urlquery - report: goldrush.ug/zxcvb.exe

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	IP	Comment
goldrush.ug (2)	0	2022-06-26 06:32:56 UTC	2022-10-31 06:19:47 UTC	193.106.191.169	Unknown ranking
r3.o.lencr.org (5)	344	No data	No data	23.36.76.226
ocsp.digicert.com (3)	86	2012-05-21 07:02:23 UTC	2020-05-02 20:58:10 UTC	93.184.220.29
content-signature-2.cdn.mozilla.net (1)	1152	No data	No data	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27 18:32:35 UTC	2022-11-04 05:51:42 UTC	34.117.237.239
push.services.mozilla.com (1)	2140	2014-10-24 08:27:06 UTC	2020-05-03 10:09:39 UTC	34.215.91.121
img-getpocket.cdn.mozilla.net (7)	1631	2018-06-21 23:36:00 UTC	2020-02-19 04:43:25 UTC	34.120.237.76

Scan Date	Severity	Indicator	Comment
2022-11-05	2	goldrush.ug/zxcvb.exe	Malware

Scan Date	Severity	Indicator	Comment
2022-11-04	2	goldrush.ug	Sinkholed
2022-11-04	2	goldrush.ug	Sinkholed

Scan Date	Severity	Indicator	Comment
2022-11-04	2	goldrush.ug	Sinkholed
2022-11-04	2	goldrush.ug	Sinkholed

Date	UQ / IDS / BL	URL	IP
2022-12-16 06:23:08 +0000	0 - 0 - 3	marnersstyler.ug/asdf.EXE	193.106.191.169
2022-12-16 06:19:00 +0000	0 - 0 - 3	marnersstyler.ug/zxcvb.exe	193.106.191.169
2022-12-16 05:31:07 +0000	0 - 0 - 3	marnersstyler.ug/zxcv.EXE	193.106.191.169
2022-12-16 05:30:59 +0000	0 - 0 - 3	marnersstyler.ug/asdfg.exe	193.106.191.169
2022-12-16 05:24:37 +0000	0 - 0 - 3	wewilltoptheworld.top/rc.exe	193.106.191.169

Date	UQ / IDS / BL	URL	IP
2022-12-17 22:10:52 +0000	0 - 0 - 12	ing-gerateerneuerung.com/95ca6d9d18742ae5428c (...)	193.106.191.135
2022-12-17 22:10:41 +0000	0 - 0 - 12	ing-gerateerneuerung.com/b8d3a8f5b0912c8b1370 (...)	193.106.191.135
2022-12-17 20:12:03 +0000	0 - 0 - 10	failed-new-attempt.com/Login.php/absa/ib	193.106.191.135
2022-12-17 18:35:22 +0000	0 - 0 - 2	secure-device-login.com/Login.php	193.106.191.135
2022-12-17 16:36:14 +0000	0 - 0 - 2	security-new-device.com/login.php	193.106.191.135

Date	UQ / IDS / BL	URL	IP
2023-02-01 08:03:03 +0000	0 - 1 - 3	goldrush.ug/zxcv.EXE	91.215.85.158
2023-02-01 08:02:38 +0000	0 - 1 - 3	goldrush.ug/zxcvb.exe	91.215.85.158
2023-02-01 04:44:16 +0000	0 - 1 - 3	goldrush.ug/zxcvb.exe	91.215.85.158
2023-02-01 04:44:11 +0000	0 - 1 - 3	goldrush.ug/zxcv.EXE	91.215.85.158
2023-02-01 01:25:37 +0000	0 - 1 - 3	goldrush.ug/zxcv.EXE	91.215.85.158

Date	UQ / IDS / BL	URL	IP
2023-02-06 16:37:52 +0000	0 - 2 - 2	dxz.janinner.icu/	104.21.27.99
2023-02-06 16:31:08 +0000	0 - 0 - 2	38.107.226.180/	38.107.226.180
2023-02-06 16:30:31 +0000	0 - 0 - 2	111.48.118.189/	111.48.118.189
2023-02-06 15:25:30 +0000	0 - 1 - 2	162.55.40.72/RAMAZIK.zip	162.55.40.72
2023-02-06 14:56:25 +0000	0 - 5 - 0	a.pomf.cat/bvudaf.exe	69.39.225.3

Request	Response
GET /zxcvb.exe HTTP/1.1 Host: goldrush.ug User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: goldrush.ug/zxcvb.exe FQDN: goldrush.ug IP: 193.106.191.169 HASH: 74608fe600df833a47580cd8c8bd177b945eb8191afff783db0c49e757718c30 193.106.191.169 HTTP/1.1 502 Bad Gateway Content-Type: text/html Server: nginx/1.20.2 Date: Sat, 05 Nov 2022 00:51:34 GMT Transfer-Encoding: chunked Connection: keep-alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Size: 157 Md5: 974decd57b1078703021ebaf290954e4 Sha1: 993ad6010b70850ff162b268ccc9b0b1095957d3 Sha256: 74608fe600df833a47580cd8c8bd177b945eb8191afff783db0c49e757718c30 Alerts: Blocklists: - fortinet: Malware - mnemonic_dns: Sinkholed - quad9: Sinkholed
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: b93410a9d62da3f219796d753b61a0f730cc272c13596724aa9d20efba298b44 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "B93410A9D62DA3F219796D753B61A0F730CC272C13596724AA9D20EFBA298B44" Last-Modified: Thu, 03 Nov 2022 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3855 Expires: Sat, 05 Nov 2022 01:55:49 GMT Date: Sat, 05 Nov 2022 00:51:34 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: b7be8442ec1e518ccc80739495f6d047 Sha1: 7a9d24b9d4046262c7753c49afaf9c19f4840626 Sha256: b93410a9d62da3f219796d753b61a0f730cc272c13596724aa9d20efba298b44
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 46ca638514d9d4cf252762fdac37a5e7b1da550fcc9911070b0b26a6aa6150a7 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 5865 Cache-Control: max-age=123436 Date: Sat, 05 Nov 2022 00:51:34 GMT Etag: "6364dbd9-1d7" Expires: Sun, 06 Nov 2022 11:08:50 GMT Last-Modified: Fri, 04 Nov 2022 09:31:05 GMT Server: ECS (ska/F71D) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: cd02b32dbc8416dcb10b468af2166c33 Sha1: 503a9c4cabdb19dfde769f5e2d3ef919c818c364 Sha256: 46ca638514d9d4cf252762fdac37a5e7b1da550fcc9911070b0b26a6aa6150a7
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 46ca638514d9d4cf252762fdac37a5e7b1da550fcc9911070b0b26a6aa6150a7 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 5865 Cache-Control: max-age=123436 Date: Sat, 05 Nov 2022 00:51:34 GMT Etag: "6364dbd9-1d7" Expires: Sun, 06 Nov 2022 11:08:50 GMT Last-Modified: Fri, 04 Nov 2022 09:31:05 GMT Server: ECS (ska/F71D) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: cd02b32dbc8416dcb10b468af2166c33 Sha1: 503a9c4cabdb19dfde769f5e2d3ef919c818c364 Sha256: 46ca638514d9d4cf252762fdac37a5e7b1da550fcc9911070b0b26a6aa6150a7
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 73a068f907cc50dd60af18d545b4264dd44bc4b9f40bf9adfceea157fdc33099 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "73A068F907CC50DD60AF18D545B4264DD44BC4B9F40BF9ADFCEEA157FDC33099" Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3822 Expires: Sat, 05 Nov 2022 01:55:16 GMT Date: Sat, 05 Nov 2022 00:51:34 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 9f3527f898221f8ba6b5015f6decc100 Sha1: ead93baa0e9d3a6297be3377dc3a624e5a3f509a Sha256: 73a068f907cc50dd60af18d545b4264dd44bc4b9f40bf9adfceea157fdc33099
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 34.160.144.191 HASH: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78 34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: AcdbfJbWWXF4oC3cNc/8k7raOeVbcCoulVDrdR+JaLgNt5D1yh7Q6iZX3sPQnS0EDZJUfZDcWKA= x-amz-request-id: PQQ097DFP2Y4C2XF content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Sat, 05 Nov 2022 00:46:59 GMT age: 275 last-modified: Fri, 30 Sep 2022 18:50:55 GMT etag: "67d5a988edcda47bc3b3b3f65d32b4b6" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 67d5a988edcda47bc3b3b3f65d32b4b6 Sha1: d4f0e0da8b3690cc7da925026d3414b68c7d954f Sha256: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /favicon.ico HTTP/1.1 Host: goldrush.ug User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://goldrush.ug/zxcvb.exe	URL: goldrush.ug/favicon.ico FQDN: goldrush.ug IP: 193.106.191.169 HASH: 74608fe600df833a47580cd8c8bd177b945eb8191afff783db0c49e757718c30 193.106.191.169 HTTP/1.1 502 Bad Gateway Content-Type: text/html Server: nginx/1.20.2 Date: Sat, 05 Nov 2022 00:51:34 GMT Transfer-Encoding: chunked Connection: keep-alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Size: 157 Md5: 974decd57b1078703021ebaf290954e4 Sha1: 993ad6010b70850ff162b268ccc9b0b1095957d3 Sha256: 74608fe600df833a47580cd8c8bd177b945eb8191afff783db0c49e757718c30 Alerts: Blocklists: - mnemonic_dns: Sinkholed - quad9: Sinkholed
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Sat, 05 Nov 2022 00:51:34 GMT content-length: 12 strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: e4928481739a2a75dce86c03b355c6dff507426e8d851cba5ca8537b1be87c20 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 1724 Cache-Control: max-age=114236 Date: Sat, 05 Nov 2022 00:51:35 GMT Etag: "6364c817-1d7" Expires: Sun, 06 Nov 2022 08:35:31 GMT Last-Modified: Fri, 04 Nov 2022 08:06:47 GMT Server: ECS (ska/F71D) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: 42a0adacced30df52cf7cad3e200036d Sha1: f7b4114defc61f806dbb74fd228bca155d52362a Sha256: e4928481739a2a75dce86c03b355c6dff507426e8d851cba5ca8537b1be87c20
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: sXhxzV2HPQ9UHdJFbt+GOg== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 34.215.91.121 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.215.91.121 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: X0BdtWdPuxwDgAi58fha0R9DwU0= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22" Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7708 Expires: Sat, 05 Nov 2022 03:00:04 GMT Date: Sat, 05 Nov 2022 00:51:36 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: f6ae0db60213bfddbf2ad71a9fb116bf Sha1: 915d2895adc3f022c28cc628aeb6e441cbb09d47 Sha256: ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22" Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7708 Expires: Sat, 05 Nov 2022 03:00:04 GMT Date: Sat, 05 Nov 2022 00:51:36 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: f6ae0db60213bfddbf2ad71a9fb116bf Sha1: 915d2895adc3f022c28cc628aeb6e441cbb09d47 Sha256: ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22" Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7708 Expires: Sat, 05 Nov 2022 03:00:04 GMT Date: Sat, 05 Nov 2022 00:51:36 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: f6ae0db60213bfddbf2ad71a9fb116bf Sha1: 915d2895adc3f022c28cc628aeb6e441cbb09d47 Sha256: ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff96da6f9-536c-48c1-bafa-3f133749368c.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 2b967cacc0433762c074cfa0e032c2694171d221c004ac9465027a8667f9207f 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5626 x-amzn-requestid: 04db4275-3da4-44dd-abca-a388803d9413 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: bGHxIGfXIAMFqZA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6365866d-3f8c4f1b5066f090713f79fc;Sampled=0 x-amzn-remapped-date: Fri, 04 Nov 2022 21:38:53 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: g0juFLitefrFCcE3J6c3Y6ku8a03xfLE_Eno50Aw1TMYDpdIo_tZpw== via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google date: Fri, 04 Nov 2022 22:10:18 GMT age: 9678 etag: "c904608373d3e938b09a5ed82a51c2e43f13452d" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5626 Md5: a5b4e91e11387354ae4208f1cc27e4dd Sha1: c904608373d3e938b09a5ed82a51c2e43f13452d Sha256: 2b967cacc0433762c074cfa0e032c2694171d221c004ac9465027a8667f9207f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ba524bd-ef85-4f86-8f19-39ca866c6ef3.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: aad9c8d5dbf34cbfc79bd5a69eb84e83880991f6765b955195b8ab515cab076b 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 3898 x-amzn-requestid: aa30ce03-5fea-431d-a8ba-f1f1f6a7313d x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: a5se8GMjIAMFgxA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63608df9-5f607dee71fc5ea4688e10ad;Sampled=0 x-amzn-remapped-date: Tue, 01 Nov 2022 03:09:45 GMT x-amz-cf-pop: SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: M117Djj2kKvQjSBxg_-Wjy9wr6gS-B8nZg-DW6-mduh-Py4fpw_0hg== via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google date: Fri, 04 Nov 2022 23:55:48 GMT age: 3348 etag: "39da4f78058b565bfcaad4ced6f1b59a2bf6a421" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 3898 Md5: e6627701fe981336792076df0c21937b Sha1: 39da4f78058b565bfcaad4ced6f1b59a2bf6a421 Sha256: aad9c8d5dbf34cbfc79bd5a69eb84e83880991f6765b955195b8ab515cab076b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b19a2f3-4e39-45b1-a802-aa79f81a8a31.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4afbfa5bd1748be41737f5471ef04f9900cdf8dbc7a9a96e4dc67cc845b3b25e 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7517 x-amzn-requestid: c0a49a26-ceff-4eb4-b7ad-5dc8da5b9a66 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ajK86HsOoAMFfFg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63578b85-405cb2a5451f04986800202a;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 07:08:53 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: Zg1JqihZgfL2qA-JFJR09hA5u5Q-jCxUW5R6AewCxDOnrHFGmV4b1A== via: 1.1 65cd593770fc4ba0453da1c7897f675c.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google date: Fri, 04 Nov 2022 10:21:00 GMT age: 52236 etag: "3388d99d480ba57fae4a0ebef3e29a5a9faa3cfc" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7517 Md5: 5a3f235a8a6a70aea08ca45b9025f073 Sha1: 3388d99d480ba57fae4a0ebef3e29a5a9faa3cfc Sha256: 4afbfa5bd1748be41737f5471ef04f9900cdf8dbc7a9a96e4dc67cc845b3b25e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3494b1e3-ddc8-454c-8b43-e70e2d8f07b8.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 2dc55e97ef3a85fccb104b80161a8bac16b12d37527c336563677432584c7ad5 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 11421 x-amzn-requestid: 80f2a46c-6682-4160-b896-eeaa366dbab7 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: aUsKNF4SoAMFn5g= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6351c0a7-5a5517d005ec7a7d1507b58e;Sampled=0 x-amzn-remapped-date: Thu, 20 Oct 2022 21:41:59 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: gdqoswTMqjrfyzzY-103agxLH8ak-rFsCId29eoLOF6WHgFmd04K7g== via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 2ab6211e66998c8b58132661a7e3cade.cloudfront.net (CloudFront), 1.1 google date: Fri, 04 Nov 2022 08:24:41 GMT age: 59215 etag: "f7705fcd2d91ce90c58e79324cce1e3abba6c1c8" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 11421 Md5: 2ae2b8d827fb2c8bef64febcd36f1645 Sha1: f7705fcd2d91ce90c58e79324cce1e3abba6c1c8 Sha256: 2dc55e97ef3a85fccb104b80161a8bac16b12d37527c336563677432584c7ad5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F28a5f5ce-bd81-4e56-bd1b-460e13379581.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 5baa90853202e78cf9b59e9ab597e16ccfbf143d7e124583e64dc1ad1ee2c2df 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7783 x-amzn-requestid: c8f73eac-612d-48e3-a655-41525e97331c x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: apxM8H7aoAMFT3w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-635a2f1f-5470c77a30a11b9423f56837;Sampled=0 x-amzn-remapped-date: Thu, 27 Oct 2022 07:11:27 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: FLFsF-1gAeN0HiZnS03oNMNajnwk12P-5Aro-QOcQNFtkjknh9g5FA== via: 1.1 0c04e836dfe22246a870a0f54a2d4746.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google date: Fri, 04 Nov 2022 19:19:17 GMT age: 19939 etag: "75805b9f03aef14cfad025259936ae5f217d25ca" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7783 Md5: 7a3b1551512640bb8f5e7deb80c32272 Sha1: 75805b9f03aef14cfad025259936ae5f217d25ca Sha256: 5baa90853202e78cf9b59e9ab597e16ccfbf143d7e124583e64dc1ad1ee2c2df
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2ee033d1-8a42-4b16-a163-50e55463bebf.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: ccb66543a3ea08e23cbd2dc2ddaf1751ad5c2a7fcf6ee4ef153599859ed062c6 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7010 x-amzn-requestid: 5f6f3a92-1993-4497-bbaa-916c92b22929 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: amew5FHFoAMF7-Q= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358de6b-2547529c1f5fadc64415b9ad;Sampled=0 x-amzn-remapped-date: Wed, 26 Oct 2022 07:14:51 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: BU2d20tHByY3pOYr3LAA5voUXdtwf29Z85az2aE5YnFGv41Lg5RCYA== via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 ebe4011a81a36e2bf678f69ce1711330.cloudfront.net (CloudFront), 1.1 google date: Fri, 04 Nov 2022 22:10:25 GMT age: 9671 etag: "204aff3eb3b4c891a362dc57d025874513deb86d" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7010 Md5: 3a3f762e3ae167546e31b6d5e0f2840a Sha1: 204aff3eb3b4c891a362dc57d025874513deb86d Sha256: ccb66543a3ea08e23cbd2dc2ddaf1751ad5c2a7fcf6ee4ef153599859ed062c6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd3819323-4f77-4bb2-bbbb-6926d5bc62aa.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 2cba117cfe96fa5e1b53981f98d42eb3e5f956083c3435a1d44d1d40784614bf 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 11427 x-amzn-requestid: 0dcc7ef4-d7fa-492e-8ddf-4342b4bc44e9 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: bGHxJGJZoAMFWlw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6365866d-7c3de2ed509a640f37c52843;Sampled=0 x-amzn-remapped-date: Fri, 04 Nov 2022 21:38:53 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: gAHLlJ0JzB6TfEUNw_sCNmrjMK-EX1hZbCY34i99xQok7R-wvcpqug== via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 567b44ed19c8caed2570b7bcd8c70034.cloudfront.net (CloudFront), 1.1 google date: Fri, 04 Nov 2022 21:59:04 GMT age: 10359 etag: "61dc4e78907f114519ff3fdd3c806b36557ab744" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 11427 Md5: 6ee20d59c5ac266f8eb9c47057271a10 Sha1: 61dc4e78907f114519ff3fdd3c806b36557ab744 Sha256: 2cba117cfe96fa5e1b53981f98d42eb3e5f956083c3435a1d44d1d40784614bf

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.76.226

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "B93410A9D62DA3F219796D753B61A0F730CC272C13596724AA9D20EFBA298B44" 

                                        
                                            
Last-Modified: Thu, 03 Nov 2022 00:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=3855 

                                        
                                            
Expires: Sat, 05 Nov 2022 01:55:49 GMT 

                                        
                                            
Date: Sat, 05 Nov 2022 00:51:34 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    b7be8442ec1e518ccc80739495f6d047

                                                Sha1:   7a9d24b9d4046262c7753c49afaf9c19f4840626

                                                Sha256: b93410a9d62da3f219796d753b61a0f730cc272c13596724aa9d20efba298b44

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.digicert.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         93.184.220.29

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Age: 5865 

                                        
                                            
Cache-Control: max-age=123436 

                                        
                                            
Date: Sat, 05 Nov 2022 00:51:34 GMT 

                                        
                                            
Etag: "6364dbd9-1d7" 

                                        
                                            
Expires: Sun, 06 Nov 2022 11:08:50 GMT 

                                        
                                            
Last-Modified: Fri, 04 Nov 2022 09:31:05 GMT 

                                        
                                            
Server: ECS (ska/F71D) 

                                        
                                            
X-Cache: HIT 

                                        
                                            
Content-Length: 471 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   471

                                                Md5:    cd02b32dbc8416dcb10b468af2166c33

                                                Sha1:   503a9c4cabdb19dfde769f5e2d3ef919c818c364

                                                Sha256: 46ca638514d9d4cf252762fdac37a5e7b1da550fcc9911070b0b26a6aa6150a7

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1 

                                        
                                            
Host: content-signature-2.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.160.144.191

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: binary/octet-stream

                                        

                                        
                                            
x-amz-id-2: AcdbfJbWWXF4oC3cNc/8k7raOeVbcCoulVDrdR+JaLgNt5D1yh7Q6iZX3sPQnS0EDZJUfZDcWKA= 

                                        
                                            
x-amz-request-id: PQQ097DFP2Y4C2XF 

                                        
                                            
content-disposition: attachment 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
content-length: 5348 

                                        
                                            
via: 1.1 google 

                                        
                                            
date: Sat, 05 Nov 2022 00:46:59 GMT 

                                        
                                            
age: 275 

                                        
                                            
last-modified: Fri, 30 Sep 2022 18:50:55 GMT 

                                        
                                            
etag: "67d5a988edcda47bc3b3b3f65d32b4b6" 

                                        
                                            
cache-control: public,max-age=3600 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  PEM certificate\012- , ASCII text

                                                Size:   5348

                                                Md5:    67d5a988edcda47bc3b3b3f65d32b4b6

                                                Sha1:   d4f0e0da8b3690cc7da925026d3414b68c7d954f

                                                Sha256: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

                                        
                                            GET /v1/tiles HTTP/1.1 

                                        
                                            
Host: contile.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.117.237.239

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/json

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Sat, 05 Nov 2022 00:51:34 GMT 

                                        
                                            
content-length: 12 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
via: 1.1 google 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with no line terminators

                                                Size:   12

                                                Md5:    23e88fb7b99543fb33315b29b1fad9d6

                                                Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

                                                Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

                                        
                                            GET / HTTP/1.1 

                                        
                                            
Host: push.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Sec-WebSocket-Version: 13 

                                        
                                            
Origin: wss://push.services.mozilla.com/ 

                                        
                                            
Sec-WebSocket-Protocol: push-notification 

                                        
                                            
Sec-WebSocket-Extensions: permessage-deflate 

                                        
                                            
Sec-WebSocket-Key: sXhxzV2HPQ9UHdJFbt+GOg== 

                                        
                                            
Connection: keep-alive, Upgrade 

                                        
                                            
Sec-Fetch-Dest: websocket 

                                        
                                            
Sec-Fetch-Mode: websocket 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
Upgrade: websocket

                                         34.215.91.121

                                        
                                            HTTP/1.1 101 Switching Protocols

                                        

                                        
                                            
Connection: Upgrade 

                                        
                                            
Upgrade: websocket 

                                        
                                            
Sec-WebSocket-Accept: X0BdtWdPuxwDgAi58fha0R9DwU0= 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.76.226

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22" 

                                        
                                            
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=7708 

                                        
                                            
Expires: Sat, 05 Nov 2022 03:00:04 GMT 

                                        
                                            
Date: Sat, 05 Nov 2022 00:51:36 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    f6ae0db60213bfddbf2ad71a9fb116bf

                                                Sha1:   915d2895adc3f022c28cc628aeb6e441cbb09d47

                                                Sha256: ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff96da6f9-536c-48c1-bafa-3f133749368c.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 5626 

                                        
                                            
x-amzn-requestid: 04db4275-3da4-44dd-abca-a388803d9413 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: bGHxIGfXIAMFqZA= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6365866d-3f8c4f1b5066f090713f79fc;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Fri, 04 Nov 2022 21:38:53 GMT 

                                        
                                            
x-amz-cf-pop: HIO50-C1, SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: g0juFLitefrFCcE3J6c3Y6ku8a03xfLE_Eno50Aw1TMYDpdIo_tZpw== 

                                        
                                            
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Fri, 04 Nov 2022 22:10:18 GMT 

                                        
                                            
age: 9678 

                                        
                                            
etag: "c904608373d3e938b09a5ed82a51c2e43f13452d" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   5626

                                                Md5:    a5b4e91e11387354ae4208f1cc27e4dd

                                                Sha1:   c904608373d3e938b09a5ed82a51c2e43f13452d

                                                Sha256: 2b967cacc0433762c074cfa0e032c2694171d221c004ac9465027a8667f9207f

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b19a2f3-4e39-45b1-a802-aa79f81a8a31.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 7517 

                                        
                                            
x-amzn-requestid: c0a49a26-ceff-4eb4-b7ad-5dc8da5b9a66 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: ajK86HsOoAMFfFg= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-63578b85-405cb2a5451f04986800202a;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Tue, 25 Oct 2022 07:08:53 GMT 

                                        
                                            
x-amz-cf-pop: SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: Zg1JqihZgfL2qA-JFJR09hA5u5Q-jCxUW5R6AewCxDOnrHFGmV4b1A== 

                                        
                                            
via: 1.1 65cd593770fc4ba0453da1c7897f675c.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Fri, 04 Nov 2022 10:21:00 GMT 

                                        
                                            
age: 52236 

                                        
                                            
etag: "3388d99d480ba57fae4a0ebef3e29a5a9faa3cfc" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   7517

                                                Md5:    5a3f235a8a6a70aea08ca45b9025f073

                                                Sha1:   3388d99d480ba57fae4a0ebef3e29a5a9faa3cfc

                                                Sha256: 4afbfa5bd1748be41737f5471ef04f9900cdf8dbc7a9a96e4dc67cc845b3b25e

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F28a5f5ce-bd81-4e56-bd1b-460e13379581.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 7783 

                                        
                                            
x-amzn-requestid: c8f73eac-612d-48e3-a655-41525e97331c 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: apxM8H7aoAMFT3w= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-635a2f1f-5470c77a30a11b9423f56837;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Thu, 27 Oct 2022 07:11:27 GMT 

                                        
                                            
x-amz-cf-pop: SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: FLFsF-1gAeN0HiZnS03oNMNajnwk12P-5Aro-QOcQNFtkjknh9g5FA== 

                                        
                                            
via: 1.1 0c04e836dfe22246a870a0f54a2d4746.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Fri, 04 Nov 2022 19:19:17 GMT 

                                        
                                            
age: 19939 

                                        
                                            
etag: "75805b9f03aef14cfad025259936ae5f217d25ca" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   7783

                                                Md5:    7a3b1551512640bb8f5e7deb80c32272

                                                Sha1:   75805b9f03aef14cfad025259936ae5f217d25ca

                                                Sha256: 5baa90853202e78cf9b59e9ab597e16ccfbf143d7e124583e64dc1ad1ee2c2df

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd3819323-4f77-4bb2-bbbb-6926d5bc62aa.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 11427 

                                        
                                            
x-amzn-requestid: 0dcc7ef4-d7fa-492e-8ddf-4342b4bc44e9 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: bGHxJGJZoAMFWlw= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6365866d-7c3de2ed509a640f37c52843;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Fri, 04 Nov 2022 21:38:53 GMT 

                                        
                                            
x-amz-cf-pop: HIO50-C1, SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: gAHLlJ0JzB6TfEUNw_sCNmrjMK-EX1hZbCY34i99xQok7R-wvcpqug== 

                                        
                                            
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 567b44ed19c8caed2570b7bcd8c70034.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Fri, 04 Nov 2022 21:59:04 GMT 

                                        
                                            
age: 10359 

                                        
                                            
etag: "61dc4e78907f114519ff3fdd3c806b36557ab744" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   11427

                                                Md5:    6ee20d59c5ac266f8eb9c47057271a10

                                                Sha1:   61dc4e78907f114519ff3fdd3c806b36557ab744

                                                Sha256: 2cba117cfe96fa5e1b53981f98d42eb3e5f956083c3435a1d44d1d40784614bf

URL	goldrush.ug/zxcvb.exe
IP	193.106.191.169 (Russia)
ASN	#59940 Kanzas LLC
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed	2022-11-05 00:51:45 UTC
Status	Loading report..
IDS alerts	0
Blocklist alert	5
urlquery alerts	No alerts detected
Tags	None

Overview

Domain Summary (7)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 193.106.191.169

Last 5 reports on ASN: Kanzas LLC

Last 5 reports on domain: goldrush.ug

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (20)

Overview

Domain Summary (7)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 193.106.191.169

Last 5 reports on ASN: Kanzas LLC

Last 5 reports on domain: goldrush.ug

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (20)

Network Intrusion Detection Systems