Overview

URL down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%93%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%AF%C3%83%C2%83%C3%82%C2%86%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%98%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%94%C3%83%C2%82%C3%82%C2%B0_142_309004.exe/
IP163.171.133.124
ASNQUANTILNETWORKS
Location France
Report completed2022-07-03 20:09:45 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2022-07-03 2 down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%93%C3%83%C2%82%C3%82%C2%A9% (...) Malware
2022-07-03 2 down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%93%C3%83%C2%82%C3%82%C2%A9% (...) Malware
mnemonic secure dns  No alerts detected
Quad9 DNS  No alerts detected


Files

URL down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%93%C3%83%C2%82%C3%82%C2%A9% (...)
IP  163.171.133.124
Magic PE32 executable (GUI) Intel 80386, for MS Windows\012- data
Size 1428688
MD5 5131c7be984a2b0bb471f99d3d2ea9e4
SHA1 9a456bbf88c462416b0e08351e5e416a23a529b7
SHA256 6fbfcb1ac311e95e097dacdb5eff8283a9d7d0091ec26753ff114d596664af7c
Analyzer Analysed Verdict Comment
VirusTotal 2022-07-01 01:07:23 27/66


Passive DNS (8)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
[Mnemonic Passive DNS] ocsp.digicert.com (1) 86 2012-11-29 12:49:49 UTC 2022-07-03 11:51:19 UTC 93.184.220.29
[Mnemonic Passive DNS] push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2022-07-03 05:03:35 UTC 35.161.231.36
[Mnemonic Passive DNS] img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-07-03 04:06:00 UTC 34.120.237.76
[Mnemonic Passive DNS] down.6lugq4fy.com (2) 0 2021-01-12 20:00:47 UTC 2022-07-03 16:13:59 UTC 163.171.133.124 Unknown ranking
[Mnemonic Passive DNS] firefox.settings.services.mozilla.com (2) 867 2016-03-17 08:25:01 UTC 2020-05-25 20:01:47 UTC 54.230.111.65
[Mnemonic Passive DNS] r3.o.lencr.org (5) 344 2020-12-02 08:52:13 UTC 2022-07-03 04:49:06 UTC 23.36.77.32
[Mnemonic Passive DNS] content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-07-03 05:07:31 UTC 54.230.111.99
[Mnemonic Passive DNS] contile.services.mozilla.com (1) 1114 No data No data 34.117.237.239


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 163.171.133.124

Date UQ / IDS / BL URL IP
2022-08-12 05:02:53 +0000
0 - 0 - 2 down.7868636.com/cx/22/1/%C3%A6%C2%90%C2%9C%C (...) 163.171.133.124
2022-08-12 02:51:03 +0000
0 - 0 - 2 down.7868636.com/cx/22/1/xpsviewerwin10v1.20% (...) 163.171.133.124
2022-08-12 02:50:57 +0000
0 - 0 - 2 down.7868636.com/cx/22/1/%C3%A8%C2%BF%C2%85%C (...) 163.171.133.124
2022-08-11 22:51:18 +0000
0 - 0 - 2 down.5887979.com/cx/22/1/%C3%83%C2%A5%C3%82%C (...) 163.171.133.124
2022-08-11 15:52:48 +0000
0 - 0 - 2 down.3257575.com/cx/22/1/pasmutility.dllC383C (...) 163.171.133.124
2022-08-11 15:43:05 +0000
0 - 0 - 1 down.zmnrz.com/cx/20190925/2/eac3to2829v3.3.1 (...) 163.171.133.124
2022-08-11 06:34:30 +0000
0 - 0 - 2 down.6lugq4fy.com/cx/22/1/%C3%BF%C3%BF%C3%BF% (...) 163.171.133.124
2022-08-11 05:34:11 +0000
0 - 0 - 2 down.7868636.com/cx/22/1/venusbloodhypno%C3%8 (...) 163.171.133.124
2022-08-11 03:34:33 +0000
0 - 0 - 1 down.zmnrz.com/cx/20190412/1/%C2%B6%C2%B5f-12 (...) 163.171.133.124
2022-08-10 13:59:21 +0000
0 - 0 - 2 down.7868636.com/cx/22/1/logitechsetpoint%C3% (...) 163.171.133.124

Last 10 reports on ASN: QUANTILNETWORKS

Date UQ / IDS / BL URL IP
2022-08-12 09:03:45 +0000
0 - 0 - 1 down.rxgif.cn/Habit_Blink.exe 163.171.130.136
2022-08-12 08:45:30 +0000
0 - 0 - 1 www--wellsfargo--com--3p49329d48d6c.wsipv6.com/ 163.171.131.129
2022-08-12 08:38:22 +0000
0 - 0 - 26 https://www--wellsfargo--com--2l49329d48d6c.w (...) 163.171.131.129
2022-08-12 08:33:43 +0000
0 - 0 - 1 down.1230578.com/DTPageSet.exe 163.171.130.136
2022-08-12 08:32:04 +0000
0 - 0 - 2 www--wellsfargo--com--3749329d48d6c.wsipv6.co (...) 163.171.131.129
2022-08-12 08:30:59 +0000
0 - 0 - 25 https://www--wellsfargo--com--2m49329d48d6c.w (...) 163.171.131.129
2022-08-12 08:26:01 +0000
0 - 0 - 25 https://www--wellsfargo--com--2n49329d48d6c.w (...) 163.171.131.129
2022-08-12 08:16:00 +0000
0 - 0 - 25 https://www--wellsfargo--com--2p49329d48d6c.w (...) 163.171.131.129
2022-08-12 08:07:20 +0000
0 - 0 - 26 https://www--wellsfargo--com--2q49329d48d6c.w (...) 163.171.131.129
2022-08-12 07:52:39 +0000
0 - 0 - 26 https://www--wellsfargo--com--2r49329d48d6c.w (...) 163.171.131.129

No other reports on domain: 6lugq4fy.com



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (19)


Request Response
                                        
                                            GET /cx/22/1/%C3%83%C2%83%C3%82%C2%93%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%AF%C3%83%C2%83%C3%82%C2%86%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%98%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%94%C3%83%C2%82%C3%82%C2%B0_142_309004.exe/ HTTP/1.1 
Host: down.6lugq4fy.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         163.171.133.124
HTTP/1.1 301 Moved Permanently
Content-Type: text/plain; charset=UTF-8
                                        
Date: Sun, 03 Jul 2022 20:09:32 GMT
Content-Length: 0
Connection: keep-alive
Location: http://down.6lugq4fy.com/cx/22/1/%C3%83%C2%83%C3%82%C2%93%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%AF%C3%83%C2%83%C3%82%C2%86%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%98%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%94%C3%83%C2%82%C3%82%C2%B0_142_309004.exe
X-Reqid: 202429121210735020220703154859lrkwvHbTsampled
Server: WS-web-server
Age: 40509
X-Via: 1.1 PS-KHH-015lO119:9 (Cdn Cache Server V2.0), 1.1 hexi47:10 (Cdn Cache Server V2.0), 1.1 PSfgblPAR2dz77:2 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 62c1f77c_PSfgblPAR2cm80_21060-41476


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.65
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Retry-After, Content-Type, Alert, Backoff, Content-Length
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 03 Jul 2022 19:37:17 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: m0VBqVRKuvlph6MlRqk9-Q4aOhRsA72XA6jlkwqccnQ3GpIHsacXZg==
Age: 1935


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    c98c56ff7bc7ba547517573963f425e3
Sha1:   58c8dccc28ecd76424af6ed9988575a35cf8a0c2
Sha256: d57d9d5e87e8761ffdf790ff762307f5c823e8e8241781797373c10e076ec44e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "8E263E6763753F5659AC0FC2D11DAF8ECE9720988153C38CB40631AF26C86575"
Last-Modified: Fri, 01 Jul 2022 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4478
Expires: Sun, 03 Jul 2022 21:24:10 GMT
Date: Sun, 03 Jul 2022 20:09:32 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-08-10-12-10-21.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.99
HTTP/2 200 OK
                                        
content-type: binary/octet-stream
content-length: 5348
last-modified: Tue, 21 Jun 2022 12:10:22 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 03 Jul 2022 03:26:42 GMT
etag: "581454acdd98f34fd3fbabd0977ade29"
x-cache: Hit from cloudfront
via: 1.1 9d4a908d41124cba1276d6cef8f00c60.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: wWTJjCBpP4mvStnnkz8oyfffY6VPEIHXKMXTP-rcAuyrx7Ob6KNQaA==
age: 60171
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    581454acdd98f34fd3fbabd0977ade29
Sha1:   d8d86c0b513137aeb85de01cea7b272c35eb6ab4
Sha256: e98f8f33ba5ed59c3cfdf2ae54957ed32652cf0899f3c8db4b5872e3ece1e4eb
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
                                        
server: nginx
date: Sun, 03 Jul 2022 20:09:32 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /cx/22/1/%C3%83%C2%83%C3%82%C2%93%C3%83%C2%82%C3%82%C2%A9%C3%83%C2%83%C3%82%C2%8A%C3%83%C2%82%C3%82%C2%AF%C3%83%C2%83%C3%82%C2%86%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%98%C3%83%C2%82%C3%82%C2%B5%C3%83%C2%83%C3%82%C2%94%C3%83%C2%82%C3%82%C2%B0_142_309004.exe HTTP/1.1 
Host: down.6lugq4fy.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         163.171.133.124
HTTP/1.1 200 OK
Content-Type: application/x-msdownload;charset=UTF-8
                                        
Date: Sun, 03 Jul 2022 20:09:32 GMT
Content-Length: 1428688
Connection: keep-alive
Accept-Ranges: bytes
ETag: "FppFa7-IxGJBaw4INR5eQWojpSm3"
Last-Modified: Fri, 17 Jun 2022 08:50:26 GMT
X-Reqid: 202429121210735820220617165424lqHEBJFKsampled
Server: WS-web-server
Age: 1
X-Via: 1.1 PS-KHH-010aH122:7 (Cdn Cache Server V2.0), 1.1 hx172:10 (Cdn Cache Server V2.0), 1.1 PSfgblPAR2dz77:19 (Cdn Cache Server V2.0)
X-Ws-Request-Id: 62c1f77c_PSfgblPAR2cm80_21060-41489


--- Additional Info ---
Magic:  PE32 executable (GUI) Intel 80386, for MS Windows\012- data
Size:   1428688
Md5:    5131c7be984a2b0bb471f99d3d2ea9e4
Sha1:   9a456bbf88c462416b0e08351e5e416a23a529b7
Sha256: 6fbfcb1ac311e95e097dacdb5eff8283a9d7d0091ec26753ff114d596664af7c

Alerts:
  Blocklists:
    - fortinet: Malware
  File Analyzers:
    - virustotal: 27/66
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.65
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Retry-After, ETag, Backoff, Last-Modified, Pragma, Cache-Control, Expires, Content-Type, Content-Length, Alert
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600
Date: Sun, 03 Jul 2022 19:26:59 GMT
Expires: Sun, 03 Jul 2022 20:05:28 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ZgtwXBSxRrIANvP3cJ0mumADpynLxYKX0DIWKQDGhKUcnRNre4yItg==
Age: 2554


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4077
Cache-Control: max-age=133502
Date: Sun, 03 Jul 2022 20:09:33 GMT
Etag: "62c14e0e-1d7"
Expires: Tue, 05 Jul 2022 09:14:35 GMT
Last-Modified: Sun, 03 Jul 2022 08:06:38 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: fOz/OWfO3Nmn/CwaMKj93g==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         35.161.231.36
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Ic7aCpNSh8IFw8MFVtUfIP8g7ZY=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "ED6C6F73611FB56DFA41FD028E23F0BC0470D319E51B212B8078C2C0DF8F4638"
Last-Modified: Fri, 01 Jul 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10308
Expires: Sun, 03 Jul 2022 23:01:23 GMT
Date: Sun, 03 Jul 2022 20:09:35 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "ED6C6F73611FB56DFA41FD028E23F0BC0470D319E51B212B8078C2C0DF8F4638"
Last-Modified: Fri, 01 Jul 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10308
Expires: Sun, 03 Jul 2022 23:01:23 GMT
Date: Sun, 03 Jul 2022 20:09:35 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "ED6C6F73611FB56DFA41FD028E23F0BC0470D319E51B212B8078C2C0DF8F4638"
Last-Modified: Fri, 01 Jul 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10308
Expires: Sun, 03 Jul 2022 23:01:23 GMT
Date: Sun, 03 Jul 2022 20:09:35 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "ED6C6F73611FB56DFA41FD028E23F0BC0470D319E51B212B8078C2C0DF8F4638"
Last-Modified: Fri, 01 Jul 2022 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10308
Expires: Sun, 03 Jul 2022 23:01:23 GMT
Date: Sun, 03 Jul 2022 20:09:35 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd8609313-2166-40d9-90ec-6341379c3fee.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 7338
x-amzn-requestid: 869697e6-0d3d-494f-9bd4-599ba8fb82b0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: UhCw0HRyIAMFw8w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62bd1805-57e7ce3e54cc61c8719cc84b;Sampled=0
x-amzn-remapped-date: Thu, 30 Jun 2022 03:27:01 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: pVdbsBmFW9hqJSM-RLiz9AfblZPeK-PvP8Nyj6G1_xBQ-EOo0nfpAA==
via: 1.1 6328d32449cd285f3f7c7b3c41dbe9ac.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Sun, 03 Jul 2022 07:25:50 GMT
age: 45825
etag: "c0a0f3da9a66c00197d4135196b6685ff977ba3c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7338
Md5:    432a79bdc37c3a8426f75c44b7ee239b
Sha1:   c0a0f3da9a66c00197d4135196b6685ff977ba3c
Sha256: 4c7ebcf38e0bf5c4c4bbd97a5f02ea76e21e1812595980100b39158e5af96bdf
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd82a5d63-f405-4f54-ad9a-a423aeae09c9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 7184
x-amzn-requestid: 5bea16e3-4d08-4511-afc7-be12e1bdf693
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Uk06uGnEIAMFlhA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62be9b77-5aedba11418da4ae48e2b501;Sampled=0
x-amzn-remapped-date: Fri, 01 Jul 2022 07:00:07 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: ZMpQjN0yPnNrW170Hz-NjEwNA4zVpJLkhvvNp-m9CnQnyer1UvMSKA==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Sun, 03 Jul 2022 08:35:26 GMT
age: 41649
etag: "984498975a9424217a161f11ea66660a441ef6d4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7184
Md5:    dbf74d25f8acb3f6b249386ce5e55871
Sha1:   984498975a9424217a161f11ea66660a441ef6d4
Sha256: bf666960a2f1d4d8c96a0b3c21bdee73a345a24916d96197d4566f925ecefedd
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0972b268-f4d1-450c-a4fb-9c028283bc9a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 10919
x-amzn-requestid: 23b6304d-6914-4b7c-9546-51a0cc618047
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Udsy_HypoAMFjpQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62bbc1ac-3609a3fa574884a612eb1430;Sampled=0
x-amzn-remapped-date: Wed, 29 Jun 2022 03:06:20 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: NYiOOnweelCp0-DKbA2Z_bItDA3jpetk97Engp4BpzxahJsDdkP3HA==
via: 1.1 11c8673f8a48dc627eaa83c99e9efedc.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Sun, 03 Jul 2022 03:42:35 GMT
age: 59220
etag: "ca5bbf12904de3b5b04917d7acec94313b09fb87"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10919
Md5:    b7bb856907b42548036082ab66b18020
Sha1:   ca5bbf12904de3b5b04917d7acec94313b09fb87
Sha256: 00f04c1600388f435b3100709ebbd3c36e2f4d50d65fa6126d477f769cfb3f10
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62bdbf01-b66e-4ea5-94cf-b77ba0d66bda.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 7408
x-amzn-requestid: 86d7e2ed-33a0-444b-85da-0257ebbed741
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: UqHhrGfxoAMF8ig=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62c0b93d-0ab2048766c9d9a9146f28ca;Sampled=0
x-amzn-remapped-date: Sat, 02 Jul 2022 21:31:41 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: jsoSMiOLqe1of6TnIGKHxOF33SUOaOon2V8IPm_-9lek8ARYMDgDBw==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google
date: Sat, 02 Jul 2022 21:55:35 GMT
age: 80040
etag: "d887eca5c4230b68a7ecf1b6cde47b88068b9ddb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7408
Md5:    71682aed511493a6d621127a09d68b4f
Sha1:   d887eca5c4230b68a7ecf1b6cde47b88068b9ddb
Sha256: ba070049962feb25d955535d9860836aa042ad9965ab519ce8e026ffa63e54ae
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F27c91804-20e6-462f-aedb-bdf209d6a7ff.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 7435
x-amzn-requestid: b40cee49-550f-4039-97ef-1b46de576522
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: UqJBtE5voAMFWCg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62c0bba4-63212eaf06fb7d291ff9e6da;Sampled=0
x-amzn-remapped-date: Sat, 02 Jul 2022 21:41:56 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 2471PJrEUC3dKtVzv8vDMiY53Zt7tLMbYHGk6cNyWmN9eL42S7VYQA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 2ab6211e66998c8b58132661a7e3cade.cloudfront.net (CloudFront), 1.1 google
date: Sat, 02 Jul 2022 21:41:56 GMT
age: 80859
etag: "9b4f9ba34e26b13aef71dd9125dd3878dc2f9105"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7435
Md5:    bff84dbfeb7d2cb2edcb367e84ed0f7e
Sha1:   9b4f9ba34e26b13aef71dd9125dd3878dc2f9105
Sha256: 0a760e8b512c0b81c732721e1e0fae54b14b8387aa0d214ce7f325ba128d7a05
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F431f287f-9907-47aa-be38-0ff4e6db75fc.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 8553
x-amzn-requestid: da971ab1-68b6-455d-9725-1c2f89e165aa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: URFadFGkoAMF6Dg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62b6b5dc-42ece449553ff5151f7d4e8e;Sampled=0
x-amzn-remapped-date: Sat, 25 Jun 2022 07:14:36 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Bm3bvTSwaAQZWxuxX3_nYO08Nba9Ve_9TO9KbdetO8drpl1iTs275A==
via: 1.1 34c44cb7892e57a3b6c51812bcf68ee4.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 03 Jul 2022 09:16:13 GMT
age: 39202
etag: "303f4efaa9b98e39a935fc6514d3731d40d2977c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8553
Md5:    e6f97e6b64100081e8bed56216564854
Sha1:   303f4efaa9b98e39a935fc6514d3731d40d2977c
Sha256: 92dd803f1633bd65a2b4ac3223d8aa93dd55ed64c74b338aff62323585a3623c