Overview

URLapp.secads.club/subue919d202273d4b8a76d6ffbe6df302dd
IP 20.113.187.208 (Germany)
ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2022-12-03 21:59:01 UTC
StatusLoading report..
IDS alerts0
Blocklist alert1
urlquery alerts
4
Scam - Fake AntiVirus
Scam - Fake AntiVirus
Tags None

Domain Summary (9)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
app.secads.club (1) 449868 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 383 1851 20.113.67.50
ocsp.digicert.com (2) 86 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 682 1594 93.184.220.29
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5843 34.160.144.191
nine3app.xyz (3) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2223 76785 188.114.97.1
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 44.240.57.100
img-getpocket.cdn.mozilla.net (6) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3246 42402 34.120.237.76
r3.o.lencr.org (4) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1352 3548 23.36.77.32
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2374 34.102.187.140
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 229 34.117.237.239

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-12-03 medium app.secads.club/subue919d202273d4b8a76d6ffbe6df302dd Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 20.113.187.208
Date UQ / IDS / BL URL IP
2023-05-29 14:10:45 UTC 0 - 0 - 25 got.novistar.online/15GLnd 20.113.187.208
2023-05-29 03:21:04 UTC 0 - 0 - 8 firstappad.me/15GQBW 20.113.187.208
2023-05-28 12:27:00 UTC 0 - 0 - 1 firstappad.me/15GiGC 20.113.187.208
2023-05-27 17:36:30 UTC 0 - 0 - 8 firstappad.me/15GUzz 20.113.187.208
2023-05-27 05:29:39 UTC 0 - 0 - 1 got.novistar.online/ 20.113.187.208


Last 5 reports on ASN: MICROSOFT-CORP-MSN-AS-BLOCK
Date UQ / IDS / BL URL IP
2023-06-02 01:15:28 UTC 0 - 0 - 2 dd365w.com/ 20.205.118.3
2023-06-02 01:00:47 UTC 0 - 0 - 0 secure.smartroom.com/ 20.41.39.188
2023-06-02 00:41:45 UTC 0 - 0 - 36 55166.vip/ 52.229.165.190
2023-06-02 00:41:22 UTC 0 - 0 - 294 www.bitcoinira-trust.com/ 20.187.88.233
2023-06-02 00:29:46 UTC 3 - 0 - 2 msfaxdocuments-secondary.z13.web.core.windows.net/ 52.239.163.176


Last 5 reports on domain: secads.club
Date UQ / IDS / BL URL IP
2023-05-28 18:00:02 UTC 4 - 0 - 1 app.secads.club/15GBdn 20.113.188.243
2023-05-27 04:50:59 UTC 0 - 0 - 1 app.secads.club/15GGb0 20.113.67.50
2023-05-25 08:19:18 UTC 4 - 0 - 1 app.secads.club/15GBdn 20.113.67.50
2023-05-25 03:15:22 UTC 0 - 0 - 1 app.secads.club/subu570d65375ac7511e6ebb15e7c (...) 20.113.67.50
2023-05-23 17:00:24 UTC 4 - 0 - 1 app.secads.club/15GBdn 20.113.67.50


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-04 05:36:51 UTC 2 - 0 - 1 app.secads.club/15GKJg 20.113.187.208
2023-04-01 16:53:07 UTC 4 - 0 - 1 app.secads.club/15GKJg 20.113.188.243
2023-04-01 09:56:49 UTC 3 - 0 - 1 app.secads.club/15GKJg 20.113.188.243
2023-03-27 23:46:35 UTC 2 - 0 - 0 firstappad.me/15GKJg 20.113.187.208
2023-03-25 07:56:42 UTC 4 - 0 - 1 firstappad.me/15GPrj 20.113.188.243

JavaScript

Executed Scripts (5)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (21)


Request Response
                                        
                                            GET /subue919d202273d4b8a76d6ffbe6df302dd HTTP/1.1 
Host: app.secads.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             20.113.67.50
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                            
Server: nginx/1.23.0
Date: Sat, 03 Dec 2022 21:58:50 GMT
Content-Length: 490
Connection: keep-alive
Location: http://nine3app.xyz/8b384f64/?clickid=52b2e0298a313578ac404748b8a42c3c-10342-1203&device_name=Desktop&device_brand=Desktop&device_model=Desktop&domain=app.secads.club&pr_key=d60a9bbe8fdf698d9f2bdc902fa957e8$5Pf4pAIO9DeOcCSysZbExA--kFCGs4CnxgYZo_s.S_tRuQUUseGQ1BvDWX8gx1ysVjMZMPziczR9_gO75GQMM9ADeD0O7p_nYkayo6odsSxbv0g1OHr4GHXwdpuznHj9mJv7b_3BlGYdtl6Qmrr4aHst_uqGkE8jYOA2b8uPFmsBIhKaKI3E8h0t.kJgZD6uhFFmcAnd23ikuHhyucCxnOzuNYX49IE7.VKUuWDLdnhG1A--
Set-Cookie: subue919d202273d4b8a76d6ffbe6df302ddl=1; Path=/; Domain=app.secads.club; Max-Age=1670191130; SameSite=Lax pc-cid=52b2e0298a313578ac404748b8a42c3c-10342-1203; Path=/; Domain=app.secads.club; Max-Age=1670191130; SameSite=Lax pc-campaign=subue919d202273d4b8a76d6ffbe6df302dd; Path=/; Domain=app.secads.club; Max-Age=1670191130; SameSite=Lax pc-linf=eyIxIjoic3VidWU5MTlkMjAyMjczZDRiOGE3NmQ2ZmZiZTZkZjMwMmRkIiwiMTIiOjg0NTMsIjIiOjEyNjYyNjAsIjMiOiJXaXRob3V0IHJlZmVyZXIiLCI0Ijp7fSwiNSI6Mjg5NzQzLCIxMSI6MjEwNzUxLCI5IjoxNjcwMTA0NzMwNjEzMDk1NzQ4LCIxMCI6MCwiMTMiOjAsIjE0IjoxLCI2IjoxLCI3IjowLCIxNSI6MCwiQ2lkIjoiNTJiMmUwMjk4YTMxMzU3OGFjNDA0NzQ4YjhhNDJjM2MtMTAzNDItMTIwMyJ9; Path=/; Domain=app.secads.club; Max-Age=1670191130; SameSite=Lax


--- Additional Info ---
Magic:  HTML document, ASCII text, with very long lines (488)
Size:   490
Md5:    3a444f50bd22f558d26be9b16701afb5
Sha1:   97757d291de64055a9080aad6dd0e5b6903a69f4
Sha256: 7e5240e4097cfa9f6e871876dc65a165aa443dadb5905b0a8af2bcf561f0eb1d

Blocklists:
  - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12876
Expires: Sun, 04 Dec 2022 01:33:26 GMT
Date: Sat, 03 Dec 2022 21:58:50 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5806
Cache-Control: max-age=137348
Date: Sat, 03 Dec 2022 21:58:50 GMT
Etag: "638b2570-1d7"
Expires: Mon, 05 Dec 2022 12:07:58 GMT
Last-Modified: Sat, 03 Dec 2022 10:31:12 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "7D7232C8C91BCD18161BA2C9D23E3BFF159604E058BD5B3FC1C7FCBCD03A7EE3"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18482
Expires: Sun, 04 Dec 2022 03:06:52 GMT
Date: Sat, 03 Dec 2022 21:58:50 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 03 Dec 2022 21:20:00 GMT
cache-control: public,max-age=3600
age: 2330
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: aeqWkvvEd1SMDLIIjEkBwFdYtUKQnnz0+ZrXCt133DMGI6gAKTTt2jia6E1kT4zll20o6Z4MZnk=
x-amz-request-id: ZQNWVHNS2J0RA3S8
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 03 Dec 2022 21:46:43 GMT
age: 727
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /8b384f64/?clickid=52b2e0298a313578ac404748b8a42c3c-10342-1203&device_name=Desktop&device_brand=Desktop&device_model=Desktop&domain=app.secads.club&pr_key=d60a9bbe8fdf698d9f2bdc902fa957e8$5Pf4pAIO9DeOcCSysZbExA--kFCGs4CnxgYZo_s.S_tRuQUUseGQ1BvDWX8gx1ysVjMZMPziczR9_gO75GQMM9ADeD0O7p_nYkayo6odsSxbv0g1OHr4GHXwdpuznHj9mJv7b_3BlGYdtl6Qmrr4aHst_uqGkE8jYOA2b8uPFmsBIhKaKI3E8h0t.kJgZD6uhFFmcAnd23ikuHhyucCxnOzuNYX49IE7.VKUuWDLdnhG1A-- HTTP/1.1 
Host: nine3app.xyz
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             188.114.97.1
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                            
Date: Sat, 03 Dec 2022 21:58:50 GMT
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B5p2wiUjz5CPNmxKQXvM1mfwTChusQ8UmAlxcqowfPkyUBhBMWdYEIgAM5%2F%2Fvyyl0bdicmjPNJs8kPBRx6QAGPUFrxP3nA3s6QMa2Zo45Iemb79tiYpnw21TWDjq8AU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 773f90e6fc5fb505-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- assembler source, Unicode text, UTF-8 text, with very long lines (513)
Size:   6487
Md5:    0f39125f11b58f59f28b6edd9054f150
Sha1:   87f7067937e30a650dc83e3c11e7b973939f5162
Sha256: 16beae4fe08915b31b94e7eeadd5d3de3ec0aa391b939aeeda0a7ec80544f3ca
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Sat, 03 Dec 2022 21:58:50 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /8b384f64/logo.gif HTTP/1.1 
Host: nine3app.xyz
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nine3app.xyz/8b384f64/?clickid=52b2e0298a313578ac404748b8a42c3c-10342-1203&device_name=Desktop&device_brand=Desktop&device_model=Desktop&domain=app.secads.club&pr_key=d60a9bbe8fdf698d9f2bdc902fa957e8$5Pf4pAIO9DeOcCSysZbExA--kFCGs4CnxgYZo_s.S_tRuQUUseGQ1BvDWX8gx1ysVjMZMPziczR9_gO75GQMM9ADeD0O7p_nYkayo6odsSxbv0g1OHr4GHXwdpuznHj9mJv7b_3BlGYdtl6Qmrr4aHst_uqGkE8jYOA2b8uPFmsBIhKaKI3E8h0t.kJgZD6uhFFmcAnd23ikuHhyucCxnOzuNYX49IE7.VKUuWDLdnhG1A--

                                        
                                             188.114.97.1
HTTP/1.1 200 OK
Content-Type: image/gif
                                            
Date: Sat, 03 Dec 2022 21:58:50 GMT
Content-Length: 68216
Connection: keep-alive
Last-Modified: Mon, 03 Oct 2022 19:40:51 GMT
ETag: "633b3ac3-10a78"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 7012
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KAA6pjaxbRvGTgk35DbTN%2Fau6mM8asfqx4TylymYnyDRCHN%2FU%2BV8SSwtqhv%2BaKKxCJIbFjGD03ixO4PGi7N4tmJZ5NuGBAiMolyen1agcPIrTz8YOh7UXqjgrwEWkS8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773f90e82dc4b505-OSL
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  GIF image data, version 89a, 520 x 520\012- data
Size:   68216
Md5:    f9612b8f5ecc81bd33c69f0dcf37a1dc
Sha1:   40d90c002295d9dd0e1aa722a9e4080b2ccd05b2
Sha256: 6cbbe0ea9c08a4e1840d5d8b49170e9ed350d74911c91322ef0ce0a23d4e0e20

urlquery:
  - Scam - Fake AntiVirus
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: nine3app.xyz
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://nine3app.xyz/8b384f64/?clickid=52b2e0298a313578ac404748b8a42c3c-10342-1203&device_name=Desktop&device_brand=Desktop&device_model=Desktop&domain=app.secads.club&pr_key=d60a9bbe8fdf698d9f2bdc902fa957e8$5Pf4pAIO9DeOcCSysZbExA--kFCGs4CnxgYZo_s.S_tRuQUUseGQ1BvDWX8gx1ysVjMZMPziczR9_gO75GQMM9ADeD0O7p_nYkayo6odsSxbv0g1OHr4GHXwdpuznHj9mJv7b_3BlGYdtl6Qmrr4aHst_uqGkE8jYOA2b8uPFmsBIhKaKI3E8h0t.kJgZD6uhFFmcAnd23ikuHhyucCxnOzuNYX49IE7.VKUuWDLdnhG1A--

                                        
                                             188.114.97.1
HTTP/1.1 404 Not Found
Content-Type: text/html
                                            
Date: Sat, 03 Dec 2022 21:58:50 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 168
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A6pVv3ey%2FuMVOQDY9oP2rEtpTrNdHlaYyazoQsBy15ivtr9WYi8Uv09fpsR%2F6OmTqA7ogH7PV%2Fu1d7g1zwRDvWUJgspWx5gKLDdp9y%2FtQ2aCB1l7LtmirKcBWuhh3oY%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773f90e89e2cb505-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text
Size:   139
Md5:    f4f81214dcbbf67cab9d1ceb6d9c6738
Sha1:   3dcf5d086a7225de20211d727ca2abe724931773
Sha256: 00d8fe36b5ad4155bb072be8ac9863352bfe459ddadb958964f93d415ec21cf7

urlquery:
  - Scam - Fake AntiVirus
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Retry-After, ETag, Alert, Expires, Cache-Control, Backoff, Content-Length, Content-Type, Pragma, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 03 Dec 2022 21:08:58 GMT
cache-control: public,max-age=3600
age: 2993
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5799
Cache-Control: max-age=132279
Date: Sat, 03 Dec 2022 21:58:51 GMT
Etag: "638b11ab-1d7"
Expires: Mon, 05 Dec 2022 10:43:30 GMT
Last-Modified: Sat, 03 Dec 2022 09:06:51 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 4pYZe9+4OSZoPKnIkBpRYw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             44.240.57.100
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: dGTFiJk6mKug9yjyFkXC09WEQPI=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13975
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:58:52 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13975
Expires: Sun, 04 Dec 2022 01:51:47 GMT
Date: Sat, 03 Dec 2022 21:58:52 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XvG2dAUeB914GQ1qJwQRHovAtra8OSjG-CsXeR8UOBq5r8qVjEbPBQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 22:39:04 GMT
age: 83988
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   2942
Md5:    b47431190f34eccf0a6efb98e2a32b7d
Sha1:   9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
Sha256: 08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73b53015-e415-4fff-9252-8a16bbe000f5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9715
x-amzn-requestid: c8102cfa-78dc-4d81-ad6a-e16b9132e238
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZO2HQKIAMF8IA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f2b-350c586b568e6565763376bd;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:31 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0QkVKyYm9UwlF5FEeli9UsRAQwEi3-c3bMR-QSJxIKRQe7WWT76dGQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:37:54 GMT
age: 1258
etag: "d4b3052021ff3ad1dc4134fa25eb12a98e7c17da"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9715
Md5:    45182367fd4f8b6dd234eef1022acdb1
Sha1:   d4b3052021ff3ad1dc4134fa25eb12a98e7c17da
Sha256: a57fadaf74db2fb457cfe761314d56f021d22146f5bdb6a8bf11b6519e8a558d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcca8556b-b044-489f-bc74-086aad62b062.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7591
x-amzn-requestid: e179862e-f840-4e50-a9dc-09f325479b9a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGgMFRZIAMFl7g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891e01-676a1571459f2d83488f2765;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 2pD4fv8j-zQzBZ9Pubo1-6UbvQpWMBb26ft_bn1pq9cWSCXsPXPW3g==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 21:53:25 GMT
age: 327
etag: "ffd0763f997e71a8c1458523fc17cafe8849dfdf"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7591
Md5:    d147ccb10bda82b153a596c3c967cd6a
Sha1:   ffd0763f997e71a8c1458523fc17cafe8849dfdf
Sha256: 1cfeb90a4ba027195f903d938d4a0aac418a1c2f0b52215ec023263f15905971
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F627a3f86-b7fa-44c4-a119-2e3d23eb8b6a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5354
x-amzn-requestid: 3d58ffea-3433-4c5c-a60b-17f6de3a33e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cSsnvG44oAMFfyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638427ca-63b375f04189b7ce7d84cd5d;Sampled=0
x-amzn-remapped-date: Mon, 28 Nov 2022 03:15:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GBhAilKMKo9RvIzqzF9V4jTZbvpa2rPZeoy6Jy8fMc1-JO078OAYzQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 05:53:40 GMT
age: 57912
etag: "65c8b4abf957f9b54d99d0f78559e639adb29efb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5354
Md5:    1e74254b3fdce7d6b84a71a7aff43789
Sha1:   65c8b4abf957f9b54d99d0f78559e639adb29efb
Sha256: f278c3cc6734da7188862a8c651c803e7ac1fda82234e191761453cb1359d3ee
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 06:00:50 GMT
age: 57482
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6174
Md5:    b986f9fcbeca91ed5c8d58fbfaf47d19
Sha1:   6e6c8bd2bce144cc4da1cd7be375b046b60dca79
Sha256: 07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7dc00fa-a8d3-44bf-ba84-1998d8dd7c5a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4309
x-amzn-requestid: c824c317-e6e3-4006-9f9d-ea54e8170a4c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cf2_tGErIAMF8_A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63896b97-7fc523296afea4dd4b5d1de8;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 03:05:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tp50A9LYeT1RvSPImBUoQNKtarPryKb8Zacm_nxqDh-gegwdQov7Nw==
via: 1.1 40b967aa4aa18637c4b91214147f3cb4.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 03:50:52 GMT
age: 65280
etag: "544428cdad754b1bb7be3cd46a79bf078fd5b450"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    fcb89ca25035b2bbb71ae5dd175fcd40
Sha1:   544428cdad754b1bb7be3cd46a79bf078fd5b450
Sha256: 36dcbbe6cd2710ee502776b4bcf32053e92b750a55e2bd4cdeadbc694c7c2699