urlquery - report: weretrtrtd975.gr.wy5532.com/

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	IP	Comment
r3.o.lencr.org (7)	344	2020-12-02 08:52:13 UTC	2022-12-08 17:12:06 UTC	23.33.119.27
track.domainparkingmanager.it (2)	0	2021-12-09 14:17:58 UTC	2022-12-08 18:52:56 UTC	35.180.17.130	Domain (domainparkingmanager.it) ranked at: 10493
firefox.settings.services.mozilla.com (2)	867	2020-05-25 20:06:39 UTC	2022-12-08 17:12:32 UTC	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03 12:26:46 UTC	2022-12-08 17:21:04 UTC	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27 18:32:35 UTC	2022-12-08 17:14:01 UTC	34.117.237.239
push.services.mozilla.com (1)	2140	2014-10-24 08:27:06 UTC	2022-12-08 17:20:00 UTC	52.24.78.9
ocsp.r2m02.amazontrust.com (1)	0	2022-10-12 14:01:39 UTC	2022-12-08 16:56:37 UTC	54.230.80.227	Domain (amazontrust.com) ranked at: 581
ocsp.digicert.com (1)	86	2012-05-21 07:02:23 UTC	2022-12-08 17:15:52 UTC	93.184.220.29
service.no.like.it (1)	0	2020-11-15 09:29:50 UTC	2022-12-08 18:52:57 UTC	35.180.205.178	Domain (like.it) ranked at: 326410
weretrtrtd975.gr.wy5532.com (3)	0	2022-12-08 19:34:50 UTC	2022-12-08 19:34:50 UTC	199.115.115.116	Unknown ranking
ocsp.sca1b.amazontrust.com (1)	1015	2016-02-14 02:37:56 UTC	2019-03-27 04:05:54 UTC	54.230.245.39
r.lnk8j7.com (2)	157579	2021-04-12 17:42:49 UTC	2022-12-08 13:37:04 UTC	54.230.111.4
img-getpocket.cdn.mozilla.net (6)	1631	2017-09-01 03:40:57 UTC	2022-12-08 15:50:00 UTC	34.120.237.76
thor-pom.com (3)	0	2022-12-07 15:02:37 UTC	2022-12-08 09:15:02 UTC	3.208.247.235	Unknown ranking
no.like.it (2)	0	2020-01-17 12:49:53 UTC	2022-12-08 18:52:57 UTC	185.25.205.112	Domain (like.it) ranked at: 326410

Scan Date	Severity	Indicator	Comment
2022-12-09	2	weretrtrtd975.gr.wy5532.com/	Malware

Date	UQ / IDS / BL	URL	IP
2023-02-02 00:45:04 +0000	0 - 0 - 3	uyclvmqe.tt.wy5532.com/	199.115.115.116
2023-01-24 08:54:19 +0000	0 - 0 - 1	simuladordeempresa.com/wp-content/new.exe	199.115.115.116
2023-01-20 14:50:55 +0000	0 - 0 - 2	1rer.38c43.aw.wy5532.com/	199.115.115.116
2023-01-19 12:05:13 +0000	0 - 2 - 1	iuyuyt.22e5e.tk.wy5532.com/	199.115.115.116
2023-01-12 09:09:17 +0000	0 - 2 - 2	mjurr.3cae8.cv.wy5532.com/	199.115.115.116

Date	UQ / IDS / BL	URL	IP
2023-02-03 12:46:42 +0000	0 - 0 - 5	linkhealthcaresystem.com/9e269449c0cbb2069078 (...)	162.210.196.167
2023-02-03 11:57:44 +0000	0 - 1 - 0	12kbps.xyz/repo/vir/others/memz.exe	207.244.65.58
2023-02-03 11:57:43 +0000	0 - 1 - 0	12kbps.xyz/repo/vir/others/windowspolicepro.exe	207.244.65.58
2023-02-03 02:55:14 +0000	0 - 0 - 3	andicomedicalsuppliers.com/chromestre/35on892 (...)	162.210.199.85
2023-02-03 00:10:10 +0000	0 - 0 - 0	www.pirate-bay.net	199.115.116.43

Date	UQ / IDS / BL	URL	IP
2023-02-02 10:55:45 +0000	0 - 0 - 1	qwqee.1e534.tv.wy5532.com/	37.48.65.148
2023-02-02 04:11:22 +0000	0 - 0 - 1	rhuugcf.wy5532.com/	81.171.22.5
2023-02-02 02:43:33 +0000	0 - 0 - 3	2490b.zz.wy5532.com/	37.48.65.149
2023-02-02 00:45:04 +0000	0 - 0 - 3	uyclvmqe.tt.wy5532.com/	199.115.115.116
2023-02-02 00:17:09 +0000	0 - 0 - 3	1de74.moedcc.wy5532.com/	81.171.22.5

Date	UQ / IDS / BL	URL	IP
2023-02-03 17:14:37 +0000	0 - 1 - 0	ema.doox.cloud/campaigns/cl375z3xbs4e6/track- (...)	137.74.189.147
2023-02-03 16:57:47 +0000	0 - 0 - 43	cintabaca.org/katalog/repository/final-stand- (...)	153.92.9.217
2023-02-03 09:22:10 +0000	0 - 0 - 2	fintechtds.com/CVHGv137	188.114.97.1
2023-02-03 06:51:31 +0000	0 - 0 - 0	ww16.jspm.jp.net/16097.php?sub1=20230203-1744 (...)	64.190.63.136
2023-02-03 06:47:44 +0000	0 - 0 - 0	ww16.jspm.jp.net/16097.php?sub1=20230203-1744 (...)	64.190.63.136

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.33.119.27 HASH: 89c5c0e2d6890798644174a8e31976aec03a1b3deb03812afbb520e5ed68f522 23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "89C5C0E2D6890798644174A8E31976AEC03A1B3DEB03812AFBB520E5ED68F522" Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15735 Expires: Fri, 09 Dec 2022 10:13:38 GMT Date: Fri, 09 Dec 2022 05:51:23 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 7181eff9c60e83eb0004ece591e47dca Sha1: 0fd8cd0c9d10b0547938982e57d2c43e2d98679f Sha256: 89c5c0e2d6890798644174a8e31976aec03a1b3deb03812afbb520e5ed68f522
GET / HTTP/1.1 Host: weretrtrtd975.gr.wy5532.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: weretrtrtd975.gr.wy5532.com/ FQDN: weretrtrtd975.gr.wy5532.com IP: 199.115.115.116 HASH: 173c1757a3187e4c076a0e2ddfd2f551af5c1910224cc312b405bf6b46637b22 199.115.115.116 HTTP/1.1 200 OK content-type: text/html; charset=utf-8 accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 488 date: Fri, 09 Dec 2022 05:51:23 GMT server: nginx set-cookie: sid=837dd3bc-7785-11ed-af5a-fe7a28e12699; path=/; domain=.wy5532.com; expires=Wed, 27 Dec 2090 09:05:30 GMT; max-age=2147483647; HttpOnly --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (488), with no line terminators Size: 488 Md5: 7a1a756de2db85f981ae83d45818a4bc Sha1: 5690d99bdbd9d756c6a99d200d5731ccd21c6acd Sha256: 173c1757a3187e4c076a0e2ddfd2f551af5c1910224cc312b405bf6b46637b22 Alerts: Blocklists: - fortinet: Malware
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.33.119.27 HASH: a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21 23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21" Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6993 Expires: Fri, 09 Dec 2022 07:47:56 GMT Date: Fri, 09 Dec 2022 05:51:23 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 388f6fea5bafa378266622b72311a6ee Sha1: 447f102dc12172ce1ba44c5e94e1d7bb49d43372 Sha256: a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.33.119.27 HASH: 4819229fd8f502a0c68c80bd7409e104c1b4d1a98ca8a6cd9deba629b1511aea 23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "4819229FD8F502A0C68C80BD7409E104C1B4D1A98CA8A6CD9DEBA629B1511AEA" Last-Modified: Thu, 08 Dec 2022 23:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=17282 Expires: Fri, 09 Dec 2022 10:39:25 GMT Date: Fri, 09 Dec 2022 05:51:23 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 4ee537977be9c03702f8ffe0025bf1fe Sha1: 21637881c4aa34c4add703f8bff4eff573159f45 Sha256: 4819229fd8f502a0c68c80bd7409e104c1b4d1a98ca8a6cd9deba629b1511aea
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/ FQDN: firefox.settings.services.mozilla.com IP: 35.241.9.150 HASH: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e 35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Fri, 09 Dec 2022 05:08:17 GMT age: 2586 cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: 14cd9a0afb6ba9a763651d5112760d1e Sha1: 75d7b104ab9ab11fbb73c3f348b43b0119b5adfa Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 34.160.144.191 HASH: 651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0 34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: B/o+MK1YDHkrtlZxC/Hhop6LE5B/kk32cAi1R7b6gnZ/He8INdVwsnLh/g11oimqOlE4wF1q8l4= x-amz-request-id: Z309Z814DXPN7JC5 content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Fri, 09 Dec 2022 05:48:12 GMT age: 192 last-modified: Wed, 30 Nov 2022 10:06:34 GMT etag: "53341dea33f4f3d9b4966f80589f429a" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 53341dea33f4f3d9b4966f80589f429a Sha1: 20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d Sha256: 651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Fri, 09 Dec 2022 05:51:24 GMT content-length: 12 access-control-expose-headers: content-type vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-credentials: true strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /favicon.ico HTTP/1.1 Host: weretrtrtd975.gr.wy5532.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://weretrtrtd975.gr.wy5532.com/ Cookie: sid=837dd3bc-7785-11ed-af5a-fe7a28e12699	URL: weretrtrtd975.gr.wy5532.com/favicon.ico FQDN: weretrtrtd975.gr.wy5532.com IP: 199.115.115.116 HASH: 907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9 199.115.115.116 HTTP/1.1 404 Not Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 9 date: Fri, 09 Dec 2022 05:51:23 GMT server: nginx --- Additional Info --- Magic: ASCII text, with no line terminators Size: 9 Md5: d8f4a1993546cc4b850cde3599e27aec Sha1: 094b763b4cfcc0b05e5d040581cd513c3ca08067 Sha256: 907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/buckets/main/c (...) FQDN: firefox.settings.services.mozilla.com IP: 35.241.9.150 HASH: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300 35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Alert, Cache-Control, Backoff, Content-Length, Content-Type, Last-Modified, ETag, Expires, Retry-After, Pragma content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Fri, 09 Dec 2022 05:07:55 GMT age: 2609 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 4143 Cache-Control: max-age=102271 Date: Fri, 09 Dec 2022 05:51:24 GMT Etag: "6391a92c-1d7" Expires: Sat, 10 Dec 2022 10:15:55 GMT Last-Modified: Thu, 08 Dec 2022 09:06:52 GMT Server: ECS (ska/F71B) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: fd55f4aaaab6ec40bc7dc10252cd819a Sha1: a72523f60be265a391fa9edc43e0a93418ad1fd0 Sha256: bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd
GET /?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3MDU3MjI4MywiaWF0IjoxNjcwNTY1MDgzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc25nazV0djMwcjMzcjMwZ28xc3FhbzYiLCJuYmYiOjE2NzA1NjUwODMsInRzIjoxNjcwNTY1MDgzODg0MTc1fQ.7W5TtzI-qLi8ICiQhgk5ioj2T_oK2ZiellQeKLweXAQ&sid=837dd3bc-7785-11ed-af5a-fe7a28e12699 HTTP/1.1 Host: weretrtrtd975.gr.wy5532.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://weretrtrtd975.gr.wy5532.com/ Cookie: sid=837dd3bc-7785-11ed-af5a-fe7a28e12699 Upgrade-Insecure-Requests: 1	URL: weretrtrtd975.gr.wy5532.com/?ch=1&js=eyJhbGciOiJIUzI1Ni (...) FQDN: weretrtrtd975.gr.wy5532.com IP: 199.115.115.116 HASH: e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47 199.115.115.116 HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Fri, 09 Dec 2022 05:51:24 GMT location: https://r.lnk8j7.com/link/br-js-fraud/v6RkJp7W6UWgi3QM2h4746?u=http%3A%2F%2Fwy5532.com&campaign_id=k9SEaoiiwt8PiqaSSUJ7J9 server: nginx set-cookie: sid=837dd3bc-7785-11ed-af5a-fe7a28e12699; path=/; domain=.wy5532.com; expires=Wed, 27 Dec 2090 09:05:31 GMT; max-age=2147483647; HttpOnly --- Additional Info --- Magic: ASCII text, with no line terminators Size: 11 Md5: 32682312d17c7cbf18e73594f5570319 Sha1: 60e22121bdd0bc71cdb2bae2a3aa577006b2eae9 Sha256: e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: 6CyOPOIvLlcC4RKGO0ahjA== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 52.24.78.9 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 52.24.78.9 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: KZYgRl3B1W+47uLGTLIO7XpBTr8= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.sca1b.amazontrust.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sca1b.amazontrust.com/ FQDN: ocsp.sca1b.amazontrust.com IP: 54.230.245.39 HASH: b53c3d3a04d55072d61455024f8d2af591a9b391e805c0ae843c4727450179ae 54.230.245.39 HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=154400 Date: Fri, 09 Dec 2022 05:51:25 GMT Etag: "6392750e-1d7" Expires: Sun, 11 Dec 2022 00:44:45 GMT Last-Modified: Thu, 08 Dec 2022 23:36:46 GMT Server: ECS (nyb/1D06) X-Cache: Miss from cloudfront Via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-P1 X-Amz-Cf-Id: kDOBqf-4Rwk69RhS8cJ7kWTAh629UPlwsjNbrU3gnk1IbmhbWXEioA== Age: 4079 --- Additional Info --- Magic: data Size: 471 Md5: 2ae7811bb6ad0b12a340c76e163b6dfb Sha1: 39cc10cce7bac2684959b5eba9e3bbec0c481b83 Sha256: b53c3d3a04d55072d61455024f8d2af591a9b391e805c0ae843c4727450179ae
GET /link/br-js-fraud/v6RkJp7W6UWgi3QM2h4746?u=http%3A%2F%2Fwy5532.com&campaign_id=k9SEaoiiwt8PiqaSSUJ7J9 HTTP/1.1 Host: r.lnk8j7.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://weretrtrtd975.gr.wy5532.com/ Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: r.lnk8j7.com/link/br-js-fraud/v6RkJp7W6UWgi3QM2h4746?u= (...) FQDN: r.lnk8j7.com IP: 54.230.111.4 HASH: d7760c3bcc8b0647e9abcddc229c84f75bf8d78c2071212400a65596dffb4b04 54.230.111.4 HTTP/2 200 OK content-type: text/html; charset=utf-8 content-length: 560 date: Fri, 09 Dec 2022 05:51:25 GMT x-amzn-requestid: 048b5c21-889c-49ed-b9f4-f2ece4e77054 referrer-policy: none, no-referrer, none, no-referrer content-encoding: gzip surrogate-control: no-store x-amzn-remapped-content-length: 1714 x-amz-apigw-id: c3TynFCXIAMFoUA= cache-control: no-store, no-cache, must-revalidate, proxy-revalidate expires: 0 etag: W/"6b2-iOxl6E5GOwird8/XOIbyFzsFH5c" x-powered-by: Express x-amzn-trace-id: Root=1-6392ccdd-3a5e33c84b49548b5f0ed1af;Sampled=0 pragma: no-cache x-cache: Miss from cloudfront via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-P1 x-amz-cf-id: a-xvqIYqbCp-eFNW5-wbeLVpFsu2kUksGu3FVjm8LSKYQ4DD_X5jSA== X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size: 560 Md5: a8d0c8893a6017757816a0d72d898fdf Sha1: 0564912f29fc6b0f1a00f13c359029da8825e2d8 Sha256: d7760c3bcc8b0647e9abcddc229c84f75bf8d78c2071212400a65596dffb4b04
GET /link/br/v6RkJp7W6UWgi3QM2h4746?referrer=http%3A%2F%2Fweretrtrtd975.gr.wy5532.com%2F&campaign_id=k9SEaoiiwt8PiqaSSUJ7J9&u=http%3A%2F%2Fwy5532.com HTTP/1.1 Host: r.lnk8j7.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: r.lnk8j7.com/link/br/v6RkJp7W6UWgi3QM2h4746?referrer=ht (...) FQDN: r.lnk8j7.com IP: 54.230.111.4 HASH: b2445ff9c3fd6fc2e0ca864e95f743e6adda123c395d904000d55c5a1d727193 54.230.111.4 HTTP/2 302 Found content-type: text/html; charset=utf-8 content-length: 183 location: https://thor-pom.com/zcvisitor/83af4194-7785-11ed-a322-0ad90c05d68f/1fe9cab0-90fa-11e9-a574-0a15cb739170?campaignid=e87e3540-17b8-11ed-9215-0a918cbcbb97 date: Fri, 09 Dec 2022 05:51:25 GMT x-amzn-requestid: 4528a27e-c4d6-4d39-9aff-be813d95647f referrer-policy: unsafe-url content-encoding: gzip surrogate-control: no-store x-amzn-remapped-content-length: 348 x-amz-apigw-id: c3TyrEagoAMFekA= cache-control: no-store, no-cache, must-revalidate, proxy-revalidate vary: Accept expires: 0 x-powered-by: Express x-amzn-trace-id: Root=1-6392ccdd-31f971125eb4eb380962cbaa;Sampled=0 pragma: no-cache x-cache: Miss from cloudfront via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-P1 x-amz-cf-id: sM8AYZAmVBb_sPe62WRJVD8EiRRm2huFkYggVlgwJaaXvZUcylTBFQ== X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document, ASCII text, with very long lines (348), with no line terminators Size: 183 Md5: 6542d015dd7c91d23eba6f8f6f778694 Sha1: 58301c125c0f152b44dea57b1c3db30169c5762d Sha256: b2445ff9c3fd6fc2e0ca864e95f743e6adda123c395d904000d55c5a1d727193
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.33.119.27 HASH: cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac 23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC" Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15775 Expires: Fri, 09 Dec 2022 10:14:21 GMT Date: Fri, 09 Dec 2022 05:51:26 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 48c90992f0837a58e0a36118a27dae6a Sha1: 3d238fed35e6d247bddbba92864e6b92e6aed9b6 Sha256: cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.33.119.27 HASH: cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac 23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC" Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15775 Expires: Fri, 09 Dec 2022 10:14:21 GMT Date: Fri, 09 Dec 2022 05:51:26 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 48c90992f0837a58e0a36118a27dae6a Sha1: 3d238fed35e6d247bddbba92864e6b92e6aed9b6 Sha256: cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.33.119.27 HASH: cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac 23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC" Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15775 Expires: Fri, 09 Dec 2022 10:14:21 GMT Date: Fri, 09 Dec 2022 05:51:26 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 48c90992f0837a58e0a36118a27dae6a Sha1: 3d238fed35e6d247bddbba92864e6b92e6aed9b6 Sha256: cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F345b9f5c-0162-4ba2-800e-223d402d28bf.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: ab70390c49c5bb3dd7e97ba008c01213a59b3bc271aa8a350ab35ff422d8b3fd 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 3030 x-amzn-requestid: c5e5e4a1-bc45-42e8-a021-9c8f99e22556 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: czUqCFWBoAMFiqg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-639134a6-5cc9bdf360f2bfb54e16b448;Sampled=0 x-amzn-remapped-date: Thu, 08 Dec 2022 00:49:42 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: x5FUJ8Cbw9B9BWcHlencYw564Xri5cgoVXkQ2MbhEjYq7Y5v2P0IxQ== via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google date: Thu, 08 Dec 2022 11:18:08 GMT age: 66798 etag: "33edd1469c54a08e3c4cb0003b87b225eba55b3f" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 3030 Md5: a1be0ae00ba0c6009ac14c8df38b8ad0 Sha1: 33edd1469c54a08e3c4cb0003b87b225eba55b3f Sha256: ab70390c49c5bb3dd7e97ba008c01213a59b3bc271aa8a350ab35ff422d8b3fd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6f3c5738-c186-4a1f-a431-33143797bcd5.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: f14393b6bcc036fa9ed61114944ebb25192adfec72c09807eb7948a88c790d69 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8345 x-amzn-requestid: b1cf2094-2cf5-4e19-9ed7-4d7e220c93cd x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: czUoREPoIAMF4hg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6391349b-1b78fe0a155179643ae2aeed;Sampled=0 x-amzn-remapped-date: Thu, 08 Dec 2022 00:49:31 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: YMFI6I2o0A4rGZTluooPsDLGNRRY9kSAfDAFrwzXhIG4HC_W-hFIoQ== via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google date: Thu, 08 Dec 2022 11:31:33 GMT age: 65993 etag: "4792b0893827924e84cc51450012407717da4d2b" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8345 Md5: 659b6eb1f1c430e2780758c7787b9a23 Sha1: 4792b0893827924e84cc51450012407717da4d2b Sha256: f14393b6bcc036fa9ed61114944ebb25192adfec72c09807eb7948a88c790d69
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F042317d8-45b6-4c5f-8767-ff9367c24193.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 2118ec68c738683d8f7e11b95239ca92fda2b9b5054aa7b128267eec0d0634c5 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8803 x-amzn-requestid: e8516be3-5ce9-4f15-b522-c81c1e57a0e2 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: cjtK9GavoAMFjpA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-638af579-538cc8f300938698004f2241;Sampled=0 x-amzn-remapped-date: Sat, 03 Dec 2022 07:06:33 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: MiOdXHxd9Vmeji8Yqd8LG_EqYoMGf0YBy6by9bhfjb12y1OxKVvvqw== via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google date: Fri, 09 Dec 2022 03:56:08 GMT age: 6918 etag: "c47af4e5770daad212f4290527b00321285105f8" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8803 Md5: 46275ec87d8221804dbb99f95b035131 Sha1: c47af4e5770daad212f4290527b00321285105f8 Sha256: 2118ec68c738683d8f7e11b95239ca92fda2b9b5054aa7b128267eec0d0634c5
POST / HTTP/1.1 Host: ocsp.r2m02.amazontrust.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.r2m02.amazontrust.com/ FQDN: ocsp.r2m02.amazontrust.com IP: 54.230.80.227 HASH: 2489ded5512791f01152b528715ef9464ec313306f1ee0a53b6c4f4dbeea6d3e 54.230.80.227 HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=128398 Date: Fri, 09 Dec 2022 05:51:26 GMT Etag: "63920a2e-1d7" Expires: Sat, 10 Dec 2022 17:31:24 GMT Last-Modified: Thu, 08 Dec 2022 16:00:46 GMT Server: ECS (nyb/1D34) X-Cache: Miss from cloudfront Via: 1.1 b2b04ca80b95df6bc86478a1bf96b7cc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-P1 X-Amz-Cf-Id: 1zJsbJOcWRZRJ2jOlXawv1xcNcw-X7TlSlhMjOwS4MhSB6liaah_cQ== Age: 5438 --- Additional Info --- Magic: data Size: 471 Md5: eae7d6e81bf1e19da44844eab9fe131f Sha1: eac5e6264b0d1f90ae7cd91bcd7329302ead2566 Sha256: 2489ded5512791f01152b528715ef9464ec313306f1ee0a53b6c4f4dbeea6d3e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 6e639298ebc82343cee9267d2910d15735af55f910e2c3de9218266b7c6fffc9 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5188 x-amzn-requestid: afb8cbd2-3674-4dac-9cd9-9ff83618ac0a x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ck2-5G9joAMFlPA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-638b6b92-2979ff216b9028aa70baef8b;Sampled=0 x-amzn-remapped-date: Sat, 03 Dec 2022 15:30:26 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: dGxzuQ6zj6wXQbkBuKBnOKxwKJDHUyGoi7PgcugcpdX4QYruNiFxsQ== via: 1.1 8ae6af4d17aae7471e5fe2792eb6abcc.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google date: Thu, 08 Dec 2022 21:51:24 GMT age: 28802 etag: "8fbff7725c842d70e047c635a725723a9dc9c55a" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5188 Md5: fba9a3854df65740512f96efe7442e58 Sha1: 8fbff7725c842d70e047c635a725723a9dc9c55a Sha256: 6e639298ebc82343cee9267d2910d15735af55f910e2c3de9218266b7c6fffc9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29d00d08-ec53-4c7b-a2ef-5901b64cdefd.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: fdb114eb142f035c7a54195d16af51b5b423642c312f4bccc0f407d8fcc245aa 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7557 x-amzn-requestid: 09204b5e-8af5-4d4b-8186-628443866e0f x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ctlz5EISoAMFdWw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-638ee9b2-357cd4f921c592e1319098dd;Sampled=0 x-amzn-remapped-date: Tue, 06 Dec 2022 07:05:22 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: 3KZwQ5HqXa_-tUyDHA5m-65OprogFpFgbbKpEJ65k-Yy3lwoCg8M5w== via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google date: Thu, 08 Dec 2022 07:15:07 GMT age: 81379 etag: "cde4c7fa0145d3645af17e34c83c63c08f76a076" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7557 Md5: 5de5d319f43d9c9c641419d96655541f Sha1: cde4c7fa0145d3645af17e34c83c63c08f76a076 Sha256: fdb114eb142f035c7a54195d16af51b5b423642c312f4bccc0f407d8fcc245aa
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F18fc6c7c-4552-4358-9e4d-cdf93bc52b43.webp HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: d7a7eeb42d36167243b3dea7147a61119cbb5d1dcc2e2304c6ddd4a62e41efd3 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4914 x-amzn-requestid: b709d5ff-617b-480b-8fc3-b1408ee358b6 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: cZQsoEkSIAMF0ZA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6386c7ea-4150ac397b97d1217cece045;Sampled=0 x-amzn-remapped-date: Wed, 30 Nov 2022 03:03:06 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: 8DqbjuQMX0JOMpduQ1-wy_B1a957NXgsAHrZc1OwUzsmqJRKfkEpoA== via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google date: Thu, 08 Dec 2022 21:49:06 GMT age: 28940 etag: "6ae9a3c17dcbac5912a46ca0c99977ca3adad4ea" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4914 Md5: 06799a30d9977b0845f525ae82355d23 Sha1: 6ae9a3c17dcbac5912a46ca0c99977ca3adad4ea Sha256: d7a7eeb42d36167243b3dea7147a61119cbb5d1dcc2e2304c6ddd4a62e41efd3
GET /favicon.ico HTTP/1.1 Host: thor-pom.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://thor-pom.com/zcredirect?visitid=83af4194-7785-11ed-a322-0ad90c05d68f&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: thor-pom.com/favicon.ico FQDN: thor-pom.com IP: 3.208.247.235 HASH: 879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8 3.208.247.235 HTTP/2 404 Not Found content-type: text/html;charset=utf-8 date: Fri, 09 Dec 2022 05:51:26 GMT content-length: 653 cache-control: no-store, no-cache, pre-check=0, post-check=0 content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' x-webkit-csp: default-src 'self'; script-src 'self' 'unsafe-inline' content-language: en server: vrWuBKOW X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators Size: 653 Md5: ba2732b1b2fa2626ffaa15f62f9e7d66 Sha1: 203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe Sha256: 879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8
GET /zcredirect?visitid=83af4194-7785-11ed-a322-0ad90c05d68f&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false HTTP/1.1 Host: thor-pom.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://thor-pom.com/zcvisitor/83af4194-7785-11ed-a322-0ad90c05d68f/1fe9cab0-90fa-11e9-a574-0a15cb739170?campaignid=e87e3540-17b8-11ed-9215-0a918cbcbb97 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: thor-pom.com/zcredirect?visitid=83af4194-7785-11ed-a322 (...) FQDN: thor-pom.com IP: 3.208.247.235 HASH: 4821cb1e28dd673997546149174bf404c873b73da840fdf738a624adcc0fff4e 3.208.247.235 HTTP/2 200 OK content-type: text/html;charset=UTF-8 date: Fri, 09 Dec 2022 05:51:26 GMT cache-control: no-store, no-cache, pre-check=0, post-check=0 content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' x-webkit-csp: default-src 'self'; script-src 'self' 'unsafe-inline' access-control-allow-origin: * access-control-allow-methods: GET,POST,OPTIONS access-control-allow-headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag redirected: JS server: oUiOYUdF X-Firefox-Spdy: h2 --- Additional Info --- Magic: data Size: 827 Md5: a4acabfdaa9ef2ab4b931fb0f5df6c2f Sha1: c849a33f72754307c6b60e29b2af4dec79b4be72 Sha256: 4821cb1e28dd673997546149174bf404c873b73da840fdf738a624adcc0fff4e
GET /favicon.ico HTTP/1.1 Host: track.domainparkingmanager.it User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://track.domainparkingmanager.it/tm.ashx?source=zp-1-1891178&det=0.010000&gio=zr83af4194778511eda3220ad90c05d68f03f9fdb81adf4553bc2ab9b3579e019a069581d43f57290d27 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: track.domainparkingmanager.it/favicon.ico FQDN: track.domainparkingmanager.it IP: 35.180.17.130 HASH: dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f 35.180.17.130 HTTP/2 404 Not Found content-type: text/html server: Microsoft-IIS/10.0 x-powered-by: ASP.NET access-control-allow-origin: * date: Fri, 09 Dec 2022 05:51:26 GMT content-length: 1245 X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators Size: 1245 Md5: 5343c1a8b203c162a3bf3870d9f50fd4 Sha1: 04b5b886c20d88b57eea6d8ff882624a4ac1e51d Sha256: dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
GET /tm2.ashx?&source=zp-1-1891178&pubid=zr83af4194778511eda3220ad90c05d68f03f9fdb81adf4553&cost=0.010000 HTTP/1.1 Host: track.domainparkingmanager.it User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://track.domainparkingmanager.it/tm.ashx?source=zp-1-1891178&det=0.010000&gio=zr83af4194778511eda3220ad90c05d68f03f9fdb81adf4553bc2ab9b3579e019a069581d43f57290d27 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: track.domainparkingmanager.it/tm2.ashx?&source=zp-1-189 (...) FQDN: track.domainparkingmanager.it IP: 35.180.17.130 HASH: 12c579efcf0764649601111907e6c63bb7e31b074bc3c4fa78da027c7f1ef362 35.180.17.130 HTTP/2 302 Found content-type: text/html; charset=utf-8 cache-control: private location: https://service.no.like.it/in.ashx?c=1171 server: Microsoft-IIS/10.0 x-frame-options: SAMEORIGIN x-aspnet-version: 4.0.30319 x-powered-by: ASP.NET access-control-allow-origin: * date: Fri, 09 Dec 2022 05:51:26 GMT content-length: 158 X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Size: 158 Md5: c184564c5f290572d03b0323eea4a55c Sha1: 69da0e3bf633ce90de367906bec08827b7bf6bc4 Sha256: 12c579efcf0764649601111907e6c63bb7e31b074bc3c4fa78da027c7f1ef362
GET /in.ashx?c=1171 HTTP/1.1 Host: service.no.like.it User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://track.domainparkingmanager.it/ Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: service.no.like.it/in.ashx?c=1171 FQDN: service.no.like.it IP: 35.180.205.178 HASH: 82b57c6d9359d03e5b8155eccc94643f0d4455ec79baeae0de6b3de90c44abcd 35.180.205.178 HTTP/2 302 Found content-type: text/html; charset=utf-8 cache-control: no-cache pragma: no-cache expires: -1 location: https://no.like.it/Search?q=loc no reisebyra i danmark buss&country=no&language=no server: Microsoft-IIS/10.0 x-frame-options: SAMEORIGIN x-aspnet-version: 4.0.30319 set-cookie: clkmrctrvsprx=http://domainparking.io/out.aspx?keyword=loc+no+reisebyra+i+danmark+buss&c=1171&logcookie=28599855; domain=no.like.it; expires=Fri, 09-Dec-2022 05:52:27 GMT; path=/; secure; SameSite=None x-powered-by: ASP.NET access-control-allow-origin: * date: Fri, 09 Dec 2022 05:51:27 GMT content-length: 207 X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Size: 207 Md5: 4d1b4170ae3c54c6c52e46320c880c6b Sha1: 82923a3baa2313203d8203f87d906249e2acf708 Sha256: 82b57c6d9359d03e5b8155eccc94643f0d4455ec79baeae0de6b3de90c44abcd
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.33.119.27 HASH: d0b7f4106ec3de21898dc46a1d5bb52c84a35f3ff825a2b86e4e800f9e573c9c 23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "D0B7F4106EC3DE21898DC46A1D5BB52C84A35F3FF825A2B86E4E800F9E573C9C" Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=18819 Expires: Fri, 09 Dec 2022 11:05:06 GMT Date: Fri, 09 Dec 2022 05:51:27 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 896eeb4edbd5fe1218c880804c064211 Sha1: 469f152a7ec28390561681376b1f1411e2a29ad6 Sha256: d0b7f4106ec3de21898dc46a1d5bb52c84a35f3ff825a2b86e4e800f9e573c9c
GET /Search?q=loc%20no%20reisebyra%20i%20danmark%20buss&country=no&language=no HTTP/1.1 Host: no.like.it User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://track.domainparkingmanager.it/ Connection: keep-alive Cookie: clkmrctrvsprx=http://domainparking.io/out.aspx?keyword=loc+no+reisebyra+i+danmark+buss&c=1171&logcookie=28599855 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: no.like.it/Search?q=loc%20no%20reisebyra%20i%20danmark% (...) FQDN: no.like.it IP: 185.25.205.112 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 185.25.205.112 HTTP/2 200 OK content-type: text/html server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Fri, 09 Dec 2022 05:49:08 GMT content-length: 0 X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1 Host: no.like.it User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://no.like.it/Search?q=loc%20no%20reisebyra%20i%20danmark%20buss&country=no&language=no Cookie: clkmrctrvsprx=http://domainparking.io/out.aspx?keyword=loc+no+reisebyra+i+danmark+buss&c=1171&logcookie=28599855 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: no.like.it/favicon.ico FQDN: no.like.it IP: 185.25.205.112 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 185.25.205.112 HTTP/2 200 OK content-type: text/html server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Fri, 09 Dec 2022 05:49:08 GMT content-length: 0 X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /zcvisitor/83af4194-7785-11ed-a322-0ad90c05d68f/1fe9cab0-90fa-11e9-a574-0a15cb739170?campaignid=e87e3540-17b8-11ed-9215-0a918cbcbb97 HTTP/1.1 Host: thor-pom.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: thor-pom.com/zcvisitor/83af4194-7785-11ed-a322-0ad90c05 (...) FQDN: thor-pom.com IP: 3.208.247.235 3.208.247.235 HTTP/2 200 OK content-type: text/html;charset=UTF-8 date: Fri, 09 Dec 2022 05:51:26 GMT cache-control: no-store, no-cache, pre-check=0, post-check=0 content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' x-webkit-csp: default-src 'self'; script-src 'self' 'unsafe-inline' access-control-allow-origin: * access-control-allow-methods: GET,POST,OPTIONS access-control-allow-headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag server: oUiOYUdF X-Firefox-Spdy: h2 --- Additional Info ---

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.33.119.27

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "89C5C0E2D6890798644174A8E31976AEC03A1B3DEB03812AFBB520E5ED68F522" 

                                        
                                            
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=15735 

                                        
                                            
Expires: Fri, 09 Dec 2022 10:13:38 GMT 

                                        
                                            
Date: Fri, 09 Dec 2022 05:51:23 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    7181eff9c60e83eb0004ece591e47dca

                                                Sha1:   0fd8cd0c9d10b0547938982e57d2c43e2d98679f

                                                Sha256: 89c5c0e2d6890798644174a8e31976aec03a1b3deb03812afbb520e5ed68f522

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.33.119.27

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21" 

                                        
                                            
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=6993 

                                        
                                            
Expires: Fri, 09 Dec 2022 07:47:56 GMT 

                                        
                                            
Date: Fri, 09 Dec 2022 05:51:23 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    388f6fea5bafa378266622b72311a6ee

                                                Sha1:   447f102dc12172ce1ba44c5e94e1d7bb49d43372

                                                Sha256: a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21

                                        
                                            GET /v1/ HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         35.241.9.150

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/json

                                        

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type 

                                        
                                            
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
content-length: 939 

                                        
                                            
via: 1.1 google 

                                        
                                            
date: Fri, 09 Dec 2022 05:08:17 GMT 

                                        
                                            
age: 2586 

                                        
                                            
cache-control: max-age=3600,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators

                                                Size:   939

                                                Md5:    14cd9a0afb6ba9a763651d5112760d1e

                                                Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa

                                                Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

                                        
                                            GET /v1/tiles HTTP/1.1 

                                        
                                            
Host: contile.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.117.237.239

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/json

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Fri, 09 Dec 2022 05:51:24 GMT 

                                        
                                            
content-length: 12 

                                        
                                            
access-control-expose-headers: content-type 

                                        
                                            
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers 

                                        
                                            
access-control-allow-credentials: true 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
via: 1.1 google 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with no line terminators

                                                Size:   12

                                                Md5:    23e88fb7b99543fb33315b29b1fad9d6

                                                Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

                                                Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: application/json 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/json 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         35.241.9.150

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/json

                                        

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
access-control-expose-headers: Alert, Cache-Control, Backoff, Content-Length, Content-Type, Last-Modified, ETag, Expires, Retry-After, Pragma 

                                        
                                            
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
content-length: 329 

                                        
                                            
via: 1.1 google 

                                        
                                            
date: Fri, 09 Dec 2022 05:07:55 GMT 

                                        
                                            
age: 2609 

                                        
                                            
last-modified: Fri, 25 Mar 2022 17:45:46 GMT 

                                        
                                            
etag: "1648230346554" 

                                        
                                            
cache-control: max-age=3600,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators

                                                Size:   329

                                                Md5:    0333b0655111aa68de771adfcc4db243

                                                Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb

                                                Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

                                        
                                            GET /?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3MDU3MjI4MywiaWF0IjoxNjcwNTY1MDgzLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc25nazV0djMwcjMzcjMwZ28xc3FhbzYiLCJuYmYiOjE2NzA1NjUwODMsInRzIjoxNjcwNTY1MDgzODg0MTc1fQ.7W5TtzI-qLi8ICiQhgk5ioj2T_oK2ZiellQeKLweXAQ&sid=837dd3bc-7785-11ed-af5a-fe7a28e12699 HTTP/1.1 

                                        
                                            
Host: weretrtrtd975.gr.wy5532.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: http://weretrtrtd975.gr.wy5532.com/ 

                                        
                                            
Cookie: sid=837dd3bc-7785-11ed-af5a-fe7a28e12699 

                                        
                                            
Upgrade-Insecure-Requests: 1

                                         199.115.115.116

                                        
                                            HTTP/1.1 302 Found

                                        

                                        
                                            
cache-control: max-age=0, private, must-revalidate 

                                        
                                            
connection: close 

                                        
                                            
content-length: 11 

                                        
                                            
date: Fri, 09 Dec 2022 05:51:24 GMT 

                                        
                                            
location: https://r.lnk8j7.com/link/br-js-fraud/v6RkJp7W6UWgi3QM2h4746?u=http%3A%2F%2Fwy5532.com&campaign_id=k9SEaoiiwt8PiqaSSUJ7J9 

                                        
                                            
server: nginx 

                                        
                                            
set-cookie: sid=837dd3bc-7785-11ed-af5a-fe7a28e12699; path=/; domain=.wy5532.com; expires=Wed, 27 Dec 2090 09:05:31 GMT; max-age=2147483647; HttpOnly 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  ASCII text, with no line terminators

                                                Size:   11

                                                Md5:    32682312d17c7cbf18e73594f5570319

                                                Sha1:   60e22121bdd0bc71cdb2bae2a3aa577006b2eae9

                                                Sha256: e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.sca1b.amazontrust.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         54.230.245.39

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Content-Length: 471 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Cache-Control: max-age=154400 

                                        
                                            
Date: Fri, 09 Dec 2022 05:51:25 GMT 

                                        
                                            
Etag: "6392750e-1d7" 

                                        
                                            
Expires: Sun, 11 Dec 2022 00:44:45 GMT 

                                        
                                            
Last-Modified: Thu, 08 Dec 2022 23:36:46 GMT 

                                        
                                            
Server: ECS (nyb/1D06) 

                                        
                                            
X-Cache: Miss from cloudfront 

                                        
                                            
Via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront) 

                                        
                                            
X-Amz-Cf-Pop: OSL50-P1 

                                        
                                            
X-Amz-Cf-Id: kDOBqf-4Rwk69RhS8cJ7kWTAh629UPlwsjNbrU3gnk1IbmhbWXEioA== 

                                        
                                            
Age: 4079 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   471

                                                Md5:    2ae7811bb6ad0b12a340c76e163b6dfb

                                                Sha1:   39cc10cce7bac2684959b5eba9e3bbec0c481b83

                                                Sha256: b53c3d3a04d55072d61455024f8d2af591a9b391e805c0ae843c4727450179ae

                                        
                                            GET /link/br/v6RkJp7W6UWgi3QM2h4746?referrer=http%3A%2F%2Fweretrtrtd975.gr.wy5532.com%2F&campaign_id=k9SEaoiiwt8PiqaSSUJ7J9&u=http%3A%2F%2Fwy5532.com HTTP/1.1 

                                        
                                            
Host: r.lnk8j7.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         54.230.111.4

                                        
                                            HTTP/2 302 Found 

                                        
                                            
content-type: text/html; charset=utf-8

                                        

                                        
                                            
content-length: 183 

                                        
                                            
location: https://thor-pom.com/zcvisitor/83af4194-7785-11ed-a322-0ad90c05d68f/1fe9cab0-90fa-11e9-a574-0a15cb739170?campaignid=e87e3540-17b8-11ed-9215-0a918cbcbb97 

                                        
                                            
date: Fri, 09 Dec 2022 05:51:25 GMT 

                                        
                                            
x-amzn-requestid: 4528a27e-c4d6-4d39-9aff-be813d95647f 

                                        
                                            
referrer-policy: unsafe-url 

                                        
                                            
content-encoding: gzip 

                                        
                                            
surrogate-control: no-store 

                                        
                                            
x-amzn-remapped-content-length: 348 

                                        
                                            
x-amz-apigw-id: c3TyrEagoAMFekA= 

                                        
                                            
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate 

                                        
                                            
vary: Accept 

                                        
                                            
expires: 0 

                                        
                                            
x-powered-by: Express 

                                        
                                            
x-amzn-trace-id: Root=1-6392ccdd-31f971125eb4eb380962cbaa;Sampled=0 

                                        
                                            
pragma: no-cache 

                                        
                                            
x-cache: Miss from cloudfront 

                                        
                                            
via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-P1 

                                        
                                            
x-amz-cf-id: sM8AYZAmVBb_sPe62WRJVD8EiRRm2huFkYggVlgwJaaXvZUcylTBFQ== 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  HTML document, ASCII text, with very long lines (348), with no line terminators

                                                Size:   183

                                                Md5:    6542d015dd7c91d23eba6f8f6f778694

                                                Sha1:   58301c125c0f152b44dea57b1c3db30169c5762d

                                                Sha256: b2445ff9c3fd6fc2e0ca864e95f743e6adda123c395d904000d55c5a1d727193

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.33.119.27

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC" 

                                        
                                            
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=15775 

                                        
                                            
Expires: Fri, 09 Dec 2022 10:14:21 GMT 

                                        
                                            
Date: Fri, 09 Dec 2022 05:51:26 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    48c90992f0837a58e0a36118a27dae6a

                                                Sha1:   3d238fed35e6d247bddbba92864e6b92e6aed9b6

                                                Sha256: cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F345b9f5c-0162-4ba2-800e-223d402d28bf.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 3030 

                                        
                                            
x-amzn-requestid: c5e5e4a1-bc45-42e8-a021-9c8f99e22556 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: czUqCFWBoAMFiqg= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-639134a6-5cc9bdf360f2bfb54e16b448;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Thu, 08 Dec 2022 00:49:42 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Miss from cloudfront 

                                        
                                            
x-amz-cf-id: x5FUJ8Cbw9B9BWcHlencYw564Xri5cgoVXkQ2MbhEjYq7Y5v2P0IxQ== 

                                        
                                            
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Thu, 08 Dec 2022 11:18:08 GMT 

                                        
                                            
age: 66798 

                                        
                                            
etag: "33edd1469c54a08e3c4cb0003b87b225eba55b3f" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   3030

                                                Md5:    a1be0ae00ba0c6009ac14c8df38b8ad0

                                                Sha1:   33edd1469c54a08e3c4cb0003b87b225eba55b3f

                                                Sha256: ab70390c49c5bb3dd7e97ba008c01213a59b3bc271aa8a350ab35ff422d8b3fd

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F042317d8-45b6-4c5f-8767-ff9367c24193.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 8803 

                                        
                                            
x-amzn-requestid: e8516be3-5ce9-4f15-b522-c81c1e57a0e2 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: cjtK9GavoAMFjpA= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-638af579-538cc8f300938698004f2241;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Sat, 03 Dec 2022 07:06:33 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: MiOdXHxd9Vmeji8Yqd8LG_EqYoMGf0YBy6by9bhfjb12y1OxKVvvqw== 

                                        
                                            
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Fri, 09 Dec 2022 03:56:08 GMT 

                                        
                                            
age: 6918 

                                        
                                            
etag: "c47af4e5770daad212f4290527b00321285105f8" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   8803

                                                Md5:    46275ec87d8221804dbb99f95b035131

                                                Sha1:   c47af4e5770daad212f4290527b00321285105f8

                                                Sha256: 2118ec68c738683d8f7e11b95239ca92fda2b9b5054aa7b128267eec0d0634c5

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60d2c55a-1a85-4fbf-b256-9d812a2b5ec2.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 5188 

                                        
                                            
x-amzn-requestid: afb8cbd2-3674-4dac-9cd9-9ff83618ac0a 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: ck2-5G9joAMFlPA= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-638b6b92-2979ff216b9028aa70baef8b;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Sat, 03 Dec 2022 15:30:26 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: dGxzuQ6zj6wXQbkBuKBnOKxwKJDHUyGoi7PgcugcpdX4QYruNiFxsQ== 

                                        
                                            
via: 1.1 8ae6af4d17aae7471e5fe2792eb6abcc.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Thu, 08 Dec 2022 21:51:24 GMT 

                                        
                                            
age: 28802 

                                        
                                            
etag: "8fbff7725c842d70e047c635a725723a9dc9c55a" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   5188

                                                Md5:    fba9a3854df65740512f96efe7442e58

                                                Sha1:   8fbff7725c842d70e047c635a725723a9dc9c55a

                                                Sha256: 6e639298ebc82343cee9267d2910d15735af55f910e2c3de9218266b7c6fffc9

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F18fc6c7c-4552-4358-9e4d-cdf93bc52b43.webp HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 4914 

                                        
                                            
x-amzn-requestid: b709d5ff-617b-480b-8fc3-b1408ee358b6 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: cZQsoEkSIAMF0ZA= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6386c7ea-4150ac397b97d1217cece045;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Wed, 30 Nov 2022 03:03:06 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: 8DqbjuQMX0JOMpduQ1-wy_B1a957NXgsAHrZc1OwUzsmqJRKfkEpoA== 

                                        
                                            
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Thu, 08 Dec 2022 21:49:06 GMT 

                                        
                                            
age: 28940 

                                        
                                            
etag: "6ae9a3c17dcbac5912a46ca0c99977ca3adad4ea" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   4914

                                                Md5:    06799a30d9977b0845f525ae82355d23

                                                Sha1:   6ae9a3c17dcbac5912a46ca0c99977ca3adad4ea

                                                Sha256: d7a7eeb42d36167243b3dea7147a61119cbb5d1dcc2e2304c6ddd4a62e41efd3

                                        
                                            GET /zcredirect?visitid=83af4194-7785-11ed-a322-0ad90c05d68f&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false HTTP/1.1 

                                        
                                            
Host: thor-pom.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://thor-pom.com/zcvisitor/83af4194-7785-11ed-a322-0ad90c05d68f/1fe9cab0-90fa-11e9-a574-0a15cb739170?campaignid=e87e3540-17b8-11ed-9215-0a918cbcbb97 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         3.208.247.235

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html;charset=UTF-8

                                        

                                        
                                            
date: Fri, 09 Dec 2022 05:51:26 GMT 

                                        
                                            
cache-control: no-store, no-cache, pre-check=0, post-check=0 

                                        
                                            
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 

                                        
                                            
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 

                                        
                                            
x-webkit-csp: default-src 'self'; script-src 'self' 'unsafe-inline' 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
access-control-allow-methods: GET,POST,OPTIONS 

                                        
                                            
access-control-allow-headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag 

                                        
                                            
redirected: JS 

                                        
                                            
server: oUiOYUdF 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   827

                                                Md5:    a4acabfdaa9ef2ab4b931fb0f5df6c2f

                                                Sha1:   c849a33f72754307c6b60e29b2af4dec79b4be72

                                                Sha256: 4821cb1e28dd673997546149174bf404c873b73da840fdf738a624adcc0fff4e

                                        
                                            GET /tm2.ashx?&source=zp-1-1891178&pubid=zr83af4194778511eda3220ad90c05d68f03f9fdb81adf4553&cost=0.010000 HTTP/1.1 

                                        
                                            
Host: track.domainparkingmanager.it

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://track.domainparkingmanager.it/tm.ashx?source=zp-1-1891178&det=0.010000&gio=zr83af4194778511eda3220ad90c05d68f03f9fdb81adf4553bc2ab9b3579e019a069581d43f57290d27 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         35.180.17.130

                                        
                                            HTTP/2 302 Found 

                                        
                                            
content-type: text/html; charset=utf-8

                                        

                                        
                                            
cache-control: private 

                                        
                                            
location: https://service.no.like.it/in.ashx?c=1171 

                                        
                                            
server: Microsoft-IIS/10.0 

                                        
                                            
x-frame-options: SAMEORIGIN 

                                        
                                            
x-aspnet-version: 4.0.30319 

                                        
                                            
x-powered-by: ASP.NET 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
date: Fri, 09 Dec 2022 05:51:26 GMT 

                                        
                                            
content-length: 158 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators

                                                Size:   158

                                                Md5:    c184564c5f290572d03b0323eea4a55c

                                                Sha1:   69da0e3bf633ce90de367906bec08827b7bf6bc4

                                                Sha256: 12c579efcf0764649601111907e6c63bb7e31b074bc3c4fa78da027c7f1ef362

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.33.119.27

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "D0B7F4106EC3DE21898DC46A1D5BB52C84A35F3FF825A2B86E4E800F9E573C9C" 

                                        
                                            
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=18819 

                                        
                                            
Expires: Fri, 09 Dec 2022 11:05:06 GMT 

                                        
                                            
Date: Fri, 09 Dec 2022 05:51:27 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    896eeb4edbd5fe1218c880804c064211

                                                Sha1:   469f152a7ec28390561681376b1f1411e2a29ad6

                                                Sha256: d0b7f4106ec3de21898dc46a1d5bb52c84a35f3ff825a2b86e4e800f9e573c9c

                                        
                                            GET /favicon.ico HTTP/1.1 

                                        
                                            
Host: no.like.it

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://no.like.it/Search?q=loc%20no%20reisebyra%20i%20danmark%20buss&country=no&language=no 

                                        
                                            
Cookie: clkmrctrvsprx=http://domainparking.io/out.aspx?keyword=loc+no+reisebyra+i+danmark+buss&c=1171&logcookie=28599855 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         185.25.205.112

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html

                                        

                                        
                                            
server: Microsoft-IIS/10.0 

                                        
                                            
x-powered-by: ASP.NET 

                                        
                                            
date: Fri, 09 Dec 2022 05:49:08 GMT 

                                        
                                            
content-length: 0 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

URL	weretrtrtd975.gr.wy5532.com/
IP	199.115.115.116 (United States)
ASN	#30633 LEASEWEB-USA-WDC
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed	2022-12-09 05:51:34 UTC
Status	Loading report..
IDS alerts	0
Blocklist alert	1
urlquery alerts	No alerts detected
Tags	None

Overview

Domain Summary (15)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 199.115.115.116

Last 5 reports on ASN: LEASEWEB-USA-WDC

Last 5 reports on domain: wy5532.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (5)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (34)

Overview

Domain Summary (15)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 199.115.115.116

Last 5 reports on ASN: LEASEWEB-USA-WDC

Last 5 reports on domain: wy5532.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (5)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (34)

Network Intrusion Detection Systems