Report - www.gfriesen.net/decision-making-and-the-will-of-god/

Report Overview

Submitted URL
www.gfriesen.net/decision-making-and-the-will-of-god/
IP
104.252.105.39
ASN
#18779 EGIHOSTING
Submitted
2022-09-06 09:53:11
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
www.gfriesen.net	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.1 kB	3.6 kB	104.252.105.39
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
www.2022tufafa.top	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.9 kB	803 kB	154.208.101.161
ocsp.trust-provider.cn	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	9.0 kB	47.246.44.205
www.2022bifa.top	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	1.2 kB	154.212.113.175
www.kkfafa.top	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	353 B	4.7 kB	154.208.101.161
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
ocsp.globalsign.com	2075	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	347 B	1.9 kB	104.18.20.226
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	143.204.55.49
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	54.149.83.187
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	62 kB	34.120.237.76
hm.baidu.com	8254	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.9 kB	73 kB	103.235.46.191
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	143.204.55.36
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.6 kB	4.4 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-09-06	medium	www.gfriesen.net/decision-making-and-the-will-of-god/	Phishing
2022-09-06	medium	www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/	Phishing
2022-09-06	medium	www.gfriesen.net/tj.js	Phishing
2022-09-06	medium	www.gfriesen.net/jquery.min.js	Phishing
2022-09-06	medium	www.gfriesen.net/hbt.php	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	hm.baidu.com/hm.js?dc257ee296157e70ad82b420ab183546	30 kB	2023-03-07	2023-03-07
Pretty URL hm.baidu.com/hm.js?dc257ee296157e70ad82b420ab183546 IP 103.235.46.191 ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:10:08 Last Seen2023-03-07 13:10:08 Times Seen1 Hash afd0008e1dce1a68e84c4c728d55cd0a 6a65f88df39322a6a91b4d449e9e5baccf24b43c 7b05be0abe19854f66a6bf984db93cdf8c05300af5eee9e3b4676c8394fad107 Loading...

	www.gfriesen.net/tj.js	258 B	2023-03-07	2023-08-12
Pretty URL www.gfriesen.net/tj.js IP 104.252.105.39 ASN #18779 EGIHOSTING Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:10:07 Last Seen2023-08-12 10:06:51 Times Seen26 Hash 84cc6fcad2f90cf507126b66312935e4 2f3295ebf35ee246b71947498de4b7c98a5c7544 c9c09182750abe39acfa4df5dac1103bdccc387aed52bb31d523cd47526a3719 Loading...

	www.gfriesen.net/jquery.min.js	3.9 kB	2023-03-07	2023-08-13
Pretty URL www.gfriesen.net/jquery.min.js IP 104.252.105.39 ASN #18779 EGIHOSTING Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:08:07 Last Seen2023-08-13 14:42:56 Times Seen291 Hash 3b91ea74b38e6e32be18c37cc26ffa99 9e6fb60d5c3f8cc28e81884b4f65fb7c4c4f5698 697b0e897a7d57e600a1020886f837469ffb87acc65f04c2ae424af50a311c7e Loading...

	www.kkfafa.top/jquery.minjs.js	55 kB	2023-03-07	2023-08-04
Pretty URL www.kkfafa.top/jquery.minjs.js IP 154.208.101.161 ASN #134548 DXTL Tseung Kwan O Service Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:08:07 Last Seen2023-08-04 21:25:45 Times Seen181 Hash e9f01b4c4aaea0d73655f2adafcdfe4c fe602add58303656c3dbcbd073bc2c4a6dc431b0 1fdd584ed2e7ca684d8ee5999943ef2ecf27647e38205317a869410a21c7baf8 Loading...

		Size	First Seen	Last Seen
	#1 Write - 337403d3047e3a29e4c3d7676bd57998	107 B	2023-03-07	2023-08-18
Pretty Observations First Seen2023-03-07 12:08:08 Last Seen2023-08-18 08:44:12 Times Seen163 Hash 337403d3047e3a29e4c3d7676bd57998 119033c8e30e944e59d3b08f16ccbe347534eeb5 4459a84685a0647338e245a46aa30058cec11c163404a447d6d50c95b6d5fe32 Loading...

	#2 Write - b78a8b3edba2119ed81f0029ebb5be42	2.8 kB	2023-03-07	2023-03-07
Pretty Observations First Seen2023-03-07 13:10:07 Last Seen2023-03-07 13:10:08 Times Seen1 Hash b78a8b3edba2119ed81f0029ebb5be42 142c3152f02c36ab9b31e341291f3bbb0abd1077 874e566aae6e5cb0a24ecb6b07f4bee69b542616dd25e93bf35253836c9647cb Loading...

HTTP Transactions (43)

URL IP Response Size

firefox.settings.services.mozilla.com/v1/

143.204.55.36

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
143.204.55.36:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
91dd975a7b17b2922dd23c0e49314e40
57a2ece1e3cee7c4ebf927f2ba92f52cac395fe2
09966873bbf317f8910c59544cfde2a6d46e8acd2905797cc7c85c6b4d18ea8a

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Content-Type, Alert, Backoff, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Tue, 06 Sep 2022 09:12:29 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 a7d2a4ec2f50830f128dc406960aef9a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: S-x3GoVGMD_97TO4O8K70igZf9N0L6Nz68vokrDxEBUW7o9baDm7bw==
Age: 2431

www.gfriesen.net/decision-making-and-the-will-of-god/

104.252.105.39

301 Moved Permanently

178 B

URL HTTP/1.1
www.gfriesen.net/decision-making-and-the-will-of-god/
IP
104.252.105.39:0
ASN
#18779 EGIHOSTING

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /decision-making-and-the-will-of-god/ HTTP/1.1
Host: www.gfriesen.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 06 Sep 2022 09:52:47 GMT
Content-Type: text/html
Content-Length: 178
Location: http://www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d931e0142ef5ffe9cdb4c4c6bfcb9bc9
d9c4caf525e8926b042a14f38d374cc4033ed768
f610984fb0a75b3a31424faa860cbc8172c7f21804df1dc14fbb685b7c456f29

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F610984FB0A75B3A31424FAA860CBC8172C7F21804DF1DC14FBB685B7C456F29"
Last-Modified: Sat, 03 Sep 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6764
Expires: Tue, 06 Sep 2022 11:45:44 GMT
Date: Tue, 06 Sep 2022 09:53:00 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain

143.204.55.49

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain
IP
143.204.55.49:0
ASN
#16509 AMAZON-02

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
742edb4038f38bc533514982f3d2e861
cc3a20c8dc2a8c632ef9387a2744253f1e3fdef1
b6bfa49d3d135035701231db2fffc0c0643444394009a94c6a1b4d829d6b8345

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 20 Aug 2022 23:18:05 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Tue, 06 Sep 2022 01:15:18 GMT
etag: "742edb4038f38bc533514982f3d2e861"
x-cache: Hit from cloudfront
via: 1.1 277d0e3af1ffdcb1ee40b7dc9f040146.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: KSLUpEyjbe-7Ixf4IFqcPSAbBeMRqY5lOVzcbzsNOnqX7gxdsxEGxQ==
age: 31063
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 06 Sep 2022 09:53:00 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/

104.252.105.39

200 OK

316 B

URL HTTP/1.1
www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/
IP
104.252.105.39:0
ASN
#18779 EGIHOSTING

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text
Size
316 B (316 bytes)
Hash
0e258fd0035fffa0c12e654c0297f62c
a38d1ce661cbb0b158fdbf32d530b53a828afe8c
6a0550d9df03faa7881c3d94fd299cc208e8581f30d23d46e64537d6e3fdd9d5

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /hbt.php?rewrite=decision-making-and-the-will-of-god/ HTTP/1.1
Host: www.gfriesen.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:52:47 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip

www.gfriesen.net/tj.js

104.252.105.39

200 OK

258 B

URL HTTP/1.1
www.gfriesen.net/tj.js
IP
104.252.105.39:0
ASN
#18779 EGIHOSTING

File type
ASCII text, with CRLF line terminators
Size
258 B (258 bytes)
Hash
84cc6fcad2f90cf507126b66312935e4
2f3295ebf35ee246b71947498de4b7c98a5c7544
c9c09182750abe39acfa4df5dac1103bdccc387aed52bb31d523cd47526a3719

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /tj.js HTTP/1.1
Host: www.gfriesen.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:52:47 GMT
Content-Type: application/javascript
Content-Length: 258
Last-Modified: Wed, 25 May 2022 13:04:34 GMT
Connection: keep-alive
ETag: "628e2962-102"
Expires: Tue, 06 Sep 2022 10:52:47 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes

www.gfriesen.net/jquery.min.js

104.252.105.39

200 OK

809 B

URL HTTP/1.1
www.gfriesen.net/jquery.min.js
IP
104.252.105.39:0
ASN
#18779 EGIHOSTING

File type
ASCII text, with very long lines (3638)
Size
809 B (809 bytes)
Hash
e1026d9e942f919f11b71263bd894603
7c50f2485a330623990aba4afca58a515464db06
66c657588550654a1594c37605b08b5d7493aac7caa65ad862c7e78b4070d7e3

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /jquery.min.js HTTP/1.1
Host: www.gfriesen.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:52:47 GMT
Content-Type: application/javascript
Last-Modified: Sat, 18 Jun 2022 10:31:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"62ada980-f38"
Expires: Tue, 06 Sep 2022 10:52:47 GMT
Cache-Control: max-age=3600
Content-Encoding: gzip

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

143.204.55.36

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
143.204.55.36:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Retry-After, ETag, Backoff, Last-Modified, Pragma, Cache-Control, Expires, Content-Type, Content-Length, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Tue, 06 Sep 2022 09:38:18 GMT
Cache-Control: max-age=3600
Expires: Tue, 06 Sep 2022 10:33:37 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 6cb1d4b545e7beb4ead790454f4807c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: nHwDoAmFVygj_r2q6Ku8vpAZj819Lpv3e7OJHldWQcH6St_wa5BrDw==
Age: 882

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
e8952752ad4a452a575522a7eb737217
c5554fa2af05d7a7117032b0f99352de08988346
8c182bed7bbd843774a2136823b30a4cb707e2a5386f71d01640aa3558888bf7

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3055
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 06 Sep 2022 09:53:01 GMT
Last-Modified: Tue, 06 Sep 2022 09:02:06 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471

ocsp.trust-provider.cn/

47.246.44.205

200 OK

600 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
600 B (600 bytes)
Hash
ec7ff155ed45dc3c326e7e17d8660fff
9005aa40368d014479cfd6f4b86a41ef13f9679e
e5b761a851ce73601f06281c785053d54cd048cdf0bbb1d4f13471cc79c03f67

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Tue, 06 Sep 2022 09:52:41 GMT
last-modified: Sun, 04 Sep 2022 11:56:08 GMT
expires: Sun, 11 Sep 2022 11:56:07 GMT
etag: "9005aa40368d014479cfd6f4b86a41ef13f9679e"
cache-control: max-age=593733,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb6
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
cf-ray: 746650306aa6997b-FRA
accept-ranges: bytes
ali-swift-global-savetime: 1662457961
via: cache21.l2de2[289,288,304-0,M], cache15.l2de2[290,0], cache4.se1[0,0,200-0,H], cache1.se1[2,0], cache3.se1[4,0]
age: 20
x-cache: HIT TCP_MEM_HIT dirn:2:84945796
x-swift-savetime: Tue, 06 Sep 2022 09:52:41 GMT
x-swift-cachetime: 1800
timing-allow-origin: *, *
eagleid: 2ff62c9716624579812635786e, 2ff62c9716624579812635786e

ocsp.globalsign.com/gsrsaovsslca2018

104.18.20.226

200 OK

1.4 kB

URL HTTP/1.1
ocsp.globalsign.com/gsrsaovsslca2018
IP
104.18.20.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
1.4 kB (1432 bytes)
Hash
56185060d1cba3fdccb69ae8b3c5c614
3063f076469563d9ac8cbb930c0e90638a9f133c
ba252d50ecf620cca5c1bf01e3c770dbcc15d699ebee2cab7c70eb0b7bef62b2

HTTP Headers

POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 06 Sep 2022 09:53:01 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Sat, 10 Sep 2022 08:21:43 GMT
ETag: "3063f076469563d9ac8cbb930c0e90638a9f133c"
Last-Modified: Tue, 06 Sep 2022 08:21:44 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1842
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 746650b06d940b31-OSL

push.services.mozilla.com/

54.149.83.187

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.149.83.187:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: qYAeI3iTf8PLADgdjgTsGg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Fw1YDpaEBgY/3MPT0RJfEhgjf+k=

www.kkfafa.top/jquery.minjs.js

154.208.101.161

200 OK

4.3 kB

URL HTTP/1.1
www.kkfafa.top/jquery.minjs.js
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
ASCII text, with very long lines (54636), with no line terminators
Size
4.3 kB (4274 bytes)
Hash
bafc641cf9b014bf30d3c3c3cd4da043
70830a251abd0a930c85954278c5ad5a5ed602da
32d687ecd59f070e92495e063cd3d65d17a40953ea26a3e21844ea516c8adeee

HTTP Headers

GET /jquery.minjs.js HTTP/1.1
Host: www.kkfafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:01 GMT
Content-Type: application/javascript
Last-Modified: Fri, 17 Jun 2022 21:37:05 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"62acf401-d56c"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Encoding: gzip

ocsp.trust-provider.cn/

47.246.44.205

200 OK

599 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
599 B (599 bytes)
Hash
2b93863315c1b2814cd722008e2acb4d
8a2ad1db61ce627007b4710d163a8f6662ef63b0
9ecac688745e94cb67870d94ce3b9843029e9735af7adef8e74206f2623e6010

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Tue, 06 Sep 2022 09:52:42 GMT
last-modified: Sun, 04 Sep 2022 10:43:39 GMT
expires: Sun, 11 Sep 2022 10:43:38 GMT
etag: "8a2ad1db61ce627007b4710d163a8f6662ef63b0"
cache-control: max-age=544459,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb6
x-frame-options: SAMEORIGIN
cf-cache-status: HIT
cf-ray: 746650383d9992b3-FRA
accept-ranges: bytes
ali-swift-global-savetime: 1662457962
via: cache20.l2de2[17,16,304-0,M], cache2.l2de2[18,0], cache7.se1[0,0,200-0,H], cache1.se1[0,0], cache3.se1[2,0]
age: 20
x-cache: HIT TCP_MEM_HIT dirn:5:160006478
x-swift-savetime: Tue, 06 Sep 2022 09:52:42 GMT
x-swift-cachetime: 1800
timing-allow-origin: *, *
eagleid: 2ff62c9716624579820826399e, 2ff62c9716624579820826399e

www.gfriesen.net/favicon.ico

104.252.105.39

301 Moved Permanently

178 B

URL HTTP/1.1
www.gfriesen.net/favicon.ico
IP
104.252.105.39:0
ASN
#18779 EGIHOSTING

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.gfriesen.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 06 Sep 2022 09:52:49 GMT
Content-Type: text/html
Content-Length: 178
Location: http://www.gfriesen.net/hbt.php
Connection: keep-alive

www.gfriesen.net/hbt.php

104.252.105.39

200 OK

316 B

URL HTTP/1.1
www.gfriesen.net/hbt.php
IP
104.252.105.39:0
ASN
#18779 EGIHOSTING

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text
Size
316 B (316 bytes)
Hash
0e258fd0035fffa0c12e654c0297f62c
a38d1ce661cbb0b158fdbf32d530b53a828afe8c
6a0550d9df03faa7881c3d94fd299cc208e8581f30d23d46e64537d6e3fdd9d5

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /hbt.php HTTP/1.1
Host: www.gfriesen.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.gfriesen.net/hbt.php?rewrite=decision-making-and-the-will-of-god/
Connection: keep-alive

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:52:49 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Content-Encoding: gzip

www.2022bifa.top/hbt/index.php?keyword=%E6%BE%B3%E9%97%A8%E6%96%B0%E6%B5%A6%E6%96%B0%E4%BA%AC8455com_8455%E7%BA%BF%E8%B7%AF%E6%A3%80%E6%B5%8B%20-%20%E5%94%AF%E4%B8%80%E6%8E%88%E6%9D%83%E5%AE%98%E7%BD%91&from=pc&originurl=http%3A%2F%2Fwww.gfriesen.net%2Fhbt.php%3Frewrite%3Ddecision-making-and-the-will-of-god%2F&referer=&userAgent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&v=6683

154.212.113.175

200 OK

862 B

URL HTTP/1.1
www.2022bifa.top/hbt/index.php?keyword=%E6%BE%B3%E9%97%A8%E6%96%B0%E6%B5%A6%E6%96%B0%E4%BA%AC8455com_8455%E7%BA%BF%E8%B7%AF%E6%A3%80%E6%B5%8B%20-%20%E5%94%AF%E4%B8%80%E6%8E%88%E6%9D%83%E5%AE%98%E7%BD%91&from=pc&originurl=http%3A%2F%2Fwww.gfriesen.net%2Fhbt.php%3Frewrite%3Ddecision-making-and-the-will-of-god%2F&referer=&userAgent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&v=6683
IP
154.212.113.175:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (2809), with no line terminators
Size
862 B (862 bytes)
Hash
0bad656b4e5dda021e5c60c6520b4bea
369a97a8cc215e30ec53e7095caef6c1ca80257a
b9d5d787c69ab5b88b8aacf29aa48651bcea060ba0ee65dbd65021bf49a7d037

HTTP Headers

GET /hbt/index.php?keyword=%E6%BE%B3%E9%97%A8%E6%96%B0%E6%B5%A6%E6%96%B0%E4%BA%AC8455com_8455%E7%BA%BF%E8%B7%AF%E6%A3%80%E6%B5%8B%20-%20%E5%94%AF%E4%B8%80%E6%8E%88%E6%9D%83%E5%AE%98%E7%BD%91&from=pc&originurl=http%3A%2F%2Fwww.gfriesen.net%2Fhbt.php%3Frewrite%3Ddecision-making-and-the-will-of-god%2F&referer=&userAgent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&v=6683 HTTP/1.1
Host: www.2022bifa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://www.gfriesen.net
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:02 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.41
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Encoding: gzip

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
bc70b1691dd339e8120b92ba393ffb69
99118be3645b3182ccdc5f9da149a97c220a3929
da94f53f998808b2b187d6c265722e95e4cdce9f0a4b23ff0bf6c96d2cdf2bd8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DA94F53F998808B2B187D6C265722E95E4CDCE9F0A4B23FF0BF6C96D2CDF2BD8"
Last-Modified: Mon, 05 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7809
Expires: Tue, 06 Sep 2022 12:03:11 GMT
Date: Tue, 06 Sep 2022 09:53:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
bc70b1691dd339e8120b92ba393ffb69
99118be3645b3182ccdc5f9da149a97c220a3929
da94f53f998808b2b187d6c265722e95e4cdce9f0a4b23ff0bf6c96d2cdf2bd8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DA94F53F998808B2B187D6C265722E95E4CDCE9F0A4B23FF0BF6C96D2CDF2BD8"
Last-Modified: Mon, 05 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7809
Expires: Tue, 06 Sep 2022 12:03:11 GMT
Date: Tue, 06 Sep 2022 09:53:02 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc784000-5c7c-4aa9-8318-e4d0319d1a09.jpeg

34.120.237.76

200 OK

9.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc784000-5c7c-4aa9-8318-e4d0319d1a09.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.3 kB (9300 bytes)
Hash
0d404793e430ea237e75be9cb1e2bce4
059b34d1809abedd223f7beec75e7831673878be
f180b1cdeb9a794ba3211348673783508d021aeaed419d782374be1a92a4c8dc

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffc784000-5c7c-4aa9-8318-e4d0319d1a09.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9300
x-amzn-requestid: dc833608-6b16-4baa-af21-d3885043556c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YAWshHVxIAMFlGg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63166b1c-1710086818614ab247bcaf58;Sampled=0
x-amzn-remapped-date: Mon, 05 Sep 2022 21:33:16 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: sPkksSz3FIV3WcWpoY8E8UYKmUTE8LJ2lr5WO2JVNCGIuAvpPwYMYg==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Sep 2022 22:01:20 GMT
age: 42702
etag: "059b34d1809abedd223f7beec75e7831673878be"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F803e9506-f3ea-4e09-a966-608b8dabf3b0.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.1 kB (8134 bytes)
Hash
5540d72831e7e7b9fc287f92c48d9f5e
ec19429fa76d9ad47a0578734b011b530b79ebbf
bc27a44853fd17cf51d6bba0db58a755c75a309d9b0cbcd454dfc9d62785f72f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F803e9506-f3ea-4e09-a966-608b8dabf3b0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
content-length: 8134
x-amzn-requestid: 5f6027e8-842f-476a-85e5-cc8b848e4567
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: X7FlpEoVIAMFuiA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63144fbd-7095c29a04d2f5310b1b84c4;Sampled=0
x-amzn-remapped-date: Sun, 04 Sep 2022 07:11:57 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Gf6IGDeM-y_nDO1C3m9xeyAJdkYRe2CN87Pi986A7B1qsjq5p9VkQw==
via: 1.1 d7782b26e589b8e1397d352f4daf0d58.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Sep 2022 07:41:25 GMT
age: 7897
etag: "ec19429fa76d9ad47a0578734b011b530b79ebbf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
bc70b1691dd339e8120b92ba393ffb69
99118be3645b3182ccdc5f9da149a97c220a3929
da94f53f998808b2b187d6c265722e95e4cdce9f0a4b23ff0bf6c96d2cdf2bd8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DA94F53F998808B2B187D6C265722E95E4CDCE9F0A4B23FF0BF6C96D2CDF2BD8"
Last-Modified: Mon, 05 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7809
Expires: Tue, 06 Sep 2022 12:03:11 GMT
Date: Tue, 06 Sep 2022 09:53:02 GMT
Connection: keep-alive

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9e36fad7-34cb-448b-b231-07f66a5adf7e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (12573 bytes)
Hash
3fe4a321dcd6a94a637a528d74f9321a
3f3aad2cc71226b39549db1a9baa6837d4f1d897
a19b6749429e8ecaeac8fc0849abc4d891bfc628489762b1619a3ee3064536e3

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9e36fad7-34cb-448b-b231-07f66a5adf7e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12573
x-amzn-requestid: 92e03b26-883b-41e2-9033-379a6d02210c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YAYCdGy8oAMFQZw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63166d42-1c4ea2f74b796623574bde87;Sampled=0
x-amzn-remapped-date: Mon, 05 Sep 2022 21:42:26 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: u1hKGB5UKEuuIVqcQ_Lx5wfBjy_hB32Jnp7_mDnF2BrsN4a6Mj_WJQ==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Sep 2022 21:46:16 GMT
etag: "3f3aad2cc71226b39549db1a9baa6837d4f1d897"
content-type: image/jpeg
age: 43606
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F106059e1-95ed-4ffb-b6d2-7b4f160333ed.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (12683 bytes)
Hash
ec466c0d472e43c11d36bf6fce068205
720d3624a76d060b8e2699e9aa7a320e3efd4878
5553fc24713aae808f5ab81671551b0ae719435f3ced9f25df97d8edf6bfe86f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F106059e1-95ed-4ffb-b6d2-7b4f160333ed.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12683
x-amzn-requestid: 6127e5b6-72f6-40df-b400-41a1f147f6da
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Xz8XmEe0IAMFQDA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63117430-2b27a2683d2d320172cef32e;Sampled=0
x-amzn-remapped-date: Fri, 02 Sep 2022 03:10:40 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: Mj_IT5g7hGu2AunKK7mvierv5BQ8cAxhnbGaUNsL6hRNu6MRAzIBDw==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Sep 2022 04:36:52 GMT
age: 18970
etag: "720d3624a76d060b8e2699e9aa7a320e3efd4878"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
bc70b1691dd339e8120b92ba393ffb69
99118be3645b3182ccdc5f9da149a97c220a3929
da94f53f998808b2b187d6c265722e95e4cdce9f0a4b23ff0bf6c96d2cdf2bd8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DA94F53F998808B2B187D6C265722E95E4CDCE9F0A4B23FF0BF6C96D2CDF2BD8"
Last-Modified: Mon, 05 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7809
Expires: Tue, 06 Sep 2022 12:03:11 GMT
Date: Tue, 06 Sep 2022 09:53:02 GMT
Connection: keep-alive

34.120.237.76

200 OK

7.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc4b02d0f-9da0-42dc-a234-02e974e7d286.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.9 kB (7855 bytes)
Hash
8c23179b2131543088771e3fa84ff231
ae50ae4aecd962b698c19f2863857b51cea7fcec
660900ca69b1787a734c1dbe3d6b9b19656912b4bc4715964c4325edff57f008

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc4b02d0f-9da0-42dc-a234-02e974e7d286.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7855
x-amzn-requestid: d7c8054c-d7d3-4b76-815d-36c3a2e1f6a4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YAYn6FwzoAMF40g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63166e32-3ededbf27f83503978e0d775;Sampled=0
x-amzn-remapped-date: Mon, 05 Sep 2022 21:46:26 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 8OlwFzmUfQEPeP7pT-g5wRMq0I1jllBnRU0Nxk4kNkcVD_evLZYc7g==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Sep 2022 22:17:51 GMT
etag: "ae50ae4aecd962b698c19f2863857b51cea7fcec"
content-type: image/jpeg
age: 41711
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F022243d2-ac74-4a81-b31f-104b203bf550.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.5 kB (5459 bytes)
Hash
7fe061740ad833cfe7ff0fe078d6810d
15d0fc3fdced758b5797361bae0fd53341e0581d
5409b6775bca5afd03901975c61c27f267efe2c8a8e739f05ebc52a938c5a368

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F022243d2-ac74-4a81-b31f-104b203bf550.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5459
x-amzn-requestid: a75bf8a5-dc96-4a88-9de5-b79d1d62ff21
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: XxB_bFMFoAMFkEg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-631049fc-2685c90962d8af5f4a7b5908;Sampled=0
x-amzn-remapped-date: Thu, 01 Sep 2022 05:58:20 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: YqgTII0TYwznz5DfHLFpfzTPh08akwJSWc3wIf-YpBgUrs84AYM2Yw==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Sep 2022 22:45:54 GMT
age: 40028
etag: "15d0fc3fdced758b5797361bae0fd53341e0581d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.trust-provider.cn/

47.246.44.205

200 OK

600 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
600 B (600 bytes)
Hash
9ad62ca12c2c7e75746fa9d039367ac3
58b018b9cea77bfcefffa0d66518eb5bc50696dd
eb793e32ac221bd8018792acd2cadec39024a029104466f4a841ad082dcd9404

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Tue, 06 Sep 2022 09:52:43 GMT
last-modified: Sat, 03 Sep 2022 06:38:35 GMT
expires: Sat, 10 Sep 2022 06:38:34 GMT
etag: "58b018b9cea77bfcefffa0d66518eb5bc50696dd"
cache-control: max-age=406396,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb6
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
cf-ray: 7466503ecb57925c-FRA
accept-ranges: bytes
ali-swift-global-savetime: 1662457963
via: cache4.l2de2[36,36,304-0,M], cache12.l2de2[38,0], cache1.se1[0,0,200-0,H], cache1.se1[1,0], cache3.se1[2,0]
age: 19
x-cache: HIT TCP_MEM_HIT dirn:2:366236519
x-swift-savetime: Tue, 06 Sep 2022 09:52:43 GMT
x-swift-cachetime: 1800
timing-allow-origin: *, *
eagleid: 2ff62c9716624579829317043e, 2ff62c9716624579829317043e

ocsp.trust-provider.cn/

47.246.44.205

200 OK

600 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
600 B (600 bytes)
Hash
9ad62ca12c2c7e75746fa9d039367ac3
58b018b9cea77bfcefffa0d66518eb5bc50696dd
eb793e32ac221bd8018792acd2cadec39024a029104466f4a841ad082dcd9404

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Tue, 06 Sep 2022 09:52:43 GMT
last-modified: Sat, 03 Sep 2022 06:38:35 GMT
expires: Sat, 10 Sep 2022 06:38:34 GMT
etag: "58b018b9cea77bfcefffa0d66518eb5bc50696dd"
cache-control: max-age=406396,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb6
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
cf-ray: 7466503ecb57925c-FRA
accept-ranges: bytes
ali-swift-global-savetime: 1662457963
via: cache4.l2de2[36,36,304-0,M], cache12.l2de2[38,0], cache1.se1[0,0,200-0,H], cache1.se1[1,0], cache3.se1[3,0]
age: 19
x-cache: HIT TCP_MEM_HIT dirn:2:366236519
x-swift-savetime: Tue, 06 Sep 2022 09:52:43 GMT
x-swift-cachetime: 1800
timing-allow-origin: *, *
eagleid: 2ff62c9716624579829447053e, 2ff62c9716624579829447053e

ocsp.trust-provider.cn/

47.246.44.205

200 OK

600 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
600 B (600 bytes)
Hash
9ad62ca12c2c7e75746fa9d039367ac3
58b018b9cea77bfcefffa0d66518eb5bc50696dd
eb793e32ac221bd8018792acd2cadec39024a029104466f4a841ad082dcd9404

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Tue, 06 Sep 2022 09:52:43 GMT
last-modified: Sat, 03 Sep 2022 06:38:35 GMT
expires: Sat, 10 Sep 2022 06:38:34 GMT
etag: "58b018b9cea77bfcefffa0d66518eb5bc50696dd"
cache-control: max-age=406396,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb6
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
cf-ray: 7466503ecb57925c-FRA
accept-ranges: bytes
ali-swift-global-savetime: 1662457963
via: cache4.l2de2[36,36,304-0,M], cache12.l2de2[38,0], cache1.se1[0,0,200-0,H], cache1.se1[1,0], cache3.se1[3,0]
age: 19
x-cache: HIT TCP_MEM_HIT dirn:2:366236519
x-swift-savetime: Tue, 06 Sep 2022 09:52:43 GMT
x-swift-cachetime: 1800
timing-allow-origin: *, *
eagleid: 2ff62c9716624579829567061e, 2ff62c9716624579829567061e

ocsp.trust-provider.cn/

47.246.44.205

200 OK

600 B

URL HTTP/1.1
ocsp.trust-provider.cn/
IP
47.246.44.205:0
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

File type
data
Size
600 B (600 bytes)
Hash
9ad62ca12c2c7e75746fa9d039367ac3
58b018b9cea77bfcefffa0d66518eb5bc50696dd
eb793e32ac221bd8018792acd2cadec39024a029104466f4a841ad082dcd9404

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
date: Tue, 06 Sep 2022 09:52:43 GMT
last-modified: Sat, 03 Sep 2022 06:38:35 GMT
expires: Sat, 10 Sep 2022 06:38:34 GMT
etag: "58b018b9cea77bfcefffa0d66518eb5bc50696dd"
cache-control: max-age=406396,s-maxage=1800,public,no-transform,must-revalidate
x-ccacdn-proxy-id: mcdpinlb6
x-frame-options: SAMEORIGIN
cf-cache-status: REVALIDATED
cf-ray: 7466503ecb57925c-FRA
accept-ranges: bytes
ali-swift-global-savetime: 1662457963
via: cache4.l2de2[36,36,304-0,M], cache12.l2de2[38,0], cache1.se1[0,0,200-0,H], cache1.se1[1,0], cache4.se1[3,0]
age: 19
x-cache: HIT TCP_MEM_HIT dirn:2:366236519
x-swift-savetime: Tue, 06 Sep 2022 09:52:43 GMT
x-swift-cachetime: 1800
timing-allow-origin: *, *
eagleid: 2ff62c9816624579829623704e, 2ff62c9816624579829623704e

hm.baidu.com/hm.js?dc257ee296157e70ad82b420ab183546

103.235.46.191

200 OK

11 kB

URL HTTP/1.1
hm.baidu.com/hm.js?dc257ee296157e70ad82b420ab183546
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
ASCII text, with very long lines (631)
Size
11 kB (11344 bytes)
Hash
d7aa392bd904b2b386e29ceea8da3699
3db35135d826d1117218945517fb9a2aa40c7f35
121086ea71d33639c9ef1680895f49ed82cb03f8aceadd9bb0371366b5ded20c

HTTP Headers

GET /hm.js?dc257ee296157e70ad82b420ab183546 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11344
Content-Type: application/javascript
Date: Tue, 06 Sep 2022 09:53:02 GMT
Etag: 653ab315eafa4ed74617438756413885
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=1D74A2FB78AF3BFD; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

www.2022tufafa.top/uploads/29800tuc0cyqvejurllnadd3n4g776ur4t2.jpg

154.208.101.161

200 OK

50 kB

URL HTTP/1.1
www.2022tufafa.top/uploads/29800tuc0cyqvejurllnadd3n4g776ur4t2.jpg
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x100, components 3\012- data
Size
50 kB (50516 bytes)
Hash
7925f7dd6392dcb4f188398fa87e8c0c
030ad16e6e28d2b8520427bf57d48e7fa38a65a4
552c475fe29e8eabac0760a6d4e5f74a0165ca447e269614a01bdbc7b60a7353

HTTP Headers

GET /uploads/29800tuc0cyqvejurllnadd3n4g776ur4t2.jpg HTTP/1.1
Host: www.2022tufafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:03 GMT
Content-Type: image/jpeg
Content-Length: 50516
Last-Modified: Fri, 17 Jun 2022 21:54:23 GMT
Connection: keep-alive
ETag: "62acf80f-c554"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Accept-Ranges: bytes

www.2022tufafa.top/uploads/fjb8negh3smbqnvwzjptz1bg713i4hxyvo3.jpg

154.208.101.161

200 OK

56 kB

URL HTTP/1.1
www.2022tufafa.top/uploads/fjb8negh3smbqnvwzjptz1bg713i4hxyvo3.jpg
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x100, components 3\012- data
Size
56 kB (56006 bytes)
Hash
87a9d827f6fd871223024b40b2646b9c
43bcec1633466893da0118ff81ebc1d875392f66
0c4a77dab5f3db9cc2269f073c9d8b182029128598d56c90a7d14b43f9f62947

HTTP Headers

GET /uploads/fjb8negh3smbqnvwzjptz1bg713i4hxyvo3.jpg HTTP/1.1
Host: www.2022tufafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:03 GMT
Content-Type: image/jpeg
Content-Length: 56006
Last-Modified: Fri, 17 Jun 2022 21:54:28 GMT
Connection: keep-alive
ETag: "62acf814-dac6"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Accept-Ranges: bytes

www.2022tufafa.top/uploads/291wu9ropi8eyj8ngdzh8b0ygl9d7d5cvek.jpg

154.208.101.161

200 OK

62 kB

URL HTTP/1.1
www.2022tufafa.top/uploads/291wu9ropi8eyj8ngdzh8b0ygl9d7d5cvek.jpg
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x100, components 3\012- data
Size
62 kB (62211 bytes)
Hash
c8e43ccc9c88624a86c0c190719d55ba
c273eba44ea68dbccaf44c36ef5d4c24cfdaee26
c34da23b1f8b51d2f0799b39e06ea1342347e7d4b32f39bbd94fa4cfb0cc1cfb

HTTP Headers

GET /uploads/291wu9ropi8eyj8ngdzh8b0ygl9d7d5cvek.jpg HTTP/1.1
Host: www.2022tufafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:03 GMT
Content-Type: image/jpeg
Content-Length: 62211
Last-Modified: Fri, 17 Jun 2022 21:54:23 GMT
Connection: keep-alive
ETag: "62acf80f-f303"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Accept-Ranges: bytes

www.2022tufafa.top/uploads/3819t6tzm6ocdjxzd9lflbkbjw4vqvfe77i.jpg

154.208.101.161

200 OK

53 kB

URL HTTP/1.1
www.2022tufafa.top/uploads/3819t6tzm6ocdjxzd9lflbkbjw4vqvfe77i.jpg
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x100, components 3\012- data
Size
53 kB (52696 bytes)
Hash
09a9c5e99ec33235f28bdca03b58682e
81d68e1a6bc09d122f9a0984c23dffc01b8d1c1c
0a5fbab46d0fed48a729000dc2c5415bea823742bc19cc2e4118f8844627414b

HTTP Headers

GET /uploads/3819t6tzm6ocdjxzd9lflbkbjw4vqvfe77i.jpg HTTP/1.1
Host: www.2022tufafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:03 GMT
Content-Type: image/jpeg
Content-Length: 52696
Last-Modified: Fri, 17 Jun 2022 21:54:24 GMT
Connection: keep-alive
ETag: "62acf810-cdd8"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Accept-Ranges: bytes

hm.baidu.com/hm.js?57d1b23dc10f80a577949e8a71266f25

103.235.46.191

200 OK

59 kB

URL HTTP/1.1
hm.baidu.com/hm.js?57d1b23dc10f80a577949e8a71266f25
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
data
Size
59 kB (59307 bytes)
Hash
a18043fc38ffff87a149287fa97c1a75
7243051d81e3e4286fd08819503a9aefc1332a20
150607a4632f634d4ee866a7e28b00b2454547158d98eec48cdbc960b311be96

HTTP Headers

GET /hm.js?57d1b23dc10f80a577949e8a71266f25 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11346
Content-Type: application/javascript
Date: Tue, 06 Sep 2022 09:53:02 GMT
Etag: f2cdefce8f559ffc3d994cd1a6dc1769
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=C36F53F7012CE851; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

www.2022tufafa.top/uploads/w4n2e2i3ckxvq7e7l88n0avxzf958asglj1.jpg

154.208.101.161

200 OK

146 kB

URL HTTP/1.1
www.2022tufafa.top/uploads/w4n2e2i3ckxvq7e7l88n0avxzf958asglj1.jpg
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x300, components 3\012- data
Size
146 kB (145496 bytes)
Hash
2b945299670d39198c6d315755f0af37
c01c80638aa17a27c03c2bdc5b23d1f35a1a6e44
bce60f8c53df42d177fb22d2fac0445f4d8ee5178b6bf1a8708fdc4f1a7a0569

HTTP Headers

GET /uploads/w4n2e2i3ckxvq7e7l88n0avxzf958asglj1.jpg HTTP/1.1
Host: www.2022tufafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:03 GMT
Content-Type: image/jpeg
Content-Length: 145496
Last-Modified: Fri, 17 Jun 2022 21:54:37 GMT
Connection: keep-alive
ETag: "62acf81d-23858"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Accept-Ranges: bytes

www.2022tufafa.top/uploads/2w4xbloeayhr2qyrw7r89gb4y0b5mue1kkw.jpg

154.208.101.161

200 OK

57 kB

URL HTTP/1.1
www.2022tufafa.top/uploads/2w4xbloeayhr2qyrw7r89gb4y0b5mue1kkw.jpg
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x100, components 3\012- data
Size
57 kB (57413 bytes)
Hash
2e599e6d4d3d33ff4de9f6729899c960
ba96b8f555d5907c0b67c723aaeba8250098e61c
3bba9661f9ad5b20934c5a85fdb31b01006948f2dcb27ff7f81cbd958b2c4fb5

HTTP Headers

GET /uploads/2w4xbloeayhr2qyrw7r89gb4y0b5mue1kkw.jpg HTTP/1.1
Host: www.2022tufafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:03 GMT
Content-Type: image/jpeg
Content-Length: 57413
Last-Modified: Fri, 17 Jun 2022 21:54:23 GMT
Connection: keep-alive
ETag: "62acf80f-e045"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Accept-Ranges: bytes

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1304880031&si=dc257ee296157e70ad82b420ab183546&v=1.2.97&lv=1&sn=31633&r=0&ww=1280&ct=!!&u=http%3A%2F%2Fwww.gfriesen.net%2Fhbt.php%3Frewrite%3Ddecision-making-and-the-will-of-god%2F&tt=%E6%BE%B3%E9%97%A8%E6%96%B0%E6%B5%A6%E6%96%B0%E4%BA%AC8455com_8455%E7%BA%BF%E8%B7%AF%E6%A3%80%E6%B5%8B%20-%20%E5%94%AF%E4%B8%80%E6%8E%88%E6%9D%83%E5%AE%98%E7%BD%91

103.235.46.191

200 OK

43 B

URL HTTP/1.1
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1304880031&si=dc257ee296157e70ad82b420ab183546&v=1.2.97&lv=1&sn=31633&r=0&ww=1280&ct=!!&u=http%3A%2F%2Fwww.gfriesen.net%2Fhbt.php%3Frewrite%3Ddecision-making-and-the-will-of-god%2F&tt=%E6%BE%B3%E9%97%A8%E6%96%B0%E6%B5%A6%E6%96%B0%E4%BA%AC8455com_8455%E7%BA%BF%E8%B7%AF%E6%A3%80%E6%B5%8B%20-%20%E5%94%AF%E4%B8%80%E6%8E%88%E6%9D%83%E5%AE%98%E7%BD%91
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1304880031&si=dc257ee296157e70ad82b420ab183546&v=1.2.97&lv=1&sn=31633&r=0&ww=1280&ct=!!&u=http%3A%2F%2Fwww.gfriesen.net%2Fhbt.php%3Frewrite%3Ddecision-making-and-the-will-of-god%2F&tt=%E6%BE%B3%E9%97%A8%E6%96%B0%E6%B5%A6%E6%96%B0%E4%BA%AC8455com_8455%E7%BA%BF%E8%B7%AF%E6%A3%80%E6%B5%8B%20-%20%E5%94%AF%E4%B8%80%E6%8E%88%E6%9D%83%E5%AE%98%E7%BD%91 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Tue, 06 Sep 2022 09:53:03 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=E626D7E799AE14A4; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

www.2022tufafa.top/uploads/2psxjmhledfn03z67ck8vbit9arwoy5qu1g.gif

154.208.101.161

200 OK

376 kB

URL HTTP/1.1
www.2022tufafa.top/uploads/2psxjmhledfn03z67ck8vbit9arwoy5qu1g.gif
IP
154.208.101.161:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
GIF image data, version 89a, 1000 x 70\012- data
Size
376 kB (376264 bytes)
Hash
b7a698b483d2b998170b510d4b53b3ac
00b550064357a2495874282355a2eabb8eff9f0d
f0fa6ce59021edf670a90ac0df04de37e15a3361db6094ec6f2d7ef6d565b91e

HTTP Headers

GET /uploads/2psxjmhledfn03z67ck8vbit9arwoy5qu1g.gif HTTP/1.1
Host: www.2022tufafa.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 Sep 2022 09:53:03 GMT
Content-Type: image/gif
Content-Length: 376264
Last-Modified: Fri, 17 Jun 2022 21:54:23 GMT
Connection: keep-alive
ETag: "62acf80f-5bdc8"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET,POST,OPTIONS
Accept-Ranges: bytes

hm.baidu.com/hm.js?dc257ee296157e70ad82b420ab183546

103.235.46.191

200 OK

0 B

URL HTTP/1.1
hm.baidu.com/hm.js?dc257ee296157e70ad82b420ab183546
IP
103.235.46.191:0
ASN
#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /hm.js?dc257ee296157e70ad82b420ab183546 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gfriesen.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11344
Content-Type: application/javascript
Date: Tue, 06 Sep 2022 09:53:02 GMT
Etag: a07aaf57d13dcc43ded8a2a503695f7e
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=592A560F8E96BABB; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (43)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers