r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash cf768e41672570b0a4a9fe86045915fc
2249064a86b2ba11e28208b9fba1c9f1db4f3e9e
a049499f78078df12f4d1c5180f1f36715a5c99db4f31c18ee06bcf0b6382b30
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A049499F78078DF12F4D1C5180F1F36715A5C99DB4F31C18EE06BCF0B6382B30"
Last-Modified: Fri, 07 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4486
Expires: Sun, 09 Oct 2022 23:54:38 GMT
Date: Sun, 09 Oct 2022 22:39:52 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
54.230.111.7200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP 54.230.111.7:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 3f17af4e8a1739eda4a518039f4892f9
c3feba08ae7e8f57e0fe9bcd2ebedea6bda67cbb
c485b09cad08b5233fe8753682faf59219fe0d18fcc34d90dc88fb0971295f5f
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 09 Oct 2022 21:48:07 GMT
Expires: Sun, 09 Oct 2022 22:25:59 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 4FR5LEWXx9b0zyzBSCM_rPJ9HLlDlMOt5SGgidylR1o7Qko55ZzE0g==
Age: 3105
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 7cba6aada5c0a04c1c0644769c09f64e
ed02f174a9b718951911343af8ec181c6d205b1d
ba863e734d5d38ed160758ab0b09d1b0f44fc795dcbcee4199329b011fcd1bd1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BA863E734D5D38ED160758AB0B09D1B0F44FC795DCBCEE4199329B011FCD1BD1"
Last-Modified: Fri, 07 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18530
Expires: Mon, 10 Oct 2022 03:48:42 GMT
Date: Sun, 09 Oct 2022 22:39:52 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: bV5vfPy7T9C5VEZfn6OXvto4TOtWmuyJrHf6d4a9cGto9Xk0ouqTRofYh92rD1zlkgBH/kQIMJY=
x-amz-request-id: CGSR0TP8282N7SSN
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 09 Oct 2022 22:00:11 GMT
age: 2381
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 09 Oct 2022 22:39:52 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
203.195.137.159200 OK 1.9 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash ac663b6b2014a63c2d60f68d0b2e201a
e90553ea100be3c4e570dba5e5f6626aa5de94f9
94d60149ca27c4663d089612ffff0ccdc303f89e80ef688b5f6a3532c436f4d9
Analyzer Verdict Alert quad9 Sinkholed
GET /hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1 HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:52 GMT
Content-Type: text/html
Last-Modified: Fri, 07 Oct 2022 22:10:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6340a3cc-1f52"
Content-Encoding: gzip
code.jquery.com/jquery-3.5.1.min.js
69.16.175.10200 OK 31 kB URL HTTP/2 code.jquery.com/jquery-3.5.1.min.js
IP 69.16.175.10:0
File type ASCII text, with very long lines (65451)
Hash 3700d0b271343804b9b9aa1c13efa521
3d6b03dbd74872ca3dfbb0529f6c80943788f918
fda7541f8e4cf921d20bcd0dc1d0efe69644c79bd18a0be4ce2f34246c83603e
GET /jquery-3.5.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://gxjjcn.com
Connection: keep-alive
Referer: http://gxjjcn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 09 Oct 2022 22:39:52 GMT
content-encoding: gzip
content-length: 30879
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-15d84"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1665355192.dop068.sk1.t,1665355192.cds247.sk1.hn,1665355192.cds208.sk1.c
X-Firefox-Spdy: h2
ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
142.250.74.106200 OK 33 kB URL HTTP/1.1 ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
IP 142.250.74.106:0
File type ASCII text, with very long lines (32072)
Hash d38e2944bbc9ae54b8947a2bd0b9a932
782a825679b248d38979c2d7ecae257873344437
65a0917567cb7037612cf420629873f2f3594d2e741aaadf90d893d07d8f5fdd
GET /ajax/libs/jquery/1.10.2/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gxjjcn.com/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 32954
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 06 Oct 2022 11:59:15 GMT
Expires: Fri, 06 Oct 2023 11:59:15 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Content-Type: text/javascript; charset=UTF-8
Age: 297637
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
54.230.111.7200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 54.230.111.7:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Expires, Backoff, ETag, Last-Modified, Pragma, Cache-Control, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600
Date: Sun, 09 Oct 2022 22:29:41 GMT
Expires: Sun, 09 Oct 2022 23:29:35 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 15d199af49035dc206cb81292fd87de2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: fEyL36zIPHK7WNgj15WBX5SHZzvNVEKBJMhloHX896N-EGRvJ0mzEw==
Age: 611
gxjjcn.com/hyi/-/dir/dist/js.cookie.js
203.195.137.159200 OK 1.5 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/js.cookie.js
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
Hash c2b8a5ec7feab55c9367484bf1a827b8
3235843155f4895895a3c82bc486cb7cf04d0293
462e9b036ef7da2ce8ac4afce22db9f437fd7a061a643e885acf303acfe23600
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/js.cookie.js HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:52 GMT
Content-Type: application/javascript
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6332e3ba-d60"
Expires: Mon, 10 Oct 2022 10:39:52 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 0e2d9e91637474eeaf391312eed441bd
5d29603c731b75308f7d1f584b3ac4c263c96a9e
7da864345088083e1a6fec2d95e07186ef8dbcef8505570e547844c556dfe3be
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4022
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 09 Oct 2022 22:39:53 GMT
Last-Modified: Sun, 09 Oct 2022 21:32:51 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471
gxjjcn.com/hyi/-/dir/dist/jquery-lang.js
203.195.137.159200 OK 8.0 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/jquery-lang.js
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
Hash ea15f345d5b4c6c29679113a0760a048
efc848d46e044e487d28df111e35cc84baf2be95
eb82846df5ab3495a4aa3567562bb43dc52983f808f0d0dd15e4950f3a259068
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/jquery-lang.js HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:53 GMT
Content-Type: application/javascript
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6332e3ba-6c2d"
Expires: Mon, 10 Oct 2022 10:39:53 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
push.services.mozilla.com/
44.238.202.79101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 44.238.202.79:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: RlnFn0KTefwG/qiVZjYY4g==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: bqOeVbUYCI+WaqM2a0FAHI4/MPk=
gxjjcn.com/hyi/-/dir/dist/dhl.css
203.195.137.159200 OK 364 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/dhl.css
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Unicode text, UTF-8 text, with very long lines (1148), with CRLF line terminators
Size 364 kB (363584 bytes)
Hash 1173a779603e4bb35745ed92a25a1ad7
5a922c9e379676611381e2fa5fdff353b1823a89
b71c0c9eda07ed2f929ddfd5e3ca9c3919a122d8297785834dafffa3c6611c35
Analyzer Verdict Alert quad9 Sinkholed
GET /hyi/-/dir/dist/dhl.css HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:52 GMT
Content-Type: text/css
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6332e3ba-15b189"
Expires: Mon, 10 Oct 2022 10:39:52 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash b5cf0255a785469b033344c2ec0ed394
a4a700c1c250cb10f175e67b4b11f2c94afb2bdb
191e75d8e785c03eb558af6f3efe0d557669b65b94d17b42a1b9b7f623947c6f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "191E75D8E785C03EB558AF6F3EFE0D557669B65B94D17B42A1B9B7F623947C6F"
Last-Modified: Fri, 07 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3014
Expires: Sun, 09 Oct 2022 23:30:08 GMT
Date: Sun, 09 Oct 2022 22:39:54 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash b5cf0255a785469b033344c2ec0ed394
a4a700c1c250cb10f175e67b4b11f2c94afb2bdb
191e75d8e785c03eb558af6f3efe0d557669b65b94d17b42a1b9b7f623947c6f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "191E75D8E785C03EB558AF6F3EFE0D557669B65B94D17B42A1B9B7F623947C6F"
Last-Modified: Fri, 07 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3014
Expires: Sun, 09 Oct 2022 23:30:08 GMT
Date: Sun, 09 Oct 2022 22:39:54 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash b5cf0255a785469b033344c2ec0ed394
a4a700c1c250cb10f175e67b4b11f2c94afb2bdb
191e75d8e785c03eb558af6f3efe0d557669b65b94d17b42a1b9b7f623947c6f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "191E75D8E785C03EB558AF6F3EFE0D557669B65B94D17B42A1B9B7F623947C6F"
Last-Modified: Fri, 07 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3014
Expires: Sun, 09 Oct 2022 23:30:08 GMT
Date: Sun, 09 Oct 2022 22:39:54 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash b5cf0255a785469b033344c2ec0ed394
a4a700c1c250cb10f175e67b4b11f2c94afb2bdb
191e75d8e785c03eb558af6f3efe0d557669b65b94d17b42a1b9b7f623947c6f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "191E75D8E785C03EB558AF6F3EFE0D557669B65B94D17B42A1B9B7F623947C6F"
Last-Modified: Fri, 07 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3014
Expires: Sun, 09 Oct 2022 23:30:08 GMT
Date: Sun, 09 Oct 2022 22:39:54 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0583d755-2f5b-458f-86f0-774b9909eb6f.jpeg
34.120.237.76200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0583d755-2f5b-458f-86f0-774b9909eb6f.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6e9aa9808428e5fd81ac9d61d6f7c708
3a8d76badce50dd98938885082dcb6e30363ae88
d8f7c48a1cbe04af2f7e0455d1ef7af9b63506b9ae343ebf14ece8689bb06bf6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0583d755-2f5b-458f-86f0-774b9909eb6f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11800
x-amzn-requestid: 5f2ce4dd-0df8-4df7-a12d-e6fffd622752
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZnTQHGADIAMFXfg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633f98cd-5044665325e5d64975c1ff0c;Sampled=0
x-amzn-remapped-date: Fri, 07 Oct 2022 03:11:09 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: LhwkinWopo6RX-yo5_35HWL9S2dGpdi7rAiwVWLxUicaHfHW3VF7DQ==
via: 1.1 4d8620b80ebe37d366388e117039aa8e.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Sun, 09 Oct 2022 22:22:12 GMT
age: 1062
etag: "3a8d76badce50dd98938885082dcb6e30363ae88"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F44fa9d85-fcdb-45fb-a35a-89c13e4fdb39.jpeg
34.120.237.76200 OK 7.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F44fa9d85-fcdb-45fb-a35a-89c13e4fdb39.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f75a7a574dc12e892223990f9e4ca03a
c14a1316ca8350a7fa606fb15591510dece77d64
4dac932b2e3aa784101dcc8f06676c44e3c36a298205a28c95b895ee0788ba58
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F44fa9d85-fcdb-45fb-a35a-89c13e4fdb39.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6973
x-amzn-requestid: 843b354e-e00b-4497-870a-7f4ff7ebbd39
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZwbGWE1TIAMF90w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63433ef5-2e74cf5b0cb790a27b8f2322;Sampled=0
x-amzn-remapped-date: Sun, 09 Oct 2022 21:36:53 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: IVh3MwU7OHQR_qLTTA4fXRx1Of7uEM-vsjZsKeotcaZv3ECZ_VUYRg==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google
date: Sun, 09 Oct 2022 21:50:33 GMT
etag: "c14a1316ca8350a7fa606fb15591510dece77d64"
content-type: image/jpeg
age: 2961
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80b1b256-44e4-4883-88d8-84200f2324aa.jpeg
34.120.237.76200 OK 5.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80b1b256-44e4-4883-88d8-84200f2324aa.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3d492733b5104b5850ab950ee04786bc
2c681d18d889c84ddb236bf9f2fd5beb7ebc1fce
54df60f5ae410e74f76e3f00f78e138c811071c66827874e616c78b0eab88f26
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F80b1b256-44e4-4883-88d8-84200f2324aa.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5511
x-amzn-requestid: da645db9-8161-4051-8beb-2ed35c7d8a1f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Zwb7LHHfIAMFeTQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63434047-12c1ad260748cf6a08dddc54;Sampled=0
x-amzn-remapped-date: Sun, 09 Oct 2022 21:42:31 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: beZfJRhU5ydHFppdynEZmpb4jBoQgNuMjKim0e3GxVdUATv3eebk4A==
via: 1.1 6ca7826fb0f4c565b1af9c7737725c48.cloudfront.net (CloudFront), 1.1 b13f158bdf9805ca47e07c0c35870c12.cloudfront.net (CloudFront), 1.1 google
date: Sun, 09 Oct 2022 21:50:33 GMT
etag: "2c681d18d889c84ddb236bf9f2fd5beb7ebc1fce"
content-type: image/jpeg
age: 2961
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb08ba1b9-62ad-4e65-96b6-b22981ce3635.jpeg
34.120.237.76200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb08ba1b9-62ad-4e65-96b6-b22981ce3635.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3e748e58f80c6b771f918c1633817aa3
59e4de3cb5a18090fa3fef06f4dabf9f7f9928a9
bd357a97c0ca7f25e8d30250bf07c5497bc54d3b042aa5db79cab0fb5e63a2a1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb08ba1b9-62ad-4e65-96b6-b22981ce3635.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7288
x-amzn-requestid: 38f93e67-dfd2-4324-bc0f-24e36a1c9b7f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZwatLHd3IAMFWdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63433e54-4ac21e2b2f55935d2df721ee;Sampled=0
x-amzn-remapped-date: Sun, 09 Oct 2022 21:34:12 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: RUFNhUlBYC05WxBkwLVQt0wpsFAxSrYL95RSJKmidxn3D72DdSGSeA==
via: 1.1 fc9b6e8f934a073c1a1983c7599b93ba.cloudfront.net (CloudFront), 1.1 b13f158bdf9805ca47e07c0c35870c12.cloudfront.net (CloudFront), 1.1 google
date: Sun, 09 Oct 2022 21:50:33 GMT
etag: "59e4de3cb5a18090fa3fef06f4dabf9f7f9928a9"
content-type: image/jpeg
age: 2961
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ba53542-d034-46b4-a809-78a6ae0132f7.jpeg
34.120.237.76200 OK 9.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ba53542-d034-46b4-a809-78a6ae0132f7.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9522f6cfe8e8b6e4c8c5ce9645752739
81eac7326ba93c7ef0ee18fe79456a89fc4e29d9
5aed3bae93e51456783c3d0b104386b6feb45d9548d961b0c6d7e4111f2d7811
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ba53542-d034-46b4-a809-78a6ae0132f7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9799
x-amzn-requestid: 979c8e16-ba90-44df-af3c-e3b41009194a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZwalQGIioAMFWLw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63433e21-1cccfc464095e86d7eafaaa8;Sampled=0
x-amzn-remapped-date: Sun, 09 Oct 2022 21:33:21 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: qoLNF5ukc9IQDiotGxtPjUqkO8mllXlpcHenTSh8WyP9NVIiBlAR7w==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Sun, 09 Oct 2022 21:50:33 GMT
etag: "81eac7326ba93c7ef0ee18fe79456a89fc4e29d9"
content-type: image/jpeg
age: 2961
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F65601377-6596-481c-9857-db59bb0ee5de.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F65601377-6596-481c-9857-db59bb0ee5de.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6a749720748edf7b0eb5d80d247df5e8
e284b84f6e883ec1541b624e1751532e25e35ffd
dbed59485baba870ede83792f06562b12a688ebdcc54a8ef8901fc36ca53214f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F65601377-6596-481c-9857-db59bb0ee5de.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10506
x-amzn-requestid: 0c9ea0f0-4b59-474d-bb39-b6c5004847a1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZwbYnF2LIAMF8Dw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63433f6a-588db0ab09fccb4353fff1df;Sampled=0
x-amzn-remapped-date: Sun, 09 Oct 2022 21:38:50 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: bR3HAzQjin8Yb6Uy-1RT0fr-NXW5lKsnC3OdN9lupCzRjL0XCwzutg==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 09 Oct 2022 21:50:33 GMT
age: 2961
etag: "e284b84f6e883ec1541b624e1751532e25e35ffd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
gxjjcn.com/hyi/-/dir/dist/fonts/default-274a65bae9742377aaf010bb1a7de971.woff
203.195.137.159200 OK 41 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/fonts/default-274a65bae9742377aaf010bb1a7de971.woff
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format, TrueType, length 41084, version 1.66\012- data
Hash 03f859bf58e4d37841070de34be7d978
3436d4fa17e7ee470c3d62b08787cfa7de408408
5af5c3746b03792640b9cafdabddfb2c5407f72988e128541a88fa439607d940
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/fonts/default-274a65bae9742377aaf010bb1a7de971.woff HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/dist/dhl.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: font/woff
Content-Length: 41084
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-a07c"
Accept-Ranges: bytes
gxjjcn.com/hyi/-/dir/dist/DHL_head.html
203.195.137.159200 OK 3.4 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/DHL_head.html
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type HTML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (1836)
Hash 98b5839a1b1be9e91833d552215700f1
3949372c264253e08d55dfb1c088072aa6a98afd
f379aba84f69f335ce51665341f2fa7841e2785d4eb450e61e5b7a009fadc071
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/DHL_head.html HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: text/html
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6332e3ba-2d05"
Content-Encoding: gzip
gxjjcn.com/hyi/-/dir/dist/load.php
203.195.137.159200 OK 1.2 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/load.php
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type HTML document, ASCII text, with CRLF line terminators
Hash c81ab15c01444ca14ab575ec887e6efd
336c0c787532534fbe935279de0e263c87dbe683
486bf42cfcdaa1a4fb885273935636932da78691aaabc36ecf2209bfe917972e
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/load.php HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.1.5
Content-Encoding: gzip
gxjjcn.com/hyi/-/dir/dist/DHL_footer.html
203.195.137.159200 OK 6.3 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/DHL_footer.html
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (2591)
Hash 9af4e72c1ec135c251cce7c69fdc5a13
ed1fe1cc1ab66866578add655566d3da7a1049ef
6dfde0dd027711b3e162b91f9fd092ac5d7ac4a8342621c70d0a518bde927c64
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/DHL_footer.html HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: text/html
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6332e3ba-3c69"
Content-Encoding: gzip
gxjjcn.com/hyi/-/dir/dist/favicon.ico
203.195.137.159200 OK 1.2 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/favicon.ico
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash d8106bf3a1d00ab43b01e6e3c92500eb
202b5e8654ab1b28351378293bca3b9d844cc29b
9ada5709e264c31b04a05bd85448a9bd5e91925e8d83df5cef0762ec97cc283e
Analyzer Verdict Alert quad9 Sinkholed
GET /hyi/-/dir/dist/favicon.ico HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-47e"
Accept-Ranges: bytes
ipinfo.io/country
34.117.59.81302 Found 72 B IP 34.117.59.81:0
File type ASCII text, with no line terminators
Hash b79f12127b13f3298b65130f55033eea
0c5df3d4734c5d754f78df4dd08f329ce38ab901
76d7f55bf215f2132f41391f47b4efd048f7c3b61db2b650e2a0a9b4a02d79f0
GET /country HTTP/1.1
Host: ipinfo.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gxjjcn.com/
Origin: http://gxjjcn.com
Connection: keep-alive
HTTP/1.1 302 Found
access-control-allow-origin: *
location: https://ipinfo.io/country
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
date: Sun, 09 Oct 2022 22:39:54 GMT
x-envoy-upstream-service-time: 39
strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: gzip
transfer-encoding: chunked
Via: 1.1 google
gxjjcn.com/hyi/-/dir/dist/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff
203.195.137.159200 OK 9.3 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format, TrueType, length 9316, version 1.0\012- data
Hash 9355df62a665ef9249036bbccad8c54c
6b7779a10187a1a7473f604fbe3db96350868c6a
6d051536af97fbd33fae0683a1b6ce3749757ab43c8ee8c89295755fd4595807
Analyzer Verdict Alert urlquery Phishing - DHL
fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/dist/dhl.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: font/woff
Content-Length: 9316
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-2464"
Accept-Ranges: bytes
ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw
142.250.74.35200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw
IP 142.250.74.35:0
Hash b0c40416281c19104e8e4192f58f5181
d8fbb3f2290ccccf8fe393a639b686bd23848851
7a50a934975015052691775bc15e584b6a528ba3af1c0dfbdfc382c0ca2f0f89
POST /s/gts1d4/5QlTZKzjgCw HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 09 Oct 2022 22:39:54 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw
142.250.74.35200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw
IP 142.250.74.35:0
Hash b0c40416281c19104e8e4192f58f5181
d8fbb3f2290ccccf8fe393a639b686bd23848851
7a50a934975015052691775bc15e584b6a528ba3af1c0dfbdfc382c0ca2f0f89
POST /s/gts1d4/5QlTZKzjgCw HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 09 Oct 2022 22:39:55 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
gxjjcn.com/hyi/-/dir/dist/fonts/default-815fcbb4d2c57901701125d768f09d67.woff
203.195.137.159200 OK 41 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/fonts/default-815fcbb4d2c57901701125d768f09d67.woff
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format, TrueType, length 41328, version 1.66\012- data
Hash e39bd2e2657ce5dd6f9c33df18529233
6db81ebb91bfa67cef8f2f870f03046150568799
19d0bda83ecbc986620468801adf000c77c3c38398650903c63fac8dcbac4383
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/fonts/default-815fcbb4d2c57901701125d768f09d67.woff HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/dist/dhl.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: font/woff
Content-Length: 41328
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-a170"
Accept-Ranges: bytes
gxjjcn.com/hyi/-/dir/dist/fonts/default-3e828e80f6e985c352eba4474518978d.woff
203.195.137.159200 OK 44 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/fonts/default-3e828e80f6e985c352eba4474518978d.woff
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format, TrueType, length 44260, version 1.66\012- data
Hash 4a350e02a03ac62e72e9ea575b31ce84
d47b03b96b6e7034a1473a293bb594e597a41dc2
87c40e3961e21f759770615ae67568a3de3ec6e0735f1238a6aae062f4ea15d5
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/fonts/default-3e828e80f6e985c352eba4474518978d.woff HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/dist/dhl.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:54 GMT
Content-Type: font/woff
Content-Length: 44260
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-ace4"
Accept-Ranges: bytes
gxjjcn.com/hyi/-/dir/dist/DHL_track.html
203.195.137.159200 OK 2.6 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/DHL_track.html
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type HTML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (356)
Hash 0c7b7259abc46422f5d830687bbb0c84
4cc31e593f4c41166236fbf37b5bb4c88364df30
dbde243b328fc1c7a707a8144a98cb359facd0102c53d176abafc80b8b4748a6
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/DHL_track.html HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:56 GMT
Content-Type: text/html
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6332e3ba-196f"
Content-Encoding: gzip
gxjjcn.com/hyi/-/dir/dist/jquery.validate.min.js
203.195.137.159200 OK 8.8 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/jquery.validate.min.js
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Unicode text, UTF-8 text, with very long lines (24237)
Hash 0aa2ca51109290ccf21ac5217babbbe1
7ea8f79d4df043f4cdd4db3bfeffe30787c21c5b
c157bb061310123c090432240fdb79e6c6f5cd8a4501a87a72495cbe1f593a7c
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/jquery.validate.min.js HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:56 GMT
Content-Type: application/javascript
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6332e3ba-5f38"
Expires: Mon, 10 Oct 2022 10:39:56 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
151.101.85.229301 Moved Permanently 0 B URL HTTP/1.1 cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
IP 151.101.85.229:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /npm/popper.js@1.16.1/dist/umd/popper.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gxjjcn.com/
HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 0
Server: Varnish
Retry-After: 0
Location: https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
Accept-Ranges: bytes
Date: Sun, 09 Oct 2022 22:39:56 GMT
X-Served-By: cache-bma1673-BMA
X-Cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
151.101.85.229200 OK 7.5 kB URL HTTP/2 cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
IP 151.101.85.229:0
File type ASCII text, with very long lines (21060)
Hash 1f61c1b15b25ba046056238766ff3a43
2b8db740e4e913e9dc87a6060dea2a6b17ad0ec8
fe78a2c604b4757dd5d114e0efb7e74c8f4acfe840bf6b6c01517205744a7648
GET /npm/popper.js@1.16.1/dist/umd/popper.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://gxjjcn.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 1.16.1
x-jsd-version-type: version
etag: W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q"
content-encoding: gzip
accept-ranges: bytes
date: Sun, 09 Oct 2022 22:39:56 GMT
age: 11645401
x-served-by: cache-fra19126-FRA, cache-bma1622-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7503
X-Firefox-Spdy: h2
ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1
104.18.20.226200 OK 1.5 kB URL HTTP/1.1 ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1
IP 104.18.20.226:0
Hash 10e0c9c9f6f109d0d483104467293f33
2e55d2d9904fb7f35798d834c85ca34875e24b6d
d65b9b3c07eae38a40a574fab1675f476f47675db4e8bd1327d7952df93d310d
POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 09 Oct 2022 22:39:56 GMT
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "47A6BCA419E9E2D7DBEA9E51D40B23906E863484"
Expires: Mon, 10 Oct 2022 09:00:00 GMT
Last-Modified: Sun, 09 Oct 2022 21:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 1917
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 757a9d7d1f43b50f-OSL
gxjjcn.com/hyi/-/dir/dist/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff
203.195.137.159200 OK 41 kB URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type Web Open Font Format, TrueType, length 41352, version 1.66\012- data
Hash 4e23ecf085132857bdb54b4da7373151
a50215c22a591536b21e509100d1707c6886ffd6
b033eff45e6e8ecd5c5bccd8ef9a96c4dc37325adc64c5aed8b1d909b24c4eb4
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/dist/dhl.css
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:56 GMT
Content-Type: font/woff
Content-Length: 41352
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-a188"
Accept-Ranges: bytes
gxjjcn.com/hyi/-/dir/dist/langpack/en.json
203.195.137.159200 OK 514 B URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/langpack/en.json
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type JSON data\012- , ASCII text
Hash e5111c3d242107acc93f71f9c9182079
c648da6b0a6c4f9b89dbee1027cf9a7be36217ca
86f9abd216bc64ead1404975e2b6132aebc42ebd106e5be0f660b7e5852051a3
Analyzer Verdict Alert urlquery Phishing - DHL
fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/langpack/en.json HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:57 GMT
Content-Type: application/json
Content-Length: 514
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-202"
Accept-Ranges: bytes
gxjjcn.com/hyi/-/dir/dist/langpack/en.json
203.195.137.159200 OK 514 B URL HTTP/1.1 gxjjcn.com/hyi/-/dir/dist/langpack/en.json
IP 203.195.137.159:0
ASN #45090 Shenzhen Tencent Computer Systems Company Limited
File type JSON data\012- , ASCII text
Hash e5111c3d242107acc93f71f9c9182079
c648da6b0a6c4f9b89dbee1027cf9a7be36217ca
86f9abd216bc64ead1404975e2b6132aebc42ebd106e5be0f660b7e5852051a3
Analyzer Verdict Alert urlquery Phishing - DHL
fortinet Phishing
quad9 Sinkholed
GET /hyi/-/dir/dist/langpack/en.json HTTP/1.1
Host: gxjjcn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gxjjcn.com/hyi/-/dir/474f04e02fee6b92bf2256f5d57a3f5c/execution.html?validation=e1s1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 09 Oct 2022 22:39:57 GMT
Content-Type: application/json
Content-Length: 514
Last-Modified: Tue, 27 Sep 2022 11:51:22 GMT
Connection: keep-alive
ETag: "6332e3ba-202"
Accept-Ranges: bytes
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed0e378d-600b-44f7-b846-37c1a3a9531d.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed0e378d-600b-44f7-b846-37c1a3a9531d.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 40ac94776919adf9a90412d38dcc5252
01d3e3f9f0295c300eaf259438cbbb5899ee1e0c
5f37c4c56389f6c38f850c2ad3ec879faa7cbf591b9735c048722da32b977339
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fed0e378d-600b-44f7-b846-37c1a3a9531d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 10548
x-amzn-requestid: 7563d056-5537-4cd2-950f-8f9b8fa22a37
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZwalRGT9IAMFh-g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63433e21-60f6b437451e94b91bfeb9cf;Sampled=0
x-amzn-remapped-date: Sun, 09 Oct 2022 21:33:21 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: XQjfsfFp6VUbjdvNSb13GehxN2FPA9eOCujLg7y2bWNRIzjyyndpkw==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Sun, 09 Oct 2022 21:51:56 GMT
etag: "01d3e3f9f0295c300eaf259438cbbb5899ee1e0c"
content-type: image/jpeg
age: 2885
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ipinfo.io/country
34.117.59.81429 Too Many Requests 0 B IP 34.117.59.81:0
GET /country HTTP/1.1
Host: ipinfo.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Referer: http://gxjjcn.com/
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 429 Too Many Requests
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-type: application/json; charset=utf-8
date: Sun, 09 Oct 2022 22:39:55 GMT
x-envoy-upstream-service-time: 1
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2