Overview

URL corps-homme.blogspot.hr/
IP142.250.74.161
ASNGOOGLE
Location United States
Report completed2022-10-04 10:01:35 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-10-04 2 corps-homme.blogspot.hr/ Malware
2022-10-04 2 corps-homme.blogspot.com/ Malware
2022-10-04 2 corps-homme.blogspot.com/js/cookienotice.js Malware
2022-10-04 2 widgetserver.com/syndication/subscriber/InsertWidget.js?appId=b6635e87-4e30 (...) Malware
2022-10-04 2 widgetserver.com/ Malware
2022-10-04 2 widgetserver.com/mtm/async/.eJxdjEsOwjAMRO-SZQk1SyjiLCgNbhIpaYzjfiTE3UkQK3b (...) Malware
2022-10-04 2 www1.widgetserver.com/ls.php Malware
2022-10-04 2 boirbonx-1.com/api/v1/px?xmlid=IPKtd3Nc61aZHwI9hobDn55mpVYYkIunLOuYJ1gV Phishing
mnemonic secure dns  No alerts detected
Quad9 DNS  No alerts detected


Files

No files detected



Passive DNS (35)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS fonts.gstatic.com (2) 0 2014-08-29 13:43:22 UTC 2022-10-04 08:34:20 UTC 216.58.207.195 Domain (gstatic.com) ranked at: 540
mnemonic passive DNS region1.google-analytics.com (1) 0 2022-03-17 11:26:33 UTC 2022-10-04 04:19:22 UTC 216.239.34.36 Domain (google-analytics.com) ranked at: 8401
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-05-27 20:08:30 UTC 2022-10-04 09:13:54 UTC 143.204.55.36
mnemonic passive DNS ocsp.pki.goog (22) 175 2017-06-14 07:23:31 UTC 2022-10-04 04:17:09 UTC 142.250.74.3
mnemonic passive DNS resources.blogblog.com (5) 13274 2017-01-30 04:47:40 UTC 2022-10-04 07:39:17 UTC 216.58.207.201
mnemonic passive DNS 3.bp.blogspot.com (8) 11048 2013-07-04 04:18:40 UTC 2022-10-04 05:24:35 UTC 142.250.74.161
mnemonic passive DNS 2.bp.blogspot.com (7) 11071 2013-07-04 03:01:31 UTC 2022-10-04 05:34:15 UTC 142.250.74.161
mnemonic passive DNS ocsp2.globalsign.com (1) 1544 2012-05-21 07:12:19 UTC 2022-10-04 05:20:14 UTC 104.18.21.226
mnemonic passive DNS d90f85.lifeimpressions.net (7) 0 No data No data 178.128.246.195 Domain (lifeimpressions.net) ranked at: 129884
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-10-04 04:16:51 UTC 34.117.237.239
mnemonic passive DNS img1.blogblog.com (1) 65460 2012-05-22 07:35:04 UTC 2022-10-04 07:39:17 UTC 216.58.207.201
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-10-04 04:45:06 UTC 35.161.230.192
mnemonic passive DNS irene-eux.com (3) 0 2022-09-21 16:06:22 UTC 2022-10-04 05:39:54 UTC 34.239.209.41 Unknown ranking
mnemonic passive DNS boirbonx-1.com (2) 0 2022-09-26 12:59:21 UTC 2022-10-04 08:13:51 UTC 3.33.192.145 Unknown ranking
mnemonic passive DNS fonts.googleapis.com (1) 8877 2013-06-10 20:14:26 UTC 2022-10-04 09:22:31 UTC 142.250.74.10
mnemonic passive DNS 4.bp.blogspot.com (8) 11215 2013-05-06 20:18:52 UTC 2022-10-04 05:34:15 UTC 142.250.74.161
mnemonic passive DNS widgetserver.com (4) 501429 2012-06-02 12:44:33 UTC 2022-10-03 20:09:33 UTC 173.255.194.134
mnemonic passive DNS www1.widgetserver.com (5) 0 2018-08-27 05:42:44 UTC 2022-10-03 21:36:40 UTC 99.83.136.84 Domain (widgetserver.com) ranked at: 501429
mnemonic passive DNS 1.bp.blogspot.com (7) 8403 2013-05-06 20:18:52 UTC 2022-10-04 07:16:09 UTC 142.250.74.161
mnemonic passive DNS img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-10-04 04:18:32 UTC 34.120.237.76
mnemonic passive DNS www.googletagmanager.com (1) 75 2012-12-25 14:52:06 UTC 2022-10-04 09:37:43 UTC 142.250.74.168
mnemonic passive DNS corps-homme.blogspot.hr (1) 0 2022-07-26 23:59:12 UTC 2022-09-13 21:20:05 UTC 142.250.74.161 Unknown ranking
mnemonic passive DNS www.blogger.com (3) 8975 2012-05-22 07:35:03 UTC 2022-10-04 07:16:09 UTC 216.58.207.201
mnemonic passive DNS pagead2.googlesyndication.com (1) 101 2021-02-20 15:52:05 UTC 2022-10-04 04:39:38 UTC 142.250.74.2
mnemonic passive DNS code.jquery.com (1) 634 2012-05-21 17:28:02 UTC 2022-10-04 03:58:00 UTC 69.16.175.42
mnemonic passive DNS corps-homme.blogspot.com (2) 0 2018-06-20 17:43:52 UTC 2022-08-11 10:29:15 UTC 142.250.74.161 Unknown ranking
mnemonic passive DNS ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2022-10-04 07:51:20 UTC 93.184.220.29
mnemonic passive DNS widgetserver.com (4) 501429 2012-06-02 12:44:33 UTC 2022-10-03 20:09:33 UTC 45.33.30.197
mnemonic passive DNS xml-v4.netload1.com (1) 0 2022-09-26 13:05:57 UTC 2022-10-04 08:11:49 UTC 198.134.116.17 Unknown ranking
mnemonic passive DNS lifeimpressions.net (9) 129884 2019-03-15 10:42:27 UTC 2022-10-02 15:13:06 UTC 178.128.246.195
mnemonic passive DNS r3.o.lencr.org (5) 344 2020-12-02 08:52:13 UTC 2022-10-04 04:17:22 UTC 23.36.77.32
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-10-04 04:29:41 UTC 143.204.55.49
mnemonic passive DNS apis.google.com (3) 105 2013-05-30 23:17:44 UTC 2022-10-04 04:25:30 UTC 142.250.74.174
mnemonic passive DNS www.gstatic.com (3) 0 2016-07-26 09:37:06 UTC 2022-10-04 09:46:17 UTC 142.250.74.163 Domain (gstatic.com) ranked at: 540
mnemonic passive DNS d38psrni17bvxu.cloudfront.net (1) 0 2022-09-21 14:24:07 UTC 2022-10-04 08:48:45 UTC 54.230.245.130 Unknown ranking


Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 142.250.74.161

Date UQ / IDS / BL URL IP
2022-11-29 19:54:38 +0000
0 - 0 - 4 77581087.blogspot.com.br/search/label/new%20cummer 142.250.74.161
2022-11-29 19:03:16 +0000
0 - 0 - 1 xcvbcvxgsdfgcxvbcxvbsdfg.blogspot.co.id/?m=1 142.250.74.161
2022-11-29 19:02:17 +0000
0 - 0 - 3 xcvbcvxgsdfgcxvbcxvbsdfg.blogspot.rs/ 142.250.74.161
2022-11-29 19:01:47 +0000
0 - 0 - 3 xcvbcvxgsdfgcxvbcxvbsdfg.blogspot.ru/ 142.250.74.161
2022-11-29 19:01:15 +0000
0 - 0 - 3 xcvbxcvbsdfgsdfgcxzxcvbsdfgsdf.blogspot.jp/ 142.250.74.161

Last 5 reports on ASN: GOOGLE

Date UQ / IDS / BL URL IP
2022-11-29 22:03:21 +0000
0 - 0 - 1 foxonlines.blogspot.com/search/label/Veeracho (...) 142.250.74.33
2022-11-29 21:55:56 +0000
0 - 0 - 3 ksalalekadu.blogspot.ru/2009/12/design-tattoo (...) 172.217.21.161
2022-11-29 21:53:38 +0000
1 - 0 - 0 craftyhardtofindmedia.rgerbancolombia.repl.co/ 34.149.204.188
2022-11-29 21:53:37 +0000
9 - 0 - 9 navelquestas.us/login/Login.php 34.136.2.82
2022-11-29 21:52:47 +0000
0 - 0 - 3 autogr.blogspot.de/2012/06/nude_13.html 172.217.21.161

Last 1 reports on domain: corps-homme.blogspot.hr

Date UQ / IDS / BL URL IP
2022-10-04 10:01:35 +0000
0 - 0 - 8 corps-homme.blogspot.hr/ 142.250.74.161

Last 1 reports with similar screenshot

Date UQ / IDS / BL URL IP
2022-09-03 17:40:19 +0000
0 - 0 - 1 carinacarlstromicloud.com/ 77.247.182.245


JavaScript

Executed Scripts (28)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (127)


Request Response
                                        
                                            GET / HTTP/1.1 
Host: corps-homme.blogspot.hr
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         142.250.74.161
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
                                        
Location: http://corps-homme.blogspot.com/
Content-Encoding: gzip
Date: Tue, 04 Oct 2022 10:01:23 GMT
Expires: Tue, 04 Oct 2022 10:01:23 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-XSS-Protection: 1; mode=block
Content-Length: 179
Server: GSE


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Size:   179
Md5:    da48548dd8d51f76617e1a14117e999d
Sha1:   ae62293ab8a3f830647b56a9aea759d824c19699
Sha256: 3f485c0800e67af721af9d8ac36702f9dc1187a52a9938f22f390db59010abec

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.36
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Retry-After, Content-Length
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Tue, 04 Oct 2022 09:47:04 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: U0rA1ELN9VN2BOrrn7fAEVnWZz5-zCGsw1nVkkHMjKXC4CXwr3DmZQ==
Age: 860


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    2d12f67fe57a87e7366b662d153a5582
Sha1:   d7b02d81cc74f24a251d9363e0f4b0a149264ec1
Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "1F611155394FAC39439B8EC8217D8CD493D6B588D372D264E0D66C03129C50C6"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7310
Expires: Tue, 04 Oct 2022 12:03:14 GMT
Date: Tue, 04 Oct 2022 10:01:24 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.49
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Tue, 04 Oct 2022 05:28:28 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 5de23153ac267c206221751e1cccb6e8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 3Uh0YXB2iIfGwomE6ka32oSqq0xL04SDhbev2db_LTOS-8hdI2-1wA==
age: 16377
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Tue, 04 Oct 2022 10:01:24 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET / HTTP/1.1 
Host: corps-homme.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Expires: Tue, 04 Oct 2022 10:01:24 GMT
Date: Tue, 04 Oct 2022 10:01:24 GMT
Cache-Control: private, max-age=0
Last-Modified: Fri, 10 Dec 2021 13:08:53 GMT
ETag: W/"a9ae7dcf47dea61384d3fd6610425084a29b2b5b19b49d41224308099a834db5"
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 25948
Server: GSE


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4154)
Size:   25948
Md5:    129790f9cfbc76b2d62dc7389befbee2
Sha1:   dc91b8def60ec7ddad3a2ac8af84fe9f48d10ade
Sha256: 74c77542d5b3fb2b3ea50045ea77a47008bb893a8f1de0e89b59ea79749a1b6a

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /static/v1/widgets/2975350028-css_bundle_v2.css HTTP/1.1 
Host: www.blogger.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         216.58.207.201
HTTP/2 200 OK
content-type: text/css
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 7776
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 01 Oct 2022 12:39:06 GMT
expires: Sun, 01 Oct 2023 12:39:06 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 30 Sep 2022 19:52:35 GMT
age: 249739
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (35959)
Size:   7776
Md5:    5aa2d3297bdc86bc81322aedecbb5e79
Sha1:   1c0a3c007e41726e167e79b70ddea76198650884
Sha256: feae1fac625d0f30b5f10fa00b62df1a5600cd2178062c427e55f289b29cc630
                                        
                                            GET /img/icon18_edit_allbkg.gif HTTP/1.1 
Host: resources.blogblog.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         216.58.207.201
HTTP/2 200 OK
content-type: image/gif
                                        
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 162
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 01 Oct 2022 19:52:13 GMT
expires: Sat, 08 Oct 2022 19:52:13 GMT
cache-control: public, max-age=604800
last-modified: Fri, 30 Sep 2022 19:52:35 GMT
age: 223752
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 18 x 18\012- data
Size:   162
Md5:    c991641178ff05adf0d004298b5eafa9
Sha1:   d8f6ce8ecd92b86d49849360f6b81ceb10b4c941
Sha256: ca9848e6006cfec8f9ffa29433ade8152204bdb95579200831c6dc0f53dff70b
                                        
                                            GET /js/platform.js HTTP/1.1 
Host: apis.google.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
content-length: 20361
date: Tue, 04 Oct 2022 10:01:25 GMT
expires: Tue, 04 Oct 2022 10:01:25 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "40c22a9ccbd70870"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1277)
Size:   20361
Md5:    b5a31516be83fe4f962609045d824f88
Sha1:   939a49a9858bf23561279f9ca2d1941d3256c66f
Sha256: edb661aa461800e97e3847608a8b2d81cfe345f69a6f84abaa001d8a60500328
                                        
                                            GET /img/widgets/arrow_dropdown.gif HTTP/1.1 
Host: resources.blogblog.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         216.58.207.201
HTTP/2 200 OK
content-type: image/gif
                                        
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 141
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 01 Oct 2022 17:07:09 GMT
expires: Sat, 08 Oct 2022 17:07:09 GMT
cache-control: public, max-age=604800
last-modified: Fri, 30 Sep 2022 19:52:35 GMT
age: 233656
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 13 x 10\012- data
Size:   141
Md5:    2964a07d60a4e76b299130fb1b4115f6
Sha1:   3b72dcc19f3ad685513eaba612e07e0ed495f2e1
Sha256: 28ab89f0285c48d2faed701905c185c302f2b389584a52ceaa76a91ea64dc3a7
                                        
                                            GET /img/icon_feed12.png HTTP/1.1 
Host: resources.blogblog.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         216.58.207.201
HTTP/2 200 OK
content-type: image/png
                                        
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 500
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 01 Oct 2022 09:06:36 GMT
expires: Sat, 08 Oct 2022 09:06:36 GMT
cache-control: public, max-age=604800
last-modified: Sat, 01 Oct 2022 07:51:36 GMT
age: 262489
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 12 x 12, 8-bit colormap, non-interlaced\012- data
Size:   500
Md5:    44e7355a788fd1082deff0018883758e
Sha1:   50e3a28a44978e85d13c30522e0c71c8d0b24675
Sha256: 3cd341f37642f8a58b0fe14c2645913449c0ffe10be6ba0986275bfef29bc319
                                        
                                            GET /img/widgets/subscribe-netvibes.png HTTP/1.1 
Host: resources.blogblog.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         216.58.207.201
HTTP/2 200 OK
content-type: image/png
                                        
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 1445
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 01 Oct 2022 11:47:52 GMT
expires: Sat, 08 Oct 2022 11:47:52 GMT
cache-control: public, max-age=604800
last-modified: Fri, 30 Sep 2022 14:51:29 GMT
age: 252813
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 91 x 17, 8-bit colormap, non-interlaced\012- data
Size:   1445
Md5:    c52a5f4ecb6be5d7e93b23ef4122ee4e
Sha1:   4e698a5f455daf3a8ea1e219b1998079f0546716
Sha256: 71b8ad79c680b3e5d452a792c3b418b23f739a0a34005e0f37ec674f4c78cb5d
                                        
                                            GET /img/widgets/subscribe-yahoo.png HTTP/1.1 
Host: resources.blogblog.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         216.58.207.201
HTTP/2 200 OK
content-type: image/png
                                        
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 580
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 01 Oct 2022 10:16:11 GMT
expires: Sat, 08 Oct 2022 10:16:11 GMT
cache-control: public, max-age=604800
last-modified: Fri, 30 Sep 2022 19:52:35 GMT
age: 258314
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 91 x 17, 8-bit colormap, non-interlaced\012- data
Size:   580
Md5:    79f602b6ac18bee79b4e2353a6674010
Sha1:   28accf82263aa1a11bb821439d4d185865662530
Sha256: bbf9b924cc32bff4738bb54d86905476349f90c8b20f748633e56f64379d553e
                                        
                                            GET /js/cookienotice.js HTTP/1.1 
Host: corps-homme.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: text/javascript
                                        
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="blogger-tech"
Report-To: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
Content-Length: 2026
Date: Tue, 04 Oct 2022 10:01:25 GMT
Expires: Tue, 11 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=604800
Last-Modified: Tue, 04 Oct 2022 09:10:01 GMT
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0


--- Additional Info ---
Magic:  ASCII text
Size:   2026
Md5:    c4e1ed83d89245089b8a1203be20a377
Sha1:   f3940e1215b89300ef97d57a25993f25243b8688
Sha256: afa801a129ff6fc98533118275db8a7d4a38fc91f8ab55ed4c19b864255e68d2

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /static/v1/widgets/792789798-widgets.js HTTP/1.1 
Host: www.blogger.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         216.58.207.201
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 56804
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 03 Oct 2022 02:15:20 GMT
expires: Tue, 03 Oct 2023 02:15:20 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 03 Oct 2022 00:49:27 GMT
age: 114365
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (2221)
Size:   56804
Md5:    02e6bf311e18828a522b4d3a4079084f
Sha1:   a63cd373fa23b4fe11f938d57737e6bfa1ebe789
Sha256: 25d469843aa09be2473931d33aaa37b65ac371874bd98ca84ec780bead3e33e4
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /_/scs/abc-static/_/js/k=gapi.lb.en.z9QjrzsHcOc.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8359JQqZQ0dzCVJ5Ui3CZcERHEWA/cb=gapi.loaded_0?le=scs HTTP/1.1 
Host: apis.google.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 57995
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 02 Oct 2022 07:25:42 GMT
expires: Mon, 02 Oct 2023 07:25:42 GMT
cache-control: public, max-age=31536000
age: 182143
last-modified: Sat, 30 Jul 2022 15:17:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (580)
Size:   57995
Md5:    d70fcc84d705c565b31a5835c0938d5b
Sha1:   d28e5dc9fcc6239d67986df3205468072023d2d7
Sha256: 1d558c94793446aa6a7832dde0c39ed7d9c77fd963ffb738c460e4f7369a7f4e
                                        
                                            GET /-BoIXWkvJvAo/U3Dk9g_f69I/AAAAAAAARH8/9ESRDll4BCk/s1600/mars2014+nexu4+340.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v4481"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 340.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 3420
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 92x128, components 3\012- data
Size:   3420
Md5:    d8e7c9bfb7f9e9947bb492f752afc92a
Sha1:   5986e24f40537bcb9f50c0f087ec4c464f105bc8
Sha256: a04cb4f2f91e9c99ab118d9b8d2ece32df4c650fce257edc7954306a90161b14
                                        
                                            GET /-Tdomkg5Srfo/WCtNPpuFIBI/AAAAAAAAfvM/Ql0gh0mPjxYEz9QvM0glYyZ6nwhJ3tfwwCLcB/s320/FB_IMG_1466082973076.jpg HTTP/1.1 
Host: 1.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efd"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="FB_IMG_1466082973076.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 14607
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 181x320, components 3\012- data
Size:   14607
Md5:    dd7a9c6fb76581f92dc0845473062c3c
Sha1:   a55398298044e494089afda6a06b26f1786d9d28
Sha256: c39c75dc7a6a5a463e80672d600489a6f270b3ae01e8f2c36738854e7af1478e
                                        
                                            GET /pagead/js/google_top_exp.js HTTP/1.1 
Host: pagead2.googlesyndication.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.2
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
                                        
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 67
X-XSS-Protection: 0
Date: Mon, 03 Oct 2022 20:51:15 GMT
Expires: Mon, 17 Oct 2022 20:51:15 GMT
Cache-Control: public, max-age=1209600
ETag: 13036835877489095579
Age: 47410


--- Additional Info ---
Magic:  ASCII text
Size:   67
Md5:    9bbc3ca32ec951a484589ce0e6b4db73
Sha1:   753d6f6183b33b2dee5dde2208fca91c17f5bb13
Sha256: b8f16a16d2a7ea39a9cc079fdbe3af7d31393d62a853668bdd549e0a0311cb3c
                                        
                                            GET /blogin.g?blogspotURL=http://corps-homme.blogspot.com/&type=blog HTTP/1.1 
Host: www.blogger.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         216.58.207.201
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
location: https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/blogin.g?blogspotURL%3Dhttp://corps-homme.blogspot.com/%26type%3Dblog%26bpli%3D1&followup=https://www.blogger.com/blogin.g?blogspotURL%3Dhttp://corps-homme.blogspot.com/%26type%3Dblog%26bpli%3D1&go=true
content-encoding: gzip
date: Tue, 04 Oct 2022 10:01:25 GMT
expires: Tue, 04 Oct 2022 10:01:25 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 283
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (344)
Size:   283
Md5:    3f7ec08cdb8a235362e9ae7b89e7e233
Sha1:   e6b7e1351a47410e663650aa7980b4d7a51f1047
Sha256: 1d2ec4d1cf1c634f6bdc5a0d5ec8a3b93bea1dd7793aad23de114e43ecb2dcfa
                                        
                                            GET /-4xSHbkbKjWw/WCtNQEuXPvI/AAAAAAAAfvg/jREmdgF14o8AIgtJ5t-d3oR5jehvZqZvACLcB/s320/e67481ee-78ed-4a96-b397-7720b82a33b3.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="e67481ee-78ed-4a96-b397-7720b82a33b3.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 37224
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 218x320, components 3\012- data
Size:   37224
Md5:    cc0d824540d8d29b8263c3030e4670c9
Sha1:   440261596717674a52e9c2df8f9da89e3d113fcd
Sha256: cc48af1b537b3ee0b7e6997070017856812e454aedd1d3e6428c075a11eba42e
                                        
                                            GET /-JvbgT1D-344/U3Dj7KLke9I/AAAAAAAAQ6E/bXlkmiN4Znk/s1600/mars2014+nexu4+058.jpg HTTP/1.1 
Host: 2.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v43a3"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 058.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 118590
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=3, software=Google], baseline, precision 8, 720x960, components 3\012- data
Size:   118590
Md5:    133db8bf6fa32361a0139c7d3efb1b27
Sha1:   5e67ace6fd32d83881233e07ca87211445a1e51e
Sha256: 42f61decce5f975136d8a96714ed42f38ed551c07e46b278400fe5fe05333a18
                                        
                                            GET /-tqWDiqT5PHM/U3DkzIMhykI/AAAAAAAARF0/ZOSu0OkqflE/s1600/mars2014+nexu4+282.jpg HTTP/1.1 
Host: 1.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v445f"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 282.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 4566
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 128x87, components 3\012- data
Size:   4566
Md5:    145e8af944dcb31b927322ea0cd557a6
Sha1:   9ddbfc1f86ad98a89ae4719918074a9799741a82
Sha256: b612b61af343795a6367bd8ee5af28b5832669c7a13471fa08b2ccc52b2a230f
                                        
                                            GET /-f6OtcQ_i9BA/U3DlolJjkVI/AAAAAAAARRk/IgRQXUe2-_8/s1600/mars2014+nexu4+647.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v451b"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 647.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 55619
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=3, software=Google], baseline, precision 8, 377x532, components 3\012- data
Size:   55619
Md5:    dc60b8792c328a014ebcc200defcb106
Sha1:   cc0ed7dbd6a95a0993a1c59fe3722cf465304810
Sha256: 231a6725276a9822ec7524b5aca53065f226458c6ec0acb65ebb38bb77868979
                                        
                                            GET /-iArUJUtNeOM/U3DkzLvoReI/AAAAAAAARFo/opWl3hhY06U/s1600/mars2014+nexu4+287.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v445c"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 287.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 3093
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 128x84, components 3\012- data
Size:   3093
Md5:    3aa063684e9ba744119e0e7fa7cbc1eb
Sha1:   d87b538c850963368b9a86787385a8f277bb3d65
Sha256: b0cb9b68ca07d5b44b1b2b67c0c0d13ad9c1fa25f025818242c8ca48a16da730
                                        
                                            GET /img/icon18_email.gif HTTP/1.1 
Host: img1.blogblog.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         216.58.207.201
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Accept-Ranges: bytes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="blogger-tech"
Report-To: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
Content-Length: 164
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 01 Oct 2022 01:06:06 GMT
Expires: Sat, 08 Oct 2022 01:06:06 GMT
Cache-Control: public, max-age=604800
Last-Modified: Fri, 30 Sep 2022 19:52:35 GMT
Age: 291319


--- Additional Info ---
Magic:  GIF image data, version 89a, 18 x 13\012- data
Size:   164
Md5:    36b9f993db1b953f3b9b08040aaf9af4
Sha1:   18248661b307586dc291fd2dff4bb59cf7579475
Sha256: 1258cbe1e2900ec3df11a83a6bb6008d7a833f783a6df80b0d5d45a052ac1466
                                        
                                            GET /-63RUVtTHg_o/WCtNPumb0pI/AAAAAAAAfvU/dU3kXPNSKA45sVdPvvmNA7u5w-XaRqx_ACLcB/s320/FB_IMG_1466198010530.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="FB_IMG_1466198010530.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 31718
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x320, components 3\012- data
Size:   31718
Md5:    43aa976ebbb86c9e954881768190edff
Sha1:   0d959ad47ffc8883402dcc84c48ed41658f5a1ae
Sha256: c6d4d937fe780fd6c1c1fb8b8a1a8baf4f0691d812622ec35cdd009cdd678aa2
                                        
                                            GET /-bhWmhWfJ40I/U3DkUIAn0BI/AAAAAAAAQ_Q/SefGH9TsW-0/s1600/mars2014+nexu4+147.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v43f6"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 147.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 37850
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x362, components 3\012- data
Size:   37850
Md5:    873f151bf97ab3116b7533a683fc2973
Sha1:   04eb21ea488006ccb71524ebfc889a39c915e024
Sha256: cdd854ef476e3baa7f1f17f837534579f41eb314c8b2d764d27d1b6b5d45bf7a
                                        
                                            GET /-EFuT2zqy1BU/U3DlT8DRlYI/AAAAAAAARM0/EvdVTAfsN20/s1600/mars2014+nexu4+473.jpg HTTP/1.1 
Host: 1.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v44cf"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 473.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 20636
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x429, components 3\012- data
Size:   20636
Md5:    1989cc59a06776542ea18cf5561b80af
Sha1:   62a639cf85faecdc3bb861db1c0081d227a488e7
Sha256: 04d5e9f4c63b1e38bfdab50bc00363e38e7fbf4c359dc1473b9a6cf9a5e84151
                                        
                                            GET /-LJLoU0A9QrY/U3DkV_xFvAI/AAAAAAAAQ_k/AfstM51xmr0/s1600/mars2014+nexu4+149.jpg HTTP/1.1 
Host: 2.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v43fb"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 149.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 12571
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x415, components 3\012- data
Size:   12571
Md5:    f20ee5dab36a52b227c3539dfc9061b2
Sha1:   43098b76df5dfb1383616e9d4a1558955c03e37f
Sha256: 29c7ab9392aefffbfb641e9d8dafa586e6af8140006ef336208eaaf16abf39ee
                                        
                                            GET /-a-47Cei4ueI/U3Dj85gV2hI/AAAAAAAAQ6Y/RilgGgz1nEE/s1600/mars2014+nexu4+064.jpg HTTP/1.1 
Host: 2.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v43a8"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 064.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 17979
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 300x300, components 3\012- data
Size:   17979
Md5:    4cf421c3eaa18d36a35202c6a6202a1a
Sha1:   a8daf9b34810a6286a8019555cf9ddf4c731d882
Sha256: d5b801c918bf7cd5f6367178eec4a58775448fc0949c596cb8afb98a896fae84
                                        
                                            GET /-ng7jGrboh6Y/U3DkahlGmsI/AAAAAAAARAc/vmSg01RBox0/s1600/mars2014+nexu4+165.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v440a"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 165.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 15879
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x360, components 3\012- data
Size:   15879
Md5:    c40f72ed28170b1ba98749258558b6c5
Sha1:   f4f902d09c2666666868cdddd570bb87233c5141
Sha256: f90d87d750cea4a4beb51abcc39c682536e7b39c9a83f6f9a4be24ecf46f17a0
                                        
                                            GET /-LbUEWrb0j4g/U3DkfJcCchI/AAAAAAAARBQ/PlKvY2H99uE/s1600/mars2014+nexu4+173.jpg HTTP/1.1 
Host: 2.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v4416"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 173.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 24205
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x385, components 3\012- data
Size:   24205
Md5:    48352bbc4dd54c1baf31ac468d658bbe
Sha1:   32664aa5f280321d6f6daf0e4696d2d07163beac
Sha256: 7a97136631f9fa883d8932ad80ded4f4d96db69c9d2e364586409dcd7b623741
                                        
                                            GET /-hAeBT3of8nU/WCtNPaYICzI/AAAAAAAAfvE/LwwjaEiexAQmQPSxvZUKZ_vfIlfBh-KOgCLcB/s320/36d33eae45a93901ccf65139045642c5.jpg HTTP/1.1 
Host: 2.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="36d33eae45a93901ccf65139045642c5.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 26546
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 214x320, components 3\012- data
Size:   26546
Md5:    718f5897d723028c400c32a10e31a119
Sha1:   c09b6e8e9c244ed206c8558af65a5527f7e47496
Sha256: c34476743d3bab354adeb197522bf594e8eb0ce8cd3c653cb8c68216a2f7be57
                                        
                                            GET /-sRVpxqFuV_A/U3DkVuohYwI/AAAAAAAAQ_g/4X3B3kQThPY/s1600/mars2014+nexu4+148.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v43fa"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 148.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 18647
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x340, components 3\012- data
Size:   18647
Md5:    58b6c4efd297b711543e306ed42196b2
Sha1:   ec03369a1a77f7d36fe6c820c941545cd0ebfbe5
Sha256: fe021efacc323f17d95b809375ca06b4bc5e28f5712eb6aa4d2230f1ef59f167
                                        
                                            GET /-_sAlqeg2T28/U3Dke5KwFoI/AAAAAAAARBM/aGib7iR4P4c/s1600/mars2014+nexu4+174.jpg HTTP/1.1 
Host: 2.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v4415"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 174.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 18543
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x339, components 3\012- data
Size:   18543
Md5:    93b24881d3151f05ce845a916ead47d2
Sha1:   33185e77ce85346422e7019eed530834a5d098c1
Sha256: 98090924463891fc790ec4fc1212d66de6688411f55057b782fd32660f171b95
                                        
                                            GET /-3tA2lUlfINg/U3Dk_sG8HGI/AAAAAAAARIc/K_n-4_h5z2Y/s1600/mars2014+nexu4+353.jpg HTTP/1.1 
Host: 1.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v4489"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 353.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 6979
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 128x127, components 3\012- data
Size:   6979
Md5:    ff1d96c819fb2263a3d5875d52682da2
Sha1:   51f3d4523d5efae2017e2f72836e128d338af06e
Sha256: b1abd84e248c9eb5626cc3ed6d494f9d71e3005afd23dbe400f9a52454d0fb65
                                        
                                            GET /-3UMeNi0Gp44/U3Dj21UYTNI/AAAAAAAAQ5c/Ojr1FWQjTnM/s1600/mars2014+nexu4+044.jpg HTTP/1.1 
Host: 2.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v439c"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 044.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 25841
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 250x298, components 3\012- data
Size:   25841
Md5:    44572d574b7643c1a0df5f830a4f3395
Sha1:   71c547bf71739e0f2a0a0ba1b1dedbfcec411d9f
Sha256: fbafef3af47f344810ee070bf96bdcd7c21081408814ddd80b847bd8a725c295
                                        
                                            GET /-0RyVvA3VDeo/U3DkdmeKYdI/AAAAAAAARBA/C3B3-htU7NE/s1600/mars2014+nexu4+172.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v4412"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 172.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 19344
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x326, components 3\012- data
Size:   19344
Md5:    68369e2b4a7d1f19bbef7bcc3069ce05
Sha1:   11f979a88d9fbad6f89fea60f8832cf2bc25c794
Sha256: 9919a84f2c360c260af3874f068fc88518f0dcb0367a6657cad0011b4e937976
                                        
                                            GET /-hhM_OcBd6ug/WCtNPVJVTAI/AAAAAAAAfvA/tuT2PABNS5gSRZIf3H5RiymkHFgy5zcHwCLcB/s320/20160108164327-709.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="20160108164327-709.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 17831
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 213x320, components 3\012- data
Size:   17831
Md5:    bc82ed6c11ed4d108793caab46911521
Sha1:   fce424b7920b6d5392484abdbcf910b924f9b003
Sha256: 189432d3e3a8f179d02c1c320b176bc91d656a68057685259f2f3c6dd05a1b63
                                        
                                            GET /-abJ4jzaiEoQ/WCtMmiCuMqI/AAAAAAAAfu0/uHcvu-WPjHcACoZI63Ug8FIF-WXuapvkACLcB/s320/Screenshot_2016-09-01-23-27-02.jpg HTTP/1.1 
Host: 1.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="Screenshot_2016-09-01-23-27-02.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 28794
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 180x320, components 3\012- data
Size:   28794
Md5:    c895ab0d9622ea6de89efb3d71648c5c
Sha1:   501e0d018bdb8428e4bfd0d9b50c33c525aea988
Sha256: dda6018adea8f440cf5619284b88bd323afce389cfe550eb26342d5651876aa6
                                        
                                            GET /-U8MI5NfR5GM/WCtNPr1loXI/AAAAAAAAfvQ/igXfIkBSl4g3s8JDZJiPu-VF5MWoY03kQCLcB/s320/FB_IMG_1465676361426.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="FB_IMG_1465676361426.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 25884
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x213, components 3\012- data
Size:   25884
Md5:    5637b9541381c08ec6a2aab67ccee5c9
Sha1:   aff79f6c731c1277d28a55a263d59f108f18b89f
Sha256: 1fcad4a3ec1ddbe4a70d93407af7a4932f50814ebc1ad59f1f75993a8ba0feb0
                                        
                                            GET /-VqVGxBoVSVk/WCtNPxuHq5I/AAAAAAAAfvY/NN_PpIWZqycGX6WXOLGEEe1Zvlp2UkxFACLcB/s320/FB_IMG_1466511837219.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efb"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="FB_IMG_1466511837219.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 12530
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 180x320, components 3\012- data
Size:   12530
Md5:    c6afcd76a9bab5041ff2cd8e89ccb7e9
Sha1:   edd1c8f1b29f3434786354e3b2bf7f4548f657e1
Sha256: 8b10cb2f8a33d7ab52d91fa99826e63af547f32c6fc74b24a935052cd9d01016
                                        
                                            GET /-eRKr2l-RjKg/WCtM5g5EcrI/AAAAAAAAfu8/5KIzdKdy07U0pPoKyUT-BQF90J4Z7G7bQCLcB/s320/2.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efb"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="2.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 26659
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 300x250, components 3\012- data
Size:   26659
Md5:    d145151afc61780c3b61660b28a29070
Sha1:   be1b525a20979458db784649fe797b63dea00f84
Sha256: 53bf3ba2b776178afa3d4671927870c555800d52edbe95c648c29c79c67ce34e
                                        
                                            GET /-jkkIy7A1W1A/U3DlGcTxjoI/AAAAAAAARJ8/vf1qj4HVlE4/s1600/mars2014+nexu4+388.jpg HTTP/1.1 
Host: 3.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v44a1"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 388.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 28138
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 375x500, components 3\012- data
Size:   28138
Md5:    75ac01670aeef5a71f540de49bc694df
Sha1:   5f7b1f5c3d6f877feaaa77e0612c35b760d6d8fd
Sha256: c92b46f91a6a6238153602f71a76481ec1c01048b39630be24389a6ab0d311dd
                                        
                                            GET /-uvPBWCUK1lc/U3Dldj3RplI/AAAAAAAARO8/T7Fx3u3P4aM/s1600/mars2014+nexu4+514.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v44f1"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 514.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 21169
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 330x440, components 3\012- data
Size:   21169
Md5:    42dfa0787a1d6a602539993341fe8225
Sha1:   dc038d7af046cceb750f67bc8bf783f5fd5151b2
Sha256: c325bb14414831eb07ea47481577a84907b1d990de6694576963dbb9d4d355e2
                                        
                                            GET /-j7UwhKLl3hc/U3Dl0KSsdgI/AAAAAAAART0/Xj0UD-5w6a4/s1600/mars2014+nexu4+702.jpg HTTP/1.1 
Host: 4.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         142.250.74.161
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Access-Control-Expose-Headers: Content-Length
ETag: "v453f"
Expires: Wed, 05 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="mars2014 nexu4 702.jpg"
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 10:01:25 GMT
Server: fife
Content-Length: 15523
X-XSS-Protection: 0


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 256x256, components 3\012- data
Size:   15523
Md5:    6d6b2f9e5729de4a72b9f6b66e9b4e1b
Sha1:   04fc5cfa5e1c34df2925acdaa7562b5c540ffabf
Sha256: a66d2e7fcfdd8d02e585347c76b1a9003ea58662de8211c805783cd327d598d2
                                        
                                            GET /syndication/subscriber/InsertWidget.js?appId=b6635e87-4e30-466a-bcb3-8e2f01cdde9e HTTP/1.1 
Host: widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/

                                         
                                         173.255.194.134
HTTP/1.1 200 OK
content-type: application/javascript
                                        
server: openresty/1.13.6.1
date: Tue, 04 Oct 2022 10:01:25 GMT
content-length: 157
last-modified: Wed, 07 Mar 2018 18:30:37 GMT
etag: "5aa02fcd-9d"
accept-ranges: bytes
connection: close


--- Additional Info ---
Magic:  ASCII text
Size:   157
Md5:    67e216a27dda24bdcb086c2385b0cb99
Sha1:   17141c80f5d32bec3691c5ab24741d8b7dd5f0c6
Sha256: 9dc433b2142d3ba0803fcffa53f19d34da26996d20c829df6d694bc887325dd7

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /-dRIcjejruQ0/WCtNPRdE8UI/AAAAAAAAfvI/og1a2jTnZO86YSshXaDCD0NI6FFonVQTQCLcB/s320/FB_IMG_1465319170940.jpg HTTP/1.1 
Host: 1.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="FB_IMG_1465319170940.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 17160
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 320x320, components 3\012- data
Size:   17160
Md5:    1b7818f9006467e559e36c5865471097
Sha1:   da6eb3c9f20ab8384171bcf561f433c59f95a582
Sha256: 0bae2081102407b3f85512e91520a0cd35cad4637ffc18f5d59f4f99c11d6c09
                                        
                                            GET /-btu33nutiQU/WCtMo1USh8I/AAAAAAAAfu4/iG_X7lei2Ps4S6Udsr_hjmQMUcRrIw2NACLcB/s320/tempFile_2016-09-01-23-17-12.jpg HTTP/1.1 
Host: 1.bp.blogspot.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.161
HTTP/2 200 OK
content-type: image/jpeg
                                        
access-control-expose-headers: Content-Length
etag: "v7efa"
expires: Wed, 05 Oct 2022 10:01:25 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="tempFile_2016-09-01-23-17-12.jpg"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
date: Tue, 04 Oct 2022 10:01:25 GMT
server: fife
content-length: 18232
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 175x320, components 3\012- data
Size:   18232
Md5:    eb56fc8572be4c06fee224ace9be93cf
Sha1:   9f0e7196c5be12f446b92d878d17b4078110f673
Sha256: 33f994a9d15f18533bec817f1eb192e91bb62502b06083d60394c69fc6cac740
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5180
Cache-Control: 'max-age=158059'
Date: Tue, 04 Oct 2022 10:01:25 GMT
Last-Modified: Tue, 04 Oct 2022 08:35:05 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /_/scs/abc-static/_/js/k=gapi.lb.en.z9QjrzsHcOc.O/m=profile/exm=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8359JQqZQ0dzCVJ5Ui3CZcERHEWA/cb=gapi.loaded_1?le=scs HTTP/1.1 
Host: apis.google.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                         
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 12103
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 01 Oct 2022 04:22:47 GMT
expires: Sun, 01 Oct 2023 04:22:47 GMT
cache-control: public, max-age=31536000
last-modified: Sat, 30 Jul 2022 15:17:53 GMT
age: 279518
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (536)
Size:   12103
Md5:    e4fb51c04ea660686e6550b82c1a18ca
Sha1:   a58d0f29017553ee017db3ff88682c046481baf6
Sha256: 9d1a0929c0bad4402483d5fa706f3433a06414cd5514a3cd48ae6c4a1b61f8cc
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.36
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 09:29:33 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Tue, 04 Oct 2022 10:27:25 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: axfH33FoeYWC8C5e9wduDvbOuEP-oARaGVrlugAPz3jtnVJ6GwGYFQ==
Age: 1912


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /feedback/js/help/prod/service/lazy.min.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.163
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/product-feedback-gathering
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="product-feedback-gathering"
report-to: {"group":"product-feedback-gathering","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/product-feedback-gathering"}]}
content-length: 33850
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 04 Oct 2022 09:28:30 GMT
expires: Tue, 04 Oct 2022 10:18:30 GMT
cache-control: public, max-age=3000
last-modified: Thu, 29 Sep 2022 21:00:43 GMT
age: 1975
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (2800)
Size:   33850
Md5:    3d5823c8d54c6fbfa1c2111ad8b5e177
Sha1:   2df748e9879f3f9b8dcf4104d5074b152881d37e
Sha256: b8e63d9f4ae8fff2900f481c5b9f813af7b74aed8cd9398049ce3cceb0afc629
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET / HTTP/1.1 
Host: widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://corps-homme.blogspot.com/
Upgrade-Insecure-Requests: 1

                                         
                                         45.33.30.197
HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
                                        
server: openresty/1.13.6.1
date: Tue, 04 Oct 2022 10:01:25 GMT
content-length: 7150
vary: Accept-Language
content-language: en
connection: close


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (330)
Size:   7150
Md5:    4f7ee142275f53e08aa0d59a2ff5fbee
Sha1:   29ac1597f9a12755c126a75edff2050a78632b21
Sha256: 377fef91b9d0dbaa98aa7fab61cbf74524d3f6422360a320960aa05f8f5e8f00

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: EWeV1zWvUtu71dR0sR4E5w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         35.161.230.192
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: oGfrr7ixGaJkwib0vOt+HYRObBY=

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://widgetserver.com/

                                         
                                         45.33.30.197
HTTP/1.1 200 OK
content-type: image/gif
                                        
server: openresty/1.13.6.1
date: Tue, 04 Oct 2022 10:01:26 GMT
content-length: 43
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
connection: close


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    ad4b0f606e0f8465bc4c4c170b37e1a3
Sha1:   50b30fd5f87c85fe5cba2635cb83316ca71250d7
Sha256: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13679
Expires: Tue, 04 Oct 2022 13:49:26 GMT
Date: Tue, 04 Oct 2022 10:01:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13679
Expires: Tue, 04 Oct 2022 13:49:26 GMT
Date: Tue, 04 Oct 2022 10:01:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13679
Expires: Tue, 04 Oct 2022 13:49:26 GMT
Date: Tue, 04 Oct 2022 10:01:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13679
Expires: Tue, 04 Oct 2022 13:49:26 GMT
Date: Tue, 04 Oct 2022 10:01:27 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8641c47a-9aff-4f73-bb07-6770cbbcc8d6.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5504
x-amzn-requestid: 37405eb0-5c75-46a9-84c0-e8ed726995d8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcpHvHPvoAMF3mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b5564-77fd550b58af612525e74761;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:34:28 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Ovm2wuk28PygH4EZNEUoPchoHQggWCyXbYHOjMV1tZmfyDrL6PjPZA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 22:29:19 GMT
age: 41528
etag: "20ef861be49c652a938e0145e4ca3a60159367e2"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5504
Md5:    6c6882c60d7ca6f918c77104e3ad1d52
Sha1:   20ef861be49c652a938e0145e4ca3a60159367e2
Sha256: 861f5870990fbd2939d151ae18384cf311e87067ca9a50818efe0c2d51b83088
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f5624b4-8e2a-461e-a32a-38d6b5a3a8d2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11101
x-amzn-requestid: f98e84d9-1e66-4436-b793-219a777f2ba0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcqcvE8JoAMFQ2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b5784-25bd2b234c1093de70074c92;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:43:32 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: becOxfqUowywFrxzDSeK7F1lFdDVTSHIF1TLC5k5aSlLPpsR6F8gjw==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 22:08:47 GMT
age: 42760
etag: "db07d58d8feff4ea01866d095e5264ee5c8e1ca3"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11101
Md5:    ae824db4a95391149198a4b6b8556c70
Sha1:   db07d58d8feff4ea01866d095e5264ee5c8e1ca3
Sha256: 19e96d204813247697e1858daf9e07d6c4cafd9ab1175a3bf39a7f07f6991521
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6315
x-amzn-requestid: 6aa75b16-32e4-48a7-9fb0-9e3d5528c2d5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWSdsHUnIAMFXtw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338cabd-742d8a436403683e0cd9368f;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 23:18:21 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 5sAzc5Ewv4g6Wqq6JJiLylG3Jyy_nlWrr5Oteeo6ebEgq7Rvss4XaQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Tue, 04 Oct 2022 04:42:53 GMT
age: 19114
etag: "58ff0bf8ce7528b303d28bab01a80ad721705569"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6315
Md5:    206fb65e75dbadf119512f71e0b78402
Sha1:   58ff0bf8ce7528b303d28bab01a80ad721705569
Sha256: 56c8d5f3b3060ee54bf81995269b86c070855d8c33bf437161339a45b309703f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F545190f2-96f3-40f8-bd46-cebe7171aee7.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9917
x-amzn-requestid: 2dff93d9-795d-4885-9b82-610b0d235a82
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcpvTGEnIAMF1zg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b5661-117afa703663ada75627792c;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:38:41 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: p5nOqBojKO6S-c_DxIu8B3p-NK0pzRHkz0DOPeyv7PQt9h0x1jdtoQ==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 1508efc4152aa1778ed4adecb328b374.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 21:55:54 GMT
age: 43533
etag: "22aab05208a01ae5def4d63dc145085630f57bcb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9917
Md5:    d8c08f8066cc732de8befd6ccd629a95
Sha1:   22aab05208a01ae5def4d63dc145085630f57bcb
Sha256: f8a560a0563518d992d0bd2655d2b5c406435a18e874ca00b51374d2ff901770
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0c459c91-b5cc-492c-9573-3101e5df6b51.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5083
x-amzn-requestid: ed99df03-5d15-4e09-9aea-bbf77a705323
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcpI0HT0IAMFxvQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b556b-422197147d76caac6e910664;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:34:35 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: pddStyEpwVdYKSAUVcpupnWVPw6ALoYCouHQzixF_vTgXdpVF60ElA==
via: 1.1 946b9edb2009c5508a0fbbd636f95014.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 22:10:59 GMT
age: 42628
etag: "f5ce815082043a4efce28fc790ae7d8b3a8531f8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5083
Md5:    34f2dfb2faff276db1d4a57739db2450
Sha1:   f5ce815082043a4efce28fc790ae7d8b3a8531f8
Sha256: e02ea92f0be524ccfe26eee61a77e39a13d852d1ba3696f729e0f61812028667
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9a61745f-0c9b-404a-ba22-0a69cf2f0383.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4858
x-amzn-requestid: fb21c414-2994-444a-a838-e643fd05b171
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcpvTEfPoAMFfeQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b5661-593dd8043b0490e7301cac0d;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:38:41 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: MiSh_FjAciKCaOakY2mM_EHBN1Z6GIDYIP8mwS4ikkrToQN3Ktsv2g==
via: 1.1 773ca14e6bd4bf9244988cb69fc9dca8.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 21:56:46 GMT
age: 43481
etag: "585e7146fd24cdc2496b05baafea04091dc541e2"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4858
Md5:    6779181f9c06975f2a662da743893939
Sha1:   585e7146fd24cdc2496b05baafea04091dc541e2
Sha256: 8e9a9f92fd89b7cdce77884ccd76b83ab82d28f125ebfc1cb0d371d4046b7985
                                        
                                            GET /mtm/async/.eJxdjEsOwjAMRO-SZQk1SyjiLCgNbhIpaYzjfiTE3UkQK3bP8zzzUgsHNShQWhl2pWIlxgkZuR5ehAYAm5nK0eeUsB9jdoWy9DanVvO5yH02Cev7Fh4OpSCvyM23VWuRpDrBXcBLitoQxWCNhDzD3pLD_p-meH3eTv1Fh2QcglnD9MMNR9IddF9_Vu8PB15CdQ:1ofejt:v-Sif9lXwdyYliR9x0FHvGP1gC4/1/0 HTTP/1.1 
Host: widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://widgetserver.com/
Connection: keep-alive

                                         
                                         45.33.30.197
HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
                                        
server: openresty/1.13.6.1
date: Tue, 04 Oct 2022 10:01:27 GMT
content-length: 256
x-mtm-path: 4
x-mtm-prov: 1:6.42;70:0.00
x-mtm-rd: 0.90
vary: Accept-Language
content-language: en
set-cookie: mtm_delivered=WyJ3aWRnZXRzZXJ2ZXIuY29tIiwiaHR0cDovL3d3dzEud2lkZ2V0c2VydmVyLmNvbS8_dG09MSZzdWJpZDQ9MTY2NDg3NzY4Ni4wMzAxMDcwMDAwJktXMT1FdXJvcGUlMjBEZWRpY2F0ZWQlMjBTZXJ2ZXJzJktXMj1Ob3J3YXklMjBEZWRpY2F0ZWQlMjBTZXJ2ZXJzJktXMz1Pc2xvJTIwQ291bnR5JTIwRGVkaWNhdGVkJTIwU2VydmVycyZLVzQ9T3NsbyUyMERlZGljYXRlZCUyMFNlcnZlcnMmS1c1PUN1c3RvbSUyMERlZGljYXRlZCUyMFNlcnZlcnMmc2VhcmNoYm94PTAmYmFja2ZpbGw9MCIsMSwiMjAyMi0xMC0wNCAxMDowMToyNyIsMSwiMTY2NDg3NzY4Ni4wMzAxMDcwMDAwIiwxLG51bGwsbnVsbF0:1ofejv:gMAc-GqC8AvLth8212sKdK4DTZ4; expires=Tue, 04-Oct-2022 11:01:27 GMT; Max-Age=3600; Path=/
connection: close


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   256
Md5:    c4959959af3eed50c4dec6bde7e80ca8
Sha1:   15daf89d5cbc36c0513282467ac6efb8df272b2f
Sha256: c383ff7ff29ba15f813219555e80770e5c59099767326fb487e3036650377744

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /?tm=1&subid4=1664877686.0301070000&KW1=Europe%20Dedicated%20Servers&KW2=Norway%20Dedicated%20Servers&KW3=Oslo%20County%20Dedicated%20Servers&KW4=Oslo%20Dedicated%20Servers&KW5=Custom%20Dedicated%20Servers&searchbox=0&backfill=0 HTTP/1.1 
Host: www1.widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://widgetserver.com/
Upgrade-Insecure-Requests: 1

                                         
                                         99.83.136.84
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 10:01:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Redirect: zeropark_zeroclick
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2238)
Size:   2494
Md5:    f5dace01970e11c49630e39ad3916dba
Sha1:   41e718bcf3e510efc9b8fc3634d35312b7f8e5c5
Sha256: 70aa2cf7040de1b009a281b335be46e211f3f7d5bcb6aedc87a01d52c536a1ff
                                        
                                            GET /scripts/js3.js HTTP/1.1 
Host: d38psrni17bvxu.cloudfront.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.widgetserver.com/

                                         
                                         54.230.245.130
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Content-Length: 1134
Connection: keep-alive
Server: nginx
Date: Tue, 04 Oct 2022 09:14:34 GMT
Last-Modified: Tue, 17 Aug 2021 09:17:22 GMT
Accept-Ranges: bytes
ETag: "611b7ea2-46e"
X-Cache: Hit from cloudfront
Via: 1.1 d9fb4c3794a085bb4ee2c5798c2cb1b8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: k5p3gAHJ2gYIP5ImAgie_vtrL_Rfl8NHQTLobsxgxaHofjtiEnFoxQ==
Age: 2814


--- Additional Info ---
Magic:  ASCII text, with very long lines (506)
Size:   1134
Md5:    64b79b43df8fbf2c5d082964b9116a68
Sha1:   dc3c763519baf0f4c32bb60bfc429651a491ea01
Sha256: c57e9feec209e3ea5eb1d75a1ba6fa277242a3df250055be8446052b51e58637
                                        
                                            GET /track.php?domain=widgetserver.com&toggle=browserjs&uid=MTY2NDg3NzY4Ny43MjAyOjBlNDRjOTExZTRlMzk2MzFhMTQyNTgxNmNiMDE1YWE3MGU0MmQ1NjNmMjQyYzUyMTY4NzQ0YmY0OTAwY2M4Mzc6NjMzYzA0NzdhZmQyYQ%3D%3D HTTP/1.1 
Host: www1.widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.widgetserver.com/?tm=1&subid4=1664877686.0301070000&KW1=Europe%20Dedicated%20Servers&KW2=Norway%20Dedicated%20Servers&KW3=Oslo%20County%20Dedicated%20Servers&KW4=Oslo%20Dedicated%20Servers&KW5=Custom%20Dedicated%20Servers&searchbox=0&backfill=0

                                         
                                         99.83.136.84
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 10:01:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

                                        
                                            POST /ls.php HTTP/1.1 
Host: www1.widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 2190
Origin: http://www1.widgetserver.com
Connection: keep-alive
Referer: http://www1.widgetserver.com/?tm=1&subid4=1664877686.0301070000&KW1=Europe%20Dedicated%20Servers&KW2=Norway%20Dedicated%20Servers&KW3=Oslo%20County%20Dedicated%20Servers&KW4=Oslo%20Dedicated%20Servers&KW5=Custom%20Dedicated%20Servers&searchbox=0&backfill=0

                                         
                                         99.83.136.84
HTTP/1.1 201 Created
Content-Type: text/javascript;charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 633c047914f0ba52322577a7
Charset: utf-8
Access-Control-Allow-Origin: http://www1.widgetserver.com
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_SUPSYTS2PCRh8Ls5zp1NSmxeij00Qvlwhvjl2cyGx0vBj3mon9/x1+ONnws1ZpP257yznaZ50Ban0jeT28eI6Q==


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: www1.widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.widgetserver.com/?tm=1&subid4=1664877686.0301070000&KW1=Europe%20Dedicated%20Servers&KW2=Norway%20Dedicated%20Servers&KW3=Oslo%20County%20Dedicated%20Servers&KW4=Oslo%20Dedicated%20Servers&KW5=Custom%20Dedicated%20Servers&searchbox=0&backfill=0

                                         
                                         99.83.136.84
HTTP/1.1 200 OK
Content-Type: image/x-icon
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Content-Length: 0
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-0"
Accept-Ranges: bytes

                                        
                                            GET /track.php?click=7734c042495d131ef4c95617c4712d5c9f446293&domain=widgetserver.com&uid=MTY2NDg3NzY4Ny43MjAyOjBlNDRjOTExZTRlMzk2MzFhMTQyNTgxNmNiMDE1YWE3MGU0MmQ1NjNmMjQyYzUyMTY4NzQ0YmY0OTAwY2M4Mzc6NjMzYzA0NzdhZmQyYQ%3D%3D&ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2MzNjMDQ3N2FmZDExfHx8MTY2NDg3NzY4OC4xMTQ4fGVlNzkxM2JkY2JlZGUyMTI3MmNkZDcwMzYyMDE2ZjliNjYwNmMxZjJ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXw2NjAzNTczZjIxYjQwZjQ3YzQ1MGExM2ExODc1ZmNiYWYyM2Y0Y2I3fDB8ZHAtdGVhbWludGVybmV0MTJfM3BofDB8MA%3D%3D&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off HTTP/1.1 
Host: www1.widgetserver.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.widgetserver.com/?tm=1&subid4=1664877686.0301070000&KW1=Europe%20Dedicated%20Servers&KW2=Norway%20Dedicated%20Servers&KW3=Oslo%20County%20Dedicated%20Servers&KW4=Oslo%20Dedicated%20Servers&KW5=Custom%20Dedicated%20Servers&searchbox=0&backfill=0

                                         
                                         99.83.136.84
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-View-Match: true
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

                                        
                                            GET /zcvisitor/834ff1b2-43cb-11ed-90b0-0a6038a7505d/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=836bde20-43cb-11ed-90b0-0a6038a7505d HTTP/1.1 
Host: irene-eux.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.widgetserver.com/
Upgrade-Insecure-Requests: 1

                                         
                                         34.239.209.41
HTTP/1.1 200
Content-Type: text/html;charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: WfLxciXX


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   996
Md5:    c530ac8c27ab0db3942cc64ac27990f8
Sha1:   56d2316cdf9dcf69e44811cf980dfe6f42ae1bf5
Sha256: 27a961b25a463721fe92b763765808e54e97e40ced744f33afd476df532276e6
                                        
                                            GET /zcredirect?visitid=834ff1b2-43cb-11ed-90b0-0a6038a7505d&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false HTTP/1.1 
Host: irene-eux.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://irene-eux.com/zcvisitor/834ff1b2-43cb-11ed-90b0-0a6038a7505d/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=836bde20-43cb-11ed-90b0-0a6038a7505d
Upgrade-Insecure-Requests: 1

                                         
                                         34.239.209.41
HTTP/1.1 200
Content-Type: text/html;charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
redirected: JS
Server: aRUXqqIo


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   338
Md5:    97a62af4c9f33c4ef5583305f51ba965
Sha1:   cfce9db59b1b11ae1b86141723769da9985b840d
Sha256: 7dc823b14e1ae2994a0a82508989c4ccb7b58e0af7db5d03b26d3e84d2680b98
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: irene-eux.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://irene-eux.com/zcredirect?visitid=834ff1b2-43cb-11ed-90b0-0a6038a7505d&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false

                                         
                                         34.239.209.41
HTTP/1.1 404
Content-Type: text/html;charset=utf-8
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Content-Length: 653
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Language: en
Server: haotySAu


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators
Size:   653
Md5:    ba2732b1b2fa2626ffaa15f62f9e7d66
Sha1:   203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe
Sha256: 879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8
                                        
                                            GET /api/v1/px?xmlid=IPKtd3Nc61aZHwI9hobDn55mpVYYkIunLOuYJ1gV HTTP/1.1 
Host: boirbonx-1.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://irene-eux.com/
Upgrade-Insecure-Requests: 1

                                         
                                         3.33.192.145
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Content-Length: 5238
Connection: keep-alive
Access-Control-Allow-Origin: *
ETag: W/"1476-vynfMYSNfnsLe+VGFCf6X1mf7Cs"


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   5238
Md5:    2b103a9935faf9cd0d825de6f1369551
Sha1:   bf29df31848d7e7b0b7be5461427fa5f599fec2b
Sha256: bdf8e56302645669e1e46e8079511e8f4824dd11affa5733762a5f78686caff3

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /api/v1/pxcheck?impId=IPKtd3Nc61aZHwI9hobDn55mpVYYkIunLOuYJ1gV&minfo=eyJjb29raWVEaXNhYmxlZCI6ZmFsc2UsInVhIjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0OyBydjo5Ni4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94Lzk2LjAiLCJpZnJhbWUiOmZhbHNlLCJkZXZpY2VQaXhlbFJhdGlvIjoxLCJ3bmRMb2NIcmVmIjoiaHR0cDovL2JvaXJib254LTEuY29tL2FwaS92MS9weD94bWxpZD1JUEt0ZDNOYzYxYVpId0k5aG9iRG41NW1wVllZa0l1bkxPdVlKMWdWIiwiZGV2aWNlU3JlZW5TaXplIjoiMTAwMngxMjgwIiwiZGV2aWNlV2luZG93U2l6ZSI6IjkzOXgxMjgwIiwid25kMnNyY1JhdGlvTHdyMDYiOmZhbHNlLCJpc0JvdCI6Im9mZiJ9 HTTP/1.1 
Host: boirbonx-1.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://boirbonx-1.com/api/v1/px?xmlid=IPKtd3Nc61aZHwI9hobDn55mpVYYkIunLOuYJ1gV
Upgrade-Insecure-Requests: 1

                                         
                                         3.33.192.145
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Date: Tue, 04 Oct 2022 10:01:29 GMT
Content-Length: 174
Connection: keep-alive
Access-Control-Allow-Origin: *
Location: http://xml-v4.netload1.com/click?seat=2402098&i=-S2gqV-Ffns_0
Vary: Accept


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   174
Md5:    5f8d5491bf7f2005a732e3a65d789ffa
Sha1:   05c778d9d450d03d56445ebb0cfb187a87922b03
Sha256: 6750d4607cabe9d352dc55bb62551df90d93c3c04a70bbda730f5aeae1d69989
                                        
                                            GET /click?seat=2402098&i=-S2gqV-Ffns_0 HTTP/1.1 
Host: xml-v4.netload1.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boirbonx-1.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         198.134.116.17
HTTP/1.1 302 Found
                                        
Cache-Control: no-store
Content-Length: 0
Age: 0
Connection: keep-alive
Location: https://lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Pragma: no-cache

                                        
                                            POST /gsalphasha2g2 HTTP/1.1 
Host: ocsp2.globalsign.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:30 GMT
Content-Length: 1423
Connection: keep-alive
Expires: Sat, 08 Oct 2022 07:00:21 GMT
ETag: "89af8471f45e5883cf8f67d13d795690f27fc303"
Last-Modified: Tue, 04 Oct 2022 07:00:22 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2536
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 754d139ca973b50f-OSL


--- Additional Info ---
Magic:  data
Size:   1423
Md5:    aa6607f536b29cd78daa36d12db7a01a
Sha1:   89af8471f45e5883cf8f67d13d795690f27fc303
Sha256: f33bf9d9453d4413cd17b0a3cef2101d2fa762b2fb1648a2c2aca3efe5a17f61
                                        
                                            GET /?z=56408&c=12345&source_id=000000000_fil HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://boirbonx-1.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:30 GMT
Last-Modified: Mon, 17 May 2021 18:15:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"60a2b2df-14c11"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (63500), with CRLF line terminators
Size:   36807
Md5:    b4952d42c3dc62e72963f55d5ba964f3
Sha1:   d793c03fd33004f3d106dde4415b9c81b8b2c46d
Sha256: 2aea419c8035214d35e9928f7a4574671b63e77a9bd7392f1c547866ccbb2aac
                                        
                                            GET /style.css HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:30 GMT
Content-Length: 11235
Last-Modified: Mon, 11 Nov 2019 17:45:45 GMT
Connection: keep-alive
ETag: "5dc99e49-2be3"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   11235
Md5:    76e7391051b1944f0d94fb0a15b5eeed
Sha1:   35476d77afeb88c15f09d2eacec3830e471e19fc
Sha256: 4d2fa0064ace3802bc8c465d9d7b2da09b42c8593d0db3c0de15a8686668dc1d
                                        
                                            GET /app.js HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:30 GMT
Content-Length: 10088
Last-Modified: Mon, 15 Mar 2021 15:30:12 GMT
Connection: keep-alive
ETag: "604f7d84-2768"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (2071)
Size:   10088
Md5:    611d12065f53a2de5b64b785c7677877
Sha1:   401e507307a177c5d5d5d8ce6ce919b0fed5adea
Sha256: b0e6528c41784514715de6de02393df967178c61651d4a249384ab5b1318ba31
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /jquery-2.1.1.min.js HTTP/1.1 
Host: code.jquery.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         69.16.175.42
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Tue, 04 Oct 2022 10:01:30 GMT
content-encoding: gzip
content-length: 29482
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
accept-ranges: bytes
server: nginx
etag: W/"620cd6ff-14915"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1664877690.dop231.sk1.t,1664877690.cds261.sk1.hn,1664877690.cds262.sk1.c
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (32061)
Size:   29482
Md5:    bc3fbf33dc7b6b815c7e294a7dd685b4
Sha1:   8ff4bad0a255364f15fd1926199bf17fb673b736
Sha256: ad3722919f1d0a20f0d7734f6e0823c211de6bc7d6972a56a9a7e9a12d7d02dd
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /firebasejs/5.4.0/firebase-app.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.163
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 12419
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 28 Sep 2022 14:47:59 GMT
expires: Thu, 28 Sep 2023 14:47:59 GMT
cache-control: public, max-age=31536000
age: 501211
last-modified: Thu, 16 Aug 2018 18:59:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (34802)
Size:   12419
Md5:    b4754e15e3b954ae32ae259d8e7a0415
Sha1:   b61d406ddc724fb7af0f5562f0aab0274e57db9a
Sha256: ae91c816008514b73c098bf96e2e38d72bd0b8f70d77db534d7b14107af60919
                                        
                                            GET /firebasejs/5.4.0/firebase-messaging.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.163
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 10046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 28 Sep 2022 12:52:14 GMT
expires: Thu, 28 Sep 2023 12:52:14 GMT
cache-control: public, max-age=31536000
age: 508156
last-modified: Thu, 16 Aug 2018 18:59:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (35630)
Size:   10046
Md5:    5afb079bc2331bd0ce1f1e38698808f7
Sha1:   92febc8e7c35b819a9a104901297e62a2d53b98c
Sha256: 28d3a6e18950b0d42849e3e817d757b2b6164ca8440e912b2e022af1107306ac
                                        
                                            GET /idb.js HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:30 GMT
Content-Length: 2637
Last-Modified: Fri, 19 Oct 2018 10:36:47 GMT
Connection: keep-alive
ETag: "5bc9b3bf-a4d"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   2637
Md5:    c13f1306227fced1506d250fe914d3e8
Sha1:   7b56f20689cb8339f444767629623e278e90f958
Sha256: a5dd5c3f8afb3604650604774c3f5fe89043a38135cb1325a242300edf802d1d
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /gtag/js?id=G-CWF1ZNVXRW HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.168
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 04 Oct 2022 10:01:30 GMT
expires: Tue, 04 Oct 2022 10:01:30 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 74958
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (18966)
Size:   74958
Md5:    6dcc21eacf4590523be295509bf847c0
Sha1:   97e2eb7e54a87009aedff194fe9c0ceb920a0e59
Sha256: 0505ade9d5d9d6da1c0c629c69dc930f3f9f775db3ad120050d06401f86a1106
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Tue, 04 Oct 2022 10:01:30 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /firebase-messaging-sw.js HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:30 GMT
Content-Length: 19262
Last-Modified: Mon, 30 Dec 2019 08:58:46 GMT
Connection: keep-alive
ETag: "5e09bc46-4b3e"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Java source, ASCII text, with very long lines (18959)
Size:   19262
Md5:    ece2d5dbc7db3df8369f932db4e4a835
Sha1:   efb153dbd5b8a9de7c382cd3f43e11033c42a4a7
Sha256: 23cb8cf8c1a90e17ab07654ccf0815c2af16c0a1d1077fadad77cc539e8deee9
                                        
                                            GET /arrow.png HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:30 GMT
Content-Length: 592
Last-Modified: Wed, 05 Dec 2018 23:08:48 GMT
Connection: keep-alive
ETag: "5c085a80-250"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 54 x 86, 8-bit/color RGBA, non-interlaced\012- data
Size:   592
Md5:    ab953ae92d6d6c014e8bf125f5ea7f6b
Sha1:   ef3e629267df3bad73d3e9ff0f2ad946d7e69eb9
Sha256: 21e067de4d0e7648a0c2d58a091ac6630b3a8bc0af8d07030823fd09aada6ea4
                                        
                                            GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://lifeimpressions.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 28 Sep 2022 19:34:08 GMT
expires: Thu, 28 Sep 2023 19:34:08 GMT
cache-control: public, max-age=31536000
age: 484042
last-modified: Wed, 11 May 2022 19:24:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Size:   15744
Md5:    15d9f621c3bd1599f0169dcf0bd5e63e
Sha1:   7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
Sha256: f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
                                        
                                            GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://lifeimpressions.net
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 28 Sep 2022 19:34:08 GMT
expires: Thu, 28 Sep 2023 19:34:08 GMT
cache-control: public, max-age=31536000
age: 484042
last-modified: Wed, 11 May 2022 19:24:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Size:   15860
Md5:    e9f5aaf547f165386cd313b995dddd8e
Sha1:   acdef5603c2387b0e5bffd744b679a24a8bc1968
Sha256: f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   132
Md5:    3d06c0eef8d0d7b16c06a4d59d7b9a8a
Sha1:   f1b09ab082acf6c0cc7208e344eb3f6619c49cf9
Sha256: 648d8e644dcbdc4ec115a30bd51d8054071891a3e4971aee01963f1cb17fb4ca
                                        
                                            GET /?z=56408&c=12345&source_id=000000000_fil HTTP/1.1 
Host: d90f85.lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.0.1664877690.0.0.0; _ga=GA1.1.415712402.1664877690
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:31 GMT
Last-Modified: Mon, 17 May 2021 18:15:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"60a2b2df-14c11"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (63500), with CRLF line terminators
Size:   36807
Md5:    b4952d42c3dc62e72963f55d5ba964f3
Sha1:   d793c03fd33004f3d106dde4415b9c81b8b2c46d
Sha256: 2aea419c8035214d35e9928f7a4574671b63e77a9bd7392f1c547866ccbb2aac
                                        
                                            GET /style.css HTTP/1.1 
Host: d90f85.lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d90f85.lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.0.1664877690.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:31 GMT
Content-Length: 11235
Last-Modified: Mon, 11 Nov 2019 17:45:45 GMT
Connection: keep-alive
ETag: "5dc99e49-2be3"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   11235
Md5:    76e7391051b1944f0d94fb0a15b5eeed
Sha1:   35476d77afeb88c15f09d2eacec3830e471e19fc
Sha256: 4d2fa0064ace3802bc8c465d9d7b2da09b42c8593d0db3c0de15a8686668dc1d
                                        
                                            GET /app.js HTTP/1.1 
Host: d90f85.lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d90f85.lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.0.1664877690.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:31 GMT
Content-Length: 10088
Last-Modified: Mon, 15 Mar 2021 15:30:12 GMT
Connection: keep-alive
ETag: "604f7d84-2768"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (2071)
Size:   10088
Md5:    611d12065f53a2de5b64b785c7677877
Sha1:   401e507307a177c5d5d5d8ce6ce919b0fed5adea
Sha256: b0e6528c41784514715de6de02393df967178c61651d4a249384ab5b1318ba31
                                        
                                            POST /g/collect?v=2&tid=G-CWF1ZNVXRW&gtm=2oe9s0&_p=604261770&cid=415712402.1664877690&ul=en-us&sr=1280x1024&_z=ccd.v9B&_s=1&sid=1664877690&sct=1&seg=0&dl=https%3A%2F%2Flifeimpressions.net%2F%3Fz%3D56408%26c%3D12345%26source_id%3D000000000_fil&dr=http%3A%2F%2Fboirbonx-1.com%2F&dt=Checking%20your%20browser%E2%80%A6&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1 
Host: region1.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://lifeimpressions.net
Connection: keep-alive
Referer: https://lifeimpressions.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

                                         
                                         216.239.34.36
HTTP/2 204 No Content
content-type: text/plain
                                        
access-control-allow-origin: https://lifeimpressions.net
date: Tue, 04 Oct 2022 10:01:31 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

                                        
                                            GET /idb.js HTTP/1.1 
Host: d90f85.lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d90f85.lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.0.1664877690.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:31 GMT
Content-Length: 2637
Last-Modified: Fri, 19 Oct 2018 10:36:47 GMT
Connection: keep-alive
ETag: "5bc9b3bf-a4d"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   2637
Md5:    c13f1306227fced1506d250fe914d3e8
Sha1:   7b56f20689cb8339f444767629623e278e90f958
Sha256: a5dd5c3f8afb3604650604774c3f5fe89043a38135cb1325a242300edf802d1d
                                        
                                            GET /firebase-messaging-sw.js HTTP/1.1 
Host: d90f85.lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.0.1664877690.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:31 GMT
Content-Length: 19262
Last-Modified: Mon, 30 Dec 2019 08:58:46 GMT
Connection: keep-alive
ETag: "5e09bc46-4b3e"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Java source, ASCII text, with very long lines (18959)
Size:   19262
Md5:    ece2d5dbc7db3df8369f932db4e4a835
Sha1:   efb153dbd5b8a9de7c382cd3f43e11033c42a4a7
Sha256: 23cb8cf8c1a90e17ab07654ccf0815c2af16c0a1d1077fadad77cc539e8deee9
                                        
                                            GET /arrow.png HTTP/1.1 
Host: d90f85.lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d90f85.lifeimpressions.net/style.css
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.0.1664877690.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:31 GMT
Content-Length: 592
Last-Modified: Wed, 05 Dec 2018 23:08:48 GMT
Connection: keep-alive
ETag: "5c085a80-250"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 54 x 86, 8-bit/color RGBA, non-interlaced\012- data
Size:   592
Md5:    ab953ae92d6d6c014e8bf125f5ea7f6b
Sha1:   ef3e629267df3bad73d3e9ff0f2ad946d7e69eb9
Sha256: 21e067de4d0e7648a0c2d58a091ac6630b3a8bc0af8d07030823fd09aada6ea4
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: d90f85.lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://d90f85.lifeimpressions.net/?z=56408&c=12345&source_id=000000000_fil
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.0.1664877690.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                         
                                         178.128.246.195
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   132
Md5:    3d06c0eef8d0d7b16c06a4d59d7b9a8a
Sha1:   f1b09ab082acf6c0cc7208e344eb3f6619c49cf9
Sha256: 648d8e644dcbdc4ec115a30bd51d8054071891a3e4971aee01963f1cb17fb4ca
                                        
                                            GET /tXml.js HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/firebase-messaging-sw.js
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.1.1664877691.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:32 GMT
Content-Length: 13979
Last-Modified: Sat, 18 Aug 2018 15:29:28 GMT
Connection: keep-alive
ETag: "5b783b58-369b"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   13979
Md5:    ff0572e0f1d51ff1b8d60e3c2190c88f
Sha1:   1749529c3243408f0bee5374d4133507e79cede3
Sha256: 341f686d65ae112c677f82d590028066b09d9926bae6565d795db5d3574c3607
                                        
                                            GET /idb.js HTTP/1.1 
Host: lifeimpressions.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/firebase-messaging-sw.js
Cookie: _ga_CWF1ZNVXRW=GS1.1.1664877690.1.1.1664877691.0.0.0; _ga=GA1.1.415712402.1664877690
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         178.128.246.195
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.14.2
Date: Tue, 04 Oct 2022 10:01:32 GMT
Content-Length: 2637
Last-Modified: Fri, 19 Oct 2018 10:36:47 GMT
Connection: keep-alive
ETag: "5bc9b3bf-a4d"
Strict-Transport-Security: max-age=63072000; includeSubdomains
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   2637
Md5:    c13f1306227fced1506d250fe914d3e8
Sha1:   7b56f20689cb8339f444767629623e278e90f958
Sha256: a5dd5c3f8afb3604650604774c3f5fe89043a38135cb1325a242300edf802d1d
                                        
                                            GET /css?family=Roboto:400,700,400i&subset=cyrillic HTTP/1.1 
Host: fonts.googleapis.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lifeimpressions.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         142.250.74.10
HTTP/2 200 OK
content-type: text/css; charset=utf-8
                                        
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 04 Oct 2022 10:01:30 GMT
date: Tue, 04 Oct 2022 10:01:30 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---