Report - whatfont.net/

Report Overview

Submitted URL
whatfont.net/
IP
104.21.54.109
ASN
#13335 CLOUDFLARENET
Submitted
2022-12-03 10:11:06
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
16

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.4 kB	6.2 kB	23.33.119.27
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
cdnjs.cloudflare.com	235	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	392 B	5.7 kB	104.17.25.14
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	54.149.51.98
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	51 kB	34.120.237.76
whatfont.net	152967	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	7.4 kB	623 kB	104.21.54.109
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.6 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-12-03	medium	whatfont.net/	Malware
2022-12-03	medium	whatfont.net/assets/css/styles.css?v=2	Malware
2022-12-03	medium	whatfont.net/assets/img/dots.svg	Malware
2022-12-03	medium	whatfont.net/assets/img/figure.svg	Malware
2022-12-03	medium	whatfont.net/assets/fonts/AirbnbCerealExtraBold.woff	Malware
2022-12-03	medium	whatfont.net/assets/fonts/AirbnbCerealLight.woff	Malware
2022-12-03	medium	whatfont.net/assets/fonts/AirbnbCerealBook.woff	Malware
2022-12-03	medium	whatfont.net/assets/fonts/AirbnbCerealBold.woff	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	whatfont.net/	99 B	2023-03-08	2023-04-01
Pretty URL whatfont.net/ IP 104.21.54.109 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 15:14:44 Last Seen2023-04-01 11:04:12 Times Seen2 Hash f08e0197477d239e0eb87e0fe1b9a3e1 34a52af2db5671db70c43a0f9949fd6904aa6fb8 bde76d17f74b614d08fc5b0e3e3e6c4150bfb17ac566a43af43d4f37c4e7dbd9 Loading...

HTTP Transactions (44)

URL IP Response Size

whatfont.net/

104.21.54.109

200 OK

1.4 kB

URL HTTP/1.1
whatfont.net/
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text
Size
1.4 kB (1362 bytes)
Hash
ae180bd2188cf5d5237298c612d419f8
9b173ff177d9771d99d8544e5a78952ad322f927
8edcb5cf1ec577ee35054018372dca147195a10a433c3bd3e263a76f82a50874

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET / HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:55 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NMx9RPF88O%2BXzLW1iao0b9hdLxfvHNgg%2FpfFnaRsBsRv%2FoIfeLOEVt2BNWdsvlcnuq0DDR6sLQHXIvDB%2BL0bYz46QPMs5pmxSfXaBAeUdATcZaj4Dgx1%2B7c1pOJnMJc%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 773b83ea6f35b4fd-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4600
Expires: Sat, 03 Dec 2022 11:27:35 GMT
Date: Sat, 03 Dec 2022 10:10:55 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
7439fb99a444b66db1e68ffbfaa38451
4b7742d7956485906f1c392c478515ff89a46184
636327ce88f733e5a1d39af212f97242717a39ce20edaef330fafea238e3a309

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2932
Cache-Control: max-age=90552
Content-Type: application/ocsp-response
Date: Sat, 03 Dec 2022 10:10:55 GMT
Etag: "6389d3f3-1d7"
Expires: Sun, 04 Dec 2022 11:20:07 GMT
Last-Modified: Fri, 02 Dec 2022 10:31:15 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 03 Dec 2022 09:19:59 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3057
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11152
Expires: Sat, 03 Dec 2022 13:16:48 GMT
Date: Sat, 03 Dec 2022 10:10:56 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: 3K/OX1Ayba1XGp6B0aXB+Y+uv5GM2EFlqr6ZMn2xU9H6GC3eUt7wbGueHLouISyCvygeTLfXp/Y=
x-amz-request-id: 1FP167GT40XH4VN2
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 03 Dec 2022 09:46:31 GMT
age: 1465
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

whatfont.net/assets/css/styles.css?v=2

104.21.54.109

200 OK

2.2 kB

URL HTTP/1.1
whatfont.net/assets/css/styles.css?v=2
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text
Size
2.2 kB (2192 bytes)
Hash
fa56fc7d827c88aee0d4782db15bf875
b1ebb5d8585dfec94af3ed25ef4c3be1b9cdadf5
0f9afb951d96f3e9fccf89efc1fe5b3839e810d9ed00686f7c8a1f05502b275e

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /assets/css/styles.css?v=2 HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: W/"61ae0a06-2196"
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qr9v2g9s5ghsKILw4UiUIqerglBD43xT1QLEQr8QCvtb%2FOlWFFWZJ6HQVhE2rD1BHRPQJvrtHLCIpzCFO7CQtdNtsI4n%2FscWsQGqJgyJKIsk%2B8r7IpLjejQbsWu0NDw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ec89cdb4fd-OSL
alt-svc: h2=":443"; ma=60

cdnjs.cloudflare.com/ajax/libs/parallax/3.1.0/parallax.min.js

104.17.25.14

200 OK

4.7 kB

URL HTTP/2
cdnjs.cloudflare.com/ajax/libs/parallax/3.1.0/parallax.min.js
IP
104.17.25.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (17272)
Size
4.7 kB (4655 bytes)
Hash
0bb455442d6528ba3d5c5dac37f7107e
7d59cba826ed9b3bc08bcf4c86cbe75b9fc61503
3c05436d103f8b7074c0f148209867bb8848da7f0cbc74be0b900ad0e228d3f3

HTTP Headers

GET /ajax/libs/parallax/3.1.0/parallax.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://whatfont.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 03 Dec 2022 10:10:56 GMT
content-type: application/javascript; charset=utf-8
content-length: 4655
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03f40-43a2"
last-modified: Mon, 04 May 2020 16:13:52 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 5065286
expires: Thu, 23 Nov 2023 10:10:56 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZbuT4gbQ%2FMufxhw7tbXx3NuaJ2ALNGrkXSllSrs7XHFVUhqaeStmiyzz%2B6VXgScKAXBZ9mEJW00kicL1xh6NzTnGYa3GLvi8rnUc8y95I9KEppKHQY6zd48VyzpB7TpyQz0isufi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 773b83ecaec8b529-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

whatfont.net/assets/img/logo.png

104.21.54.109

200 OK

4.5 kB

URL HTTP/1.1
whatfont.net/assets/img/logo.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 167 x 31, 8-bit/color RGBA, non-interlaced\012- data
Size
4.5 kB (4488 bytes)
Hash
69da526fc972afb4f623afc831fd6452
27a3f92965062d00be8318590e3b54b1a83f78ca
f91748ce5feda4e717f4a7c849ced40b6234010f8e18dc678a42ca47e69eebbe

HTTP Headers

GET /assets/img/logo.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 4488
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-1188"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QZR4RANUTISKtfofWxviWAobClX5B7RadhGL1TZTflRmVmuQye%2BnWRctpryuULWt4fgrucWYjGriFOJHhxd%2FtoJ4TOIyrWcC3TYl0g2DG5%2Bk8lwTq8QEwrB2A7OYMgg%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83eccc8fb51b-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/hover.png

104.21.54.109

200 OK

27 kB

URL HTTP/1.1
whatfont.net/assets/img/hover.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 350 x 190, 8-bit/color RGB, non-interlaced\012- data
Size
27 kB (26643 bytes)
Hash
0e91c48d8a977ea139d5d4bf4a0deb6c
d8f35132d2ba8b1f1066a667a57806f422f7011d
c8727fa42580fb0eb888c3216dcee9622b8c04467dcab4cfa33cb9b1f0ffe309

HTTP Headers

GET /assets/img/hover.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 26643
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-6813"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZHQb%2BelYaQbiJPQ5%2ByKFoTdOo4qZh52qxJtlew7aEsQ74Qa3ZmYGbXOKe2vAUig%2FP7ITwYGzIXRHgrW%2BUr9fORD8KC4Mm%2BAbyOCfkEG05w8bo4%2BZ0IVDHtLm%2BCk6rCU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ecca17b4fd-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/dots.svg

104.21.54.109

200 OK

439 B

URL HTTP/1.1
whatfont.net/assets/img/dots.svg
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
SVG Scalable Vector Graphics image\012- , ASCII text
Size
439 B (439 bytes)
Hash
44d69ede108b9a90997f1366ecc5fb00
1834c595ff0e394f1081345d0f8be7704f66ce6a
c5b781eb209dd461e8e1d9f4e9cab04ef7313df321a058b05fcafbfee8716d99

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /assets/img/dots.svg HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: W/"61ae0a06-b3f"
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8zp7l9gobglj5AAIKYwC0DCqiCqC6wJTiiUrNGj02VXEQKf7wX7YVGRw8OmeaMsEsC2D6sx1wGY421q9qdAbUl2xpoWGPetlqZz0w%2B7KK6iY30eHjJigLBwTeioAQBE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83eccfc5b523-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/detailed.png

104.21.54.109

200 OK

26 kB

URL HTTP/1.1
whatfont.net/assets/img/detailed.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 350 x 207, 8-bit/color RGB, non-interlaced\012- data
Size
26 kB (26229 bytes)
Hash
09f1c8605ea3e669c8e787e04479dd13
b3968526f5e367399dcf16907442469ad2fe9be2
973aac4eef613ab7e8728a7ea1bd6fefd8492bebac0edc2fcbdb9d026b5b5991

HTTP Headers

GET /assets/img/detailed.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 26229
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-6675"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZGiVClas%2FOhnxadBaO5QBpx4S06gx4Ws%2F2gKNqyeeeU57xD9mkBvSgBvDUtVrc44BxVGSMv1E%2Bd2zk0wESFs2bqSavaGNV9Y6xv67qEjUBvdRq84Z6%2Fe7ohsLkdau8w%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83eccc660b51-OSL
alt-svc: h2=":443"; ma=60

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 03 Dec 2022 10:10:56 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

whatfont.net/assets/img/search.png

104.21.54.109

200 OK

43 kB

URL HTTP/1.1
whatfont.net/assets/img/search.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 431 x 240, 8-bit/color RGBA, non-interlaced\012- data
Size
43 kB (43176 bytes)
Hash
f3214ce05416ab95099837c178d25ddc
c6f2c320cdce4343bcc8ad0b8dc7859ee11b4bab
06d57b0c2aed6f91972fc82eb732e87b8e4329e013d81039496ea18ce9f6d7e3

HTTP Headers

GET /assets/img/search.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 43176
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-a8a8"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=354JjMPDdJQxIepV2CTyPLojUJafga51OT2TTdZN4Sz7fhsAJojhDSIyUdulPtRAFXR9GOTF%2FWTlFvUk6ip6rVYiBbRRK5m4z23uXealQuOeFWcM0nF7xbokCddAbtQ%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83eccfc7b523-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/ball.png

104.21.54.109

200 OK

2.4 kB

URL HTTP/1.1
whatfont.net/assets/img/ball.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced\012- data
Size
2.4 kB (2394 bytes)
Hash
7737db518c0d6ea246c0f4012b068905
b23074c7405ca4062070243f61273587b6cbf995
53b95626dc54fe9bf646dce0049e6e824fbc38809c50dcb19c1686ecf83dfbad

HTTP Headers

GET /assets/img/ball.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 2394
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-95a"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2F1yJnEO9DMGdiyS7LkoiXxWE7SeETMmo6TTPYToagiSaVIewwYqyFgJu9mIhMKPYm3%2BGGnplZMR8Q0ixaiZ11iAW2yeCHZTKIRpp4P0ctlil%2Bd0IvsOU7q95ny%2BxMw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ecfc930b51-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/step1.gif

104.21.54.109

200 OK

17 kB

URL HTTP/1.1
whatfont.net/assets/img/step1.gif
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
GIF image data, version 89a, 350 x 190\012- data
Size
17 kB (17388 bytes)
Hash
e6e1974eb22ca73c72e5f8dc5146093e
9bf44acaaefc3fa2d96f32ecf6f9a3988e3aaedf
94dee05c5563aa7e56dfb43ae8812670b0ab0b8347cebc159aecae5b08358d43

HTTP Headers

GET /assets/img/step1.gif HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/gif
Content-Length: 17388
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-43ec"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tq1Mky1zOPj8xWEZ1A7f46pzyfb2XW9vj%2F5456c4sp03i1WUScoCgYhlO8aMh9YaGJ7W2KbMwEfdqtDq5p9P2JpMzBabQvzzJNcjVNDjNKBkr3wm6J%2B6760kABx6TQM%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ecf88c0b45-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/step1.png

104.21.54.109

200 OK

7.1 kB

URL HTTP/1.1
whatfont.net/assets/img/step1.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 350 x 190, 8-bit/color RGB, non-interlaced\012- data
Size
7.1 kB (7107 bytes)
Hash
b35851e727046a461220576cb30c2846
b6f5dba69366002ae2cf2a33bd4689c711686ab1
8f3e99cd31f00539497be9445b2fc4bb3b2257bb8d5c1f8998e36d9177f6f01e

HTTP Headers

GET /assets/img/step1.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 7107
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-1bc3"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6wa6Q6yD0jmqTKxYOCnV9%2FC6GPjt%2BYpqrLvvYXbFjQaQoAzKQS0cuvV9t%2BfUbF8yFhDzDmSqaCPHbzzQwC%2FXpllIE8PTn5PswpCGbOxv%2F%2B%2FMjKHJu0Kx8%2B6lmf3xCwY%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ecfa5cb4fd-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/hover.gif

104.21.54.109

200 OK

97 kB

URL HTTP/1.1
whatfont.net/assets/img/hover.gif
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
GIF image data, version 89a, 350 x 190\012- data
Size
97 kB (97101 bytes)
Hash
2df70d7dbd070e73a17fb9ae19fb916f
961c69130d6edaf254afda64d03a3fb0f41cd409
2761144cf242089e50aea3a029a809bfeb48316f515289ab845893abcee17f16

HTTP Headers

GET /assets/img/hover.gif HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/gif
Content-Length: 97101
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-17b4d"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dyXPcPoKkfpblaSpR%2FA1XcsVk6A5%2BBaoxdeUUnk31%2BM%2FxFJ1OOI0LEgwKL4hSZ8LCT4j14nNdux%2BSWFLSh45ZVwof%2FCwnIqZbckU7whu4G%2FWPf2CRarojrfTYig84xk%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ececbdb51b-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/text_2.png

104.21.54.109

200 OK

16 kB

URL HTTP/1.1
whatfont.net/assets/img/text_2.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 171 x 176, 8-bit/color RGBA, non-interlaced\012- data
Size
16 kB (16138 bytes)
Hash
ad123b8edd39a6b98bc4a0515ec12ca5
19ba904e38957fbb7db18fa21e82ce985682c653
21a47211145ce9d31528e5c6984b0f51dd0950ee32857dd0fd4efbd172cc06a0

HTTP Headers

GET /assets/img/text_2.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 16138
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-3f0a"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=msQX1lF560AdCIg7OjECdlEfz0Tjg9ko85Q2RXDun2xa7VpIYypfCNELGVahMOKcSLWKj4AdHcUZYrA5FmXrz%2Ffr8TyEsGPsHVs4iWIlME43K%2FzgcDm1xvcxx77i%2FI0%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed1cac0b51-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/pin1.gif

104.21.54.109

200 OK

68 kB

URL HTTP/1.1
whatfont.net/assets/img/pin1.gif
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
GIF image data, version 89a, 480 x 270\012- data
Size
68 kB (68182 bytes)
Hash
0d801875df302362c806cb682b3829a3
2560b240c157f02690d80bcfc1fd67416a1b0d19
e6e97595931596bdb27014e5f99e170bdff3abc3155f8bc96d0daa293db9809a

HTTP Headers

GET /assets/img/pin1.gif HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/gif
Content-Length: 68182
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-10a56"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=72o9tQSEJoxFt%2FUnGSh728ha%2BLyM88lB9GKwkX19ncVOsqgul%2FZKXUTwBgizphxiwvnFshIh77oN%2FvG1yNDNz7mW0xnFm7P3sg3cWt%2B%2F1V%2FJ8QxcU1EzfooxDzhYh1U%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ecf819b523-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/text_1.png

104.21.54.109

200 OK

94 kB

URL HTTP/1.1
whatfont.net/assets/img/text_1.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 483 x 476, 8-bit/color RGBA, non-interlaced\012- data
Size
94 kB (94206 bytes)
Hash
c2a4ec458c0f9eba90df382a41577bce
81e55afae86d88706ef828c7a42cc4392bc7bf00
2e3f41fb449a7573035c2cf35ee24bc1f2d06257c80f01a21b6bbf542ab5b0c2

HTTP Headers

GET /assets/img/text_1.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 94206
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-16ffe"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B1LYhs1aUlvYv5S3ee02O2CGxx4z0zB%2Bt7Ba2Iba6cMwpqaII1K1GmZxTWgGkKy38RWDJDBAlX4hosMUdNIqcbk%2FPEt3a1pYPwe3fAw8oj%2F3mOBGXz4goJ6C2tZzE5w%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed0825b523-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/waves.png

104.21.54.109

200 OK

8.8 kB

URL HTTP/1.1
whatfont.net/assets/img/waves.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 651 x 60, 8-bit/color RGBA, non-interlaced\012- data
Size
8.8 kB (8772 bytes)
Hash
14daeb87f80fd4632e8fa8216ad92ab3
b2c833fc3580bd5a18ae62fbca587e6f5713463f
acf45d144343715e9d5fa2eb41794780461018ffe39524325ecacb642ba9c13e

HTTP Headers

GET /assets/img/waves.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/assets/css/styles.css?v=2

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 8772
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-2244"
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uzo7CmPz%2FiMZGBVqYK2M3%2BbX5cgyNo8sFWYluFWlJuFl6JRa%2B8pMh0MmADc7P%2FLNaJezYnDnB3x6eb1pbDtj4LgWruMcB5jVxKKze98q9cQwl8%2FkOPWghoRXDqsQKyE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed8d69b51b-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/img/figure.svg

104.21.54.109

200 OK

372 B

URL HTTP/1.1
whatfont.net/assets/img/figure.svg
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (466)
Size
372 B (372 bytes)
Hash
d2b6d24e3176ee125ad09e4c16208a36
1fcc987a158c3d85506f248fd6b0fdc491c19618
d3759c1acf4351c6b2e186dea7253b83a9c057c659673338ae232d20836a0dd2

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /assets/img/figure.svg HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/assets/css/styles.css?v=2

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: W/"61ae0a06-23e"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F445BdUrB2t78WsTbM58SCcxakXvuLuNJZR3TJTwFXOBlU9mqIs1Xnssa9djSuDDyh%2FGG5mHYjtwi4gVE%2FhObRK%2Fs5chjepC%2Bn310KRFDHTpoykNXg87Wg0zaYYruHI%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed88ff0b45-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

whatfont.net/assets/fonts/AirbnbCerealExtraBold.woff

104.21.54.109

200 OK

30 kB

URL HTTP/1.1
whatfont.net/assets/fonts/AirbnbCerealExtraBold.woff
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format, TrueType, length 30168, version 0.0\012- data
Size
30 kB (30168 bytes)
Hash
eef0aa3fd067658b3ae410fd1b563aa0
519f3bb96539333c97c2ac5d868aafb1b8a2d452
9c5cb9c09ab4752880e1726426cb917b01623169e23c9dfa4eb84bde96cc8f09

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /assets/fonts/AirbnbCerealExtraBold.woff HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://whatfont.net/assets/css/styles.css?v=2

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: application/font-woff
Content-Length: 30168
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-75d8"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iDnnH7gV2fzNapuump%2FGwYVtdruxO%2BWszw74SZmx%2FllLXZGvuRpQwEX5DtoWsZeT5AzhBW9za73bsGYjR%2BH8pYmPyvmcdX%2F%2BTfkHQwydvWUXGM%2FlNGO%2BhJY4XV%2FqdW8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed8b30b4fd-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/fonts/AirbnbCerealLight.woff

104.21.54.109

200 OK

49 kB

URL HTTP/1.1
whatfont.net/assets/fonts/AirbnbCerealLight.woff
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format, TrueType, length 49216, version 0.0\012- data
Size
49 kB (49216 bytes)
Hash
d2a616df336ba4fbc0bafbf4683da4b1
32b0081bcf18ae1f0aaf0dd363c638c17873f1da
3b0c739607dccc75824b687e910ccb5a2a07680e75330b7572041f1676419fa5

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /assets/fonts/AirbnbCerealLight.woff HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://whatfont.net/assets/css/styles.css?v=2

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: application/font-woff
Content-Length: 49216
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-c040"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iwEQdnEr9H5OPxEDJwUY03AN5hMzCCKDlsydU4FcXVTQ8l1UNi0Bv4EfGgfh90Oh8a8jClkcF3PZgP06GQqQI02xbuegF2Vvi7xrxuE9wqQZ1gvbGcBtOiV5KtimS7k%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed8d1a0b51-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/fonts/AirbnbCerealBook.woff

104.21.54.109

200 OK

50 kB

URL HTTP/1.1
whatfont.net/assets/fonts/AirbnbCerealBook.woff
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format, TrueType, length 50432, version 0.0\012- data
Size
50 kB (50432 bytes)
Hash
886339361d3ff50e8a95ac5cdc63a82e
df3c81ab2c5ff45725cf041783a36e8543d1773e
9d23ae4ad95c9315e7f1df4cc0a36c666e1cb2731cd7925931f9be37933f369d

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /assets/fonts/AirbnbCerealBook.woff HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://whatfont.net/assets/css/styles.css?v=2

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: application/font-woff
Content-Length: 50432
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-c500"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QLcQmHZymo6tltTuoz%2BjnK2XlRydkQ2cWFohW3rHKL06ktep1ulu%2B%2BJ80uki7eYE6US7JyUqpkTvOJSFBw9fNHvjp%2Bpb5Mua%2Bc%2B781o3Eazzt78OmrPCmdoOS57vmDE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed88b8b523-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/fonts/AirbnbCerealBold.woff

104.21.54.109

200 OK

50 kB

URL HTTP/1.1
whatfont.net/assets/fonts/AirbnbCerealBold.woff
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format, TrueType, length 49964, version 0.0\012- data
Size
50 kB (49964 bytes)
Hash
6021dfe8dec0b7e6578d6acb473c0121
a23e0138873b16bf36a275cf7d8b091f0a9752ba
5630e1e0f2e6e8f2d7b51a17ec98298252cfbf8fa036f65e3f3f3a80e1ace934

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /assets/fonts/AirbnbCerealBold.woff HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://whatfont.net/assets/css/styles.css?v=2

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: application/font-woff
Content-Length: 49964
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-c32c"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=escr3IOnfRVwtdhwIlZ3hcER11DH9aiUIddPn%2FvFnyqRjsO8PSpRL%2FH3GNk69TF%2BOldVQfXbRqxa%2BXjQtbrO5Dc015JaVE4I4xR5stpgfKbBZoBNogd1oiaQSphs%2FBw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ed88b6b523-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/info/android-icon-192x192.png

104.21.54.109

200 OK

10 kB

URL HTTP/1.1
whatfont.net/assets/info/android-icon-192x192.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data
Size
10 kB (10017 bytes)
Hash
98e92fc4413c65a967b222d0847fdb82
ef98b333db4ae455b0497c422b70e19252a22812
8ffc166163336dd7d6b210c302dd74774a2a0e6dfdd6bae31d09a5c5f0b775b1

HTTP Headers

GET /assets/info/android-icon-192x192.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 10017
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-2721"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EHlE7FGtO61xSDM9CHFzbKFyfG%2F9lcAkMsirKhh1F5%2B6eQNDbqZfozug463zCM700yB60dDvETtrpsDPvq6JGlYQ72htp3YQ8vKHHPGsUjvjBzijvyJMuHrsiZsHLO4%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ee196e0b45-OSL
alt-svc: h2=":443"; ma=60

whatfont.net/assets/info/favicon-16x16.png

104.21.54.109

200 OK

1.1 kB

URL HTTP/1.1
whatfont.net/assets/info/favicon-16x16.png
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 16 x 16, 8-bit colormap, non-interlaced\012- data
Size
1.1 kB (1119 bytes)
Hash
bbc30f429e1668a837d226ddb900b30d
d3d5ebe793075486f60a10dca93e105ef0b93a63
32ab9a77ce08ce5fcfed4bb7e0438ccc8f969bd7910718bf29f4dd4e9d6ee1c8

HTTP Headers

GET /assets/info/favicon-16x16.png HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/png
Content-Length: 1119
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-45f"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qeiDAQhTbE%2FHmJX0oDuYZjoqdInZpJPGA5fK6jYKjdEZqh7O3lbsTY1BvCQDkoUhdtw%2BP%2FkmV8U51KWGbkkh8eLjQAIDZsriaHADVjs%2BeRhcu15Omukd8gZ%2BgDHm2l0%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ee1e02b51b-OSL
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 03 Dec 2022 10:08:58 GMT
cache-control: public,max-age=3600
age: 118
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
a151c326c67e1abb747847c1427db76f
80885d30ef8ba867bf33c40b861976958a27493a
de2b573ee1c8af980e593352e0c331b2595f62bd4499300ace30821d20814760

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2917
Cache-Control: max-age=171872
Content-Type: application/ocsp-response
Date: Sat, 03 Dec 2022 10:10:56 GMT
Etag: "638b11ab-1d7"
Expires: Mon, 05 Dec 2022 09:55:28 GMT
Last-Modified: Sat, 03 Dec 2022 09:06:51 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

54.149.51.98

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.149.51.98:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: NlKow9hT8FS1+cdw4j1GSA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: nN987mHBM6DyAFXDpVQvyg8ZClc=

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4656
Expires: Sat, 03 Dec 2022 11:28:34 GMT
Date: Sat, 03 Dec 2022 10:10:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4656
Expires: Sat, 03 Dec 2022 11:28:34 GMT
Date: Sat, 03 Dec 2022 10:10:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4656
Expires: Sat, 03 Dec 2022 11:28:34 GMT
Date: Sat, 03 Dec 2022 10:10:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4656
Expires: Sat, 03 Dec 2022 11:28:34 GMT
Date: Sat, 03 Dec 2022 10:10:58 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4656
Expires: Sat, 03 Dec 2022 11:28:34 GMT
Date: Sat, 03 Dec 2022 10:10:58 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg

34.120.237.76

200 OK

6.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.2 kB (6174 bytes)
Hash
b986f9fcbeca91ed5c8d58fbfaf47d19
6e6c8bd2bce144cc4da1cd7be375b046b60dca79
07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 06:00:50 GMT
age: 15008
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6e545217-31b4-442a-abef-bcaaffcd0407.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.4 kB (9449 bytes)
Hash
249aec334460c66dc88b9e8def4e48df
f86d1d278ba5b24587b10519b1b30d75044efd97
b083151804ced0533a5b33302ef110b50ddc4bf653de0fb8f6c7711f4bc29fe2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6e545217-31b4-442a-abef-bcaaffcd0407.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9449
x-amzn-requestid: c21c52f9-d971-46d9-b632-0439a0e23da4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZkxHKbIAMFxkQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6fb7-2b8cc0982af568626f4a4bbf;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:35:51 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: h_QxhlhIxUS0VSjt1z50xNf0u1eB6c1WPTJUfvwGQA-t4M0zmXo2AA==
via: 1.1 b838ef1ff22a4a994af82d5178c30e1c.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 22:03:42 GMT
etag: "f86d1d278ba5b24587b10519b1b30d75044efd97"
content-type: image/jpeg
age: 43636
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

2.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
2.9 kB (2942 bytes)
Hash
b47431190f34eccf0a6efb98e2a32b7d
9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XvG2dAUeB914GQ1qJwQRHovAtra8OSjG-CsXeR8UOBq5r8qVjEbPBQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 22:39:04 GMT
age: 41514
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F652bfe35-9b09-4fba-b7b5-c6bd90cccdbe.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.1 kB (6119 bytes)
Hash
7ffa12df550123f63b20f67437cd8a04
398fd2d837c73f54c4591b69cd683f29bdf9184a
fd9ac4396488098923c27531295e64475047dd008a901e59915109a73a69f305

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F652bfe35-9b09-4fba-b7b5-c6bd90cccdbe.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6119
x-amzn-requestid: b0bf3aed-f968-4ebb-953e-35300d74ef16
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cdCe8GgNIAMFQag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63884ac5-4b20ca67753e65c5232660f5;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 06:33:41 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: axyk2U1R7AX1RVQmdc303S2S2CUs_RgphyeYPsbGveGHMAjY3KEzdw==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 13:19:35 GMT
age: 75083
etag: "398fd2d837c73f54c4591b69cd683f29bdf9184a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F528dcb40-0960-4efd-98b7-a07004a61b22.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.7 kB (7657 bytes)
Hash
3abdcce275bb9723b4ac1d0c38cc8891
91f0d888c38db0899f106b652e3dcac062648099
ff411fc0d5abaf519d6600961ec51ad71ad9a02e23cc02ad818e27f0324b3d1e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F528dcb40-0960-4efd-98b7-a07004a61b22.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7657
x-amzn-requestid: c0dbd862-41cf-4fa8-ab6b-256763c63fbf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZN1Fo6IAMF9EQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f25-554ffbc83fd70c557437120f;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:25 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ElvfdUly4Rb3YOQyMO2C_VelFUe6xcFbMh6x5fNrRzGjKCITdGSwLQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:37:47 GMT
age: 45191
etag: "91f0d888c38db0899f106b652e3dcac062648099"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3d568a89-ee21-427a-b971-0d1500164a62.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11942 bytes)
Hash
becc8cdba57494c6fe212eb67634e1eb
c8bd6bd9086e0a52b83b89dfd755e7ebba222fb8
fbb25b88b10a818bb0c6ad385b1e5ba54b87672c73bfa8a9c1ecb17dcc689d5a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3d568a89-ee21-427a-b971-0d1500164a62.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11942
x-amzn-requestid: ba8a5d03-7796-4c6d-a6df-3cc71b1c5259
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: chqukGmWoAMFtLg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a24c3-609dc90d769060d30a16e3df;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 16:16:03 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: m6j_3bDGFIAHQYzrZ1zXqUb-HbEJ8XCoGH5mgBFOWRbLzoSiuNBnhg==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:37:55 GMT
etag: "c8bd6bd9086e0a52b83b89dfd755e7ebba222fb8"
content-type: image/jpeg
age: 45183
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

whatfont.net/assets/img/detailed.gif

104.21.54.109

200 OK

0 B

URL HTTP/1.1
whatfont.net/assets/img/detailed.gif
IP
104.21.54.109:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /assets/img/detailed.gif HTTP/1.1
Host: whatfont.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://whatfont.net/

HTTP/1.1 200 OK
Date: Sat, 03 Dec 2022 10:10:56 GMT
Content-Type: image/gif
Content-Length: 133238
Connection: keep-alive
Last-Modified: Mon, 06 Dec 2021 13:03:02 GMT
ETag: "61ae0a06-20876"
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qWz973EUp3oORo1BjOSqnVXPhijX2XoSHS3OzZ8cy36PgO2K3NNHNpj36yiEt0a3vvYd05iS4D7JhYc07EYuEfVWS0MIiyupBi%2BDK8iO0AAzM%2FHU%2BuCk%2FVzKH0JCfTU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 773b83ecc8610b45-OSL
alt-svc: h2=":443"; ma=60

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (44)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type