Overview

URLarubahosting.bestmailoffers.us/pannelloadmin/4d38fd6267bcc5b/login.php?
IP 104.21.90.65 ()
ASN#13335 CLOUDFLARENET
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-10-14 15:41:13 UTC
StatusLoading report..
IDS alerts0
Blocklist alert1
urlquery alerts No alerts detected
Tags None

Domain Summary (9)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-10-14 05:36:50 UTC 34.160.144.191
ocsp.digicert.com (2) 86 2012-05-21 07:02:23 UTC 2022-10-14 11:22:30 UTC 93.184.220.29
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-10-14 04:19:48 UTC 34.117.237.239
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-10-14 11:47:22 UTC 34.120.237.76
arubahosting.bestmailoffers.us (4) 0 2022-10-13 15:35:46 UTC 2022-10-14 00:35:11 UTC 104.21.90.65 Unknown ranking
firefox.settings.services.mozilla.com (2) 867 2020-05-27 20:08:30 UTC 2022-10-14 10:50:44 UTC 143.204.55.35
r3.o.lencr.org (5) 344 2020-12-02 08:52:13 UTC 2022-10-14 04:41:04 UTC 23.36.77.32
push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-10-14 04:44:18 UTC 35.162.217.251
performance.radar.cloudflare.com (1) 0 2022-06-29 10:44:51 UTC 2022-10-14 11:52:23 UTC 104.18.30.78 Domain (cloudflare.com) ranked at: 342

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-10-14 2 arubahosting.bestmailoffers.us/pannelloadmin/4d38fd6267bcc5b/login.php? Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 104.21.90.65
Date UQ / IDS / BL URL IP
2022-10-21 02:52:23 +0000 0 - 0 - 1 arubahosting.bestmailoffers.us/pannelloadmin/ (...) 104.21.90.65
2022-10-14 15:41:13 +0000 0 - 0 - 1 arubahosting.bestmailoffers.us/pannelloadmin/ (...) 104.21.90.65
2022-10-12 03:29:40 +0000 0 - 0 - 1 pagamenti.bestmailoffers.us/pannelloadmin/3a5 (...) 104.21.90.65
2022-10-11 17:06:22 +0000 0 - 0 - 1 pagamenti.bestmailoffers.us/pannelloadmin/3a5 (...) 104.21.90.65
2022-09-17 10:12:01 +0000 0 - 0 - 1 pagamenti.bestmailoffers.us/Home/d4448a25eda0 (...) 104.21.90.65


Last 5 reports on ASN: CLOUDFLARENET
Date UQ / IDS / BL URL IP
2023-01-31 04:02:15 +0000 0 - 4 - 0 1377x.to/search/candlestick%20/3/ 172.67.220.6
2023-01-31 04:01:42 +0000 0 - 0 - 1 veganyumyum.com/2007/02/avocado-lime-tea-cookies-2 188.114.97.1
2023-01-31 04:00:40 +0000 0 - 0 - 2 sllikevol.com/ 23.227.38.32
2023-01-31 04:00:38 +0000 0 - 0 - 2 vrclosset.click/A4/webGRqZGpkbmF1d2llZDA5MzAz (...) 172.67.187.170
2023-01-31 04:00:35 +0000 0 - 2 - 4 pdoyl.curd.io/prn247.com/tagged/amateur-ass 104.21.18.117


Last 5 reports on domain: bestmailoffers.us
Date UQ / IDS / BL URL IP
2022-12-02 06:22:12 +0000 0 - 0 - 1 pagamenti.bestmailoffers.us/pannelloadmin/3a5 (...) 91.195.240.117
2022-10-21 02:52:23 +0000 0 - 0 - 1 arubahosting.bestmailoffers.us/pannelloadmin/ (...) 104.21.90.65
2022-10-14 20:15:47 +0000 0 - 0 - 1 arubahosting.bestmailoffers.us/pannelloadmin/ (...) 172.67.196.13
2022-10-14 15:50:00 +0000 0 - 0 - 1 arubahosting.bestmailoffers.us/pannelloadmin/ (...) 172.67.196.13
2022-10-14 15:41:13 +0000 0 - 0 - 1 arubahosting.bestmailoffers.us/pannelloadmin/ (...) 104.21.90.65


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2022-12-05 20:26:54 +0000 0 - 0 - 1 skechersshoesgreece.gr/ 172.67.181.134
2022-12-05 06:19:59 +0000 0 - 0 - 1 gymsharkenmexico.com/ 188.114.97.1
2022-12-05 06:18:43 +0000 0 - 0 - 1 gymsharkenmexico.com/ 188.114.97.1
2022-12-05 03:59:38 +0000 0 - 0 - 1 ddy1.pastcast18.ru.com/ 104.21.235.29
2022-12-03 19:42:42 +0000 0 - 0 - 1 enigmasolutions.xyz/ 188.114.96.1

JavaScript

Executed Scripts (3)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (23)


Request Response
                                        
                                            GET /pannelloadmin/4d38fd6267bcc5b/login.php? HTTP/1.1 
Host: arubahosting.bestmailoffers.us
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         104.21.90.65
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                        
Date: Fri, 14 Oct 2022 15:41:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2tfpgIMDVnzlzqLvBgbI%2F12p1JffGgMzo%2FVhClErb%2BfIrnbE%2BsGtBx49lkTU%2B65xdQUrvVFxgHRGv8kvB4wk3sISaotbxkhkI63%2BUp9WkNWzFpvtae4zL%2BRHfkosB%2FwNj0j9apTz4znZ%2B7D5jCLktZ0%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75a16aba5b23b500-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (531)
Size:   1675
Md5:    896e7832e624846f2d1ba04710993d4b
Sha1:   4c56d13b954365d7cff5ad70d529dc4e0d3d6e4d
Sha256: d7ef333ae4ac0f934bc5412ab66b73cf3073d2a7007c3cd11b9b7fabf7bd49e1

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Length, Content-Type, Retry-After, Backoff
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Fri, 14 Oct 2022 14:49:52 GMT
Expires: Fri, 14 Oct 2022 15:01:33 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 8NlSxglv8gzKUS0UWnfpFCVfRLPrN9279YpA0MjIPkqplQc1mAhQfg==
Age: 3070


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    bdb8b66c705a7b996496d780f50c00b5
Sha1:   403ae92039fcc933870f51f913f78ccaf9652256
Sha256: c923ed2539f4ce9f4d43743c402fbb2060a52a4cbedbf14c5f5742ab718073d6
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E9BAD8BE490429A84A567ACD710F97A402BCF7B4BA4E47F2BED27CADA418C439"
Last-Modified: Wed, 12 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6937
Expires: Fri, 14 Oct 2022 17:36:39 GMT
Date: Fri, 14 Oct 2022 15:41:02 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "6C840089371A0E25D60D0D76D6400348B0CDFB5967876C7B88E2B4A2AAF01A03"
Last-Modified: Wed, 12 Oct 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4398
Expires: Fri, 14 Oct 2022 16:54:20 GMT
Date: Fri, 14 Oct 2022 15:41:02 GMT
Connection: keep-alive

                                        
                                            GET /cdn-cgi/styles/errors.css HTTP/1.1 
Host: arubahosting.bestmailoffers.us
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://arubahosting.bestmailoffers.us/pannelloadmin/4d38fd6267bcc5b/login.php?
Connection: keep-alive

search
                                         104.21.90.65
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Fri, 14 Oct 2022 15:41:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 11 Oct 2022 13:37:46 GMT
ETag: W/"634571aa-bf7"
Server: cloudflare
CF-RAY: 75a16abc3df9b500-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 14 Oct 2022 17:41:02 GMT
Cache-Control: max-age=7200, public
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (3063), with no line terminators
Size:   1246
Md5:    6ebc66c2255d4260fcf5d1a4e777c71f
Sha1:   f81368a2e913a709f99a606cfe922ac7c561c589
Sha256: ef2e861f2b9642a2a4c7accabf3c0aa3315fe474f19ae3aef7d07ed93c41a9f5
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: wZRnf58SGFe99N/yeUpy5GfXsTyTt1bxu6bC02KU96yBQGSL7f+uB9ZaS59kHo0NNybchm5//J0=
x-amz-request-id: QSMRDVHYGKC5CW97
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 14 Oct 2022 15:02:11 GMT
age: 2331
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    67d5a988edcda47bc3b3b3f65d32b4b6
Sha1:   d4f0e0da8b3690cc7da925026d3414b68c7d954f
Sha256: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
                                        
                                            GET /cdn-cgi/images/external.png HTTP/1.1 
Host: arubahosting.bestmailoffers.us
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://arubahosting.bestmailoffers.us/pannelloadmin/4d38fd6267bcc5b/login.php?
Connection: keep-alive

search
                                         104.21.90.65
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Date: Fri, 14 Oct 2022 15:41:02 GMT
Content-Length: 265
Connection: keep-alive
Last-Modified: Tue, 11 Oct 2022 13:37:46 GMT
ETag: "634571aa-109"
Server: cloudflare
CF-RAY: 75a16abc3d830b02-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 14 Oct 2022 17:41:02 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 24 x 24, 4-bit colormap, non-interlaced\012- data
Size:   265
Md5:    cb09a55c92c63ed227cf14f2b7f23601
Sha1:   a97780adf99f6dcc0e88dba36cd11df267098271
Sha256: 9f03b2b292f718119a8203689d05692e054f1059112c981c1e20dec82e9f2ddb
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4752
Cache-Control: max-age=129051
Date: Fri, 14 Oct 2022 15:41:02 GMT
Etag: "6348c599-117"
Expires: Sun, 16 Oct 2022 03:31:53 GMT
Last-Modified: Fri, 14 Oct 2022 02:12:41 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 279

                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Fri, 14 Oct 2022 15:41:02 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: arubahosting.bestmailoffers.us
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://arubahosting.bestmailoffers.us/pannelloadmin/4d38fd6267bcc5b/login.php?
Connection: keep-alive

search
                                         104.21.90.65
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                        
Date: Fri, 14 Oct 2022 15:41:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GPiy9422uI1zT8JrGtmA7OjtrzLVYtmBbmcjHCaOL0n9nSYngg%2FyPxrQyPDuMDfEwMzlADCtrMg9wnDLDAY2RcCPZ%2F1GnUfe6fLq5V%2BYiCoe8g%2BelyVp96X0Qj211fL1h6IP6iJVueJAnH9Y1n4jrmw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75a16abd1e8a0b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (531)
Size:   1674
Md5:    b42452f006ff7a1a090ddf0e07632664
Sha1:   ac036d74b0dbcf0a63fc20de9641fc0b494d212b
Sha256: 81c9fdf1fc0eedf0f5d5f83c6502b0e25ab9e0adea663bcf9d192ffbb0961ae2
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         143.204.55.35
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Fri, 14 Oct 2022 15:07:43 GMT
Cache-Control: max-age=3600
Expires: Fri, 14 Oct 2022 15:39:23 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 8e6dce34fd223e0c9d89fd938d1784a2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 5O7ExKjwrXPm8_32mfJQel_dAqJ9qgfccCkaawTqCrZoapLD0OqoHA==
Age: 2000


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 867
Cache-Control: max-age=146415
Date: Fri, 14 Oct 2022 15:41:03 GMT
Etag: "6349189b-1d7"
Expires: Sun, 16 Oct 2022 08:21:18 GMT
Last-Modified: Fri, 14 Oct 2022 08:06:51 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: R5jMX2fte2ieGEmu7oDFng==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         35.162.217.251
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: r4u+dWiqIlmF2u7mV78ffD9QGb0=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10354
Expires: Fri, 14 Oct 2022 18:33:38 GMT
Date: Fri, 14 Oct 2022 15:41:04 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10354
Expires: Fri, 14 Oct 2022 18:33:38 GMT
Date: Fri, 14 Oct 2022 15:41:04 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10354
Expires: Fri, 14 Oct 2022 18:33:38 GMT
Date: Fri, 14 Oct 2022 15:41:04 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6c5ba8cd-8206-4fb1-b9e3-305080968fd6.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8695
x-amzn-requestid: 10b6b333-690e-4f2d-926b-a6c196465e2d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z9m7ZGi8oAMF56A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63488515-353359b609f895647f25a703;Sampled=0
x-amzn-remapped-date: Thu, 13 Oct 2022 21:37:25 GMT
x-amz-cf-pop: SEA73-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: hi3uEN2XHSwLtPGl2dfO7d6xPrqSGQpk_J-H8dkaY7j8oU6SSuYWAg==
via: 1.1 a8e5d5aeee6eacca5c379e5059b1f68c.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google
date: Thu, 13 Oct 2022 21:53:58 GMT
age: 64026
etag: "8c120e5937e7b178aee70c6564845300041651de"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8695
Md5:    5a0d87eadde461ea8e1ef3ea09f174a1
Sha1:   8c120e5937e7b178aee70c6564845300041651de
Sha256: e8d7528314928517975d8e6cd2ad23e234257dd9b9d4e2219a0a44b4fee20cb5
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F560d2eb7-40d7-4861-8041-41b8184de030.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8183
x-amzn-requestid: f41fdb47-83e8-48f9-95ac-a79e2bfc521d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z6Tu8FwCoAMF_OQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6347332c-67bc08ef6315488e07fc3c4c;Sampled=0
x-amzn-remapped-date: Wed, 12 Oct 2022 21:35:40 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: CGpa_I95VYqIP5j-OWRJ_xLopy7H9wlZRPSTP_mL-hymbOqhelsTCQ==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 b8c4a4ca04bb1976e020396d211bc8dc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 13 Oct 2022 21:50:40 GMT
age: 64224
etag: "ec5e3f3d6a334d0b8a92ce06327b5b145002087c"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8183
Md5:    c3368090318fe53289f4e0fe284ee1e2
Sha1:   ec5e3f3d6a334d0b8a92ce06327b5b145002087c
Sha256: 73bb52c89af285a60360a119d3f21b0d7309ea7fd26a36c1e46fe6b1b9f25164
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98481d75-e189-4e2a-94de-5d6c94c4ea9e.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6685
x-amzn-requestid: 8d5aa091-bf24-4ab1-a33b-73795e951da1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z9m0EENeIAMF9Eg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634884e6-36c8c3d75b57c8df3b0644a0;Sampled=0
x-amzn-remapped-date: Thu, 13 Oct 2022 21:36:38 GMT
x-amz-cf-pop: SEA73-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Lf8nte3n3LzQdLXnv6MfnVk2LO0b0CjSfyiaxK2UWsM2DLsm-xEAgA==
via: 1.1 33d72803ad26b392c1b578a2b1276580.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google
date: Thu, 13 Oct 2022 22:56:52 GMT
age: 60252
etag: "3c567806bfec9a195235f1c1e3c3e4bc647fdde9"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6685
Md5:    b1a0e7692a42450c5880b6bf2c3e600f
Sha1:   3c567806bfec9a195235f1c1e3c3e4bc647fdde9
Sha256: 318e462ae5b2da302cc3fa6539270866a352f011ebcc9ea35eef50c38fe9fe24
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F66af0895-4532-481a-84d9-523353a6c160.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9350
x-amzn-requestid: fd2ec00f-7ef1-4e4a-a652-a388dcba3e16
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z9m0EHctoAMF8Ww=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634884e6-7e945574599f2ec67e824671;Sampled=0
x-amzn-remapped-date: Thu, 13 Oct 2022 21:36:38 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: jwQT6vQNNLDQFqrROqQ-prpvIGnhB5aK-hVVwZRClZQP5fnbgpfOuA==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Thu, 13 Oct 2022 23:04:28 GMT
age: 59796
etag: "6c055a00a12067ab5b11458bb614bc6f1028c28a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9350
Md5:    e80557033ce8935b57b87fe59633393e
Sha1:   6c055a00a12067ab5b11458bb614bc6f1028c28a
Sha256: 8a88d7f2110e5c200f6f26ed5e6c7b299b9c76654f095b870cfffb2a8d7b96d9
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe601c322-0073-4b24-8118-55869adbeb98.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12311
x-amzn-requestid: ea7249c5-3474-468f-95da-f72348359496
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z3yJEFDGoAMFo8g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634630a0-7e14ca5f47e01f696db40261;Sampled=0
x-amzn-remapped-date: Wed, 12 Oct 2022 03:12:32 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Ob3vdgFus0FNjPIM2kFx4W-lUaeoajDM4CmrcrJH3VP3Qs3yJcji_A==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google
date: Fri, 14 Oct 2022 04:01:44 GMT
age: 41960
etag: "aee7bccc46ab5f49f91f469058958c38b957564a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12311
Md5:    a9c5be9ddedaa70a8e03c2caa6612e50
Sha1:   aee7bccc46ab5f49f91f469058958c38b957564a
Sha256: d2c07961af9586fd776ab456b37516d0da1512bd511411f025c6e624442ec334
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F42e00752-5abb-46e6-8a0d-c47f96af6b9f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9622
x-amzn-requestid: 340d7e66-1eb4-49fc-bf3d-56e5cc4af771
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z9n2_HXqIAMFzsg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63488692-78ea067c541cb84f75741d22;Sampled=0
x-amzn-remapped-date: Thu, 13 Oct 2022 21:43:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: uN6RkKHKGjhauRGxTQiyluFaTwFaGBgtkJsdFMcxUoZNEu_05ocMZg==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 13 Oct 2022 23:14:16 GMT
etag: "c34dd1552df55e8b62e699a5efb14e7f26a60acb"
age: 59208
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9622
Md5:    07dec47a418618af22b7104e1bbde5e6
Sha1:   c34dd1552df55e8b62e699a5efb14e7f26a60acb
Sha256: 5eb94cd99c5187faa2c0c8f5ef5b9786009d37c2950ca0048eb3f737e45c363b
                                        
                                            GET /beacon.js HTTP/1.1 
Host: performance.radar.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.18.30.78
HTTP/2 200 OK
content-type: text/javascript;charset=UTF-8
                                        
date: Fri, 14 Oct 2022 15:41:02 GMT
access-control-allow-origin: *
cache-control: no-store, max-age=0
access-control-allow-headers: *
access-control-allow-methods: *
referrer-policy: no-referrer
timing-allow-origin: *
set-cookie: __cf_bm=nCjhcNuVwZtwmGaW5VCIHX_5KW6nBJusBlFBgdoTaS4-1665762062-0-Aa9P70kNmVyEFvl1129HBUKgIf7SUt/R2/PDCJ0XUYrqHB6DPYqpInfMm6taaIShNW1PoQVF3ECqC0O8Ew+/JZM=; path=/; expires=Fri, 14-Oct-22 16:11:02 GMT; domain=.radar.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
server: cloudflare
cf-ray: 75a16abcbbbd1c06-OSL
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---