Overview

URLcleopatraloungebar.com.br/risa/mmimnanaiii
IP 45.35.114.212 (United States)
ASN#40676 AS40676
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2023-03-01 03:39:10 UTC
StatusLoading report..
IDS alerts1
Blocklist alert1
urlquery alerts No alerts detected
Tags None

Domain Summary (8)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
cleopatraloungebar.com.br (3) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1102 6253 45.35.114.212
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 391 34.117.237.239
use.fontawesome.com (2) 942 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 745 48216 172.64.133.15
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 52.89.217.163
img-getpocket.cdn.mozilla.net (6) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3245 60176 34.120.237.76
r3.o.lencr.org (7) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2366 6204 23.36.76.226
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2374 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5881 34.160.144.191

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-03-01 03:38:59 UTC high Client IP  45.35.114.212 ThreatFox payload delivery (url - confidence level: 75%) 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-03-01 medium cleopatraloungebar.com.br/risa/mmimnanaiii Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 45.35.114.212
Date UQ / IDS / BL URL IP
2023-03-01 03:39:10 UTC 0 - 1 - 1 cleopatraloungebar.com.br/risa/mmimnanaiii 45.35.114.212
2022-10-28 03:17:09 UTC 0 - 0 - 6 cleopatraloungebar.com.br/ror/atnui 45.35.114.212
2022-10-28 03:17:05 UTC 0 - 0 - 6 cleopatraloungebar.com.br/risa/rouhciaettct 45.35.114.212
2022-10-28 03:16:57 UTC 0 - 0 - 6 cleopatraloungebar.com.br/ror/iutqmiiucseiltaepid 45.35.114.212
2022-10-28 03:16:53 UTC 0 - 0 - 6 cleopatraloungebar.com.br/risa/ualsomountsrcs (...) 45.35.114.212


Last 5 reports on ASN: AS40676
Date UQ / IDS / BL URL IP
2023-06-10 13:28:36 UTC 0 - 2 - 0 files.catbox.moe/fosulw.zip 107.160.74.131
2023-06-10 09:26:12 UTC 0 - 2 - 0 litter.catbox.moe/j91kns.zip 107.160.74.132
2023-06-10 09:12:59 UTC 0 - 2 - 0 litter.catbox.moe/k41re6.zip 107.160.74.132
2023-06-10 03:04:34 UTC 0 - 2 - 0 files.catbox.moe/hyvbao.zip 107.160.74.131
2023-06-10 01:17:35 UTC 0 - 2 - 0 allbox.ml/onep/api/a63031f2250a8a53c521ce0977 (...) 172.106.0.115


Last 5 reports on domain: cleopatraloungebar.com.br
Date UQ / IDS / BL URL IP
2023-03-01 03:39:10 UTC 0 - 1 - 1 cleopatraloungebar.com.br/risa/mmimnanaiii 45.35.114.212
2022-10-28 03:17:09 UTC 0 - 0 - 6 cleopatraloungebar.com.br/ror/atnui 45.35.114.212
2022-10-28 03:17:05 UTC 0 - 0 - 6 cleopatraloungebar.com.br/risa/rouhciaettct 45.35.114.212
2022-10-28 03:16:57 UTC 0 - 0 - 6 cleopatraloungebar.com.br/ror/iutqmiiucseiltaepid 45.35.114.212
2022-10-28 03:16:53 UTC 0 - 0 - 6 cleopatraloungebar.com.br/risa/ualsomountsrcs (...) 45.35.114.212


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-04 22:41:33 UTC 0 - 0 - 7 eventsbymoda.com/wp/crypto/login.php 168.119.136.101
2023-04-04 22:11:21 UTC 0 - 0 - 2 backup.juliechoi.com/dhlpo/autodhl/dhl/kydmxw (...) 162.215.121.120
2023-04-04 22:02:17 UTC 0 - 0 - 11 officeaddons.com/technologies 45.141.152.19
2023-04-04 21:58:14 UTC 0 - 0 - 2 centrocomercialventasviva.com/categoria-produ (...) 162.241.61.244
2023-04-04 21:00:10 UTC 0 - 0 - 2 westgazette.com/options.zip 69.16.236.116

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (23)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "4B69973AF6E9C5A78D94E8661B08D9349176A515E7BFB3386B10ACE4C6F1AE21"
Last-Modified: Tue, 28 Feb 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8964
Expires: Wed, 01 Mar 2023 06:08:23 GMT
Date: Wed, 01 Mar 2023 03:38:59 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "7B72AC559134398CEDCB17BBCA3EA3E5467A05A7DA769EE2F83F4F762AF62918"
Last-Modified: Mon, 27 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10889
Expires: Wed, 01 Mar 2023 06:40:29 GMT
Date: Wed, 01 Mar 2023 03:39:00 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "F329F0E623ED8981E9CE3EDDB63ADD02A524CE0D95367EC106730A3DC105973C"
Last-Modified: Mon, 27 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8060
Expires: Wed, 01 Mar 2023 05:53:20 GMT
Date: Wed, 01 Mar 2023 03:39:00 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 01 Mar 2023 03:12:49 GMT
age: 1571
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    4ad6984a756720fbfff47b37a75513a2
Sha1:   355e35258114452af8b9638985ed9d8ef3bf0aca
Sha256: 43181fccb10652c68cae86e5e32b4e8f426fb5ad49d8125cb99e072cff573cf5
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: yqI2+lDC4Kyppd1/7vSYQVWtQVwj3qhYPf+xNMU8zk63woudWy3vpYGlUZBpX5pNJ12t60ww1iY=
x-amz-request-id: HH2VGFJ0HQ4GKDQJ
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 01 Mar 2023 03:32:29 GMT
age: 391
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    b5ba6334e73496995e3e3a9ecd0eb323
Sha1:   ad80d3b7718c28364e8c2004fb38a13a1747e462
Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
                                        
                                            GET /risa/mmimnanaiii HTTP/1.1 
Host: cleopatraloungebar.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             45.35.114.212
HTTP/1.1 302 Found
content-type: text/html
                                            
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 683
date: Wed, 01 Mar 2023 03:38:59 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
location: http://cleopatraloungebar.com.br/cgi-sys/suspendedpage.cgi


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Size:   683
Md5:    6371befc85069a96b0cb3c52e754a55a
Sha1:   de3def799f60ce2a16721687937ffb2a3f9bd3ae
Sha256: db6f3663ecb5b124f3c02ce15691739fe69888b7ed6112f03062489470517f77

Blocklists:
  - fortinet: Malware
IDS:
  - ThreatFox payload delivery (url - confidence level: 75%)
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Wed, 01 Mar 2023 03:39:00 GMT
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /cgi-sys/suspendedpage.cgi HTTP/1.1 
Host: cleopatraloungebar.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             45.35.114.212
HTTP/1.1 200 OK
content-type: text/html
                                            
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
transfer-encoding: chunked
content-encoding: gzip
vary: Accept-Encoding
date: Wed, 01 Mar 2023 03:39:00 GMT


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4070)
Size:   4093
Md5:    e7d8bc42334b0f5da94afb05196a200b
Sha1:   7e38805fdb9ec35dab9c42059ba14e561ccc4e58
Sha256: c51097888d5c5a8d5c426b6e29ed98aea99b1422265850871ba420b469ab48ba
                                        
                                            GET /releases/v5.0.6/css/all.css HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cleopatraloungebar.com.br/

                                        
                                             172.64.133.15
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Date: Wed, 01 Mar 2023 03:39:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
x-amz-id-2: IGO1nWwplShoEyJu2PFwbf4zgIbHh5Ea/5kgYTNajErXiLoGFboJxmKrfR8ojTXk+6GMCYPiMb4=
x-amz-request-id: P19BKW3DDTN57YW4
Last-Modified: Wed, 30 Jun 2021 15:27:49 GMT
ETag: W/"42eaa52604673b64d6b356c2fd7f87e3"
Cache-Control: max-age=31556926
CF-Cache-Status: HIT
Age: 2067411
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E5XrRsRQ0n%2FzRVsxevvpY5glJYupkGCJY0y7aRoLa%2BVORofzX%2BMmsqr0UbxQD23aU2LQttRvXNliHYmtTja%2BBmzDtJLwAZm33qwc8w%2BYmFOy4y4BjVpwO75Yj5lLM5jZG5YZuGQK"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7a0e5ed04dd423c6-LHR
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  ASCII text, with very long lines (34556)
Size:   7532
Md5:    e968798a6e6b5d8c0d1a0b3dd562e8b1
Sha1:   d5fc0ab33b1db7ccc960a222dfa28d850fcc150d
Sha256: 984600f8404a2812e9655ee8f5fc6883c1abf8e52eab0923baa5ebd8bb45b712
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Cache-Control, Backoff, Pragma, Expires, Last-Modified, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 01 Mar 2023 03:03:35 GMT
age: 2125
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "B797E9B583B27D9C7288B67ECD1C8FC0DA8A0FF8AC6D335F3D6E0BED653F2AED"
Last-Modified: Mon, 27 Feb 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10132
Expires: Wed, 01 Mar 2023 06:27:52 GMT
Date: Wed, 01 Mar 2023 03:39:00 GMT
Connection: keep-alive

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: cleopatraloungebar.com.br
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cleopatraloungebar.com.br/cgi-sys/suspendedpage.cgi

                                        
                                             45.35.114.212
HTTP/1.1 302 Found
content-type: text/html
                                            
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 683
date: Wed, 01 Mar 2023 03:39:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
location: http://cleopatraloungebar.com.br/cgi-sys/suspendedpage.cgi


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Size:   683
Md5:    6371befc85069a96b0cb3c52e754a55a
Sha1:   de3def799f60ce2a16721687937ffb2a3f9bd3ae
Sha256: db6f3663ecb5b124f3c02ce15691739fe69888b7ed6112f03062489470517f77
                                        
                                            GET /releases/v5.0.6/webfonts/fa-solid-900.woff2 HTTP/1.1 
Host: use.fontawesome.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://cleopatraloungebar.com.br
Connection: keep-alive
Referer: http://use.fontawesome.com/

                                        
                                             172.64.133.15
HTTP/1.1 200 OK
Content-Type: application/font-woff2
                                            
Date: Wed, 01 Mar 2023 03:39:00 GMT
Content-Length: 38784
Connection: keep-alive
x-amz-id-2: Ea/fTwyENM6m0GKSyfLSwwV4F5FIjrgaKy9D7QmuiwoGTOwtcZrL4Dkbfq29RbRwDHaTh+pdrhk=
x-amz-request-id: Z8M38VV69N0R2E16
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Max-Age: 3000
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
Last-Modified: Wed, 30 Jun 2021 15:27:50 GMT
ETag: "f9b85c9463af7103b9b24bbbf09a06ed"
Cache-Control: max-age=31556926
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rkE6pcSYzJgf62G3IxsRK1RvnZ2%2BMp27vJ2bYJ%2FD8ETTwVMA63tjwXaoDfKP1fXWZd33%2FzZ7FnalZ6o3t8fSCWuyQrHnyujbBA59zDwMk%2BNoGG6vdfjjYpqyXxknjBDjwtJx03%2Fz"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7a0e5ed10c2c4141-LHR
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 38784, version 1.0\012- data
Size:   38784
Md5:    f9b85c9463af7103b9b24bbbf09a06ed
Sha1:   d28d7222bcbeb8ea701a771e85f7efe006e62fb1
Sha256: 62554277d07b20c6bfae7c6267b3198b4846f604a37d4085bf9f54c392210b56
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: LolhPasg2PuPm5JRWUZdKw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             52.89.217.163
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: T3Y845QfzrNRQCoXKgsGbXcrf3U=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D546818CBD4BA1B7AE00D0A759556E330E2AA4FEF0BCA65AC98453A19CB7E09A"
Last-Modified: Mon, 27 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4616
Expires: Wed, 01 Mar 2023 04:55:58 GMT
Date: Wed, 01 Mar 2023 03:39:02 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D546818CBD4BA1B7AE00D0A759556E330E2AA4FEF0BCA65AC98453A19CB7E09A"
Last-Modified: Mon, 27 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4616
Expires: Wed, 01 Mar 2023 04:55:58 GMT
Date: Wed, 01 Mar 2023 03:39:02 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D546818CBD4BA1B7AE00D0A759556E330E2AA4FEF0BCA65AC98453A19CB7E09A"
Last-Modified: Mon, 27 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4616
Expires: Wed, 01 Mar 2023 04:55:58 GMT
Date: Wed, 01 Mar 2023 03:39:02 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F87437be5-1eb4-4c8c-a302-2b61ae9d4ff3.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5471
x-amzn-requestid: 712d66d0-ef01-4d8a-8ca6-e09947b33259
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AxufTFRzIAMFv4Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63f6f794-1a4b12250069b836045411b1;Sampled=0
x-amzn-remapped-date: Thu, 23 Feb 2023 05:20:20 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: anWw0H6zBO4_SUgjJVchr9C9Dghqmwd-4427mg4tTgxzUlZFFUaNCw==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 6af3b573d8970d5db2a4d03354335b84.cloudfront.net (CloudFront), 1.1 google
date: Wed, 01 Mar 2023 03:24:02 GMT
age: 900
etag: "a7c44b9b30dc2323bd9b3ace785f9d3615111413"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5471
Md5:    192715fdb86c2f3fd4b4e69d94e1b42e
Sha1:   a7c44b9b30dc2323bd9b3ace785f9d3615111413
Sha256: 38f3b9ea9d31a4c8d08bdf1842715ca061eea348488d8f0f3461ad8cff446c1d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd2b77c22-c3f8-4f19-bbf5-186e210147ab.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 12013
x-amzn-requestid: b18966f1-be7a-40bb-a11a-f2e34ca640b6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BEbrpGhVoAMFREw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fe7317-2781ca621d9e678f21aa066c;Sampled=0
x-amzn-remapped-date: Tue, 28 Feb 2023 21:33:11 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: E68nRyTscBJM6oa1B7b15UzMai_XODiWrUycez1lqj7H-0rzyibz6g==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 3236f234d59c0fda99b416088c283260.cloudfront.net (CloudFront), 1.1 google
date: Tue, 28 Feb 2023 21:38:31 GMT
age: 21631
etag: "5c5b1814329c7fc3ac74d4dae119db7719fc26ec"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12013
Md5:    52235b5f0cc478b1fd5cec46d9432b46
Sha1:   5c5b1814329c7fc3ac74d4dae119db7719fc26ec
Sha256: 1d373ebad0ad64bfd58793f491d4719d43a0770312652a700a9760804b27f13f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3b192ea9-c31b-4b4b-86d9-522fb2794a59.png HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 12353
x-amzn-requestid: c48e73fb-7093-48e0-9b5f-47f2f36e7519
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A741_HWJIAMFuUw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fb0826-179aa5b5676a2683663bc77f;Sampled=0
x-amzn-remapped-date: Sun, 26 Feb 2023 07:20:06 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: PlNobtD6bF0LMNW2v1jv2gjXIDQ7XhfEaXij8uuppKjtgZp3OJp3CQ==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 6bdc2963c9ed59b475ec36c35e5932a4.cloudfront.net (CloudFront), 1.1 google
date: Tue, 28 Feb 2023 23:23:33 GMT
age: 15329
etag: "f4268c2fbd5acc172ce907aec8cf164bc2ce2d1e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12353
Md5:    5efe6f2ea16c4353c583e2732e2b9ba9
Sha1:   f4268c2fbd5acc172ce907aec8cf164bc2ce2d1e
Sha256: 71d1a767f794ed6d9221346d36dcb9d7d52b92c57f55f1836ba867aa00a91e98
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd3522243-5d97-4af8-b226-ab57b3bee6ce.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5676
x-amzn-requestid: c688d38f-fe89-4583-a61f-bd21fdc64325
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BBJiUGmboAMFWTw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fd22db-17d51fe00701a6f13222bc9e;Sampled=0
x-amzn-remapped-date: Mon, 27 Feb 2023 21:38:35 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: teauWLTks7ZSgX9YiAVkOoftmq-Zv0KmYZnZFgUulWmRYoGbmdl0iA==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 29a825d8a219984d47bec4350779b558.cloudfront.net (CloudFront), 1.1 google
date: Tue, 28 Feb 2023 22:06:55 GMT
age: 19927
etag: "3ac78dbfb5e00eced4d80ead89637db5d5569b59"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5676
Md5:    9c31845a0e9bfa6eefa096b10b1748e6
Sha1:   3ac78dbfb5e00eced4d80ead89637db5d5569b59
Sha256: 89da1434d398527a658be5746929afdc17064ea30d05b094b860557d101a2043
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F050170a2-4e52-4454-b5bc-8000c7d655d2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9472
x-amzn-requestid: fffdb4a6-5eeb-4a8e-b8ab-be8ff576a482
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: BBOTNHLWoAMFtRA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63fd2a7a-56afa9bb3c28f53814c931a5;Sampled=0
x-amzn-remapped-date: Mon, 27 Feb 2023 22:11:06 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: QQwGKCoSUbp1-kTasVtNs8hyWTfcWAtJ8IVpH0uT_9KEiEuBV42iBg==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 3236f234d59c0fda99b416088c283260.cloudfront.net (CloudFront), 1.1 google
date: Tue, 28 Feb 2023 07:44:25 GMT
age: 71677
etag: "986d17121808a71b1afcab848215c76ed68a0313"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9472
Md5:    23560aa13bf9131eaaddf3efe054a9ca
Sha1:   986d17121808a71b1afcab848215c76ed68a0313
Sha256: cdf81731accebbf8f18b0a7d9aa161936264c889a34836e6dc99701bedba499a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F77ea2415-57a8-404d-8313-52c8cc6340fb.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 8862
x-amzn-requestid: 306d5a4c-cfec-464c-9cbc-f45b46d4795c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: A38NHFSloAMFf2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63f973ed-77dec03d03eecc6552fc5294;Sampled=0
x-amzn-remapped-date: Sat, 25 Feb 2023 02:35:25 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: 2z5TP_Q2PivQf0j39LiLpWX0Jrjo5kEAleVemeTEHcoTdpy8g2H_BA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 de2dd11312f7d5ad3bcd0cb112c7fd0e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 28 Feb 2023 22:10:58 GMT
age: 19684
etag: "ebfceb33ae49f259314299bddf1be4a848c7203f"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8862
Md5:    2b436b88c2f5ba756bd02b66a47097f8
Sha1:   ebfceb33ae49f259314299bddf1be4a848c7203f
Sha256: ad66d49fe3029b566548789beac637b92f7e52d6a53ef541243280260a69585d