Report - orcawave.xyz/officev4.zip

Report Overview

Submitted URL
orcawave.xyz/officev4.zip
IP
198.54.117.242
ASN
#22612 NAMECHEAP-NET
Submitted
2022-12-06 18:13:13
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.77.32
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	3.8 kB	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
orcawave.xyz	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	356 B	17 kB	198.54.117.242
static.nc-img.com	159061	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	6.0 kB	218 kB	104.17.182.52
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	52.34.4.233
ocsp.sectigo.com	487	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	340 B	773 B	104.18.32.68
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	75 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-12-06	medium	orcawave.xyz/officev4.zip	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	static.nc-img.com/uiraa/libs/polyfills_469970f8ffedace1b5b8.js	187 kB	2023-03-07	2024-04-25
Pretty URL static.nc-img.com/uiraa/libs/polyfills_469970f8ffedace1b5b8.js IP 104.17.182.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:05 Last Seen2024-04-25 23:00:06 Times Seen1381 Hash bbb0a7562a948ca06bcebb419b7b31fa c2bf2b3b01d60231d96d422fb1e93eb9871a1f78 9c0bd44b3d16140158eb5f52b28e48cbdfdb7215b06dfeeb2cd07078361e1016 Loading...

	static.nc-img.com/uiraa/libs/vendors_70ac76496c2b0e5ed06c.js	612 kB	2023-03-07	2024-04-25
Pretty URL static.nc-img.com/uiraa/libs/vendors_70ac76496c2b0e5ed06c.js IP 104.17.182.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:05 Last Seen2024-04-25 23:00:06 Times Seen1628 Hash 0b789b1da2ae8daafb7dbe161f39b121 0f6e5d831cce369b5ab370c48c0cb94c59068d5c 1230ad30ea6bbcc22f8e08d8a496c66aac8266db7a4b72b2c465e0ec89c2c658 Loading...

	static.nc-img.com/uiraa/app.3c1b6a5a2612ad098ccd.js	76 kB	2023-03-07	2024-04-25
Pretty URL static.nc-img.com/uiraa/app.3c1b6a5a2612ad098ccd.js IP 104.17.182.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:05 Last Seen2024-04-25 23:00:06 Times Seen1327 Hash a0a0453dc621b1f8d016f838f8c5bfae 843cefd6f474940a2790edc2b5f02a1374a9ad05 7593448ec6c3349c827aaaeb7fd5a8afbd90b96be204331c6eb85a31888e9df8 Loading...

	orcawave.xyz/officev4.zip	38 kB	2023-03-07	2023-04-02
Pretty URL orcawave.xyz/officev4.zip IP 198.54.117.242 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:05 Last Seen2023-04-02 21:31:50 Times Seen42 Hash c55ec6baee2dce3884c371edf2357503 a748df820697ed1dba55f97e85143faa7e701a9b 274e8f945b86ea73172fcedee4622ae69feacb94b1111687b1e86e923b1e42f1 Loading...

	orcawave.xyz/officev4.zip	2.7 kB	2023-03-07	2024-04-25
Pretty URL orcawave.xyz/officev4.zip IP 198.54.117.242 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:05 Last Seen2024-04-25 23:00:06 Times Seen1178 Hash bb1164d2fca41ca00ca27d34fd1ab1cb 0e3f953750a22364386aca4b83b074f3e3999d7f 672dc833729d0d59ff27afc40f835bf10b92caf61f861e2080fbe673a81e11e3 Loading...

	orcawave.xyz/officev4.zip	952 B	2023-03-07	2024-04-25
Pretty URL orcawave.xyz/officev4.zip IP 198.54.117.242 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:05 Last Seen2024-04-25 23:00:06 Times Seen1178 Hash f064828a007cdf4690951436a912d401 5a85f7f26bec5a251bf0f950088297dfba7cf9f2 0ab881506bf32f1e39434c44b518170be116dc2f4c87f01625cfb1f561dadd03 Loading...

	orcawave.xyz/officev4.zip	1.4 kB	2023-03-08	2023-03-08
Pretty URL orcawave.xyz/officev4.zip IP 198.54.117.242 ASN #22612 NAMECHEAP-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 20:26:35 Last Seen2023-03-08 20:26:35 Times Seen1 Hash 56a27b3aba33ab150905199437d10b38 3fbd0ec9c3769320957dc5791fbc4a05db9f52f9 e96158b6e2d2d4cada8a9a4e102d9f900d7d5783241f25c746f98de47249a49d Loading...

HTTP Transactions (38)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5ceaca9fd4ad000cb435820812fc69c8
8168397aaf7b572c89a9c83f46c0b65e4ac509f2
9c4e52e7e17158307d752db0bc3d1fbedae4f305cc301fd73b260f73ab796492

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9C4E52E7E17158307D752DB0BC3D1FBEDAE4F305CC301FD73B260F73AB796492"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9810
Expires: Tue, 06 Dec 2022 20:56:33 GMT
Date: Tue, 06 Dec 2022 18:13:03 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
f83c5e33ba42e312ee398848bbb711f5
caa1fd23b1fbbe883292ded04404c1cfd861eb09
106d08fba45f1e13f85b4b5abc456594878494238933e54b6a06e21ed8a52bc9

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 666
Cache-Control: max-age=145761
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:13:03 GMT
Etag: "638f19f6-1d7"
Expires: Thu, 08 Dec 2022 10:42:24 GMT
Last-Modified: Tue, 06 Dec 2022 10:31:18 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a0abf10fb7e96c1c98dacf2f013a68b4
acdd839bce85eadc78a8e821e32e00a958d5c0c8
b85d98f8df05431777d96c767ce4c152302ec3f653cdf6e61c8c3fa9574f3255

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B85D98F8DF05431777D96C767CE4C152302EC3F653CDF6E61C8C3FA9574F3255"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3033
Expires: Tue, 06 Dec 2022 19:03:36 GMT
Date: Tue, 06 Dec 2022 18:13:03 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 06 Dec 2022 17:20:25 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3158
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: KCSg3tkTrMtUvvlsxNDmT6z5rOLpzj+AIl9PtDWvzRRmwYNFIYy8ArQ/YP/a7rYh2TXvsShZ30Y=
x-amz-request-id: 34CFSYA382DMSPBX
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 06 Dec 2022 17:47:11 GMT
age: 1552
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Tue, 06 Dec 2022 18:13:03 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

orcawave.xyz/officev4.zip

198.54.117.242

200 OK

17 kB

URL HTTP/1.1
orcawave.xyz/officev4.zip
IP
198.54.117.242:0
ASN
#22612 NAMECHEAP-NET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (34346)
Size
17 kB (16641 bytes)
Hash
407cc47b0cf5353bbca4c4c6a263f6a2
2726d1c34ccc92a22ad79398b56e67f624f03063
5dd213b2ad253a355d1864e55e04b2c7f54d97c282ded73160c17407edd23ebc

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /officev4.zip HTTP/1.1
Host: orcawave.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:13:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: SessionId=22bed12dd7514ddba05d0491fe67ca97; domain=.www.namecheap.com; path=/; httponly
x-ncpl-csrf=874988d385c746689213ba8168aed170; domain=.www.namecheap.com; path=/; secure; samesite=none
X-Proxy-Cache: HIT
Server: namecheap-nginx
Content-Encoding: gzip

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
c2383ed3fa6c59e6a29d7d4a315fed6d
64a9d0a4f3401c17adbfd9e156dd9691f09bf9d8
7dcaa8c5204ce85b0a8b41df91d1ab83490d075717e3598f2be59afb3dbf45cc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5735
Cache-Control: max-age=104020
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:13:03 GMT
Etag: "638e631c-118"
Expires: Wed, 07 Dec 2022 23:06:43 GMT
Last-Modified: Mon, 05 Dec 2022 21:31:08 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 280

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
c2383ed3fa6c59e6a29d7d4a315fed6d
64a9d0a4f3401c17adbfd9e156dd9691f09bf9d8
7dcaa8c5204ce85b0a8b41df91d1ab83490d075717e3598f2be59afb3dbf45cc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4594
Cache-Control: max-age=102879
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:13:03 GMT
Etag: "638e631c-118"
Expires: Wed, 07 Dec 2022 22:47:42 GMT
Last-Modified: Mon, 05 Dec 2022 21:31:08 GMT
Server: ECS (ska/F706)
X-Cache: HIT
Content-Length: 280

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
c2383ed3fa6c59e6a29d7d4a315fed6d
64a9d0a4f3401c17adbfd9e156dd9691f09bf9d8
7dcaa8c5204ce85b0a8b41df91d1ab83490d075717e3598f2be59afb3dbf45cc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5735
Cache-Control: max-age=104020
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:13:03 GMT
Etag: "638e631c-118"
Expires: Wed, 07 Dec 2022 23:06:43 GMT
Last-Modified: Mon, 05 Dec 2022 21:31:08 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 280

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
c2383ed3fa6c59e6a29d7d4a315fed6d
64a9d0a4f3401c17adbfd9e156dd9691f09bf9d8
7dcaa8c5204ce85b0a8b41df91d1ab83490d075717e3598f2be59afb3dbf45cc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5735
Cache-Control: max-age=104020
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:13:03 GMT
Etag: "638e631c-118"
Expires: Wed, 07 Dec 2022 23:06:43 GMT
Last-Modified: Mon, 05 Dec 2022 21:31:08 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 280

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
c2383ed3fa6c59e6a29d7d4a315fed6d
64a9d0a4f3401c17adbfd9e156dd9691f09bf9d8
7dcaa8c5204ce85b0a8b41df91d1ab83490d075717e3598f2be59afb3dbf45cc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4594
Cache-Control: max-age=102879
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:13:03 GMT
Etag: "638e631c-118"
Expires: Wed, 07 Dec 2022 22:47:42 GMT
Last-Modified: Mon, 05 Dec 2022 21:31:08 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 280

static.nc-img.com/pp/nc-ui-globalenv/museo-sans-300-webfont.96dd56ebb50aa0150f6630360d8d69cf.woff2

104.17.182.52

200 OK

21 kB

URL HTTP/2
static.nc-img.com/pp/nc-ui-globalenv/museo-sans-300-webfont.96dd56ebb50aa0150f6630360d8d69cf.woff2
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 20848, version 1.0\012- data
Size
21 kB (20848 bytes)
Hash
96dd56ebb50aa0150f6630360d8d69cf
8ada6284514db2f56a084733eed649b9c7d41f1f
93467f75842330c3502fc0268a7a62151f3744221ca7ffa6dc5057dac4a64cee

HTTP Headers

GET /pp/nc-ui-globalenv/museo-sans-300-webfont.96dd56ebb50aa0150f6630360d8d69cf.woff2 HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:03 GMT
content-type: font/woff2
content-length: 20848
last-modified: Tue, 13 Sep 2022 11:52:30 GMT
etag: "63206efe-5170"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4b496eb515-OSL
X-Firefox-Spdy: h2

static.nc-img.com/pp/nc-ui-globalenv/museo-sans-700-webfont.b125dc012841fa8a23b98c37499ca5e8.woff2

104.17.182.52

200 OK

18 kB

URL HTTP/2
static.nc-img.com/pp/nc-ui-globalenv/museo-sans-700-webfont.b125dc012841fa8a23b98c37499ca5e8.woff2
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 18128, version 1.0\012- data
Size
18 kB (18128 bytes)
Hash
b125dc012841fa8a23b98c37499ca5e8
2ea271a80f6a93b9888a34797db75cee3e627673
177c4f2826cbc2cc24a9d8018e6c9848ed73178a76fd3aabe99b44ee9458514c

HTTP Headers

GET /pp/nc-ui-globalenv/museo-sans-700-webfont.b125dc012841fa8a23b98c37499ca5e8.woff2 HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:03 GMT
content-type: font/woff2
content-length: 18128
last-modified: Tue, 13 Sep 2022 11:52:30 GMT
etag: "63206efe-46d0"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4b5992b515-OSL
X-Firefox-Spdy: h2

static.nc-img.com/pp/nc-ui-globalenv/museo-sans-500-webfont.5d9883d92e2eaa724e4e6beb0ef6728a.woff2

104.17.182.52

200 OK

21 kB

URL HTTP/2
static.nc-img.com/pp/nc-ui-globalenv/museo-sans-500-webfont.5d9883d92e2eaa724e4e6beb0ef6728a.woff2
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 20920, version 1.0\012- data
Size
21 kB (20920 bytes)
Hash
5d9883d92e2eaa724e4e6beb0ef6728a
3e36376942825aaaa32279175fdb34a4b7bc9435
9c0749dc1deb3275e1846a462c0dcb83df2b5fec30112eacdf5530fa51e3160f

HTTP Headers

GET /pp/nc-ui-globalenv/museo-sans-500-webfont.5d9883d92e2eaa724e4e6beb0ef6728a.woff2 HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:03 GMT
content-type: font/woff2
content-length: 20920
last-modified: Tue, 13 Sep 2022 11:52:30 GMT
etag: "63206efe-51b8"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4b5994b515-OSL
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 06 Dec 2022 18:11:20 GMT
cache-control: public,max-age=3600
age: 103
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

static.nc-img.com/pp/nc-ui-globalenv/main.05e11966e54a7ee94a37404daccb2c74.css

104.17.182.52

200 OK

32 kB

URL HTTP/2
static.nc-img.com/pp/nc-ui-globalenv/main.05e11966e54a7ee94a37404daccb2c74.css
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65536), with no line terminators
Size
32 kB (31672 bytes)
Hash
5fe0a4188211c43c9e8a1e7fbbcab9c7
5a51f6652107c5efee5ab5e07f72b63ce6f28d8b
48269a8fde643cdf22645cfb7c4a55c9ea680eae6034f07bafa19e8dd4d95728

HTTP Headers

GET /pp/nc-ui-globalenv/main.05e11966e54a7ee94a37404daccb2c74.css HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:03 GMT
content-type: text/css
last-modified: Tue, 13 Sep 2022 11:52:30 GMT
vary: Accept-Encoding, Origin
etag: W/"63206efe-2a163"
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
server: cloudflare
cf-ray: 7756fe4b5996b515-OSL
content-encoding: br
X-Firefox-Spdy: h2

static.nc-img.com/pp/nc-ui-globalenv/museo-sans-300-webfont.79d75c0208e298dce66a21f77de03ef7.woff

104.17.182.52

200 OK

35 kB

URL HTTP/2
static.nc-img.com/pp/nc-ui-globalenv/museo-sans-300-webfont.79d75c0208e298dce66a21f77de03ef7.woff
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format, TrueType, length 35241, version 0.0\012- data
Size
35 kB (35241 bytes)
Hash
79d75c0208e298dce66a21f77de03ef7
14541a65f08834b16aca7d79eb78300a65f1eda2
6a382a283c77b7e93e7bb5b0b1902242082a4800dac20da3334d641093b33005

HTTP Headers

GET /pp/nc-ui-globalenv/museo-sans-300-webfont.79d75c0208e298dce66a21f77de03ef7.woff HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: https://static.nc-img.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:04 GMT
content-type: font/woff
content-length: 35241
last-modified: Tue, 13 Sep 2022 11:52:30 GMT
etag: "63206efe-89a9"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4c1a8bb515-OSL
X-Firefox-Spdy: h2

static.nc-img.com/uiraa/app.ab29bfd164428d10f32bc34df1cad4ed.css

104.17.182.52

200 OK

16 kB

URL HTTP/2
static.nc-img.com/uiraa/app.ab29bfd164428d10f32bc34df1cad4ed.css
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (31921), with no line terminators
Size
16 kB (16166 bytes)
Hash
8c4f147490d7a9a1c0e078a383e0e83d
3ac9cebbea6ee536f5c3c1c2e33bfc0b68df4911
9e36574aa61920f881a0f8e393a7d2a0ebcce3fdc9d6d84c546e7782dbd68c8d

HTTP Headers

GET /uiraa/app.ab29bfd164428d10f32bc34df1cad4ed.css HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:03 GMT
content-type: text/css
last-modified: Tue, 29 Nov 2022 09:06:07 GMT
vary: Accept-Encoding, Origin
etag: W/"6385cb7f-7cb1"
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
server: cloudflare
cf-ray: 7756fe4b4974b515-OSL
content-encoding: br
X-Firefox-Spdy: h2

push.services.mozilla.com/

52.34.4.233

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.34.4.233:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: RAHm+bJoiKge07Ll+3TIRA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: VOUgion5mxJlulS+3NpcTHFDtIM=

static.nc-img.com/uiraa/logo.4072d8d7bfca34be693eb0e573c3b7fe.png

104.17.182.52

200 OK

1.4 kB

URL HTTP/2
static.nc-img.com/uiraa/logo.4072d8d7bfca34be693eb0e573c3b7fe.png
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 219 x 43, 8-bit colormap, non-interlaced\012- data
Size
1.4 kB (1418 bytes)
Hash
4072d8d7bfca34be693eb0e573c3b7fe
6b2d4c85693daa99c1ab6b1d6134f10ec6c13a88
9b69072496fa454b46c2e91ea0bcfeeedc8a47b268a07863c9eee88082aa6937

HTTP Headers

GET /uiraa/logo.4072d8d7bfca34be693eb0e573c3b7fe.png HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:04 GMT
content-type: image/png
content-length: 1418
last-modified: Thu, 17 Jun 2021 07:33:23 GMT
etag: "60cafac3-58a"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
cf-cache-status: HIT
age: 13393104
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4e1d34b515-OSL
X-Firefox-Spdy: h2

static.nc-img.com/uiraa/email.168aa475ec312d6c7a976ba66ef4e982.png

104.17.182.52

200 OK

3.3 kB

URL HTTP/2
static.nc-img.com/uiraa/email.168aa475ec312d6c7a976ba66ef4e982.png
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced\012- data
Size
3.3 kB (3286 bytes)
Hash
168aa475ec312d6c7a976ba66ef4e982
32c327ae4ca72aae61cf5fe5929a8950503f28d5
cbbda36462bd705a3377cc1a607db2382c033161e16c56a8aadfe93f292874e0

HTTP Headers

GET /uiraa/email.168aa475ec312d6c7a976ba66ef4e982.png HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:04 GMT
content-type: image/png
content-length: 3286
last-modified: Tue, 24 May 2022 10:39:50 GMT
etag: "628cb5f6-cd6"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
cf-cache-status: HIT
age: 1720036
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4e1d47b515-OSL
X-Firefox-Spdy: h2

static.nc-img.com/uiraa/app.3c1b6a5a2612ad098ccd.js

104.17.182.52

200 OK

37 kB

URL HTTP/2
static.nc-img.com/uiraa/app.3c1b6a5a2612ad098ccd.js
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
Unicode text, UTF-8 text, with very long lines (64880), with no line terminators
Size
37 kB (37393 bytes)
Hash
f8dbd9d118568b0caae5e9d6b1e9079d
8b0c58c0ee80d9d84d67f23e2daeba592456007a
728647f7547a7622f2a08e709daf82ba6f546e1dbfde838d873b466d0ca915df

HTTP Headers

GET /uiraa/app.3c1b6a5a2612ad098ccd.js HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:03 GMT
content-type: application/javascript
last-modified: Tue, 29 Nov 2022 09:06:03 GMT
vary: Accept-Encoding, Origin
etag: W/"6385cb7b-12933"
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
server: cloudflare
cf-ray: 7756fe4b4975b515-OSL
content-encoding: br
X-Firefox-Spdy: h2

static.nc-img.com/uiraa/user.9c3b83fd37ab617bbe55d0fdc0222fa9.png

104.17.182.52

200 OK

3.4 kB

URL HTTP/2
static.nc-img.com/uiraa/user.9c3b83fd37ab617bbe55d0fdc0222fa9.png
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced\012- data
Size
3.4 kB (3384 bytes)
Hash
9c3b83fd37ab617bbe55d0fdc0222fa9
880e8419e745ea307cfd7b813b4c53590a893373
7307ff8fce6be70dbd3c6ec226910961f863b26f4abce662a7f757821e7b9b1f

HTTP Headers

GET /uiraa/user.9c3b83fd37ab617bbe55d0fdc0222fa9.png HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:04 GMT
content-type: image/png
content-length: 3384
last-modified: Thu, 17 Jun 2021 07:33:10 GMT
etag: "60cafab6-d38"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
cf-cache-status: HIT
age: 19653352
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4e2d4ab515-OSL
X-Firefox-Spdy: h2

static.nc-img.com/pp/nc-ui-globalenv/gb-icon.fc92e479cdcd7b6074c9908a32ea6e85.woff2

104.17.182.52

200 OK

24 kB

URL HTTP/2
static.nc-img.com/pp/nc-ui-globalenv/gb-icon.fc92e479cdcd7b6074c9908a32ea6e85.woff2
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 23864, version 1.0\012- data
Size
24 kB (23864 bytes)
Hash
fc92e479cdcd7b6074c9908a32ea6e85
dd985ee9603c453f3c60e37371f6ca1fef23c4be
69aad6299b431c9394aba77fe786475a06640318aebd4cbb7bf3f351b9c1f416

HTTP Headers

GET /pp/nc-ui-globalenv/gb-icon.fc92e479cdcd7b6074c9908a32ea6e85.woff2 HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: https://static.nc-img.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:04 GMT
content-type: font/woff2
content-length: 23864
last-modified: Tue, 13 Sep 2022 11:52:30 GMT
etag: "63206efe-5d38"
vary: Origin, Accept-Encoding
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45266
accept-ranges: bytes
server: cloudflare
cf-ray: 7756fe4e3d7cb515-OSL
X-Firefox-Spdy: h2

ocsp.sectigo.com/

104.18.32.68

200 OK

281 B

URL HTTP/1.1
ocsp.sectigo.com/
IP
104.18.32.68:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
281 B (281 bytes)
Hash
c278dfb8e5dfbf946ce0994140e2bd8c
d57e34ef4d67abb3ee0227f5adf39d4b91fce77e
9865e950a08c01142138dab651d2504acc4ffa0c2c61e01ea1fddfa8d32f0154

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:13:04 GMT
Content-Type: application/ocsp-response
Content-Length: 281
Connection: keep-alive
Last-Modified: Sat, 03 Dec 2022 18:28:28 GMT
Expires: Sat, 10 Dec 2022 18:28:27 GMT
Etag: "d57e34ef4d67abb3ee0227f5adf39d4b91fce77e"
Cache-Control: max-age=345922,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7756fe4d7d11b50f-OSL

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10138
Expires: Tue, 06 Dec 2022 21:02:03 GMT
Date: Tue, 06 Dec 2022 18:13:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10138
Expires: Tue, 06 Dec 2022 21:02:03 GMT
Date: Tue, 06 Dec 2022 18:13:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10138
Expires: Tue, 06 Dec 2022 21:02:03 GMT
Date: Tue, 06 Dec 2022 18:13:05 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10138
Expires: Tue, 06 Dec 2022 21:02:03 GMT
Date: Tue, 06 Dec 2022 18:13:05 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11224 bytes)
Hash
b15136d60fd0a5e0f657a4f5c75d540f
36082b7329d473829178f280cb71a83b1531e486
79478269b1f5dcfd1e45ccd4264fa44805b37c5c8fec820bcbd2fa1689dfbbd8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11224
x-amzn-requestid: 938de0b8-1055-4416-9ad7-162ab5f4db9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csUINEwdoAMFuOw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e6701-38b079ef341bb17e567de773;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:47:45 GMT
x-amz-cf-pop: YVR50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: tGtiCE9C3j0BUruNaFN2j1mKxCSouLmocmTXpmLMBJaLNyVwkXu1gQ==
via: 1.1 f0ac467993db44dbfc36b778dfcaf73c.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 22:23:09 GMT
age: 71396
etag: "36082b7329d473829178f280cb71a83b1531e486"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d735c66-8946-4145-a67f-e17dd48087bc.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11175 bytes)
Hash
38b97436af942d5eb1111ca7043259a0
0234fe32c84c4711f0619714f3ac6d3db1b717d3
a76a7721355abbaecd5c8cb5218e7e4626dc345eb26e7541c71bf4ceaa7ae5d8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d735c66-8946-4145-a67f-e17dd48087bc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11175
x-amzn-requestid: 9c93ddca-1247-44af-a364-e617f69ace26
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSzYEnEoAMFa2A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64e2-7d38ea383725901524bc2ca0;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: jqWuNfsDgPOsqxlX2HGJdhXm9GnGC-TBafSbSCrztICFgEwcyqc_iA==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 22:22:22 GMT
age: 71443
etag: "0234fe32c84c4711f0619714f3ac6d3db1b717d3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F70fb9d31-10e5-4323-9fbd-ed451a00e6b1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10594 bytes)
Hash
7e1b54923ba506fde6b21c5bfb51ccc8
366aa3ab0790c496ea51bc08d1f2ff3358530d9e
a993ca6dc9a1f854f4542f9221e4f90060825ea863974b5163a9d3e284dc4663

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F70fb9d31-10e5-4323-9fbd-ed451a00e6b1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10594
x-amzn-requestid: eee9f193-eef5-44bf-997a-877fa206749e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSyIHpGoAMF1fw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64da-0a9190f7698dbf2f73bb1575;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:34 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: f-KQCOuDl461V8MBPsSOj1ILCU91Q0pCSENaldkMHR2oZdrEUnHeaA==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 22:03:16 GMT
age: 72589
etag: "366aa3ab0790c496ea51bc08d1f2ff3358530d9e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faeae6973-c3cb-4597-8dcc-f36e4cd35fda.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11469 bytes)
Hash
5529617b0748f2d8c82ef99c1ac116a8
a862b74508113ae72b56b9b3de0c75ba559b9032
376a82ae4a5b80f59fb746be79bca569b03a74c345845c7bbf15189964b0bb96

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faeae6973-c3cb-4597-8dcc-f36e4cd35fda.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11469
x-amzn-requestid: f60a3f0d-38f7-4f82-bdd5-9e31814ab1d9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSuZGAXIAMFwuA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64c2-5b4b99e779a0aaa71a311a1c;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:10 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: El70-nSITf6MuEV19s_OMrwTcWIKO-u4JsghVUSzolero071AVGvjg==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:38:28 GMT
age: 74077
etag: "a862b74508113ae72b56b9b3de0c75ba559b9032"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

13 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feff698a5-ffc4-43ea-b7a3-b681cafeb108.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
13 kB (12830 bytes)
Hash
5d72fb8d20c29763234c2817b119d11b
d4924ec714f5157bcb2fddcb5f768188a3dd37dc
e9aa59142e0673ed3f58b36beaca48213c678dbe4655f9c4b64581cb0f6f22f6

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feff698a5-ffc4-43ea-b7a3-b681cafeb108.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 12830
x-amzn-requestid: 66f5f2fa-8472-4484-bbea-20ece7e98b1f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cmcsxGDyIAMFX4Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638c0e51-146167697890d9312ce3dbac;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 03:04:49 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: WMeay1i2pxnboCB3Qcwb2ray4tnyEzO89tQrHCfGdI3s9kJsMWvzBw==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 04:19:52 GMT
age: 49993
etag: "d4924ec714f5157bcb2fddcb5f768188a3dd37dc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffaf0de04-19bf-4944-9ac5-5178afafb192.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11352 bytes)
Hash
7f2c354a00ab51d4a41221b6bf191c10
01ceb7233fe05ad8dff3a0a43eef879ea2b83ec4
7d3c8417e1db0db41ceb8b4bf3f506864392dd1ad29319a06a8a6055f6f2ed12

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffaf0de04-19bf-4944-9ac5-5178afafb192.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11352
x-amzn-requestid: 7c3fc7bb-eb1f-46ec-8e92-b6ffc6261848
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSwuF1ToAMFiIA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64d1-7c53152a279f00595b9886bd;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:25 GMT
x-amz-cf-pop: SFO5-P2, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: aYf5d6wAJlPSXVwF5uQXUb1g_65z-v6tInk7IF64bBV-w31d3MKeIQ==
via: 1.1 b6d577696b14c86cbfeb5b3459f38c50.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 22:22:23 GMT
age: 71442
etag: "01ceb7233fe05ad8dff3a0a43eef879ea2b83ec4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

static.nc-img.com/uiraa/libs/polyfills_469970f8ffedace1b5b8.js

104.17.182.52

200 OK

0 B

URL HTTP/2
static.nc-img.com/uiraa/libs/polyfills_469970f8ffedace1b5b8.js
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /uiraa/libs/polyfills_469970f8ffedace1b5b8.js HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:04 GMT
content-type: application/javascript
last-modified: Tue, 29 Nov 2022 09:06:03 GMT
vary: Accept-Encoding, Origin
etag: W/"6385cb7b-2dbad"
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45268
server: cloudflare
cf-ray: 7756fe4c1a86b515-OSL
content-encoding: br
X-Firefox-Spdy: h2

static.nc-img.com/uiraa/libs/vendors_70ac76496c2b0e5ed06c.js

104.17.182.52

200 OK

0 B

URL HTTP/2
static.nc-img.com/uiraa/libs/vendors_70ac76496c2b0e5ed06c.js
IP
104.17.182.52:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /uiraa/libs/vendors_70ac76496c2b0e5ed06c.js HTTP/1.1
Host: static.nc-img.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://orcawave.xyz
Connection: keep-alive
Referer: http://orcawave.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:13:04 GMT
content-type: application/javascript
last-modified: Tue, 29 Nov 2022 09:06:07 GMT
vary: Accept-Encoding, Origin
etag: W/"6385cb7f-95896"
cache-control: public, max-age=31536000, immutable
access-control-allow-origin: *
cf-cache-status: HIT
age: 45267
server: cloudflare
cf-ray: 7756fe4c8b10b515-OSL
content-encoding: br
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (38)

URL HTTP/1.1

IP

ASN

File type

Size