r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash e935ea42be4feaed61a824b0b903913e
f966cfa80d65a805cb9d7c6a53b3340865d7c51a
eb0ce9ae50d156fe5924b2d77346735e4e93b5240cff301c9aa835bb0b385815
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB0CE9AE50D156FE5924B2D77346735E4E93B5240CFF301C9AA835BB0B385815"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10431
Expires: Sat, 04 Feb 2023 07:36:19 GMT
Date: Sat, 04 Feb 2023 04:42:28 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash d4e95d0d8982bcd07804baf6fc88231c
5027abda0875bd2529dd4d6691784c74da71a9ee
373799b5749d2cb08b5721699a3e4c6b94b0d41604ac07d4ef7179e47dabc71f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "373799B5749D2CB08B5721699A3E4C6B94B0D41604AC07D4EF7179E47DABC71F"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3498
Expires: Sat, 04 Feb 2023 05:40:46 GMT
Date: Sat, 04 Feb 2023 04:42:28 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Retry-After, Backoff, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 04 Feb 2023 04:36:13 GMT
content-type: application/json
age: 375
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 7d2222d41721947297aaeb5a6e3d0714
04cc1ee417c8bf6338657fd4c2e4e1c1ddfd3065
de0e45969a2ad95e52f7e2fbd0d021d9075dd7b14666c929346efe111f648f7c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DE0E45969A2AD95E52F7E2FBD0D021D9075DD7B14666C929346EFE111F648F7C"
Last-Modified: Thu, 02 Feb 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8887
Expires: Sat, 04 Feb 2023 07:10:35 GMT
Date: Sat, 04 Feb 2023 04:42:28 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: KitouZSWMehj4IWpiX1DUFv6fmMGa/OR3dyDxaGaaIP/FYtHLaCop5oaLJtvsuh1QH236hFssrM=
x-amz-request-id: TPAD7PPW1ASKFE28
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 04 Feb 2023 04:23:51 GMT
age: 1117
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 04 Feb 2023 04:42:28 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
59.19.54.199/
59.19.54.199200 OK 458 B IP 59.19.54.199:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 86eab012e92bdb1a720c2472acc9e9e9
5ea6d7aaaf5629298bacfbfe87049484b157244d
26dab256a48aefdde53bdd58ee3350e2310fcf5b746e3848935ac135cfc221e2
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET / HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:32 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 458
Last-Modified: Mon, 17 Apr 2017 07:15:56 GMT
Content-Type: text/html
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 04 Feb 2023 03:49:07 GMT
age: 3202
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash dedf9c519ac38c4bece9c5bc895787d7
4911175c3f8a435978c5301c33c7a99a5e00a1d5
bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BDDD7E3A4939F863642A7C5348C1C8B9BC569B35C10A27F4CF5EC71F7E6B9698"
Last-Modified: Fri, 03 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3811
Expires: Sat, 04 Feb 2023 05:46:00 GMT
Date: Sat, 04 Feb 2023 04:42:29 GMT
Connection: keep-alive
59.19.54.199/index.html?_1675485782895
59.19.54.199200 OK 10 kB URL HTTP/1.1 59.19.54.199/index.html?_1675485782895
IP 59.19.54.199:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash ab5c3ebe0fdc9aa3ab2bba1e8b9282dd
1edd7f890995b0ce7ba1e5eb4916abe9cb8c748f
d948169b9f8f1f8fee91c50936ff9ae003f8e773c72312a8f71207fd70e474a2
Analyzer Verdict Alert quad9 Sinkholed
GET /index.html?_1675485782895 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:32 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 10397
Last-Modified: Tue, 28 Feb 2017 08:15:50 GMT
Content-Type: text/html
push.services.mozilla.com/
52.38.146.2101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 52.38.146.2:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: NBZ3kq5glhV8DheSvGMXIQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: tdIflER5d/gNdq9m3TCn6cr+LEg=
59.19.54.199/css/RSUI.css
59.19.54.199200 OK 1.9 kB URL HTTP/1.1 59.19.54.199/css/RSUI.css
IP 59.19.54.199:0
File type ASCII text, with CRLF line terminators
Hash acd558fc6ff464e9f4ff13de44046566
d6c5f46863fe96c92ee524ae1e2f76a4f8f23811
b902499db582243a23c4467ed5546331f4437deab3007deec7fa267a4dbec044
Analyzer Verdict Alert quad9 Sinkholed
GET /css/RSUI.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 1929
Last-Modified: Wed, 16 Nov 2016 01:49:50 GMT
Content-Type: text/css
59.19.54.199/js/LAB.min.js
59.19.54.199200 OK 5.5 kB URL HTTP/1.1 59.19.54.199/js/LAB.min.js
IP 59.19.54.199:0
File type ASCII text, with very long lines (5389)
Hash e842152f94c9b774040a36d6912188d9
82bac8881a591d959d78c37edc73bffd3cd9ae74
bf1fce150ff945b16370d23bed230287f97d36a1b0a13f62abeb89c2ca3f61e7
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/LAB.min.js HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:32 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 5490
Last-Modified: Fri, 08 Apr 2016 03:50:20 GMT
Content-Type: application/javascript
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
59.19.54.199200 OK 278 B URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 8d2799f78a6b6ce3db8217cc45b7a60c
34c439a1627a4a33d5327f879267fcd34f7bd688
f54b597dbc63181d070b07365ec4bd83b99ae7361b1247e918888948c95a5190
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-all.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 278
Last-Modified: Tue, 07 Jun 2016 05:53:36 GMT
Content-Type: text/css
59.19.54.199/css/main.css
59.19.54.199200 OK 6.5 kB URL HTTP/1.1 59.19.54.199/css/main.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 3bec80586a0da98608960ad4167ce4ee
a13484e93b943fc88f0c8d65e8fb75c86d39940a
69ffb43ae335c063dcef83f8f0cf744061cedb8d5bc0a3a9c369545f957e01b0
Analyzer Verdict Alert quad9 Sinkholed
GET /css/main.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 6515
Last-Modified: Wed, 18 Jan 2017 15:32:56 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-menu.css
59.19.54.199200 OK 2.0 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-menu.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 4b3800820d6aef7851bd3bd8e675ffc2
9ecdd4344c8221216b36e6b305977670c5302d7b
813777e6a74a386a8bf4b67ee7dae46e5144be07d17d84f8b3c6fbacf99872ac
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-menu.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 2015
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-grid.css
59.19.54.199200 OK 16 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-grid.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 2fc94e92acb9c378bcabaed91f813978
3a959862f7435b6d1b32ad3e5858717ba4e3b814
2b12768fd498b055904c021312839cc23a6919863101722168f867ece25c8f06
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-grid.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 15484
Last-Modified: Thu, 13 Oct 2016 01:14:28 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-dialog.css
59.19.54.199200 OK 14 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-dialog.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (305), with CRLF line terminators
Hash 64dbb8e32cacf9ee8f6345a4daa1999b
1cbc4af919c1e64472f37621c4bd78c6a13ddfcd
21d84c284f39abce9419e6b4a0d7dc5cac3056186bd9ff637057ed6e7c4f5abb
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-dialog.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 14374
Last-Modified: Tue, 07 Jun 2016 05:53:36 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-layout.css
59.19.54.199200 OK 7.6 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-layout.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 92cad57b46713293ced75ee551d1a9d0
d18d7639883e4bbace6631cb3e0c30c2ec90350d
384d092cd74c1281b253f9616ba1d033f3ed56668a8d0c4f2d0851c0af40b28f
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-layout.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 7632
Last-Modified: Thu, 11 Aug 2016 08:45:59 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-common.css
59.19.54.199200 OK 6.8 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-common.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (581), with CRLF line terminators
Hash c2f05706c81d4712cbaece0f3e680f92
8126cdfbd2eef2450ac31574d593cdfdd0b0370e
3e505ad314021e63e14f61000510cf250f0cd84f8423123bd43bc64c07e85c5b
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-common.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 6806
Last-Modified: Thu, 13 Oct 2016 01:14:28 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-form.css
59.19.54.199200 OK 19 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-form.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (512), with CRLF line terminators
Hash d0cf0faa08dea4e05486897890c68956
8dba9d15cbd2cf21db3fb518190b73cf6ef62ef4
cd75e612c778888531ea6a3b5fa35ee738cf221d85992f6de2467f367695a231
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-form.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 19338
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-tree.css
59.19.54.199200 OK 3.0 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-tree.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash d5233c0719a0623a11fb57adc401bfc8
a8a3a0d3ae7b8e22a6b85e0813784d2ef9865a70
d9e96b1eb0847cc615fe4118be6dd96b9761b5102676ccc2f00a231d4162d02f
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-tree.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 3021
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
59.19.54.199/ligerUI/skins/Aqua/css/ligerui-tab.css
59.19.54.199200 OK 6.2 kB URL HTTP/1.1 59.19.54.199/ligerUI/skins/Aqua/css/ligerui-tab.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 0bcb972d3599392d43d3c1ed65645465
9a526455f1952b0546be3d484194ea48f3873eb9
cdefe689cb9d036f86f3470cfc250c5923f1dfd07cb25032427026031e805136
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-tab.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:33 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 6197
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8266
Expires: Sat, 04 Feb 2023 07:00:16 GMT
Date: Sat, 04 Feb 2023 04:42:30 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8266
Expires: Sat, 04 Feb 2023 07:00:16 GMT
Date: Sat, 04 Feb 2023 04:42:30 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash c14d3cf8ade0150a711f094be32ac474
11e7fb5487d364c5392e1594e09f5b49831043ea
2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8266
Expires: Sat, 04 Feb 2023 07:00:16 GMT
Date: Sat, 04 Feb 2023 04:42:30 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca17cfb9-5ad6-429a-9791-23b12f01c467.jpeg
34.120.237.76200 OK 8.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca17cfb9-5ad6-429a-9791-23b12f01c467.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8bee4ee9542d0c7a9cc8402d60e7cca2
95b8debca975255d2a0a60c5c6dde74040bd2f88
a6c63af682c3d4b11e5af0aa6b72921b8acf72626fb765a60e96d491d2a04c70
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca17cfb9-5ad6-429a-9791-23b12f01c467.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8148
x-amzn-requestid: 6006bf4d-0aef-4eec-a73d-70cb8cad5abd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyDraGO9oAMFscg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd7fe2-1df60a735b30e2d41fd3a435;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:42:58 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tnqzIXXbcIjPhSnbzsVd2oN_qouQqZqlYGRNOAxlkQgnoI60PHY-CQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:09:44 GMT
age: 23566
etag: "95b8debca975255d2a0a60c5c6dde74040bd2f88"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4c16006-34b0-45cb-bb9f-46fe6dd44e3c.jpeg
34.120.237.76200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4c16006-34b0-45cb-bb9f-46fe6dd44e3c.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cf80667db0c35c9c6139eca4ba5d12fd
4c4cfdc2463e8704a7bf8e1477c43b6adf7c7590
d63e69f4b6ea16333d242bf33d4f02a4a6c96a739ca018d86afc5741d85b774d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4c16006-34b0-45cb-bb9f-46fe6dd44e3c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13065
x-amzn-requestid: 20c6f462-0f1f-44d1-9b6b-6afbc4e79e8b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fpYpcELtIAMFvFg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63da07d5-44cd803c0feba28919b0a9ec;Sampled=0
x-amzn-remapped-date: Wed, 01 Feb 2023 06:33:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: T3PhGRcHX1X2hn8K_4587fXBrEyuY5Em-b9Jg41uH4uyQXeFoRBIYg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 21:55:01 GMT
age: 24449
etag: "4c4cfdc2463e8704a7bf8e1477c43b6adf7c7590"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b2d6920-2a79-45a8-b007-d36cc875c52f.jpeg
34.120.237.76200 OK 9.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b2d6920-2a79-45a8-b007-d36cc875c52f.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3ac51fd6789cbe19c2d484c9022b0e39
bcba22a7b7f5dd1f59fffd1027e5d7002cecb6e9
300b5e50cb910f9f4905ee7313d98763b68f85f5874db499cc94469fb14cabfe
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8b2d6920-2a79-45a8-b007-d36cc875c52f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9500
x-amzn-requestid: 8fe94388-e8d9-4329-b73a-e9a356df76bb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyD9QEA1IAMF3Ug=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8054-51f954ac4bec16d1055e38f5;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:44:52 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: FkTJ6wQ4eFYBPDyS0l5vLeWvHHiQIx-cYyFzT4ggHJ8M5Gg3dozFxQ==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 21:59:51 GMT
age: 24159
etag: "bcba22a7b7f5dd1f59fffd1027e5d7002cecb6e9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F549d8f22-b421-4fad-867d-64232284ffaf.jpeg
34.120.237.76200 OK 8.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F549d8f22-b421-4fad-867d-64232284ffaf.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9409d3b4b0f8f973d9acab2b744d8dd0
15431d807c3fe818a9b363f1c725c1860e939799
ddde1e1c8faef040370396ccda3a5090e64b63a1bddbe642c128d66849c1caa4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F549d8f22-b421-4fad-867d-64232284ffaf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8148
x-amzn-requestid: a9d4782b-b24e-4b72-9994-b9efa680c2fd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyEEOHxIoAMFvUg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8081-1d17982c4fe45adf0704f4c4;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:45:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: VkajXQ1KEbO3T3sVDkH6XLx7pKr5cnHC2QOsR1EvKa7-8WPQrVFbXw==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:10:21 GMT
age: 23529
etag: "15431d807c3fe818a9b363f1c725c1860e939799"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd573e5ee-5860-4f00-9316-68ffbc966d73.jpeg
34.120.237.76200 OK 7.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd573e5ee-5860-4f00-9316-68ffbc966d73.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash bd5f43772dbf673858972c77e1e630d4
94c0a24c5d47a636e45a3694c694815091aee213
0b6c34a934eab27c326dab6c8b90e78e710a948ac7c4bf13ba907b5cda738c3e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd573e5ee-5860-4f00-9316-68ffbc966d73.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7692
x-amzn-requestid: 4a8d5bcb-b1a0-4015-9fb1-c00f613de8e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyEEEH5JoAMF0Ew=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8080-703ca5a95c06465c080a1c7d;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:45:36 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 7sVT1f8RurPSTdULfz7FLHS6c1-6TaaDqyH9hmVBUw8B6A2umK-TtA==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:12:57 GMT
age: 23373
etag: "94c0a24c5d47a636e45a3694c694815091aee213"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4e245a51-5c03-4b84-b42a-29fa3a7806e9.jpeg
34.120.237.76200 OK 8.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4e245a51-5c03-4b84-b42a-29fa3a7806e9.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 65cd12302c9ca5468dbc9a98155970e0
a0c63213c3021e40f8ea54f2da6a5c165ed5cfd1
8463155faca74f13ec4500fed98289d8bfbdc4a989d1cb7580736018eadf1000
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4e245a51-5c03-4b84-b42a-29fa3a7806e9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7992
x-amzn-requestid: ba4f95d9-6081-4b34-955c-bbe8e7b2335c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fyEEjGsdIAMF84w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dd8083-7666baa66ccdec9b5fec8736;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 21:45:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: A3c6sSs_b8KkREPa26a8X9NTEZpHGDjElR9hT-NXwg6dYpeuRNZXfA==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 22:10:21 GMT
age: 23529
etag: "a0c63213c3021e40f8ea54f2da6a5c165ed5cfd1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
59.19.54.199/js/pluginVersion.js?version=1675485784756
59.19.54.199200 OK 115 B URL HTTP/1.1 59.19.54.199/js/pluginVersion.js?version=1675485784756
IP 59.19.54.199:0
File type ASCII text, with CRLF line terminators
Hash a728527da69c9df2977fcebcb94e09cf
3f9a2140a37e0459f0646481b116cb95401bf0c3
a740f02720e2994fdba55becc04d61d8aa3fc2482e54ea42763b40a451d3e440
Analyzer Verdict Alert quad9 Sinkholed
GET /js/pluginVersion.js?version=1675485784756 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:34 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 115
Last-Modified: Mon, 17 Apr 2017 07:16:10 GMT
Content-Type: application/javascript
59.19.54.199/js/json.js?version=1.0.0.85
59.19.54.199200 OK 5.0 kB URL HTTP/1.1 59.19.54.199/js/json.js?version=1.0.0.85
IP 59.19.54.199:0
Hash 34f7231a0a213167e801318716261d1e
f9383563b79b1df26542b6ede395bb8d1213f904
5b7242ed8e6fe3e6afec7c014b7c66fc1bd68a7b2e0d2706ffaab7876ab8f94a
Analyzer Verdict Alert quad9 Sinkholed
GET /js/json.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:34 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 4955
Last-Modified: Fri, 08 Apr 2016 03:50:19 GMT
Content-Type: application/javascript
59.19.54.199/js/jquery-1.11.1.min.js
59.19.54.199200 OK 96 kB URL HTTP/1.1 59.19.54.199/js/jquery-1.11.1.min.js
IP 59.19.54.199:0
File type ASCII text, with very long lines (32086)
Hash 8101d596b2b8fa35fe3a634ea342d7c3
d6c1f41972de07b09bfa63d2e50f9ab41ec372bd
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/jquery-1.11.1.min.js HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:34 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 95786
Last-Modified: Fri, 08 Apr 2016 03:50:20 GMT
Content-Type: application/javascript
59.19.54.199/js/jcookie.js?version=1.0.0.85
59.19.54.199200 OK 1.8 kB URL HTTP/1.1 59.19.54.199/js/jcookie.js?version=1.0.0.85
IP 59.19.54.199:0
File type ASCII text, with CRLF line terminators
Hash 5ce74bbdfb5c027a12b22783cbc34824
66c014ee9b0c9d8dbac4c261e6ac28a5262e7a25
20e17c0c5216d9fcd9bc639e7f11a96a2743ccfebd6ca0a490f6428aba025019
Analyzer Verdict Alert quad9 Sinkholed
GET /js/jcookie.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=996
Content-Length: 1753
Last-Modified: Wed, 06 Jul 2016 00:48:23 GMT
Content-Type: application/javascript
59.19.54.199/js/CProgress.js?version=1.0.0.85
59.19.54.199200 OK 2.4 kB URL HTTP/1.1 59.19.54.199/js/CProgress.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash bc9e0142e6cb186e59bf3fdf275d1aff
237347d2b2a22767dcf513ead052af80c569afa6
208246414a3fc2e2a52885ea002913749ba455038ee019be51f83865045a78da
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/CProgress.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 2400
Last-Modified: Fri, 08 Apr 2016 03:50:18 GMT
Content-Type: application/javascript
59.19.54.199/js/common.js?version=1.0.0.85
59.19.54.199200 OK 38 kB URL HTTP/1.1 59.19.54.199/js/common.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 626bc8a7144a1f8cb65bac1fbb89e1fe
984197625838690034a3b8bb2ed4c4574f07e5b8
5e502055d06bd8ffb733057eb2acfd9416179964bd78e04325404f4479829506
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/common.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 38099
Last-Modified: Tue, 28 Feb 2017 08:15:30 GMT
Content-Type: application/javascript
59.19.54.199/js/class.js?version=1.0.0.85
59.19.54.199200 OK 35 kB URL HTTP/1.1 59.19.54.199/js/class.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 21d201ed8384516f829ae698db90cc8b
97423dfab1e6b06bcf216edce277e0cfce7b6ffb
2cdd96a49ca44d39710f8e51646f629c0917f04d132d0b7a36b7e3eaa741e167
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/class.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 34877
Last-Modified: Mon, 20 Feb 2017 09:25:50 GMT
Content-Type: application/javascript
59.19.54.199/js/function.js?version=1.0.0.85
59.19.54.199200 OK 8.0 kB URL HTTP/1.1 59.19.54.199/js/function.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash bc2faa43c45a7622a36084260156fa45
f200ace1c239390dae39a4449d807a83fd0f6961
37691844e7e8ab530111dc9afdd05fe58cf36980344577cde1033260e0052c0f
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/function.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 8025
Last-Modified: Wed, 18 Jan 2017 09:58:58 GMT
Content-Type: application/javascript
59.19.54.199/js/RSUI.js?version=1.0.0.85
59.19.54.199200 OK 14 kB URL HTTP/1.1 59.19.54.199/js/RSUI.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 6db0cf8c8657daf9cf89d3923a4f7f2d
76e9f2ac21fb749f7555c5035e38fefc646eb218
a77c9f3937ed50541f2f5e8e2cd62293f6423bf33e5e91f225518b992c802cba
Analyzer Verdict Alert quad9 Sinkholed
GET /js/RSUI.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=995
Content-Length: 14240
Last-Modified: Wed, 18 Jan 2017 03:48:34 GMT
Content-Type: application/javascript
59.19.54.199/js/divBox.js?version=1.0.0.85
59.19.54.199200 OK 9.9 kB URL HTTP/1.1 59.19.54.199/js/divBox.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash a4c72049873bb8dbb8fc072991f1b332
139df86161adfabb4c1bc3fa024d230da8fda13b
fb3765bbe0070ad4bbab798833f80e7b9eed17d28ecae21e32b501d579c32935
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/divBox.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 9905
Last-Modified: Fri, 25 Nov 2016 13:04:49 GMT
Content-Type: application/javascript
59.19.54.199/favicon.ico
59.19.54.199404 Not Found 38 kB IP 59.19.54.199:0
File type HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators
Hash 13f973bd928ab91c4043f323860e6aee
9dfb9fee625a23ff1a91ec564b95ac041eb15ff5
8c5bc512b2e4619fd2901ccfa298f064aab9ea5b89337965abd353588f3b02c5
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 404 Not Found
Date: Sat, 04 Feb 2023 13:25:34 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=ISO-8859-1
59.19.54.199/js/jquery.qrcode.min.js?version=1.0.0.85
59.19.54.199200 OK 14 kB URL HTTP/1.1 59.19.54.199/js/jquery.qrcode.min.js?version=1.0.0.85
IP 59.19.54.199:0
File type ASCII text, with very long lines (544)
Hash 05f0b1d7d4b9b0b4975870606d650e3c
f424bd339870510d1160d1c5da5d698aedbb452e
f4ccf02b69092819ac24575c717a080c3b6c6d6161f1b8d82bf0bb523075032d
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/jquery.qrcode.min.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:36 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 13995
Last-Modified: Fri, 08 Apr 2016 03:50:20 GMT
Content-Type: application/javascript
59.19.54.199/js/language.js?version=1.0.0.85
59.19.54.199200 OK 142 kB URL HTTP/1.1 59.19.54.199/js/language.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size 142 kB (141870 bytes)
Hash 8c7a75052e5e905c72b3815508355114
8cd4cecb35f45e037c5d2a402d870a8903f69c39
60be18762720bdec40defdc4ef6c99f34fcd5a7bcda392b28241a36b6868e94b
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/language.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:35 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 141870
Last-Modified: Wed, 08 Mar 2017 06:08:04 GMT
Content-Type: application/javascript
59.19.54.199/js/jquery.base64.js?version=1.0.0.85
59.19.54.199200 OK 4.5 kB URL HTTP/1.1 59.19.54.199/js/jquery.base64.js?version=1.0.0.85
IP 59.19.54.199:0
File type Algol 68 source text\012- Pascal source, ASCII text
Hash 20b1c2c863902e5bda8bab936f3acaf9
1ae88b012c9af18c8b03222810f80d9b324102c2
d38111b8e9d0a7e37b99e00917719eeea05c49c2c0e4da7861ab337e92b61d9b
Analyzer Verdict Alert quad9 Sinkholed
GET /js/jquery.base64.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:36 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=994
Content-Length: 4498
Last-Modified: Tue, 19 Feb 2013 15:20:18 GMT
Content-Type: application/javascript
59.19.54.199/ligerUI/js/ligerui.min.js?version=1.0.0.85
59.19.54.199200 OK 136 kB URL HTTP/1.1 59.19.54.199/ligerUI/js/ligerui.min.js?version=1.0.0.85
IP 59.19.54.199:0
File type ISO-8859 text, with very long lines (4671), with CRLF line terminators
Size 136 kB (135881 bytes)
Hash 6ff162554a4af4bdfc987ef94e118c5d
3e42873f2466a3359f1daf3adbcb50b2a84bf527
8e10fc96a223aed4ba0e6e51c50bb8a780208423f2fd7a2a3754662e0afeeb1d
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/js/ligerui.min.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:36 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 135881
Last-Modified: Mon, 04 Jul 2016 06:41:19 GMT
Content-Type: application/javascript
59.19.54.199/js/main.js?version=1.0.0.85
59.19.54.199200 OK 89 kB URL HTTP/1.1 59.19.54.199/js/main.js?version=1.0.0.85
IP 59.19.54.199:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (498), with CRLF line terminators
Hash 7228d3efa86dcc4c1f5fc2c17ad7e095
89308431a63d0076321aaf4594e6daa71a5d836e
68335e1dd2daca5ec57e704cd659306a2494e4f6a09b4b892abf4f67bdfd58bb
Analyzer Verdict Alert quad9 Sinkholed
GET /js/main.js?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:37 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=996
Content-Length: 88848
Last-Modified: Wed, 08 Mar 2017 00:50:52 GMT
Content-Type: application/javascript
59.19.54.199/html/webplugins.html?version=1.0.0.85
59.19.54.199200 OK 615 B URL HTTP/1.1 59.19.54.199/html/webplugins.html?version=1.0.0.85
IP 59.19.54.199:0
File type ASCII text, with CRLF line terminators
Hash b65347996a1cf884160560d97f156e77
5d6a6546760962562c8e781fa15f2ef3ba75fac1
919bf6db949372d06be39882bf2036613a1993998bca596c9a85953d4f594f34
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /html/webplugins.html?version=1.0.0.85 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:38 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=995
Content-Length: 615
Last-Modified: Fri, 08 Apr 2016 03:50:15 GMT
Content-Type: text/html
59.19.54.199/css/webplugins.css
59.19.54.199200 OK 447 B URL HTTP/1.1 59.19.54.199/css/webplugins.css
IP 59.19.54.199:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash ddae9ef6ef799a16583037c8f8a873a5
6bce4fb79909df056ea21ddf747f9b5abbe306fd
687a96b2097d73a6b35a628745fd3658db57e7c0dac65dada6de70b5fdeb6266
Analyzer Verdict Alert quad9 Sinkholed
GET /css/webplugins.css HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:39 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=994
Content-Length: 447
Last-Modified: Fri, 04 Nov 2016 01:46:28 GMT
Content-Type: text/css
59.19.54.199/js/webplugins.js?version=1.0.0.85&_=1675485785983
59.19.54.199200 OK 625 B URL HTTP/1.1 59.19.54.199/js/webplugins.js?version=1.0.0.85&_=1675485785983
IP 59.19.54.199:0
File type ASCII text, with CRLF line terminators
Hash b9da459aeae31a64d4b7792e6e66b36e
00e317e6457d08012968eea0ddf719f600f9d8c5
e822d4ccb5948ac7d25402c3c40349100ca3f0a7813d3c8462f819c2dbddd54b
Analyzer Verdict Alert quad9 Sinkholed
GET /js/webplugins.js?version=1.0.0.85&_=1675485785983 HTTP/1.1
Host: 59.19.54.199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://59.19.54.199/index.html?_1675485782895
HTTP/1.1 200 OK
Date: Sat, 04 Feb 2023 13:25:39 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 625
Last-Modified: Tue, 28 Feb 2017 08:14:52 GMT
Content-Type: application/javascript