Report - alexatracker.com/?r=aHR0cHM6Ly9kYXRlZXhvdGljLmNvbS9hZ0VBP3VzaWQ9OTJiajNncjExazImZW1haWw9aG9zc3IlNDBuY2JwaW5jLmNvbSZzdWIxPWNsZWFyJnByaWQ9OTJiajNncjExazI=&h=12a402c5a2cd10fb4f5a9aa5ab6a7847

Report Overview

Submitted URL
alexatracker.com/?r=aHR0cHM6Ly9kYXRlZXhvdGljLmNvbS9hZ0VBP3VzaWQ9OTJiajNncjExazImZW1haWw9aG9zc3IlNDBuY2JwaW5jLmNvbSZzdWIxPWNsZWFyJnByaWQ9OTJiajNncjExazI=&h=12a402c5a2cd10fb4f5a9aa5ab6a7847
IP
172.67.204.112
ASN
#13335 CLOUDFLARENET
Submitted
2022-10-06 23:13:00
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
146.190.228.148	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	362 B	802 B	146.190.228.148
ocsp.globalsign.com	2075	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	347 B	1.4 kB	104.18.20.226
mc.yandex.ru	2672	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.1 kB	76 kB	87.250.250.119
alexatracker.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	506 B	811 B	104.21.85.99
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	54.230.111.7
e1.o.lencr.org	6159	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	652 B	1.5 kB	23.36.76.226
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.7 kB	68 kB	34.120.237.76
svntrk.com	105291	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	327 B	718 B	104.21.82.62
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
humadecure.gq	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.8 kB	24 kB	160.20.147.80
dateexotic.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	547 B	100 kB	216.119.156.49
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.3 kB	6.2 kB	23.36.76.226
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	34.216.192.228
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-10-06	medium	humadecure.gq	Sinkholed
2022-10-06	medium	humadecure.gq	Sinkholed
2022-10-06	medium	humadecure.gq	Sinkholed
2022-10-06	medium	humadecure.gq	Sinkholed
2022-10-06	medium	humadecure.gq	Sinkholed

JavaScript (5)

	URL	Size	First Seen	Last Seen
	humadecure.gq/?s1=mqmq&s3=el	505 B	2023-03-07	2023-03-17
Pretty URL humadecure.gq/?s1=mqmq&s3=el IP 160.20.147.80 ASN #30823 combahton GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:03:01 Last Seen2023-03-17 12:48:05 Times Seen1 Hash a4bdf73d6c7cffc574d06bd074029acc 4d594f31e6c4bfcbb278cb4989a316293666b665 b1539b6b56f3239fc24b36f63e7e433e01df8c8d864e461c7a209debda8df2c4 Loading...

	svntrk.com/assets/mqmq_633f60f3610cb.js	0 B	2023-03-07	2024-04-24
Pretty URL svntrk.com/assets/mqmq_633f60f3610cb.js IP 104.21.82.62 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-24 06:46:31 Times Seen37033178 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	humadecure.gq/?s1=mqmq&s3=el	390 B	2023-03-07	2023-03-08
Pretty URL humadecure.gq/?s1=mqmq&s3=el IP 160.20.147.80 ASN #30823 combahton GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:17:33 Last Seen2023-03-08 07:52:40 Times Seen1 Hash a921f0644872b34c15544bdc35f28e7b e9adcfc5649df78fcf84e7e52d0eceefe0184dd3 3c88a9d02a1959f11bec008166dfe95d877f204690baa9a64e5282dcdfed76f4 Loading...

	humadecure.gq/landings/4/js/vendor.js	100 kB	2023-03-07	2023-03-08
Pretty URL humadecure.gq/landings/4/js/vendor.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:17:33 Last Seen2023-03-08 07:52:40 Times Seen1 Hash 8296ac8061647d1197f455cd91d60984 2a9856362d469e2000f3dd1ef667e3153b871119 d1121bd98cf3738bee66007c2a49359466de81a6ce49d5e6d4f62d33a58ae85d Loading...

	humadecure.gq/?s1=mqmq&s3=el	693 B	2023-03-07	2023-03-08
Pretty URL humadecure.gq/?s1=mqmq&s3=el IP 160.20.147.80 ASN #30823 combahton GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:17:33 Last Seen2023-03-08 07:52:40 Times Seen1 Hash a61c875301398f1117c614129281635e 60c888edf401226913803cab5438d0bfcbf9d7f8 94bb97adae4cdf18f9d6816f531ecf3f751af770f81936b84b71971f6c0fddc2 Loading...

HTTP Transactions (36)

URL IP Response Size

alexatracker.com/?r=aHR0cHM6Ly9kYXRlZXhvdGljLmNvbS9hZ0VBP3VzaWQ9OTJiajNncjExazImZW1haWw9aG9zc3IlNDBuY2JwaW5jLmNvbSZzdWIxPWNsZWFyJnByaWQ9OTJiajNncjExazI=&h=12a402c5a2cd10fb4f5a9aa5ab6a7847

104.21.85.99

301 Moved Permanently

0 B

URL HTTP/1.1
alexatracker.com/?r=aHR0cHM6Ly9kYXRlZXhvdGljLmNvbS9hZ0VBP3VzaWQ9OTJiajNncjExazImZW1haWw9aG9zc3IlNDBuY2JwaW5jLmNvbSZzdWIxPWNsZWFyJnByaWQ9OTJiajNncjExazI=&h=12a402c5a2cd10fb4f5a9aa5ab6a7847
IP
104.21.85.99:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /?r=aHR0cHM6Ly9kYXRlZXhvdGljLmNvbS9hZ0VBP3VzaWQ9OTJiajNncjExazImZW1haWw9aG9zc3IlNDBuY2JwaW5jLmNvbSZzdWIxPWNsZWFyJnByaWQ9OTJiajNncjExazI=&h=12a402c5a2cd10fb4f5a9aa5ab6a7847 HTTP/1.1
Host: alexatracker.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Thu, 06 Oct 2022 23:12:49 GMT
Content-Length: 0
Connection: keep-alive
Location: https://dateexotic.com/agEA?usid=92bj3gr11k2&email=hossr%40ncbpinc.com&sub1=clear&prid=92bj3gr11k2&tbsession=63565680854655217&c=572721652
Set-Cookie: trbarid=63565680854655217;expires=Sat, 05 Oct 2024 23:12:49 GMT;secure;HttpOnly;SameSite=None;path=/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pg5yEaj96LKbf3e6wSGK3azqwpYpU%2FrSTeriTrO73gj%2BbO8aqYZ1f7xxwfs6r%2F0%2B%2F8%2BMd%2B%2Fnc7t%2B1xNOQAD4i69iE3oMQOKbBOyxnGnJh203nhfKaLGjIEOKepmXb8PrOfzB"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75621587ff260afa-OSL
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/

54.230.111.7

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
54.230.111.7:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
2d12f67fe57a87e7366b662d153a5582
d7b02d81cc74f24a251d9363e0f4b0a149264ec1
73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-age=259200
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Wed, 05 Oct 2022 15:47:18 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: HMZVFzjsJ5lltBRHBLE4BMOEeX8Ffj0u22BibpVds6XENeQ_nydRdw==
Age: 113132

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
282f6e1328452c1cb41f6a6272fff757
20b9ff1b5f4f81b645769bd4b4cf7bf7dfc16262
6a8070ebe51259cb11db68cca2c81f3c7408fad481d8c14cc1c38912442c63f4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6A8070EBE51259CB11DB68CCA2C81F3C7408FAD481D8C14CC1C38912442C63F4"
Last-Modified: Wed, 05 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8787
Expires: Fri, 07 Oct 2022 01:39:17 GMT
Date: Thu, 06 Oct 2022 23:12:50 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
4ab7d8709d334de0e46dcb86aabfbff1
f221138a8ad9d0bfa3c054370dcdb363a67dc310
b91d37f606eaf448b9c7dfc05566a11de004ce44503409e1a776288ee2622805

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B91D37F606EAF448B9C7DFC05566A11DE004CE44503409E1A776288EE2622805"
Last-Modified: Wed, 05 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4644
Expires: Fri, 07 Oct 2022 00:30:14 GMT
Date: Thu, 06 Oct 2022 23:12:50 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: FQv/Ln2K9QI5VpSPjhOndAgHWCKaM9cCeWlhyDFIA0ly+8p+m2dZbOWCHBeBZo/DQxrtkG75iOs=
x-amz-request-id: 25XY1TEVYA45AMHX
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 06 Oct 2022 22:30:57 GMT
age: 2513
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 06 Oct 2022 23:12:50 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
276d788f82c699aa79f1e08eeb37f13e
203867e4ced38d98b07fdd19254ab68a8b31df1a
057197960cdecd9285240d0b8f7c58a9cd4266d573dae028cc42ea32f88bcb95

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "057197960CDECD9285240D0B8F7C58A9CD4266D573DAE028CC42EA32F88BCB95"
Last-Modified: Wed, 05 Oct 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19446
Expires: Fri, 07 Oct 2022 04:36:56 GMT
Date: Thu, 06 Oct 2022 23:12:50 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

54.230.111.7

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
54.230.111.7:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Expires, Backoff, ETag, Last-Modified, Pragma, Cache-Control, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Date: Thu, 06 Oct 2022 22:29:41 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Thu, 06 Oct 2022 23:08:21 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: JkWG9z-_tduIvMD1yZd5y_5Ipl9_eqWyplkim8fxZWf6m6YtpnG13A==
Age: 2589

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
8be5570b9a5ca76c580da007a824b029
38840f2ac6476bdd5608121c5653e338c7ad9715
0b94e05080ef85432b1815eb3c6c7594c9613cfde1b51eeabee46d0d9fde64b2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4995
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 06 Oct 2022 23:12:50 GMT
Last-Modified: Thu, 06 Oct 2022 21:49:35 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

34.216.192.228

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.216.192.228:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: ubhY673Jhene93SNgiURxA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: nkNNiFAIMuBrHhcVd5eXRxvAVHw=

146.190.228.148/gGsS7C?click_id=92bj3gr11k2

146.190.228.148

302 Found

0 B

URL HTTP/1.1
146.190.228.148/gGsS7C?click_id=92bj3gr11k2
IP
146.190.228.148:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /gGsS7C?click_id=92bj3gr11k2 HTTP/1.1
Host: 146.190.228.148
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Found
Server: nginx/1.20.1
Date: Thu, 06 Oct 2022 23:12:51 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0
Expires: 0
Last-Modified: Thu, 06 Oct 2022 23:12:51 GMT
Location: http://humadecure.gq?s1=mqmq&s3=el
Pragma: no-cache
Set-Cookie: _subid=376l60jr11lk;Expires=Sunday, 06-Nov-2022 23:12:51 GMT;Max-Age=2678400;Path=/
b15e4=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjE0NFwiOjE2NjUwOTc5NzF9LFwiY2FtcGFpZ25zXCI6e1wiNDJcIjoxNjY1MDk3OTcxfSxcInRpbWVcIjoxNjY1MDk3OTcxfSJ9.xWUXprRKydlQBuOe4v4vzbxfz_M-vsFJvqXYPPEWIW0;Expires=Saturday, 13-Jul-2075 22:25:42 GMT;Max-Age=1665184371;Path=/
Vary: Accept-Encoding
Access-Control-Allow-Origin: *

humadecure.gq/?s1=mqmq&s3=el

160.20.147.80

200 OK

4.6 kB

URL HTTP/1.1
humadecure.gq/?s1=mqmq&s3=el
IP
160.20.147.80:0
ASN
#30823 combahton GmbH

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text
Size
4.6 kB (4574 bytes)
Hash
5bd797a7adf6768b5c76c24266e4dadf
09d60104d188e79aaa4440cbc00065727408f149
4134b34db3dea0876629c50d3d48c40b44d1e3e2a01e8301392d49192597f010

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /?s1=mqmq&s3=el HTTP/1.1
Host: humadecure.gq
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Thu, 06 Oct 2022 23:12:51 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
set-cookie: XSRF-TOKEN=eyJpdiI6ImlWaHorYWtlV2JpczhxNkFObGt4MVE9PSIsInZhbHVlIjoiYncxVjQySFUwQTI2dGVXRzUyRkd5RDIwaUF0SWJhYTFGdmE5NmtRTnUrMG1ySzhNbEk2UEdiNW9kWnJjZnlkZSIsIm1hYyI6IjY4NTI5M2RkODk4YjY5NjQyM2RmMmFkMTk3Yjk1MzgxNDk3NmQwYjA5NDhmZDI2NWIzOWJkMjEwNDNhNzRiMmQifQ%3D%3D; expires=Fri, 07-Oct-2022 01:12:51 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IldRZXN3SDNBQmRyR01FeURGQmZBcWc9PSIsInZhbHVlIjoiWWVsQjJqUTJjV2VQdWFLK2dIcWlMeW5HbU8rTnVDMDhtd1BVcjNKdnRsQTA2c3h1Y2RDbUprMHFmU1FMb2s5UCIsIm1hYyI6IjY0Y2I5N2Q2OGY0YWJlYWUwYjNkYzY1OTRiMTAxN2FiNmRiZmE3ZTE4YzAwZDA1ZTJjYzkwNGZmMTc4MGY3Y2EifQ%3D%3D; expires=Fri, 07-Oct-2022 01:12:51 GMT; Max-Age=7200; path=/; httponly; samesite=lax
SRVNAME=w2; path=/

e1.o.lencr.org/

23.36.76.226

200 OK

345 B

URL HTTP/1.1
e1.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
345 B (345 bytes)
Hash
63b078fc3ce9baeb0f33acad40ef01e6
c0871cfccaa01855a859f43f0b0c394527fc1cbd
96432da0893447228b5872deb636fb959bdeed602276630ba8b10b429a9e015d

HTTP Headers

POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "96432DA0893447228B5872DEB636FB959BDEED602276630BA8B10B429A9E015D"
Last-Modified: Thu, 06 Oct 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19183
Expires: Fri, 07 Oct 2022 04:32:34 GMT
Date: Thu, 06 Oct 2022 23:12:51 GMT
Connection: keep-alive

humadecure.gq/landings/4/fonts/vendor.css

160.20.147.80

200 OK

8.7 kB

URL HTTP/1.1
humadecure.gq/landings/4/fonts/vendor.css
IP
160.20.147.80:0
ASN
#30823 combahton GmbH

File type
ASCII text, with very long lines (8748), with no line terminators
Size
8.7 kB (8748 bytes)
Hash
251585d08ad3eec2779bd11ae0eb946b
d02f90845c437bd6232e6faf7507f481466316b0
8c1d107a1d05e39d4f217263fc47883fe7d169ca18ff07b74c3a450c1e954b0b

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /landings/4/fonts/vendor.css HTTP/1.1
Host: humadecure.gq
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlWaHorYWtlV2JpczhxNkFObGt4MVE9PSIsInZhbHVlIjoiYncxVjQySFUwQTI2dGVXRzUyRkd5RDIwaUF0SWJhYTFGdmE5NmtRTnUrMG1ySzhNbEk2UEdiNW9kWnJjZnlkZSIsIm1hYyI6IjY4NTI5M2RkODk4YjY5NjQyM2RmMmFkMTk3Yjk1MzgxNDk3NmQwYjA5NDhmZDI2NWIzOWJkMjEwNDNhNzRiMmQifQ%3D%3D; laravel_session=eyJpdiI6IldRZXN3SDNBQmRyR01FeURGQmZBcWc9PSIsInZhbHVlIjoiWWVsQjJqUTJjV2VQdWFLK2dIcWlMeW5HbU8rTnVDMDhtd1BVcjNKdnRsQTA2c3h1Y2RDbUprMHFmU1FMb2s5UCIsIm1hYyI6IjY0Y2I5N2Q2OGY0YWJlYWUwYjNkYzY1OTRiMTAxN2FiNmRiZmE3ZTE4YzAwZDA1ZTJjYzkwNGZmMTc4MGY3Y2EifQ%3D%3D; SRVNAME=w2

HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Thu, 06 Oct 2022 23:12:51 GMT
Content-Type: text/css
Content-Length: 8748
Connection: keep-alive
last-modified: Fri, 29 Jul 2022 11:40:11 GMT
etag: "62e3c71b-222c"
accept-ranges: bytes

e1.o.lencr.org/

23.36.76.226

200 OK

345 B

URL HTTP/1.1
e1.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
345 B (345 bytes)
Hash
63b078fc3ce9baeb0f33acad40ef01e6
c0871cfccaa01855a859f43f0b0c394527fc1cbd
96432da0893447228b5872deb636fb959bdeed602276630ba8b10b429a9e015d

HTTP Headers

POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "96432DA0893447228B5872DEB636FB959BDEED602276630BA8B10B429A9E015D"
Last-Modified: Thu, 06 Oct 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19183
Expires: Fri, 07 Oct 2022 04:32:34 GMT
Date: Thu, 06 Oct 2022 23:12:51 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8787
Expires: Fri, 07 Oct 2022 01:39:18 GMT
Date: Thu, 06 Oct 2022 23:12:51 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8787
Expires: Fri, 07 Oct 2022 01:39:18 GMT
Date: Thu, 06 Oct 2022 23:12:51 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8787
Expires: Fri, 07 Oct 2022 01:39:18 GMT
Date: Thu, 06 Oct 2022 23:12:51 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
31e440ccd993c4ee793f50511c2ac7c4
4380327d50b7001d158aee05a57c6078e57c94e4
65d8a97f6df1e110333a01d1f6dcb4982db7bb4b1c5f3f1498fafa716e250c0f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "65D8A97F6DF1E110333A01D1F6DCB4982DB7BB4B1C5F3F1498FAFA716E250C0F"
Last-Modified: Thu, 06 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8787
Expires: Fri, 07 Oct 2022 01:39:18 GMT
Date: Thu, 06 Oct 2022 23:12:51 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7758caee-c969-46dd-96d0-b4402437781d.jpeg

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7758caee-c969-46dd-96d0-b4402437781d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8445 bytes)
Hash
4572451a09430ca7a9203f14ddc035ba
46e17c44fba23988d7a9d9832c411ba2810136c3
fa54e73c4b32d8e109504ebcd46e4316de8143f44b7eae20a44ba63d14a6f24b

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7758caee-c969-46dd-96d0-b4402437781d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8445
x-amzn-requestid: 7d295b3b-29d6-4b2e-8314-c9055d1def80
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Zmju5FxwoAMFeQw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633f4cc5-3f58c18b1159ad512c60422b;Sampled=0
x-amzn-remapped-date: Thu, 06 Oct 2022 21:46:45 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Miss from cloudfront
x-amz-cf-id: DC1ECXhkAhfdrU8ZyMhhDdwydsq4PQfzzGOPd-REjCkCsDbXQLnLiA==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 34c44cb7892e57a3b6c51812bcf68ee4.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 22:01:57 GMT
etag: "46e17c44fba23988d7a9d9832c411ba2810136c3"
content-type: image/jpeg
age: 4254
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F773e2560-6c32-4224-8404-2794a40799cd.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.6 kB (9564 bytes)
Hash
39cf77bd6009d3c538455b3846680278
ad0ed304e5173bdb8f08254c2e4a5032e8fcafa5
792997f1f9a485ca57d274c7899e4f526476bf15ed564a8b74d248c4458b188f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F773e2560-6c32-4224-8404-2794a40799cd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9564
x-amzn-requestid: 38d87e57-3600-4e0e-bd24-a8f857800bc6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZmhkGHtZIAMFz0w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633f494d-21b041d97b406dea36b9f35b;Sampled=0
x-amzn-remapped-date: Thu, 06 Oct 2022 21:31:57 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Hit from cloudfront
x-amz-cf-id: DNBjRFbLHdYGd4-klRgAiRXPCq2_uOMh5LGi9udoD1c0eSVXJ6h4xw==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 ca66331b52971370c4e54619e8a952cc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 21:44:18 GMT
age: 5313
etag: "ad0ed304e5173bdb8f08254c2e4a5032e8fcafa5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F03835263-33ef-46f3-bb24-467731afac81.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10979 bytes)
Hash
174bf241d8cb920a398e42d1c21b99d3
bdf4ef11beb8aa206ec122a38477bb594fa62a5f
261d039dbb733396b2519edb880fd1f1643339ea4654924c6bd665632bd6bc94

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F03835263-33ef-46f3-bb24-467731afac81.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10979
x-amzn-requestid: 435b7d65-fbff-4a71-ae57-ac5c30163d38
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZkY_zFDqoAMFUuA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633e6ecb-66db0baa3129a1d7135254be;Sampled=0
x-amzn-remapped-date: Thu, 06 Oct 2022 05:59:39 GMT
x-amz-cf-pop: SEA73-P2
x-cache: Miss from cloudfront
x-amz-cf-id: YWWurLLYtT2PWv0-SBjcte2VUmCEfYGqR9qJ-JIn0bDTpX0vtiBDmQ==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 95785220a566cd050f3ad80928463374.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 18:25:38 GMT
age: 17233
etag: "bdf4ef11beb8aa206ec122a38477bb594fa62a5f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd0135ba0-9033-445f-8155-a6c093862ccb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.0 kB (9046 bytes)
Hash
7e30ca5022768294665070cafc9d489c
c6ebf53c21206cfcf8e70279d3ae43f0170ade3a
6b834cdae692318a114c0d82ebff4fa8f4e65526983758e08ffb130d4d86020f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd0135ba0-9033-445f-8155-a6c093862ccb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9046
x-amzn-requestid: d560c8ba-6e81-46f7-a451-30c40fbfce6f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Zmhi_F7qIAMFkQg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633f4946-012e65d675558ec8544a1f30;Sampled=0
x-amzn-remapped-date: Thu, 06 Oct 2022 21:31:50 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Miss from cloudfront
x-amz-cf-id: a9tOPCySPRdXpvJf239ycM7_3PJS7GcITvM52Sxic_FwYr_-n2XQHA==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 de8fc80b494d3d381f7e006918dcc588.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 21:44:18 GMT
etag: "c6ebf53c21206cfcf8e70279d3ae43f0170ade3a"
content-type: image/jpeg
age: 5313
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7ee0abd8-4ecf-437c-9675-8f3d0154f2b9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.5 kB (6518 bytes)
Hash
7e1d0226194b6ccc5e2d460745b53fb4
715224d106cc3342482c53905322d6418421f6d2
0992c3232fd28edf9a9af56c2cc7f64f9ae53a2ec0cc4fb38c2cdb468a6a5791

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7ee0abd8-4ecf-437c-9675-8f3d0154f2b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6518
x-amzn-requestid: 2d3dc175-26a9-40a2-b629-0c8b533d5037
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZmhktGcloAMF0SA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633f4951-23e7e2852fe1f11c009d4c26;Sampled=0
x-amzn-remapped-date: Thu, 06 Oct 2022 21:32:01 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P2
x-cache: Miss from cloudfront
x-amz-cf-id: XZZtr9fG5zlx9W9TIX5zVjqvyZ5NEeSEPqtNUhwArlhBEIdcT5unpQ==
via: 1.1 fec77e486350d1bd33f526a760d8b5a4.cloudfront.net (CloudFront), 1.1 f62c9ca47e35df5c65764381977823a6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 22:01:47 GMT
etag: "715224d106cc3342482c53905322d6418421f6d2"
content-type: image/jpeg
age: 4264
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff362ea4b-2913-4401-9322-7a70f223e2a9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.2 kB (9160 bytes)
Hash
5cf80f9e9e5aabf650c561b5939acf1c
6a66ddb2c8c77cbd27101b8705a34492aa998b98
9aff5e0564805bbf83edb94b2d0462f76e09b5b67a39f3ab65aee66a24a192da

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff362ea4b-2913-4401-9322-7a70f223e2a9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9160
x-amzn-requestid: 3064ca86-5e0e-4bff-ad0c-6dcce9fa1404
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZmhkaGIGoAMFZzg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633f494f-06a55ad9421678605d12a4a6;Sampled=0
x-amzn-remapped-date: Thu, 06 Oct 2022 21:31:59 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Miss from cloudfront
x-amz-cf-id: 1uTAUuD8oF_Y8yRT9Fh30YuIJMN-iKXQiXwDfq7NgCnPeyM5pV9BKQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 27fe6f224e0cfa3f3a446471ee256e56.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 22:01:45 GMT
age: 4266
etag: "6a66ddb2c8c77cbd27101b8705a34492aa998b98"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

dateexotic.com/agEA?usid=92bj3gr11k2&email=hossr%40ncbpinc.com&sub1=clear&prid=92bj3gr11k2&tbsession=63565680854655217&c=572721652

216.119.156.49

302 Found

100 kB

URL HTTP/2
dateexotic.com/agEA?usid=92bj3gr11k2&email=hossr%40ncbpinc.com&sub1=clear&prid=92bj3gr11k2&tbsession=63565680854655217&c=572721652
IP
216.119.156.49:0
ASN
#46562 PERFORMIVE

File type
Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Size
100 kB (99744 bytes)
Hash
8296ac8061647d1197f455cd91d60984
2a9856362d469e2000f3dd1ef667e3153b871119
d1121bd98cf3738bee66007c2a49359466de81a6ce49d5e6d4f62d33a58ae85d

HTTP Headers

GET /agEA?usid=92bj3gr11k2&email=hossr%40ncbpinc.com&sub1=clear&prid=92bj3gr11k2&tbsession=63565680854655217&c=572721652 HTTP/1.1
Host: dateexotic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 302 Found
server: nginx/1.18.0 (Ubuntu)
date: Thu, 06 Oct 2022 23:12:50 GMT
content-type: text/html; charset=UTF-8
location: http://146.190.228.148/gGsS7C?click_id=92bj3gr11k2
set-cookie: trbarid=644073b586aa39db5035ea356fa81923920553ab11721fca2b0ef9a82c272358a%3A2%3A%7Bi%3A0%3Bs%3A7%3A%22trbarid%22%3Bi%3A1%3Bs%3A17%3A%2263565680854655217%22%3B%7D; expires=Thu, 10-Oct-2024 23:12:50 GMT; Max-Age=63504000; path=/; secure; HttpOnly; SameSite=None
tbar_uc1=b346519490446615b70b927b99dda6d9aecaef2690c2919cbcd695c810acf3f9a%3A2%3A%7Bi%3A0%3Bs%3A8%3A%22tbar_uc1%22%3Bi%3A1%3Bs%3A24%3A%22aG9zc3JAbmNicGluYy5jb20%3D%22%3B%7D; expires=Thu, 10-Oct-2024 23:12:50 GMT; Max-Age=63504000; path=/; secure; HttpOnly; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2

humadecure.gq/landings/4/img/bg-body.jpg

160.20.147.80

200 OK

8.2 kB

URL HTTP/1.1
humadecure.gq/landings/4/img/bg-body.jpg
IP
160.20.147.80:0
ASN
#30823 combahton GmbH

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 387x285, components 3\012- data
Size
8.2 kB (8178 bytes)
Hash
c05959294cd1f0bb7140c0f25757708c
94a78932e0a3d357519d248320e17666fed9f825
7b7d701f53a79ebc1e0d8e3c9f924c0eace4d2965794e471d009d8410582a05f

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /landings/4/img/bg-body.jpg HTTP/1.1
Host: humadecure.gq
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://humadecure.gq/landings/4/fonts/vendor.css
Cookie: XSRF-TOKEN=eyJpdiI6ImlWaHorYWtlV2JpczhxNkFObGt4MVE9PSIsInZhbHVlIjoiYncxVjQySFUwQTI2dGVXRzUyRkd5RDIwaUF0SWJhYTFGdmE5NmtRTnUrMG1ySzhNbEk2UEdiNW9kWnJjZnlkZSIsIm1hYyI6IjY4NTI5M2RkODk4YjY5NjQyM2RmMmFkMTk3Yjk1MzgxNDk3NmQwYjA5NDhmZDI2NWIzOWJkMjEwNDNhNzRiMmQifQ%3D%3D; laravel_session=eyJpdiI6IldRZXN3SDNBQmRyR01FeURGQmZBcWc9PSIsInZhbHVlIjoiWWVsQjJqUTJjV2VQdWFLK2dIcWlMeW5HbU8rTnVDMDhtd1BVcjNKdnRsQTA2c3h1Y2RDbUprMHFmU1FMb2s5UCIsIm1hYyI6IjY0Y2I5N2Q2OGY0YWJlYWUwYjNkYzY1OTRiMTAxN2FiNmRiZmE3ZTE4YzAwZDA1ZTJjYzkwNGZmMTc4MGY3Y2EifQ%3D%3D; SRVNAME=w2

HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Thu, 06 Oct 2022 23:12:52 GMT
Content-Type: image/jpeg
Content-Length: 8178
Connection: keep-alive
last-modified: Fri, 29 Jul 2022 11:40:11 GMT
etag: "62e3c71b-1ff2"
accept-ranges: bytes

humadecure.gq/landings/4/img/str-b.png

160.20.147.80

200 OK

339 B

URL HTTP/1.1
humadecure.gq/landings/4/img/str-b.png
IP
160.20.147.80:0
ASN
#30823 combahton GmbH

File type
PNG image data, 39 x 23, 8-bit colormap, non-interlaced\012- data
Size
339 B (339 bytes)
Hash
f7de895bd66937dc58c29949f5457186
41b3c452d2ee9ad6ae0815784e4a6368b67aa368
50d311a61f8213c9688c919882ab114bb9fd54249a19b414027db7a0351225ee

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /landings/4/img/str-b.png HTTP/1.1
Host: humadecure.gq
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://humadecure.gq/landings/4/fonts/vendor.css
Cookie: XSRF-TOKEN=eyJpdiI6ImlWaHorYWtlV2JpczhxNkFObGt4MVE9PSIsInZhbHVlIjoiYncxVjQySFUwQTI2dGVXRzUyRkd5RDIwaUF0SWJhYTFGdmE5NmtRTnUrMG1ySzhNbEk2UEdiNW9kWnJjZnlkZSIsIm1hYyI6IjY4NTI5M2RkODk4YjY5NjQyM2RmMmFkMTk3Yjk1MzgxNDk3NmQwYjA5NDhmZDI2NWIzOWJkMjEwNDNhNzRiMmQifQ%3D%3D; laravel_session=eyJpdiI6IldRZXN3SDNBQmRyR01FeURGQmZBcWc9PSIsInZhbHVlIjoiWWVsQjJqUTJjV2VQdWFLK2dIcWlMeW5HbU8rTnVDMDhtd1BVcjNKdnRsQTA2c3h1Y2RDbUprMHFmU1FMb2s5UCIsIm1hYyI6IjY0Y2I5N2Q2OGY0YWJlYWUwYjNkYzY1OTRiMTAxN2FiNmRiZmE3ZTE4YzAwZDA1ZTJjYzkwNGZmMTc4MGY3Y2EifQ%3D%3D; SRVNAME=w2

HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Thu, 06 Oct 2022 23:12:52 GMT
Content-Type: image/png
Content-Length: 339
Connection: keep-alive
last-modified: Fri, 29 Jul 2022 11:40:11 GMT
etag: "62e3c71b-153"
accept-ranges: bytes

humadecure.gq/landings/4/img/str-y.png

160.20.147.80

200 OK

338 B

URL HTTP/1.1
humadecure.gq/landings/4/img/str-y.png
IP
160.20.147.80:0
ASN
#30823 combahton GmbH

File type
PNG image data, 39 x 23, 8-bit colormap, non-interlaced\012- data
Size
338 B (338 bytes)
Hash
285dfc5c87a58e3a82c9ce42382c69af
ba124dcbf8bff0bafacc4d952f638c7235004b53
a07e51af75e047225bc68b472f3a6e898616d1b048791b73d453c5245c337655

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /landings/4/img/str-y.png HTTP/1.1
Host: humadecure.gq
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://humadecure.gq/landings/4/fonts/vendor.css
Cookie: XSRF-TOKEN=eyJpdiI6ImlWaHorYWtlV2JpczhxNkFObGt4MVE9PSIsInZhbHVlIjoiYncxVjQySFUwQTI2dGVXRzUyRkd5RDIwaUF0SWJhYTFGdmE5NmtRTnUrMG1ySzhNbEk2UEdiNW9kWnJjZnlkZSIsIm1hYyI6IjY4NTI5M2RkODk4YjY5NjQyM2RmMmFkMTk3Yjk1MzgxNDk3NmQwYjA5NDhmZDI2NWIzOWJkMjEwNDNhNzRiMmQifQ%3D%3D; laravel_session=eyJpdiI6IldRZXN3SDNBQmRyR01FeURGQmZBcWc9PSIsInZhbHVlIjoiWWVsQjJqUTJjV2VQdWFLK2dIcWlMeW5HbU8rTnVDMDhtd1BVcjNKdnRsQTA2c3h1Y2RDbUprMHFmU1FMb2s5UCIsIm1hYyI6IjY0Y2I5N2Q2OGY0YWJlYWUwYjNkYzY1OTRiMTAxN2FiNmRiZmE3ZTE4YzAwZDA1ZTJjYzkwNGZmMTc4MGY3Y2EifQ%3D%3D; SRVNAME=w2

HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Thu, 06 Oct 2022 23:12:52 GMT
Content-Type: image/png
Content-Length: 338
Connection: keep-alive
last-modified: Fri, 29 Jul 2022 11:40:11 GMT
etag: "62e3c71b-152"
accept-ranges: bytes

ocsp.globalsign.com/gseccovsslca2018

104.18.20.226

200 OK

938 B

URL HTTP/1.1
ocsp.globalsign.com/gseccovsslca2018
IP
104.18.20.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
938 B (938 bytes)
Hash
aa650f4b5b471d13bb54c8bc2aab54da
ddedea853f29daf06cd7f61d23ec6279964ce94b
bf8b08edb464b4fd2b759a97f752928a78944527284c3d3a7019a8d2ed64f864

HTTP Headers

POST /gseccovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 06 Oct 2022 23:12:52 GMT
Content-Type: application/ocsp-response
Content-Length: 938
Connection: keep-alive
Expires: Mon, 10 Oct 2022 22:30:46 GMT
ETag: "ddedea853f29daf06cd7f61d23ec6279964ce94b"
Last-Modified: Thu, 06 Oct 2022 22:30:47 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 813
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75621596afc30b4d-OSL

mc.yandex.ru/metrika/tag.js

87.250.250.119

200 OK

72 kB

URL HTTP/2
mc.yandex.ru/metrika/tag.js
IP
87.250.250.119:0
ASN
#13238 YANDEX LLC

File type
Unicode text, UTF-8 (with BOM) text, with very long lines (593)
Size
72 kB (72341 bytes)
Hash
7a68c8644032413981e4ba5bc0d66c4a
2d46ca8055e8577ae7138140e34a6e633434973c
e0573e9a9cbfc3f00a921fa64c50270f5941a1ebb253ab70af2cc0dac45cb0d5

HTTP Headers

GET /metrika/tag.js HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-length: 72341
date: Thu, 06 Oct 2022 23:12:52 GMT
access-control-allow-origin: *
etag: "633be002-11a95"
expires: Fri, 07 Oct 2022 00:12:52 GMT
last-modified: Tue, 04 Oct 2022 10:25:54 GMT
cache-control: max-age=3600
content-encoding: br
content-type: application/javascript
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

mc.yandex.ru/metrika/advert.gif

87.250.250.119

200 OK

43 B

URL HTTP/2
mc.yandex.ru/metrika/advert.gif
IP
87.250.250.119:0
ASN
#13238 YANDEX LLC

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

HTTP Headers

GET /metrika/advert.gif HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-length: 43
date: Thu, 06 Oct 2022 23:12:52 GMT
access-control-allow-origin: *
etag: "633be002-2b"
expires: Fri, 07 Oct 2022 00:12:52 GMT
accept-ranges: bytes
last-modified: Tue, 04 Oct 2022 10:25:54 GMT
cache-control: max-age=3600
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

mc.yandex.ru/watch/54239065?wmode=7&page-url=http%3A%2F%2Fhumadecure.gq%2F%3Fs1%3Dmqmq%26s3%3Del&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aat6op7b9z7b01ildsv2t4%3Afp%3A2146%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A304383873090%3Ahid%3A657369510%3Az%3A0%3Ai%3A20221006231252%3Aet%3A1665097972%3Ac%3A1%3Arn%3A1018959117%3Arqn%3A1%3Au%3A1665097972178752251%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A33%2C25%2C211%2C0%2C1324%2C0%2C%2C525%2C1%2C%2C%2C%2C2146%3Ans%3A1665097969846%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1665097973%3At%3ABetter%20than%20dating&t=gdpr(14)clc(0-0-0)aw(1)rqnt(1)fip(1)rqnl(1)ti(2)

87.250.250.119

302 Found

419 B

URL HTTP/2
mc.yandex.ru/watch/54239065?wmode=7&page-url=http%3A%2F%2Fhumadecure.gq%2F%3Fs1%3Dmqmq%26s3%3Del&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aat6op7b9z7b01ildsv2t4%3Afp%3A2146%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A304383873090%3Ahid%3A657369510%3Az%3A0%3Ai%3A20221006231252%3Aet%3A1665097972%3Ac%3A1%3Arn%3A1018959117%3Arqn%3A1%3Au%3A1665097972178752251%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A33%2C25%2C211%2C0%2C1324%2C0%2C%2C525%2C1%2C%2C%2C%2C2146%3Ans%3A1665097969846%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1665097973%3At%3ABetter%20than%20dating&t=gdpr(14)clc(0-0-0)aw(1)rqnt(1)fip(1)rqnl(1)ti(2)
IP
87.250.250.119:0
ASN
#13238 YANDEX LLC

File type
JSON data\012- , ASCII text, with very long lines (419), with no line terminators
Size
419 B (419 bytes)
Hash
23a82e935bd899b82e309730124ad427
7105e92c55f691d4a074c710448f4402d7d017a2
fa01b4712f71426735b8a28a1f92104f3f5f7545c91358ef22da7c3b0ebd1aaf

HTTP Headers

GET /watch/54239065?wmode=7&page-url=http%3A%2F%2Fhumadecure.gq%2F%3Fs1%3Dmqmq%26s3%3Del&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aat6op7b9z7b01ildsv2t4%3Afp%3A2146%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A304383873090%3Ahid%3A657369510%3Az%3A0%3Ai%3A20221006231252%3Aet%3A1665097972%3Ac%3A1%3Arn%3A1018959117%3Arqn%3A1%3Au%3A1665097972178752251%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A33%2C25%2C211%2C0%2C1324%2C0%2C%2C525%2C1%2C%2C%2C%2C2146%3Ans%3A1665097969846%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1665097973%3At%3ABetter%20than%20dating&t=gdpr(14)clc(0-0-0)aw(1)rqnt(1)fip(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://humadecure.gq
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 302 Found
location: /watch/54239065/1?wmode=7&page-url=http%3A%2F%2Fhumadecure.gq%2F%3Fs1%3Dmqmq%26s3%3Del&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Aat6op7b9z7b01ildsv2t4%3Afp%3A2146%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A304383873090%3Ahid%3A657369510%3Az%3A0%3Ai%3A20221006231252%3Aet%3A1665097972%3Ac%3A1%3Arn%3A1018959117%3Arqn%3A1%3Au%3A1665097972178752251%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A33%2C25%2C211%2C0%2C1324%2C0%2C%2C525%2C1%2C%2C%2C%2C2146%3Ans%3A1665097969846%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1665097973%3At%3ABetter%20than%20dating&t=gdpr%2814%29clc%280-0-0%29aw%281%29rqnt%281%29fip%281%29rqnl%281%29ti%282%29
date: Thu, 06 Oct 2022 23:12:52 GMT
access-control-allow-origin: http://humadecure.gq
set-cookie: yandexuid=4891595451665097972; Expires=Fri, 06-Oct-2023 23:12:52 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure
yuidss=4891595451665097972; Expires=Fri, 06-Oct-2023 23:12:52 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure
yabs-sid=1353872391665097972; Path=/; SameSite=None; Secure
i=M+z4zBpjR6vieo83iUb8PEFLw0wJYZufLFtq9YCggu+4p6jYD+JJte5s/aTYAuHj2lwcfJuI/oxVpOMKY/KdmJ63P0E=; Expires=Sun, 03-Oct-2032 23:12:49 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly; SameSite=None
ymex=1696633972.yrts.1665097972#1696633972.yrtsi.1665097972; Expires=Fri, 06-Oct-2023 23:12:52 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Thu, 06-Oct-2022 23:12:52 GMT
last-modified: Thu, 06-Oct-2022 23:12:52 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

mc.yandex.ru/watch/54239065/1?page-url=http%3A%2F%2Fhumadecure.gq%2F%3Fs1%3Dmqmq%26s3%3Del&charset=utf-8&hittoken=1665097972_093521a835902a1a2b405a8bd1c3ab160be25843050d2dfbcd58c4e59c215ede&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Aat6op7b9z7b01ildsv2t4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A304383873090%3Ahid%3A657369510%3Az%3A0%3Ai%3A20221006231252%3Aet%3A1665097973%3Ac%3A1%3Arn%3A117317981%3Arqn%3A2%3Au%3A1665097972178752251%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Apri%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C2664%2C2664%2C0%2C%3Ans%3A1665097969846%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1665097973&t=gdpr(14)mc(p-1)clc(0-0-0)aw(1)rqnt(2)rqnl(1)ti(2)

87.250.250.119

200 OK

43 B

URL HTTP/2
mc.yandex.ru/watch/54239065/1?page-url=http%3A%2F%2Fhumadecure.gq%2F%3Fs1%3Dmqmq%26s3%3Del&charset=utf-8&hittoken=1665097972_093521a835902a1a2b405a8bd1c3ab160be25843050d2dfbcd58c4e59c215ede&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Aat6op7b9z7b01ildsv2t4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A304383873090%3Ahid%3A657369510%3Az%3A0%3Ai%3A20221006231252%3Aet%3A1665097973%3Ac%3A1%3Arn%3A117317981%3Arqn%3A2%3Au%3A1665097972178752251%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Apri%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C2664%2C2664%2C0%2C%3Ans%3A1665097969846%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1665097973&t=gdpr(14)mc(p-1)clc(0-0-0)aw(1)rqnt(2)rqnl(1)ti(2)
IP
87.250.250.119:0
ASN
#13238 YANDEX LLC

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

HTTP Headers

POST /watch/54239065/1?page-url=http%3A%2F%2Fhumadecure.gq%2F%3Fs1%3Dmqmq%26s3%3Del&charset=utf-8&hittoken=1665097972_093521a835902a1a2b405a8bd1c3ab160be25843050d2dfbcd58c4e59c215ede&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Aat6op7b9z7b01ildsv2t4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A904%3Acn%3A1%3Adp%3A0%3Als%3A304383873090%3Ahid%3A657369510%3Az%3A0%3Ai%3A20221006231252%3Aet%3A1665097973%3Ac%3A1%3Arn%3A117317981%3Arqn%3A2%3Au%3A1665097972178752251%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Apri%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C2664%2C2664%2C0%2C%3Ans%3A1665097969846%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1665097973&t=gdpr(14)mc(p-1)clc(0-0-0)aw(1)rqnt(2)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
Origin: http://humadecure.gq
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
content-length: 43
date: Thu, 06 Oct 2022 23:12:52 GMT
access-control-allow-origin: http://humadecure.gq
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Thu, 06-Oct-2022 23:12:52 GMT
last-modified: Thu, 06-Oct-2022 23:12:52 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F38d969a0-82cd-4d27-8f25-f1b95cacc89f.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.3 kB (7261 bytes)
Hash
ed3fa86bbe319c9a2f81ff625e677cb0
e3d5210207f6ff922bc28e328285059c19a523a4
5919694bd942a4f25d5b7ffc3f8aee1af6cdb8461d4ba3dba9a2e72cf19164c8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F38d969a0-82cd-4d27-8f25-f1b95cacc89f.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
content-length: 7261
x-amzn-requestid: e1bdf299-b29e-4f58-9c8a-33f5dacdb081
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZmirBELYoAMFfgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633f4b13-1969b32c6f4f7e5749e7caa0;Sampled=0
x-amzn-remapped-date: Thu, 06 Oct 2022 21:39:31 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Hit from cloudfront
x-amz-cf-id: V3fTgH8URZ1iWMxWPy49--20mtdJvMK6XTG_aPKk68pvwCxPl8lULw==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 583992e175976bd59a21b4416890271e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 06 Oct 2022 21:44:18 GMT
age: 5320
etag: "e3d5210207f6ff922bc28e328285059c19a523a4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

svntrk.com/assets/mqmq_633f60f3610cb.js

104.21.82.62

200 OK

0 B

URL HTTP/2
svntrk.com/assets/mqmq_633f60f3610cb.js
IP
104.21.82.62:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /assets/mqmq_633f60f3610cb.js HTTP/1.1
Host: svntrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Thu, 06 Oct 2022 23:12:51 GMT
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: BYPASS
set-cookie: svnimp=633f60f3aa06c; path=/; secure; httponly; samesite=none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GutHOJuV6Fzc%2B93YYlmpAXn4v0yvUwAYKTxgo%2BIDFLB92fgxP8d1CxjFVrIkWZLbJbZM2S8s%2FVZObWrQ7xbEtkUWAifd7t0aR3dMj3zTiIl0zNcsfJs0EVs%2FXlWq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 756215922b2d0afe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (36)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size