjdhMzI6NjNmYzAzZmU3MWNkMQ%3D%3D
IP
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.uni.cc domain
GET /track.php?domain=uni.cc&toggle=browserjs&uid=MTY3NzQ2MDQ3OC40NjYxOmNiOTRhOTE4ZjYyMjk5NjYyNDQ3YjhmMzEyN2Q5N2YxOTRlYjJjM2U3ZmFlNWFiZjAzODNjYWEyMDg4NjdhMzI6NjNmYzAzZmU3MWNkMQ%3D%3D HTTP/1.1
Host: ww1.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.uni.cc/?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
Cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 01:14:38 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash f0eb6131ddbcf7b456b75aedb33dec51
9b0e4febf1c9e23c83618b89f58fbff02857f3e2
c43deaba4d0fbf1a2b4814e7fe60ba123e83fcb2638ac31d87791c8fc6f6d792
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 01:14:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
200 OK 11 kB URL HTTP/1.1 d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
IP
File type PNG image data, 1500 x 600, 8-bit colormap, non-interlaced\012- data
Hash 0cb2e5165dc9324eb462199f04e1ffa9
9e0f89847ec8a98d98a6020bc5c4ed32b7a48bf8
67dff0aad873050f12609885f2264417ccdd0d438311000a704c89f0865f7865
GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.uni.cc/
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 11375
Connection: keep-alive
Server: nginx
Date: Sun, 26 Feb 2023 01:21:51 GMT
Last-Modified: Thu, 23 Jun 2022 10:44:43 GMT
Accept-Ranges: bytes
ETag: "62b4441b-2c6f"
X-Cache: Hit from cloudfront
Via: 1.1 98794c1dec0d4e7b10ddf0faa094cf94.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: RiqD2sJYVjKMPxDRyfhLPAc_6LmP4AOwYaf7w9mC-qGSa-Hnwt9-5Q==
Age: 85967
www.google.com/afs/ads?adtest=off&psid=6016880802&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.uni.cc%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2M2ZjMDNmZTcxY2I4fHx8MTY3NzQ2MDQ3OC40NzE3fGM5ODQ3OTY0YzNjNDA1NzQwMDQxN2I5MDJjMGUwMmYyMzA5NzA2ZjR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8VzEwPXw5M2NjMmNhYTI3MmE5NGIxMTQ1OWFjMWVlMDBiOGRlNmU5YThmZWQxfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MA%253D%253D&terms=Domain%20Web%20Hosting&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2615971448043088&oe=UTF-8&ie=UTF-8&fexp=21404&format=r3%7Cs&nocache=3751677460584362&num=0&output=afd_ads&domain_name=ww1.uni.cc&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1677460584363&u_w=1280&u_h=1024&biw=1280&bih=939&psw=1280&psh=760&frm=0&cl=507651520&uio=--&cont=tc&jsid=caf&jsv=507651520&rurl=http%3A%2F%2Fww1.uni.cc%2F%3Fsubid1%3D1a3d387a-b63c-11ed-ac14-2637c6c3d1c1&referer=http%3A%2F%2Fbenjamin296.uni.cc%2F&adbw=master-1%3A530
200 OK 2.5 kB URL HTTP/2 www.google.com/afs/ads?adtest=off&psid=6016880802&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.uni.cc%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2M2ZjMDNmZTcxY2I4fHx8MTY3NzQ2MDQ3OC40NzE3fGM5ODQ3OTY0YzNjNDA1NzQwMDQxN2I5MDJjMGUwMmYyMzA5NzA2ZjR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8VzEwPXw5M2NjMmNhYTI3MmE5NGIxMTQ1OWFjMWVlMDBiOGRlNmU5YThmZWQxfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MA%253D%253D&terms=Domain%20Web%20Hosting&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2615971448043088&oe=UTF-8&ie=UTF-8&fexp=21404&format=r3%7Cs&nocache=3751677460584362&num=0&output=afd_ads&domain_name=ww1.uni.cc&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1677460584363&u_w=1280&u_h=1024&biw=1280&bih=939&psw=1280&psh=760&frm=0&cl=507651520&uio=--&cont=tc&jsid=caf&jsv=507651520&rurl=http%3A%2F%2Fww1.uni.cc%2F%3Fsubid1%3D1a3d387a-b63c-11ed-ac14-2637c6c3d1c1&referer=http%3A%2F%2Fbenjamin296.uni.cc%2F&adbw=master-1%3A530
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6333)
Hash 205d36cc2f88c277a4e35f499403d552
ddf87690b8e863eef658374b271e9886ebf8f8e2
6ad998c09a978149ba5a311603e9c82acf380e0445515c55dd3ea680db0ad145
GET /afs/ads?adtest=off&psid=6016880802&pcsa=false&channel=000001%2Cbucket103&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww1.uni.cc%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDN8fHx8fHw2M2ZjMDNmZTcxY2I4fHx8MTY3NzQ2MDQ3OC40NzE3fGM5ODQ3OTY0YzNjNDA1NzQwMDQxN2I5MDJjMGUwMmYyMzA5NzA2ZjR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfGV5Sm9iQ0k2SW1WdUluMD18fDF8VzEwPXw5M2NjMmNhYTI3MmE5NGIxMTQ1OWFjMWVlMDBiOGRlNmU5YThmZWQxfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MA%253D%253D&terms=Domain%20Web%20Hosting&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2615971448043088&oe=UTF-8&ie=UTF-8&fexp=21404&format=r3%7Cs&nocache=3751677460584362&num=0&output=afd_ads&domain_name=ww1.uni.cc&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1677460584363&u_w=1280&u_h=1024&biw=1280&bih=939&psw=1280&psh=760&frm=0&cl=507651520&uio=--&cont=tc&jsid=caf&jsv=507651520&rurl=http%3A%2F%2Fww1.uni.cc%2F%3Fsubid1%3D1a3d387a-b63c-11ed-ac14-2637c6c3d1c1&referer=http%3A%2F%2Fbenjamin296.uni.cc%2F&adbw=master-1%3A530 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ww1.uni.cc/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Mon, 27 Feb 2023 01:14:38 GMT
expires: Mon, 27 Feb 2023 01:14:38 GMT
cache-control: private, max-age=3600
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding: br
server: gws
content-length: 2524
x-xss-protection: 0
set-cookie: NID=511=lfGG-cCLqi5CWf7zyimM06PFVAZPEAiQeqQ9WboE7j9A0wwuVuV0B1kgwjRI1JBel-iQ0ZbH870RPjHIK9ti-tuyB4AiE8cPCejOHvBgFpXZsAPN9Xar2ZD1R4FNMaY9bollwhILjiUz9VlL23_4xV51rsaSd068tS2kcXBKUIw; expires=Tue, 29-Aug-2023 01:14:38 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+100; expires=Wed, 26-Feb-2025 01:14:38 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 1f05f2c7fdc02ed684ef75ba4d66ad0f
34c4592d68ad95d828840ef77b41e5292d684d63
1c1f4ded92091983e6472d5c609868ac53930995433a5ffab80873d61bdc748b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 01:14:38 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
partner.googleadservices.com/gampad/cookie.js?domain=ww1.uni.cc&client=dp-teaminternet09_3ph&product=SAS&callback=__sasCookie
200 OK 236 B URL HTTP/2 partner.googleadservices.com/gampad/cookie.js?domain=ww1.uni.cc&client=dp-teaminternet09_3ph&product=SAS&callback=__sasCookie
IP
File type ASCII text, with very long lines (352), with no line terminators
Hash a96bde8f802621896c1c81a07e5f618d
993fd916ff0fa147bdd906378cee4e8e8f78819f
b78c7a982dab4efd6c114448e58bcebd9af0853db927db396b2b46e32cb2072c
GET /gampad/cookie.js?domain=ww1.uni.cc&client=dp-teaminternet09_3ph&product=SAS&callback=__sasCookie HTTP/1.1
Host: partner.googleadservices.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ww1.uni.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Mon, 27 Feb 2023 01:14:38 GMT
server: cafe
cache-control: private
content-length: 236
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 37075758f2dac3c047d883c969abeaf0
ec7e33ca003d29f0511a315ef78adb7e11099c8c
c45467844b92be111e09390247c39f7763244d2ec9ff40d27694978d60767a8a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 01:14:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 1f05f2c7fdc02ed684ef75ba4d66ad0f
34c4592d68ad95d828840ef77b41e5292d684d63
1c1f4ded92091983e6472d5c609868ac53930995433a5ffab80873d61bdc748b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 01:14:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ww1.uni.cc/favicon.ico
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.uni.cc domain
GET /favicon.ico HTTP/1.1
Host: ww1.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.uni.cc/?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
Cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 01:14:39 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-0"
Accept-Ranges: bytes
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash fde3aa1cd0e46c45ac48502f6b20c716
39e52782b5f3a1fb76d13edd15579be979e42206
97978e61fc8887a76100c363c9c850fa9cac48dcb1330170ac7e8115fdf4092d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 01:14:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
200 OK 270 B URL HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
IP
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (390)
Hash 5100391430a00e10ce60aa159f525b5c
231a4492d73b225f441b1e9028dc33c89862e498
52b1432a6e3002e41ed1d8f4c84b258fdc4c6dac863e3c0e5c06360c81be6067
GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 270
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Mon, 27 Feb 2023 00:10:07 GMT
expires: Mon, 27 Feb 2023 23:10:07 GMT
cache-control: public, max-age=82800
age: 3872
last-modified: Thu, 19 Dec 2019 14:15:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash fde3aa1cd0e46c45ac48502f6b20c716
39e52782b5f3a1fb76d13edd15579be979e42206
97978e61fc8887a76100c363c9c850fa9cac48dcb1330170ac7e8115fdf4092d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 01:14:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
200 OK 174 B URL HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
IP
File type SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Hash 4de8b85c8915995b571bde50e231be7c
29c226ca7b9cbe1d44e5480ce95bbb42727b2d99
2ec9168c4507546748c5f400f5030031f0eb06f2aed8deaa11362c395bff4f7a
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Sun, 26 Feb 2023 07:33:15 GMT
expires: Mon, 27 Feb 2023 06:33:15 GMT
cache-control: public, max-age=82800
age: 63684
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash fde3aa1cd0e46c45ac48502f6b20c716
39e52782b5f3a1fb76d13edd15579be979e42206
97978e61fc8887a76100c363c9c850fa9cac48dcb1330170ac7e8115fdf4092d
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 27 Feb 2023 01:14:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ww1.uni.cc/ls.php
201 Created 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
POST /ls.php HTTP/1.1
Host: ww1.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 2270
Origin: http://ww1.uni.cc
Connection: keep-alive
Referer: http://ww1.uni.cc/?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
Cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1; GoogleAdServingTest=Good
HTTP/1.1 201 Created
Date: Mon, 27 Feb 2023 01:14:39 GMT
Content-Type: text/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 63fc03ffdcf30b4e9b2a67a2
Charset: utf-8
Access-Control-Allow-Origin: http://ww1.uni.cc
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_YGUHi8BXnD4R6ol52C6anNM+6i4Khs7a+TjIFxmgadjgq2srpyfUa1Hm+jlbe7+VO+cSX+HhDW5O1TTOXbr9uA==
ww1.uni.cc/track.php?domain=uni.cc&caf=1&toggle=answercheck&answer=yes&uid=MTY3NzQ2MDQ3OC40NjYxOmNiOTRhOTE4ZjYyMjk5NjYyNDQ3YjhmMzEyN2Q5N2YxOTRlYjJjM2U3ZmFlNWFiZjAzODNjYWEyMDg4NjdhMzI6NjNmYzAzZmU3MWNkMQ%3D%3D
200 OK 20 B URL HTTP/1.1 ww1.uni.cc/track.php?domain=uni.cc&caf=1&toggle=answercheck&answer=yes&uid=MTY3NzQ2MDQ3OC40NjYxOmNiOTRhOTE4ZjYyMjk5NjYyNDQ3YjhmMzEyN2Q5N2YxOTRlYjJjM2U3ZmFlNWFiZjAzODNjYWEyMDg4NjdhMzI6NjNmYzAzZmU3MWNkMQ%3D%3D
IP
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.uni.cc domain
GET /track.php?domain=uni.cc&caf=1&toggle=answercheck&answer=yes&uid=MTY3NzQ2MDQ3OC40NjYxOmNiOTRhOTE4ZjYyMjk5NjYyNDQ3YjhmMzEyN2Q5N2YxOTRlYjJjM2U3ZmFlNWFiZjAzODNjYWEyMDg4NjdhMzI6NjNmYzAzZmU3MWNkMQ%3D%3D HTTP/1.1
Host: ww1.uni.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.uni.cc/?subid1=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1
Cookie: sid=1a3d387a-b63c-11ed-ac14-2637c6c3d1c1; __gsas=ID=f97e6aec7b166179:T=1677460478:S=ALNI_MYaU-fGslbbNGTHj4SmI2rBCmBz3w
HTTP/1.1 200 OK
Date: Mon, 27 Feb 2023 01:14:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: answercheck
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5d5cf3f527452c87e71b812f75d18aff
e5c41bc319d5831248d3b855ceedf0f9fcede64b
f6a19fa64c95712fdbcf654cc999a244f79fb0dc38b66745a08afad747f9e69c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6A19FA64C95712FDBCF654CC999A244F79FB0DC38B66745A08AFAD747F9E69C"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10414
Expires: Mon, 27 Feb 2023 04:08:13 GMT
Date: Mon, 27 Feb 2023 01:14:39 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5d5cf3f527452c87e71b812f75d18aff
e5c41bc319d5831248d3b855ceedf0f9fcede64b
f6a19fa64c95712fdbcf654cc999a244f79fb0dc38b66745a08afad747f9e69c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6A19FA64C95712FDBCF654CC999A244F79FB0DC38B66745A08AFAD747F9E69C"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10414
Expires: Mon, 27 Feb 2023 04:08:13 GMT
Date: Mon, 27 Feb 2023 01:14:39 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5d5cf3f527452c87e71b812f75d18aff
e5c41bc319d5831248d3b855ceedf0f9fcede64b
f6a19fa64c95712fdbcf654cc999a244f79fb0dc38b66745a08afad747f9e69c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6A19FA64C95712FDBCF654CC999A244F79FB0DC38B66745A08AFAD747F9E69C"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10414
Expires: Mon, 27 Feb 2023 04:08:13 GMT
Date: Mon, 27 Feb 2023 01:14:39 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5d5cf3f527452c87e71b812f75d18aff
e5c41bc319d5831248d3b855ceedf0f9fcede64b
f6a19fa64c95712fdbcf654cc999a244f79fb0dc38b66745a08afad747f9e69c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6A19FA64C95712FDBCF654CC999A244F79FB0DC38B66745A08AFAD747F9E69C"
Last-Modified: Sat, 25 Feb 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10414
Expires: Mon, 27 Feb 2023 04:08:13 GMT
Date: Mon, 27 Feb 2023 01:14:39 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fec402fde-1c7d-4dbd-8447-addb3a661518.jpeg
200 OK 7.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fec402fde-1c7d-4dbd-8447-addb3a661518.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ffb8f5b4089baa7b82374b8fbe70ebe0
02facc492b9e6cd658e0cca772d302a881c1d99c
7f98075dee46110a3095e3c9821748846cb21167cfbdd835a9108f53f1306dab
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fec402fde-1c7d-4dbd-8447-addb3a661518.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7926
x-amzn-requestid: afce3b0b-4fac-4c22-8557-604cb33a3b2a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A0umGFmWoAMFjaw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63f82af3-34d2c99729dcd2a9591b6ef2;Sampled=0
x-amzn-remapped-date: Fri, 24 Feb 2023 03:11:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oMkeYQyU0a_ItGOMCRMMZ9PKMeJRzGUW-bzBhXip84Hg7UjtgqEKxw==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 03:40:36 GMT
age: 77643
etag: "02facc492b9e6cd658e0cca772d302a881c1d99c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb97e8f2e-6da0-4f8b-b12c-1af676e3e4da.jpeg
200 OK 9.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb97e8f2e-6da0-4f8b-b12c-1af676e3e4da.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2a5f3d376fe6a3a78a5d1fe136f962fb
3e9b03cc296e954d63526a4e7e75beea3130fc3b
c8cf4f1c0352102764247e4dc5a2076921e0eaa18bfd110e5b0b97a55c706690
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb97e8f2e-6da0-4f8b-b12c-1af676e3e4da.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9093
x-amzn-requestid: 3fd9f8c8-cf10-4222-a2cc-5f18ff7b2e9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Az9D3HqmoAMFeBQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63f7dbb2-352315613cc0c2bc7eb28e05;Sampled=0
x-amzn-remapped-date: Thu, 23 Feb 2023 21:33:38 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: S8s54RJtScNtsl6uEFtBEHnTj4lb3l5xIWR96Kvr_SdwQQQMgSKNxA==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:34:59 GMT
age: 13180
etag: "3e9b03cc296e954d63526a4e7e75beea3130fc3b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F36bd1287-b32c-4603-9360-89332f5a1691.jpeg
200 OK 6.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F36bd1287-b32c-4603-9360-89332f5a1691.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 98b2f7c8e759e559d28d0e2b15651bf5
dbe61e9ed7cd1f187a1b7cd24708b05c8c3b9e7e
c1d34f17f7642871ca63cb65d3fd7a33592b53e03c282ca60d9e22ecde5afdb9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F36bd1287-b32c-4603-9360-89332f5a1691.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6868
x-amzn-requestid: cf613d6f-8c37-434c-b467-565409889ee9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A91zAE8zIAMFhog=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fbd012-5f358161034e44d50766c19d;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 21:33:06 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: HjL7q58a3oDSGcYoniT_tEMLriVytaxA0jQG3hoRXVq0_L3ceYShpw==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 f268a165a18929fd0a24a3189fbd16b2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:58:26 GMT
age: 11773
etag: "dbe61e9ed7cd1f187a1b7cd24708b05c8c3b9e7e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60ddd461-0486-4e4d-b696-2371823c5e14.jpeg
200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60ddd461-0486-4e4d-b696-2371823c5e14.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c032cec1a16da61168946d24f7cf5fab
19bdee3d97ef45fcf316537eba10d29e68f4809c
cd123878e4c4464610fef1cdb2e40409e1c03473954f63b6dd044bfbcf73f07b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60ddd461-0486-4e4d-b696-2371823c5e14.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7645
x-amzn-requestid: 5705420a-44e3-4719-8595-620696e29f95
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A92ihFxwIAMFfAg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fbd143-3529246d52399e377b565ddf;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 21:38:11 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: Kcu85Bm5HY3n0KPxdKppTiQZuIBffD11WsUlJWBV3JO-om0R1s6n9A==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 1f41b5f27f3ec2e93db2155dbc56900c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:43:20 GMT
age: 12679
etag: "19bdee3d97ef45fcf316537eba10d29e68f4809c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F838b2524-bc97-4a3e-b5fe-ae5e915f1dd4.jpeg
200 OK 9.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F838b2524-bc97-4a3e-b5fe-ae5e915f1dd4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c0fe3499281ce4fbe3edf63a602713bd
ec7d7192ba6ffad617243447f9e26ef2ea60d228
3060226c2022d024c5f2d4896da5b29a449c8fab170b26ddf8f4b47c2473262e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F838b2524-bc97-4a3e-b5fe-ae5e915f1dd4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9541
x-amzn-requestid: 7f527c03-a50f-49ab-88e8-6b913a13e58a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A93DNFJvoAMFsUA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fbd214-499d32086009e1c1585cdef3;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 21:41:40 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: kKhbR4RG2SdjQJfDrTH1yN_fIAUvjdACJb2Mfi1S9aHSacWb1NTPaQ==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 7545e37b10b5fcf5e3df98185c85194a.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 21:43:18 GMT
age: 12681
etag: "ec7d7192ba6ffad617243447f9e26ef2ea60d228"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62916a14-6002-4814-a837-bec7f1ee4740.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62916a14-6002-4814-a837-bec7f1ee4740.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 02a24564de916ef38129e489d5bbdb2d
593121aed65422def36e9fca69ee9f7780462334
e87b9d199d64c9f8df9556cde07c599906c6d652ecae21ecc50a4076862f2e90
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62916a14-6002-4814-a837-bec7f1ee4740.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12856
x-amzn-requestid: 95399446-e5e0-49a5-aa44-0204ca04612b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A4jifHwroAMFhTg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63f9b2dc-382dc0ea54b7d4e24fc2f1a9;Sampled=0
x-amzn-remapped-date: Sat, 25 Feb 2023 07:03:56 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: azWoTLvd-in17atYMQaACXFZg_415P56hYjoEu_g8jWD0BIP4MmXbA==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 5c35539543902c678280929df206948c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 26 Feb 2023 03:30:05 GMT
age: 78274
etag: "593121aed65422def36e9fca69ee9f7780462334"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
www.google.com/adsense/domains/caf.js
200 OK 0 B URL HTTP/2 www.google.com/adsense/domains/caf.js
IP
GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.google.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Mon, 27 Feb 2023 01:14:38 GMT
expires: Mon, 27 Feb 2023 01:14:38 GMT
cache-control: private, max-age=3600
etag: "11622235040905886500"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
192.198.80.147
23.33.119.27