Report - 4.us.silverwinds.xyz/feed/?link=true&tid=4&subid=4.us.android.chrome&ref=pdxx-7fmavzpxk2xlm-4-2.lowsea.fun&s1=63a4fcf8226147359d08f3e9

Report Overview

Submitted URL
4.us.silverwinds.xyz/feed/?link=true&tid=4&subid=4.us.android.chrome&ref=pdxx-7fmavzpxk2xlm-4-2.lowsea.fun&s1=63a4fcf8226147359d08f3e9
IP
23.235.251.114
ASN
#19437 SS-ASH
Submitted
2022-12-23 00:58:03
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
e1.o.lencr.org	6159	2021-08-20T09:36:30Z	2023-03-09T05:14:34Z	676 B	1.5 kB	23.36.76.226
gbstwrldnws.com	unknown	2022-12-16T11:46:55Z	2023-03-09T18:05:35Z	2.5 kB	3.3 kB	192.133.142.177
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-09T05:09:13Z	606 B	127 B	52.39.94.191
go.redanemone.xyz	72592	2020-01-16T11:48:25Z	2023-02-28T00:10:18Z	496 B	241 B	198.134.116.30
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-09T05:09:48Z	333 B	391 B	34.117.237.239
4.us.silverwinds.xyz	unknown	2022-03-31T18:01:00Z	2023-02-21T08:48:56Z	465 B	257 B	23.235.251.114
redir.blowingwind.xyz	unknown	2022-12-09T15:19:31Z	2023-03-09T04:01:03Z	497 B	662 B	198.211.113.186
leche.labtrffc.com	unknown	2021-02-18T15:08:36Z	2023-02-24T17:00:27Z	510 B	260 B	51.83.143.92
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-09T10:04:36Z	3.2 kB	49 kB	34.120.237.76
my.okueroskynt.com	153384	2020-10-01T10:14:12Z	2023-03-05T07:12:33Z	591 B	893 B	18.158.88.249
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-09T05:09:18Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-09T05:09:49Z	413 B	5.9 kB	34.160.144.191
cngcpy.com	390783	2021-07-13T16:46:45Z	2023-03-05T19:53:41Z	484 B	740 B	104.21.38.243
rexpush.pro	unknown	2022-05-10T20:47:44Z	2023-03-09T06:04:18Z	1.3 kB	2.0 kB	199.182.164.165
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-09T05:09:05Z	4.4 kB	12 kB	23.36.76.226
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-09T11:52:10Z	341 B	797 B	93.184.220.29

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2022-12-23 00:57:52	medium	198.134.116.30	Client IP	ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2022-12-23 00:57:53	medium	Client IP	Internal IP	ET INFO DNS Query for Suspicious .icu Domain

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-12-23	medium	gbstwrldnws.com	Sinkholed
2022-12-23	medium	gbstwrldnws.com	Sinkholed
2022-12-23	medium	gbstwrldnws.com	Sinkholed
2022-12-23	medium	gbstwrldnws.com	Sinkholed
2022-12-23	medium	gbstwrldnws.com	Sinkholed

JavaScript (2)

	URL	Size	First Seen	Last Seen
	gbstwrldnws.com/adult_video_2/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&fullscreen=1	624 B	2023-03-10	2023-03-10
Pretty URL gbstwrldnws.com/adult_video_2/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&fullscreen=1 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 04:47:39 Last Seen2023-03-10 04:47:39 Times Seen1 Hash 3dde2cc30c80809e5130ce95d2b3f60e 0d79f83dadf68fd27d5eee913e6321bb871db6dc a060634dd673b87dee7735ff19114f63d6c36254dbf6b92c9c4dd5f1d728cd58 Loading...

	rexpush.pro/js/s_4204c681cbc6ffce849ca2efa5d21139.min.js?tag=1328&attempt=0&rnd=412738441&lnd=adult_video_2&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&t_rdr=	85 kB	2023-03-10	2023-03-10
Pretty URL rexpush.pro/js/s_4204c681cbc6ffce849ca2efa5d21139.min.js?tag=1328&attempt=0&rnd=412738441&lnd=adult_video_2&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&t_rdr= IP 199.182.164.165 ASN #15317 SERVEREL-AS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 04:47:39 Last Seen2023-03-10 04:47:39 Times Seen1 Hash 1a778dd9a955e9eab549b427ca70a642 feb78b1c1526aa04c209f3c1d941fde4448b01eb 95870084c47db82bda6393d7267a49581a6442223ffc00d9f4d0feb286c0a2c4 Loading...

HTTP Transactions (41)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ad598540c6639aaaa344fb3ce4f3162f
b0b9f86d50de7dc23bdc7aee2f45d79a06165afc
4e9aaff330ce0c9c11f6bb8502fe21296b1845151bace75f73908a3194d5d0a1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4E9AAFF330CE0C9C11F6BB8502FE21296B1845151BACE75F73908A3194D5D0A1"
Last-Modified: Thu, 22 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14093
Expires: Fri, 23 Dec 2022 04:52:44 GMT
Date: Fri, 23 Dec 2022 00:57:51 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7e300ca7d2d586dd1ca0c185ef6b0da5
3914cfd3b7aa6e1d1117bf509319479e489ed2a4
91c8810ad137faf4393f7d15f9c619c06d124a7aaebfa21290dca614db2c7757

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "91C8810AD137FAF4393F7D15F9C619C06D124A7AAEBFA21290DCA614DB2C7757"
Last-Modified: Thu, 22 Dec 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11762
Expires: Fri, 23 Dec 2022 04:13:53 GMT
Date: Fri, 23 Dec 2022 00:57:51 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Type, Content-Length, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 23 Dec 2022 00:34:41 GMT
content-type: application/json
age: 1390
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
32167242c3bbe7e45a2a865279df94a6
d03436f418ff77d50a553daa892c05e0725ba908
d5578d537296da18f3f349a98465e9fe930dca60a8ed62c183e9c9f6eb53f493

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D5578D537296DA18F3F349A98465E9FE930DCA60A8ED62C183E9C9F6EB53F493"
Last-Modified: Wed, 21 Dec 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8677
Expires: Fri, 23 Dec 2022 03:22:28 GMT
Date: Fri, 23 Dec 2022 00:57:51 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: IMFhGWSNMEPhOwNIp8tFtrIpnfiecNNdNt4JoEASnY18ltRqf4xt6V5jto9Myb3nCLJUfu5+4kK7QfswD05xyA==
x-amz-request-id: 420N9SK67TTKF878
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 23 Dec 2022 00:53:52 GMT
age: 240
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 23 Dec 2022 00:57:52 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

4.us.silverwinds.xyz/feed/?link=true&tid=4&subid=4.us.android.chrome&ref=pdxx-7fmavzpxk2xlm-4-2.lowsea.fun&s1=63a4fcf8226147359d08f3e9

23.235.251.114

301 Moved Permanently

0 B

URL HTTP/1.1
4.us.silverwinds.xyz/feed/?link=true&tid=4&subid=4.us.android.chrome&ref=pdxx-7fmavzpxk2xlm-4-2.lowsea.fun&s1=63a4fcf8226147359d08f3e9
IP
23.235.251.114:0
ASN
#19437 SS-ASH

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /feed/?link=true&tid=4&subid=4.us.android.chrome&ref=pdxx-7fmavzpxk2xlm-4-2.lowsea.fun&s1=63a4fcf8226147359d08f3e9 HTTP/1.1
Host: 4.us.silverwinds.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Cache-Control: no-cache
Location: https://redir.blowingwind.xyz/click/invalid/?tid=4&subid=4.us.android.chrome
Date: Fri, 23 Dec 2022 00:57:52 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, ETag, Pragma, Last-Modified, Expires, Alert, Content-Type, Retry-After, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 23 Dec 2022 00:33:24 GMT
age: 1468
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c5473fc5740e1e6cb177ea5c65b9e446
2f12ac02c2a609f3b876b7bfe6d84a6286bc7a5c
f73bd9db2f03bb7cdb6161050a44d1b551116bab9c876a7ab190b532fada5aeb

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F73BD9DB2F03BB7CDB6161050A44D1B551116BAB9C876A7AB190B532FADA5AEB"
Last-Modified: Thu, 22 Dec 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11590
Expires: Fri, 23 Dec 2022 04:11:02 GMT
Date: Fri, 23 Dec 2022 00:57:52 GMT
Connection: keep-alive

redir.blowingwind.xyz/click/invalid/?tid=4&subid=4.us.android.chrome

198.211.113.186

302 Found

230 B

URL HTTP/1.1
redir.blowingwind.xyz/click/invalid/?tid=4&subid=4.us.android.chrome
IP
198.211.113.186:0
ASN
#14061 DIGITALOCEAN-ASN

File type
HTML document, ASCII text, with no line terminators
Size
230 B (230 bytes)
Hash
bf1ea261d68c3cae104a4434b2ed8723
5c2720cc951f801f2f7091867636e73490adcc78
67be18803779206c2595f60be36782945e42e8ba6ce70f8595a405c6861670d0

HTTP Headers

GET /click/invalid/?tid=4&subid=4.us.android.chrome HTTP/1.1
Host: redir.blowingwind.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 302 Found
X-Powered-By: Express
Surrogate-Control: no-store
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: 0
Location: https://leche.labtrffc.com/p.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240?s=nxs_4
Vary: Accept
Content-Type: text/html; charset=utf-8
Content-Length: 230
Date: Fri, 23 Dec 2022 00:57:52 GMT
Connection: keep-alive
Keep-Alive: timeout=5

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
70a7b165f99b2b8fa0dc98318a7158d7
4d924f7febab9c8fe3fe9199e8879fd6ad892575
c5e0e414c34f2f328b487ae72b21a12a1b50d952aa1a31fb6314b4e700d27e05

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1479
Cache-Control: max-age=117217
Content-Type: application/ocsp-response
Date: Fri, 23 Dec 2022 00:57:52 GMT
Etag: "63a41e2a-1d7"
Expires: Sat, 24 Dec 2022 09:31:29 GMT
Last-Modified: Thu, 22 Dec 2022 09:06:50 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6e4591914aec0dd93670bbe7c8474544
33f03e137bdd55c00a37a7fe2379047e89f053bb
b47597184cf8090d65e8403db3a8e5a85a3e800384df02541c3b2e38d28147a3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B47597184CF8090D65E8403DB3A8E5A85A3E800384DF02541C3B2E38D28147A3"
Last-Modified: Thu, 22 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5063
Expires: Fri, 23 Dec 2022 02:22:15 GMT
Date: Fri, 23 Dec 2022 00:57:52 GMT
Connection: keep-alive

leche.labtrffc.com/p.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240?s=nxs_4

51.83.143.92

302 Found

0 B

URL HTTP/1.1
leche.labtrffc.com/p.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240?s=nxs_4
IP
51.83.143.92:0
ASN
#16276 OVH SAS

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /p.php?p=c:9qopki6xwqp07eckv&d=603611c5b7eaf46891533240?s=nxs_4 HTTP/1.1
Host: leche.labtrffc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 302 Found
Server: nginx
Date: Fri, 23 Dec 2022 00:57:52 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Round: 
Raund: 
Location: https://go.redanemone.xyz/redirect?feed=465513&url=&subid=888fb&query=888fb

push.services.mozilla.com/

52.39.94.191

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.39.94.191:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: dIxZHy7LgCv6w8P4PZ696A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Z+JXTl46b5g/JtbQ06Cde0cxmDA=

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecc7a7baf688845a02fe8b4c67484768
6b499f4c3f77879d8e8871cf641267041c0fbf0e
fe60ddfb7b5d7337e6e8a7df75b2b4b4f749c8fb85fbaa4647daad3f6aadf0f1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FE60DDFB7B5D7337E6E8A7DF75B2B4B4F749C8FB85FBAA4647DAAD3F6AADF0F1"
Last-Modified: Wed, 21 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15133
Expires: Fri, 23 Dec 2022 05:10:06 GMT
Date: Fri, 23 Dec 2022 00:57:53 GMT
Connection: keep-alive

go.redanemone.xyz/redirect?feed=465513&url=&subid=888fb&query=888fb

198.134.116.30

302 Found

0 B

URL HTTP/1.1
go.redanemone.xyz/redirect?feed=465513&url=&subid=888fb&query=888fb
IP
198.134.116.30:0
ASN
#27257 WEBAIR-INTERNET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /redirect?feed=465513&url=&subid=888fb&query=888fb HTTP/1.1
Host: go.redanemone.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 302 Found
Server: nginx
Date: Fri, 23 Dec 2022 00:57:53 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Age: 0
Location: https://cngcpy.com/cuhdl?wh=MS9RKSYOsDOD7jbbc39Ni1Cy&si1=478937
Pragma: no-cache

e1.o.lencr.org/

23.36.76.226

200 OK

345 B

URL HTTP/1.1
e1.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
345 B (345 bytes)
Hash
b94a9116744d1c338034b73aedef869e
e09c5b940e7f4076fcd51ef29981c05a6f99d5a2
12380cf353bf2b85cf3544d219cdd7d73a5d5c86f4298c20c8b868262b0132b8

HTTP Headers

POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "12380CF353BF2B85CF3544D219CDD7D73A5D5C86F4298C20C8B868262B0132B8"
Last-Modified: Thu, 22 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4361
Expires: Fri, 23 Dec 2022 02:10:34 GMT
Date: Fri, 23 Dec 2022 00:57:53 GMT
Connection: keep-alive

e1.o.lencr.org/

23.36.76.226

200 OK

345 B

URL HTTP/1.1
e1.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
345 B (345 bytes)
Hash
b94a9116744d1c338034b73aedef869e
e09c5b940e7f4076fcd51ef29981c05a6f99d5a2
12380cf353bf2b85cf3544d219cdd7d73a5d5c86f4298c20c8b868262b0132b8

HTTP Headers

POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "12380CF353BF2B85CF3544D219CDD7D73A5D5C86F4298C20C8B868262B0132B8"
Last-Modified: Thu, 22 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4361
Expires: Fri, 23 Dec 2022 02:10:34 GMT
Date: Fri, 23 Dec 2022 00:57:53 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
fc328f2e44d4ac962c03be665dbf6436
7ac1bb5dd0d42c9cb2e6a67b06b55934190691fe
7d7ced4a7da10564449ddec77f05d85557a2b2f7e8fe2a7d15541c7b52aee928

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7CED4A7DA10564449DDEC77F05D85557A2B2F7E8FE2A7D15541C7B52AEE928"
Last-Modified: Thu, 22 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10640
Expires: Fri, 23 Dec 2022 03:55:14 GMT
Date: Fri, 23 Dec 2022 00:57:54 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
fc328f2e44d4ac962c03be665dbf6436
7ac1bb5dd0d42c9cb2e6a67b06b55934190691fe
7d7ced4a7da10564449ddec77f05d85557a2b2f7e8fe2a7d15541c7b52aee928

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7CED4A7DA10564449DDEC77F05D85557A2B2F7E8FE2A7D15541C7B52AEE928"
Last-Modified: Thu, 22 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10640
Expires: Fri, 23 Dec 2022 03:55:14 GMT
Date: Fri, 23 Dec 2022 00:57:54 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
fc328f2e44d4ac962c03be665dbf6436
7ac1bb5dd0d42c9cb2e6a67b06b55934190691fe
7d7ced4a7da10564449ddec77f05d85557a2b2f7e8fe2a7d15541c7b52aee928

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7CED4A7DA10564449DDEC77F05D85557A2B2F7E8FE2A7D15541C7B52AEE928"
Last-Modified: Thu, 22 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10640
Expires: Fri, 23 Dec 2022 03:55:14 GMT
Date: Fri, 23 Dec 2022 00:57:54 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
fc328f2e44d4ac962c03be665dbf6436
7ac1bb5dd0d42c9cb2e6a67b06b55934190691fe
7d7ced4a7da10564449ddec77f05d85557a2b2f7e8fe2a7d15541c7b52aee928

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7CED4A7DA10564449DDEC77F05D85557A2B2F7E8FE2A7D15541C7B52AEE928"
Last-Modified: Thu, 22 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10640
Expires: Fri, 23 Dec 2022 03:55:14 GMT
Date: Fri, 23 Dec 2022 00:57:54 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
fc328f2e44d4ac962c03be665dbf6436
7ac1bb5dd0d42c9cb2e6a67b06b55934190691fe
7d7ced4a7da10564449ddec77f05d85557a2b2f7e8fe2a7d15541c7b52aee928

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7CED4A7DA10564449DDEC77F05D85557A2B2F7E8FE2A7D15541C7B52AEE928"
Last-Modified: Thu, 22 Dec 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10640
Expires: Fri, 23 Dec 2022 03:55:14 GMT
Date: Fri, 23 Dec 2022 00:57:54 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F169797b0-6e7c-465c-beb9-7a6d7fececc1.jpeg

34.120.237.76

200 OK

5.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F169797b0-6e7c-465c-beb9-7a6d7fececc1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.7 kB (5670 bytes)
Hash
399e3ad7724965850c99ea3fc5e8bb45
fcf47ddb70d7861aafa57164182185b606d1b0c6
7d754b6de71e3f0e08eee4a657a12e402d04f68ae4f1771cd3d3b755837443d2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F169797b0-6e7c-465c-beb9-7a6d7fececc1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5670
x-amzn-requestid: bd33e45f-6da2-4885-a098-0e2310f1842d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dhfOFExroAMFijg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a3abf3-0e3675b0071c0a041ab7c3cf;Sampled=0
x-amzn-remapped-date: Thu, 22 Dec 2022 00:59:31 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 05BFfdjEXh8VlWjIiuug8_Jz9beocfVDO7gsKjrXcAQQqEcZhdk3Pw==
via: 1.1 a20e81b65d2465c729ce2f6bfe539dd0.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Dec 2022 12:28:21 GMT
age: 44973
etag: "fcf47ddb70d7861aafa57164182185b606d1b0c6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F636d561f-4cac-46b6-9b12-799eb03be3f7.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.1 kB (8103 bytes)
Hash
5aee260508b4a6317aa74cfa263fcf0f
0268b809b07f0126ae1c707f0a72cbf2c5ee5dde
b43410a5b53d6318d13a1b6cac311beaff9aaf2b21a6d68420ec7e3291ce44b4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F636d561f-4cac-46b6-9b12-799eb03be3f7.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8103
x-amzn-requestid: 1dec4794-e477-4587-a919-10fed7e06f73
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: degIwFtioAMFZoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a27a37-2088c1ec6c0d3158153e907b;Sampled=0
x-amzn-remapped-date: Wed, 21 Dec 2022 03:15:03 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mBdKNm-n2HvTeSA3FxMS7yfjJvmpTCrNNCuOlJgt1Q6y258pawKQ0A==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Dec 2022 08:40:52 GMT
age: 58622
etag: "0268b809b07f0126ae1c707f0a72cbf2c5ee5dde"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

2.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F257007ab-90ff-4ebd-93a2-9587a6c927b6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
2.5 kB (2495 bytes)
Hash
37ffea06e6cf128e4e43c662f4e8ad21
2d7b97172e7a0481a6eb1ccf0aa970d8934b2146
54a17f81719e2113d10e4bfadda1770b2f7d7827d6dc718327a1e469a4e07eca

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F257007ab-90ff-4ebd-93a2-9587a6c927b6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 2495
x-amzn-requestid: 9fe89a74-d6ce-4c60-94d6-42f3ff69a1ef
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dkUhqH68IAMFYGA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a4ce0a-3c64c13f25da86714b698121;Sampled=0
x-amzn-remapped-date: Thu, 22 Dec 2022 21:37:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: giGN-w7dHck4wGdPQY0t1Io_Ms1uUMDLJv-C7Pw0zsB4fIRV9_Flwg==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Dec 2022 21:38:11 GMT
age: 11983
etag: "2d7b97172e7a0481a6eb1ccf0aa970d8934b2146"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47ee94a5-9c56-4939-b124-56487f665b25.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11460 bytes)
Hash
187fd7f19c2b5452c58da85ac9010790
ae6a889ca7a320d976dd68c00cfe9fbd9e4b20be
a4baaa24e3ec3d41805bf1fe31f7d8c8572f7339950f65f356d9bdd8b101fa80

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47ee94a5-9c56-4939-b124-56487f665b25.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11460
x-amzn-requestid: e44d67f8-de86-44d3-8c81-30f8f9165623
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dkVD-EK5oAMF3eQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a4cee6-040b15d4132e0af7118d6217;Sampled=0
x-amzn-remapped-date: Thu, 22 Dec 2022 21:40:54 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Y_HOu1dDbdlkh8mU2QQwmIwiddfI8ZplWJbk8WBJcehxIeppmfzxsw==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Dec 2022 21:59:48 GMT
etag: "ae6a889ca7a320d976dd68c00cfe9fbd9e4b20be"
content-type: image/jpeg
age: 10686
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff4d8b8ab-ff79-4e93-97dc-b4b7d18e0b5b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.6 kB (6645 bytes)
Hash
0c276f786c96caac3f6a2b1cb20e4993
233988de2b66d8d97e0f21cbd1a182a9b4bd162f
bd5418d62aabf5e38f5c06409d0e1144f101d045072513150d5f16ffc2df169c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff4d8b8ab-ff79-4e93-97dc-b4b7d18e0b5b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6645
x-amzn-requestid: 0f18f9e7-c8b3-4250-8156-96d3ea8a9749
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: diVuQE5fIAMFeXQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a40327-520100d2431fabd14317afe3;Sampled=0
x-amzn-remapped-date: Thu, 22 Dec 2022 07:11:35 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: UYAT01ECmYKrp25iLBix5K0qdahEvfppThLwVjcQOffxq0UI9PEKsg==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Dec 2022 07:16:19 GMT
age: 63695
etag: "233988de2b66d8d97e0f21cbd1a182a9b4bd162f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e289df1-a1b6-4a7a-a3f0-0326ee48b354.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.6 kB (8628 bytes)
Hash
ada16d13af9310487aee9dae29df40fd
fcecaab531e403f8d5912cf29d977e549f96765b
66b7f13460489f1cd5f09b44cebadcf2f459b46aa6ff0c984c10fe0a48062942

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e289df1-a1b6-4a7a-a3f0-0326ee48b354.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8628
x-amzn-requestid: bf74fd40-dfac-4565-8e8d-a79bdaf4e1ba
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dVJpaHvTIAMF9ZA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639ebca2-29fa0add445d8e0d1691645d;Sampled=0
x-amzn-remapped-date: Sun, 18 Dec 2022 07:09:22 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: v_cc-cskoH2Fd8guDwxt7OhXQozpMVr77b5YvSz5q3NQidTA3R5B2g==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 219e8f088c8c2a564bdacafe44be620a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Dec 2022 07:31:19 GMT
age: 62795
etag: "fcecaab531e403f8d5912cf29d977e549f96765b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

my.okueroskynt.com/d65cf81f-7fce-4b74-a76f-b50cfca5bef2?source_id=355801&reason_id=hosting&format=pops&zone_id=1001973&browser=Firefox&country=NO&mode=sw&clickid=

18.158.88.249

302 Found

0 B

URL HTTP/2
my.okueroskynt.com/d65cf81f-7fce-4b74-a76f-b50cfca5bef2?source_id=355801&reason_id=hosting&format=pops&zone_id=1001973&browser=Firefox&country=NO&mode=sw&clickid=
IP
18.158.88.249:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /d65cf81f-7fce-4b74-a76f-b50cfca5bef2?source_id=355801&reason_id=hosting&format=pops&zone_id=1001973&browser=Firefox&country=NO&mode=sw&clickid= HTTP/1.1
Host: my.okueroskynt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 302 Found
server: nginx
date: Fri, 23 Dec 2022 00:57:54 GMT
content-length: 0
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://gbstwrldnws.com/rotator/352/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&fullscreen=1
pragma: no-cache
set-cookie: d65cf81f-7fce-4b74-a76f-b50cfca5bef2-v4=d4WCga2CbzqUHPOUQYxwe3HLNbmB_xsnZdnjEJQhSDA; Max-Age=86400; Expires=Sat, 24-Dec-2022 00:57:54 GMT; Domain=my.okueroskynt.com; Path=/; Secure; HttpOnly;SameSite=None
cc-v4=WRcLc9XMcMuCGSKiNUwmRMx0JPGghcM9yb3mOvP7diLSmCx4%2BQinDsRkQeOdMT%2FO05NpmwEwPe1cR%2B1LpX45zt91nLS8snpxZaBL%2BYigU187oH1eJmD%2Bagt8pefh%2FqdxWdQ6uV50A0l0rO4%2B3TzGBg%3D%3D; Max-Age=31536000; Expires=Sat, 23-Dec-2023 00:57:54 GMT; Domain=my.okueroskynt.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
756e9f7c773007265d88fcbfb5972912
6e982370f547bafd07d2a7903807f9aa7ceaeeb8
f129200f808b76fdea91bd4874fe764b35cf7684405f98dd17d0ac3ec32f3d87

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F129200F808B76FDEA91BD4874FE764B35CF7684405F98DD17D0AC3EC32F3D87"
Last-Modified: Wed, 21 Dec 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=311
Expires: Fri, 23 Dec 2022 01:03:05 GMT
Date: Fri, 23 Dec 2022 00:57:54 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c053e5cb4c99540582cd4fc0f25214e9
099d20f0a0a9d183d843fb6ba8594ca89afe0432
a1c2c12949a55b7f1d67502a0114d35402c5f5e474fa445f23a923b013ef5ba9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A1C2C12949A55B7F1D67502A0114D35402C5F5E474FA445F23A923B013EF5BA9"
Last-Modified: Tue, 20 Dec 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10656
Expires: Fri, 23 Dec 2022 03:55:31 GMT
Date: Fri, 23 Dec 2022 00:57:55 GMT
Connection: keep-alive

gbstwrldnws.com/adult_video_2/favicon.ico

192.133.142.177

200 OK

1.4 kB

URL HTTP/2
gbstwrldnws.com/adult_video_2/favicon.ico
IP
192.133.142.177:0
ASN
#15317 SERVEREL-AS

File type
MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel\012- data
Size
1.4 kB (1406 bytes)
Hash
bf5b6c805abb9d242e0eefe8f85e9253
7430ff53470894ca5d22d074c1569efc3b72b95d
edff483f89d1eeef57d191848be78a7f52313af079c116bf714a0f5d5b57e9c5

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /adult_video_2/favicon.ico HTTP/1.1
Host: gbstwrldnws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gbstwrldnws.com/adult_video_2/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&fullscreen=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 23 Dec 2022 00:57:56 GMT
content-type: image/x-icon
content-length: 1406
last-modified: Thu, 25 Jul 2019 13:49:48 GMT
etag: "5d39b37c-57e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2

gbstwrldnws.com/sw_rex_v2.js

192.133.142.177

200 OK

572 B

URL HTTP/2
gbstwrldnws.com/sw_rex_v2.js
IP
192.133.142.177:0
ASN
#15317 SERVEREL-AS

File type
data
Size
572 B (572 bytes)
Hash
69481dea9b29fa898b8038fe02e39571
ddd7c5d5c362e19476e4dd3e1bef4b5270ba667a
1af61cc437e6b217d3205216f56fada09f4215f74155d11719e3ccfa0917bee7

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /sw_rex_v2.js HTTP/1.1
Host: gbstwrldnws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Cache-Control: max-age=0
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 23 Dec 2022 00:57:57 GMT
content-type: application/javascript
expires: Fri, 23 Dec 2022 01:57:57 GMT
cache-control: max-age=3600
content-encoding: gzip
X-Firefox-Spdy: h2

rexpush.pro/js/sw_v2.js

199.182.164.165

200 OK

1.1 kB

URL HTTP/2
rexpush.pro/js/sw_v2.js
IP
199.182.164.165:0
ASN
#15317 SERVEREL-AS

File type
data
Size
1.1 kB (1140 bytes)
Hash
c5dac3abb2b1dc010fe1fdfa381c8f62
fc521486e9f6e3ad44b3bb4a795de9a6b6e4bba1
22f8a63b67201b4e59f89c1e8a0298719ce559df48dd088b284d027566aea670

HTTP Headers

GET /js/sw_v2.js HTTP/1.1
Host: rexpush.pro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 23 Dec 2022 00:57:57 GMT
content-type: application/javascript
last-modified: Tue, 08 Nov 2022 19:28:55 GMT
etag: W/"636aadf7-93c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
content-encoding: gzip
X-Firefox-Spdy: h2

cngcpy.com/cuhdl?wh=MS9RKSYOsDOD7jbbc39Ni1Cy&si1=478937

104.21.38.243

302 Found

0 B

URL HTTP/2
cngcpy.com/cuhdl?wh=MS9RKSYOsDOD7jbbc39Ni1Cy&si1=478937
IP
104.21.38.243:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /cuhdl?wh=MS9RKSYOsDOD7jbbc39Ni1Cy&si1=478937 HTTP/1.1
Host: cngcpy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 302 Found
date: Fri, 23 Dec 2022 00:57:53 GMT
content-type: text/html; charset=utf-8
location: https://my.okueroskynt.com/d65cf81f-7fce-4b74-a76f-b50cfca5bef2?source_id=355801&reason_id=hosting&format=pops&zone_id=1001973&browser=Firefox&country=NO&mode=sw&clickid=
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EiePi9THF5JTZfGS8yDJKvgWBk5FvQWsT62BvqLoyRxPAxxvsL%2FwL5EICTyw6D6f0NSChos5arTHdmIR7pusatV7hw4PZwR0IR%2FEiZHmAncY1fqMBp1S0Kn6GwMH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77dd254debc8b51d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

gbstwrldnws.com/rotator/352/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&fullscreen=1

192.133.142.177

302 Found

0 B

URL HTTP/2
gbstwrldnws.com/rotator/352/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&fullscreen=1
IP
192.133.142.177:0
ASN
#15317 SERVEREL-AS

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /rotator/352/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&fullscreen=1 HTTP/1.1
Host: gbstwrldnws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 302 Found
server: nginx
date: Fri, 23 Dec 2022 00:57:54 GMT
content-type: text/html; charset=UTF-8
location: https://gbstwrldnws.com/adult_video_2/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&fullscreen=1
X-Firefox-Spdy: h2

gbstwrldnws.com/adult_video_2/video.mp4

192.133.142.177

206 Partial Content

0 B

URL HTTP/2
gbstwrldnws.com/adult_video_2/video.mp4
IP
192.133.142.177:0
ASN
#15317 SERVEREL-AS

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /adult_video_2/video.mp4 HTTP/1.1
Host: gbstwrldnws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://gbstwrldnws.com/adult_video_2/1328/2da4af00d834dfbd23fda189a58e00c9/?click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&fullscreen=1
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 206 Partial Content
server: nginx
date: Fri, 23 Dec 2022 00:57:55 GMT
content-type: video/mp4
content-length: 483291
last-modified: Thu, 25 Jul 2019 13:49:48 GMT
etag: "5d39b37c-75fdb"
content-range: bytes 0-483290/483291
X-Firefox-Spdy: h2

rexpush.pro/js/s_4204c681cbc6ffce849ca2efa5d21139.min.js?tag=1328&attempt=0&rnd=412738441&lnd=adult_video_2&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&t_rdr=

199.182.164.165

200 OK

0 B

URL HTTP/2
rexpush.pro/js/s_4204c681cbc6ffce849ca2efa5d21139.min.js?tag=1328&attempt=0&rnd=412738441&lnd=adult_video_2&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&t_rdr=
IP
199.182.164.165:0
ASN
#15317 SERVEREL-AS

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /js/s_4204c681cbc6ffce849ca2efa5d21139.min.js?tag=1328&attempt=0&rnd=412738441&lnd=adult_video_2&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=woj4drgmg6ldq8cligv1n5f6&sub1=355801&sub2=&sub3=&tb=&t_rdr= HTTP/1.1
Host: rexpush.pro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gbstwrldnws.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 23 Dec 2022 00:57:55 GMT
content-type: text/javascript;charset=UTF-8
set-cookie: _f_30d9ff6106b5fe28d448dd5186c64932=2; expires=Mon, 20-Dec-2032 00:57:55 GMT; Max-Age=315360000; path=/; domain=.rexpush.pro; secure; SameSite=None
content-encoding: gzip
X-Firefox-Spdy: h2

gbstwrldnws.com/sw_rex_v2.js

192.133.142.177

200 OK

0 B

URL HTTP/2
gbstwrldnws.com/sw_rex_v2.js
IP
192.133.142.177:0
ASN
#15317 SERVEREL-AS

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /sw_rex_v2.js HTTP/1.1
Host: gbstwrldnws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 23 Dec 2022 00:57:56 GMT
content-type: application/javascript
expires: Fri, 23 Dec 2022 01:57:56 GMT
cache-control: max-age=3600
content-encoding: gzip
X-Firefox-Spdy: h2

rexpush.pro/js/sw_v2.js

199.182.164.165

200 OK

0 B

URL HTTP/2
rexpush.pro/js/sw_v2.js
IP
199.182.164.165:0
ASN
#15317 SERVEREL-AS

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /js/sw_v2.js HTTP/1.1
Host: rexpush.pro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://gbstwrldnws.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 23 Dec 2022 00:57:56 GMT
content-type: application/javascript
last-modified: Tue, 08 Nov 2022 19:28:55 GMT
etag: W/"636aadf7-93c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (41)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size