r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash b7407cc102d62a5acd5e61f8a79bed36
c2f4890a62454e514962b55b7fc14228339c8e90
be282de92da261128a7c8471f3067466aa9930fd0ab2a2cdda8cd2d6ce2bbd74
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE282DE92DA261128A7C8471F3067466AA9930FD0AB2A2CDDA8CD2D6CE2BBD74"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14598
Expires: Thu, 09 Feb 2023 03:05:50 GMT
Date: Wed, 08 Feb 2023 23:02:32 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 565c1bbc5c1c40be1988b3bf6fd9dc1a
cfdba5bc597130461dd67bf6cda53183be592493
60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3521
Expires: Thu, 09 Feb 2023 00:01:13 GMT
Date: Wed, 08 Feb 2023 23:02:32 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 08 Feb 2023 22:34:13 GMT
content-type: application/json
age: 1699
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash cc14b0d2f7c451f6431dc87ba54d1d60
bab8bfda6fa3e2f17125353f5147211787dc25d0
b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD"
Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5230
Expires: Thu, 09 Feb 2023 00:29:42 GMT
Date: Wed, 08 Feb 2023 23:02:32 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6
GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: MLb0W/V60O+Z6K1bgMXgcGDMNmyPjO8PYxbDUnZi/XmW3efkkP0kecsK+L9euKVnsr9dh4RLjgyc1X1gU2nmNg==
x-amz-request-id: 7WH9KF72SSDM8VEY
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 08 Feb 2023 22:36:07 GMT
age: 1585
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
signinauth-accountapp1e.democratscdmx.com/?hvheu4b8zgp7=
43.130.114.211200 OK 188 B URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/?hvheu4b8zgp7=
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type HTML document text\012- exported SGML document, ASCII text, with no line terminators
Hash 2bff6f1ad944d3ba84e5d0f5c0f71c0c
64db48c766c24a61f9811a9572d6825ea1d03775
ded7f9fe589992c2b3b8b17ba323d9204416a3bccfef40178ba84e62d3e1a258
Analyzer Verdict Alert fortinet Phishing
GET /?hvheu4b8zgp7= HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
x-powered-by: PHP/7.4.33
set-cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
content-length: 188
content-encoding: gzip
date: Wed, 08 Feb 2023 23:02:32 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 08 Feb 2023 23:02:32 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
43.130.114.211200 OK 2.8 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (330)
Hash e4397acb695be8f07c64db4787f3c381
b2a12c32e5bcf7e631e0650d7961ed5e7b905d11
3b15926cfbb3b49849000d29ebbc96c297bceb8d0326429b95fb8855b8a755cf
GET /account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/?hvheu4b8zgp7=
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
x-powered-by: PHP/7.4.33
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
content-length: 2804
content-encoding: gzip
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Retry-After, Content-Length, Content-Type, ETag, Cache-Control, Alert, Pragma, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 08 Feb 2023 22:51:21 GMT
age: 672
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
signinauth-accountapp1e.democratscdmx.com/assets/css/modal.css
43.130.114.211200 OK 2.9 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/css/modal.css
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type ASCII text, with very long lines (17803), with no line terminators
Hash a7f19133c80fb7fb9c695c10ff93e01c
63292453965e26f5020eff45871d7766010069c9
7808c75338145d0eb05c61de3a2af0eb0cbfda8f0a4be33c1890fc5b2ea4e627
GET /assets/css/modal.css HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: text/css
last-modified: Wed, 11 Jul 2018 02:56:28 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 2881
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 248ce16379b12f11927ecc3142aec450
fa5b189f2d9182479170cb61cc1723571e437bd2
a8d259b331bdefb00625b9bf057d44d0b3290fda0734c57eda187b04e23d59d4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A8D259B331BDEFB00625B9BF057D44D0B3290FDA0734C57EDA187B04E23D59D4"
Last-Modified: Wed, 08 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13859
Expires: Thu, 09 Feb 2023 02:53:32 GMT
Date: Wed, 08 Feb 2023 23:02:33 GMT
Connection: keep-alive
signinauth-accountapp1e.democratscdmx.com/assets/js/jquery.validate.min.js
43.130.114.211200 OK 7.5 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/js/jquery.validate.min.js
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type Unicode text, UTF-8 text, with very long lines (23122), with CRLF line terminators
Hash 7c059dab4a9321ae2b27c7acbc1203e4
ba9be8785a1b88acfce267d11d18d0f0bd39ee1d
c345510541f587e31e6e1860237f9338ebc15029a453b87c658184ab1238337f
Analyzer Verdict Alert fortinet Phishing
GET /assets/js/jquery.validate.min.js HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: application/javascript
last-modified: Sun, 11 Nov 2018 18:18:56 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 7526
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
43.130.114.211200 OK 1.7 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type ASCII text, with very long lines (7994), with no line terminators
Hash 7f0008fe6a5714f86775e8f175a83e21
4f65d4cce9dd977ca16f0673a31767323e8fc0d6
f796a66d6c9c0009598a0d4fe292b30c084a027bbe79a572c601574584f3c466
GET /assets/css/style-login-desktop.css HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: text/css
last-modified: Wed, 11 Jul 2018 02:57:02 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1699
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/js/script-login-desktop.js
43.130.114.211200 OK 364 B URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/js/script-login-desktop.js
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type ASCII text, with CRLF line terminators
Hash aad3cd871cb74617433409f076c50085
6ee0b8648e2dbeab7448e83a705fda2383dea4ef
a7d811eb7cd3546964c47a4e5c76820aa53370cbf9e13c13ef1a03cc4e1bf53a
Analyzer Verdict Alert fortinet Phishing
GET /assets/js/script-login-desktop.js HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: application/javascript
last-modified: Mon, 25 Dec 2017 22:59:06 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 364
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/js/jquery.js
43.130.114.211200 OK 30 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/js/jquery.js
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type ASCII text, with very long lines (32065), with CRLF line terminators
Hash 639056f8010e5edf521bd1a7b89e2da8
f9cf412b6e6a278880d2da5268ca4f75ff8c1878
3c6b384468c60e3509e07be64d4e7340cca8c239a10ec25002fb1773b5c3830c
Analyzer Verdict Alert fortinet Phishing
GET /assets/js/jquery.js HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: application/javascript
last-modified: Sun, 11 Nov 2018 18:38:58 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 29912
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/css/bootstrap.min.css
43.130.114.211200 OK 18 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/css/bootstrap.min.css
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type ASCII text, with very long lines (65371)
Hash edb6e9116546e00e17919b0bd3fceb02
75091b9ee884ed5f3469d4164db30ca3cb07f724
d39a6172436ee86ca3ce1c6fc78dc4afc6771bba64265bec73804e2034f0df26
GET /assets/css/bootstrap.min.css HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: text/css
last-modified: Tue, 24 Jun 2014 05:14:12 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 18148
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
push.services.mozilla.com/
35.160.45.85101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.160.45.85:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: ptPHLFI1nsqckOtoa1j0zQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: +EPYFp1ynLnYLMl/RdLtDSyn2AE=
signinauth-accountapp1e.democratscdmx.com/assets/img/logo.png
43.130.114.211200 OK 4.7 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/logo.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type PNG image data, 420 x 112, 8-bit colormap, non-interlaced\012- data
Hash 643a1f9fc2aa09799472c39031456af5
70f89834a607b4a00e5c1e8ff2bd66b798db04df
c691a459c75691e086dfbbacf08d2f4591a8316f11484ff99a5ca500a172e2b4
Analyzer Verdict Alert urlquery phishing Phishing - Apple
GET /assets/img/logo.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Tue, 28 Nov 2017 23:29:44 GMT
accept-ranges: bytes
content-length: 4690
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/img/btn.png
43.130.114.211200 OK 711 B URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/btn.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type PNG image data, 29 x 28, 8-bit/color RGBA, non-interlaced\012- data
Hash 72ae62bf41ef56795a918c54169c1243
ed438963479a897b970eb29f916f8b81c46d5cff
20561e3f883ab183123a6ef5a08a66fd701c6553766be53950034e487731b3fb
Analyzer Verdict Alert urlquery phishing Phishing - Apple
GET /assets/img/btn.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Sat, 26 Dec 2015 08:24:34 GMT
accept-ranges: bytes
content-length: 711
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/img/navbar-repeat-login.png
43.130.114.211200 OK 186 B URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/navbar-repeat-login.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type PNG image data, 1 x 105, 8-bit/color RGBA, non-interlaced\012- data
Hash 830a3bf9352f3c3b78865d529d72cee4
1b5d9f63eb347cee0e8a612e8af6adcfc3b929f3
e49898a9129afa7b491faa3cfe7e03667c7152e1aad867b3c910c9de8aad2ab7
Analyzer Verdict Alert urlquery phishing Phishing - Apple
GET /assets/img/navbar-repeat-login.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Tue, 28 Nov 2017 23:57:10 GMT
accept-ranges: bytes
content-length: 186
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/img/navbar.png
43.130.114.211200 OK 20 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/navbar.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type PNG image data, 1000 x 44, 8-bit/color RGBA, non-interlaced\012- data
Hash 3eec9a839c236164353015a4becf6310
ad05219c34d3a4dc026e708436701fe8ad6eb116
9d031ab45532cbbc836814405707597d04c0830d59c713fc26176c4e48e6a5cc
Analyzer Verdict Alert urlquery phishing Phishing - Apple
GET /assets/img/navbar.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Fri, 25 Dec 2015 05:19:08 GMT
accept-ranges: bytes
content-length: 20218
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/img/footerbawah.png
43.130.114.211200 OK 16 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/footerbawah.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type PNG image data, 1919 x 82, 8-bit/color RGBA, non-interlaced\012- data
Hash e597de7e0dfe85e6cc02af6ce0262e41
58ee2bcb88211c7029e770a13dbe299f177ce392
b1ac2ddc56e4e42633a6ee8c8ac6a939914317c4fd816fb56529af10e75a9eec
GET /assets/img/footerbawah.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Tue, 10 Jan 2023 09:42:00 GMT
accept-ranges: bytes
content-length: 16336
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/css/31642.ttf
43.130.114.211200 OK 61 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/css/31642.ttf
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type OpenType font data\012- data
Hash ac12dcfaf66432f2a03841b143885edc
db7761528f3a664929adccf84fadc1db823272cd
7a8a6c668e967c89719f22492cf9ad7582a48f602f051ce54c6a75b2e9fbbd75
Analyzer Verdict Alert fortinet Phishing
GET /assets/css/31642.ttf HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: font/ttf
last-modified: Fri, 03 Jun 2016 00:29:00 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 61274
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/img/fot.png
43.130.114.211200 OK 67 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/fot.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type PNG image data, 1902 x 61, 8-bit/color RGBA, non-interlaced\012- data
Hash 3dcdedf20bc77cbbdee5f2b8ae29dbb1
cd93f3ffdd276085fe8181d434aecd397617d98f
345e61aa67f62cfe752729e2762f0e371ae85c46b72c4be81dda8a639b77c5ed
GET /assets/img/fot.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Sun, 21 Feb 2021 20:46:18 GMT
accept-ranges: bytes
content-length: 67059
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3451
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 23:02:34 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3451
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 23:02:34 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3451
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 23:02:34 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3451
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 23:02:34 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc04429b-38db-4e0a-96bf-5a6d2bc7e8cf.jpeg
34.120.237.76200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc04429b-38db-4e0a-96bf-5a6d2bc7e8cf.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4b42802dc628e38e9631a01b6320040a
c83355f0828815ecbff47d8195d2deed8077e368
d0f093b1769b568a5d68ada359eadfd1ab3360488a20e1deeb99b0a51b649441
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc04429b-38db-4e0a-96bf-5a6d2bc7e8cf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11256
x-amzn-requestid: fc079b98-a94a-4945-8e51-9b5941fda799
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fwD8SEOMIAMFomA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dcb381-72b83330325d280821ecf4c1;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 07:10:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: tlIxKyJ3tqYVM667Uz4n2OHk2eiLer2Nc7bnFKqJUZcYDoPqjRlagQ==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 19:24:56 GMT
age: 13058
etag: "c83355f0828815ecbff47d8195d2deed8077e368"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffa565275-3a2e-4292-b935-18f8fc648689.jpeg
34.120.237.76200 OK 8.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffa565275-3a2e-4292-b935-18f8fc648689.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ebad32ed6e84736b26623ed3d9b6cfe7
f9ddc5333953bafc7de7c971a693771a179e8bab
c8cc0ee6bcc93f226bcf774f1354e094bd6715c86e680be7523c84e457b7922d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffa565275-3a2e-4292-b935-18f8fc648689.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8637
x-amzn-requestid: 5d2c1f9d-9088-461f-ad0d-d5ebcc54f78f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fsw9gGk5IAMF1fg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63db61ef-1318c7ba1dc92b30228a1aaf;Sampled=0
x-amzn-remapped-date: Thu, 02 Feb 2023 07:10:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: jCwYb_u5z_XDADfhooA_MtH6KDONfrUsOUESiOTcZciCPM3jwyMgAA==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 13:40:47 GMT
etag: "f9ddc5333953bafc7de7c971a693771a179e8bab"
content-type: image/jpeg
age: 33707
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc03326d1-bbfd-4654-a9db-ac431757b9f6.jpeg
34.120.237.76200 OK 8.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc03326d1-bbfd-4654-a9db-ac431757b9f6.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 764b732e88dd1e9c1824529b24b3dffc
2ba954a51c2972b267ae0536e343e608aa9aa7f4
a1efdf03b14bb05cf8e407b92476592c35fa2d27c5e66705322abdb4c6412a06
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc03326d1-bbfd-4654-a9db-ac431757b9f6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8150
x-amzn-requestid: 3834493a-4162-4cc9-b67c-541cc9be895b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fwD8IH0TIAMFWqQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dcb380-3746ff7b0a6894366efa848e;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 07:10:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: HNuUU4SaVvuPbW0clgJa6UZ-0zefgWJWfIJEsz_yCfKiCrx2wsu6vA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 09:58:24 GMT
age: 47050
etag: "2ba954a51c2972b267ae0536e343e608aa9aa7f4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3ab2faf0-d9a7-41a6-b5cf-bf6189f66342.jpeg
34.120.237.76200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3ab2faf0-d9a7-41a6-b5cf-bf6189f66342.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9203cfb9f0c1c958dd008eac55a9d3c4
6bdd1047590dd3fb54c15d5d6d38e7c86274b203
09770229be5ff3037708543e3204c66de84253b3a858a83a0e1672a04c0e9cb1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3ab2faf0-d9a7-41a6-b5cf-bf6189f66342.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11760
x-amzn-requestid: b2863a01-4714-4554-a478-5402467b3448
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AChJKHc_oAMFwlw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e4156d-1c5a3edf37bc7cc937c800d2;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 21:34:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: euok7HXthk9GEynD8n9wXgf85lD0shxOdtT5VZvj-xHkoxEMxuohmA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:42:38 GMT
age: 4796
etag: "6bdd1047590dd3fb54c15d5d6d38e7c86274b203"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff8db31dc-3366-48e5-8c4b-ebe994dd40ef.jpeg
34.120.237.76200 OK 15 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff8db31dc-3366-48e5-8c4b-ebe994dd40ef.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 95081172f8e19d19921acc802488e019
8531c150cb11de44361a95624b11cf46b9e0ba02
7a2d8f012c7d590f3f39ad834d4f3f9fb729143b7395bc588bd608b5bdee039b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff8db31dc-3366-48e5-8c4b-ebe994dd40ef.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 15019
x-amzn-requestid: 574e3e2c-2fbe-4215-9500-021147338832
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f583LHiioAMFqkQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e0a82d-4f12aac524c39f822ca4f422;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 07:11:41 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: _3jIo3Giw3zmTmnSkJArAllT6uigN7EEzLPfkGpd6168_mSdqdk_Cg==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 08:24:16 GMT
age: 52698
etag: "8531c150cb11de44361a95624b11cf46b9e0ba02"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4930c104-0ac3-49ae-9506-13702874f821.jpeg
34.120.237.76200 OK 3.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4930c104-0ac3-49ae-9506-13702874f821.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2c1f5626e7ff7e681468c3c5820f3633
a8bb267f929b734a53b3dab0283c717270f6eb43
38d81274cc9f71f149091f72494c74872d99909c69d612a595c930c4755c4da3
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4930c104-0ac3-49ae-9506-13702874f821.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3474
x-amzn-requestid: 1b0f88cf-460b-4ed2-8235-86c9e3e3ff93
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ffW2uG3LIAMF3cg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d604f7-42e5c38315bdbd47615985b6;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 05:32:39 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nfLYmz3SEBzBp32-FDPDF-rqh4-pAjLixYD4abVqF5fl3awttBNRUA==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 22:47:56 GMT
age: 878
etag: "a8bb267f929b734a53b3dab0283c717270f6eb43"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
signinauth-accountapp1e.democratscdmx.com/assets/img/footer-login-desktop.png
43.130.114.211200 OK 68 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/footer-login-desktop.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type PNG image data, 1010 x 387, 8-bit/color RGBA, non-interlaced\012- data
Hash 03f050d044fa1712f4da42ba60c1bb57
980756aec61d0ada8dd224449bcb7ae6acee1d7e
63d0b4747b1208a82a115837bf59556c26a2bf4173bcf7a6cbb9254373a7c0f5
Analyzer Verdict Alert urlquery phishing Phishing - Apple
GET /assets/img/footer-login-desktop.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/assets/css/style-login-desktop.css
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Tue, 26 Dec 2017 06:25:54 GMT
accept-ranges: bytes
content-length: 67831
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/img/login-desktop.png
43.130.114.211200 OK 1.1 MB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/login-desktop.png
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 1x1, segment length 16, progressive, precision 8, 4628x1732, components 3\012- data
Size 1.1 MB (1080923 bytes)
Hash e2f376b6b058ff6c7c1e6f3b525a9157
5c50c1cd477de76e7b1e2c6437479664bb86ca7b
bca2ec8caf9eaaa75ed49a2f0de20067590b055d7457ae1f0c67acd394055fdc
Analyzer Verdict Alert urlquery phishing Phishing - Apple
GET /assets/img/login-desktop.png HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:33 GMT
content-type: image/png
last-modified: Tue, 10 Jul 2018 14:32:34 GMT
accept-ranges: bytes
content-length: 1080923
date: Wed, 08 Feb 2023 23:02:33 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
signinauth-accountapp1e.democratscdmx.com/assets/img/favicon.ico
43.130.114.211200 OK 1.7 kB URL HTTP/1.1 signinauth-accountapp1e.democratscdmx.com/assets/img/favicon.ico
IP 43.130.114.211:0
ASN #132203 Tencent Building, Kejizhongyi Avenue
File type MS Windows icon resource - 4 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel\012- data
Hash 07bc3f17fb6d83d454c8683dc4f41729
bd9ed118a5b5adcb213fa4e3aeaceb2009da3c68
ef45c64ec3437c7f9f7b81d94ac77774d41b047129f12ed638fdd71a38f52361
Analyzer Verdict Alert urlquery phishing Phishing - Apple
GET /assets/img/favicon.ico HTTP/1.1
Host: signinauth-accountapp1e.democratscdmx.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://signinauth-accountapp1e.democratscdmx.com/account/?view=login&appIdKey=a964943ec381744f6edb34c0e5d75b4ef090dbd191681f62ff4545d&country=NO
Cookie: PHPSESSID=69242e0e0a27369f02d30227e3e6bb6b
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: public, max-age=604800
expires: Wed, 15 Feb 2023 23:02:34 GMT
content-type: image/x-icon
last-modified: Fri, 25 Dec 2015 08:05:32 GMT
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
content-length: 1699
date: Wed, 08 Feb 2023 23:02:34 GMT
server: LiteSpeed
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg
34.120.237.76200 OK 7.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ce710ab5746832fe637fada3e6d63abf
d545c85d4a8cf92dc8b88db0a056623d1ef7a943
40bae4a2fb9dd60e9339d15ad0838f3ca83b5b6275c35cd22878b6783fcd6247
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 7450
x-amzn-requestid: c3dabd4b-797b-4bbe-8824-5f502ff477b0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fmJ2aG-IoAMFfnQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d8bcf5-68de905b2ed5bfe46a87e688;Sampled=0
x-amzn-remapped-date: Tue, 31 Jan 2023 07:02:13 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AX-TsURes3Bn0RrAnH7TnsouJdkcOpbq7f7KAzPMWq4RMBH8FWMz7g==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 17:45:22 GMT
age: 19038
etag: "d545c85d4a8cf92dc8b88db0a056623d1ef7a943"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2