Report - myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

Report Overview

Submitted URL
myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6
IP
172.67.69.126
ASN
#13335 CLOUDFLARENET
Submitted
2022-11-05 13:44:47
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-10T05:10:02Z	606 B	127 B	54.149.219.22
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-10T05:09:10Z	2.4 kB	6.2 kB	23.36.77.32
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-10T13:49:44Z	682 B	1.6 kB	93.184.220.29
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-10T05:10:00Z	333 B	229 B	34.117.237.239
code.jquery.com	634	2012-05-21T19:28:02Z	2023-03-10T05:11:37Z	402 B	31 kB	69.16.175.10
cdn.jsdelivr.net	439	2012-09-30T02:15:09Z	2023-03-10T11:13:22Z	879 B	48 kB	151.101.85.229
gauvaiho.net	285509	2021-03-26T20:00:47Z	2023-03-10T09:36:11Z	340 B	28 kB	139.45.197.251
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-10T05:12:35Z	413 B	5.8 kB	34.160.144.191
myjollyrudder.com	328177	2021-12-18T21:11:28Z	2023-02-18T12:51:32Z	4.6 kB	222 kB	104.26.2.176
ocsp.globalsign.com	2075	2012-07-20T19:46:16Z	2023-03-10T05:11:21Z	368 B	1.9 kB	104.18.20.226
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-10T05:10:04Z	3.8 kB	60 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-05	medium	myjollyrudder.com/land/rou/js/propeller.min.js	Malware
2022-11-05	medium	myjollyrudder.com/land/rou/js/default1.js	Malware
2022-11-05	medium	myjollyrudder.com/land/rou/js/confetti.js	Malware
2022-11-05	medium	myjollyrudder.com/land/rou/js/winwheel_game.min.js	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (11)

	URL	Size	First Seen	Last Seen
	myjollyrudder.com/land/rou/js/propeller.min.js	11 kB	2023-03-07	2023-05-30
Pretty URL myjollyrudder.com/land/rou/js/propeller.min.js IP 104.26.2.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2023-05-30 00:37:20 Times Seen488 Hash 20ff2d103a051f36069225e9bb9c87c0 eda19b305872d407fc62cb8d469d7a29b8b7b857 74c66b1c99c8c71ceb2bee5c74748060d22a2998389e7b4dd1080796252c0131 Loading...

	cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js	84 kB	2023-03-07	2024-04-27
Pretty URL cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js IP 151.101.85.229 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-04-27 03:07:02 Times Seen5296 Hash f81d0a1705048649befc8b595e455a94 aec551e4d573463088fca7d14fb644eb389f1839 b0212543cc5a4a0a31c1b5a9d1e8973261992116b4cfde3e7dfcf33b4e81a97b Loading...

	myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6	123 B	2023-03-10	2023-03-10
Pretty URL myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6 IP 104.26.2.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 21:24:49 Last Seen2023-03-10 21:24:49 Times Seen1 Hash 362e37467dc5e2bb670595eaebeba9ed 12832d726c2b7392d025f17a94773be862d775da d840ad0ff15870f7daad92ca8a25c29e09b59c75f2448cf82482d137769962db Loading...

	myjollyrudder.com/land/rou/js/confetti.js	6.6 kB	2023-03-07	2023-05-30
Pretty URL myjollyrudder.com/land/rou/js/confetti.js IP 104.26.2.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2023-05-30 00:37:20 Times Seen366 Hash 594e7bd784c66babe7dd35e2cf498f14 88ecedc9e7685f09b8233c8b093923e68efe77d9 f74a1f085b5583dff6b8dd38c1ccc746a8a572bffec38794a5199c5a3f9eda5b Loading...

	code.jquery.com/jquery-3.6.0.min.js	90 kB	2023-03-07	2024-04-27
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 69.16.175.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-04-27 05:01:51 Times Seen262020 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6	549 B	2023-03-07	2023-03-17
Pretty URL myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6 IP 104.26.2.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2023-03-17 12:44:24 Times Seen1 Hash bf1447f6ac63890c81e2646f3e1186ac 185a8cc821c94a23535ea3f8874a80ea9e123a7d 9de93393bfa5362eb461c6691f34d1b5e374fad3e01483ec7b40ce4b9337812a Loading...

	myjollyrudder.com/land/rou/js/winwheel_game.min.js	3.9 kB	2023-03-07	2023-03-17
Pretty URL myjollyrudder.com/land/rou/js/winwheel_game.min.js IP 104.26.2.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2023-03-17 12:44:24 Times Seen1 Hash e271c6bd7bf93a7fb34f73c08eef4095 c145d7229b519e48d78782cbde0fec2a6197176a 9690c2dbe5a44a5ecc8f4cf4bab5e3f4588f928c9371e50d17e9166f97038150 Loading...

	myjollyrudder.com/land/rou/js/default1.js	2.8 kB	2023-03-07	2023-03-17
Pretty URL myjollyrudder.com/land/rou/js/default1.js IP 104.26.2.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2023-03-17 12:44:24 Times Seen1 Hash 130e0e9e53193fcb53fa334e284c268a 73ecf9b24cfd0f20c898fb00a69a1b8649a068c4 6752ba0627f68d0fabf93b12349a72899058b9222aac61775c0f990c37816677 Loading...

	gauvaiho.net/pfe/current/micro.tag.min.js?z=4681922&sw=/sw-check-permissions-7c336.js	78 kB	2023-03-10	2023-03-13
Pretty URL gauvaiho.net/pfe/current/micro.tag.min.js?z=4681922&sw=/sw-check-permissions-7c336.js IP 139.45.197.251 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 18:55:30 Last Seen2023-03-13 05:41:40 Times Seen1 Hash b889112f22c9adb498e7f3ec64ebfe7a c2734bb05dc42c43a36e6f594064f3cc84d853c9 0091781d32fa208d9cb4ad29cd18a8ac200d3a505f2c7df847573eb05c6a47f6 Loading...

	myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6	103 B	2023-03-10	2023-03-10
Pretty URL myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6 IP 104.26.2.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 21:24:49 Last Seen2023-03-10 21:24:49 Times Seen1 Hash bba56a089bb71a84ab377d1d67315d99 0aae2a20a153df079eb220e1016886a2f4271d76 47623191aaea165f10d509f7533f84f4d7278461564b46a6a91d6fb33cb63b44 Loading...

		Size	First Seen	Last Seen
	#1 Eval - ef121c0b21a837e98b54f1beea93a42f	80 B	2023-03-10	2023-03-10
Pretty Observations First Seen2023-03-10 21:24:49 Last Seen2023-03-10 21:24:49 Times Seen1 Hash ef121c0b21a837e98b54f1beea93a42f 3b2287ddcedd979ce4f99a3d90c3913b142ecc0c 7efe65681f93f0dc9f8089b22eea4869ac3e2ed9b2a110ae345ac574b239db32 Loading...

HTTP Transactions (36)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b7be8442ec1e518ccc80739495f6d047
7a9d24b9d4046262c7753c49afaf9c19f4840626
b93410a9d62da3f219796d753b61a0f730cc272c13596724aa9d20efba298b44

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B93410A9D62DA3F219796D753B61A0F730CC272C13596724AA9D20EFBA298B44"
Last-Modified: Thu, 03 Nov 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2573
Expires: Sat, 05 Nov 2022 14:27:29 GMT
Date: Sat, 05 Nov 2022 13:44:36 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
72c64df35304c35cd95e4ed6e101e795
a39287987854d644a8da295da536fb31de8b44c1
a9bf0da57e0f108b376781ede4b9762ae1b0d088910d26fb7be98c2d03e69092

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3217
Cache-Control: max-age=160805
Content-Type: application/ocsp-response
Date: Sat, 05 Nov 2022 13:44:36 GMT
Etag: "63662d58-1d7"
Expires: Mon, 07 Nov 2022 10:24:41 GMT
Last-Modified: Sat, 05 Nov 2022 09:31:04 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9f3527f898221f8ba6b5015f6decc100
ead93baa0e9d3a6297be3377dc3a624e5a3f509a
73a068f907cc50dd60af18d545b4264dd44bc4b9f40bf9adfceea157fdc33099

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "73A068F907CC50DD60AF18D545B4264DD44BC4B9F40BF9ADFCEEA157FDC33099"
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6712
Expires: Sat, 05 Nov 2022 15:36:28 GMT
Date: Sat, 05 Nov 2022 13:44:36 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: I3Qv3eR2FCoNH2WBB6kyByX7LqazkJ1Kr4x1OEFdEcEQEIfusnzbfeLrl3FrhUlfnOQkrn8ZhLg=
x-amz-request-id: G3XSZ5DWBXYZ3GB4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 05 Nov 2022 12:47:12 GMT
age: 3444
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

104.26.2.176

200 OK

1.4 kB

URL HTTP/1.1
myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
1.4 kB (1389 bytes)
Hash
8977fe26971e1612625e2e02528d1c76
f8b0fadae3b9e18f0721e945a35bfaeabbccec01
269a6c0f4e3e197a7725a000accc3575f4d2e5471479dcf16df6c886b10bb492

HTTP Headers

GET /land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6 HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
vary: Accept-Encoding
cache-control: no-cache, private
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sb7l6KGAG5teAf4iEuZ5qvhHNCkYimYM2ZUqXiFH2gEbA1vMUa8xzI8%2BhsfPN93uPiRmg%2BwUDfBQrnTZLevaJNXgLxWT6iQOTuICQjSlUYitqvFYyX7xkW6%2FCFk8%2BebyAN%2F6"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 765606688dd51c16-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 05 Nov 2022 13:44:36 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

myjollyrudder.com/land/rou/js/propeller.min.js

104.26.2.176

200 OK

3.3 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/js/propeller.min.js
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (11334), with no line terminators
Size
3.3 kB (3262 bytes)
Hash
759f21c48dbd114dd7ab55eeeeb47398
12e66cf3a08b162d67def69cbec30404b15fc6cf
96d1358fa960eb4fade9069138544dcfbf48971762d0c26a3c3aaf1f4ed7b805

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /land/rou/js/propeller.min.js HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
vary: Accept-Encoding
etag: W/"636515e1-2c46"
content-encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GDizyoAV8GzkYlcv4b9%2BNyflsWfmszZ2VWCdCdLmLRYI58ua%2FgUCGsTJeHphf8kv2XnHgTNLpzjolK605kXq4CSDKO%2FpbFq40Q%2FTmYvRHTUK5FLPO0ngUkZjL60ReXzp%2BAL1"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7656066ad82e1c16-OSL
alt-svc: h2=":443"; ma=60

myjollyrudder.com/land/rou/js/default1.js

104.26.2.176

200 OK

893 B

URL HTTP/1.1
myjollyrudder.com/land/rou/js/default1.js
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text
Size
893 B (893 bytes)
Hash
1552836eabed9798a3940abc2c5eaf46
95e359c9b99966cd05ce66fd7c9a2722b59161f3
3edd0f8858803255c767ce5e2d9045c50c7bd4beeec8d02815752aa15c71f781

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /land/rou/js/default1.js HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
vary: Accept-Encoding
etag: W/"636515e1-b0b"
content-encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fWupyKo9JkI1MBiREOtL%2BUcd8HCCOCHQdlAFCO6PZUn7%2FWRRLTkYajYQpA9TDQ3EERNeWBuO9Tix8NpkEgJX0qe42Vb5ZoViU0VPw%2BTLkNhDvf2JW%2BNqG%2BMjpuF8g1f60G%2BY"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7656066adaf6b4f4-OSL
alt-svc: h2=":443"; ma=60

myjollyrudder.com/land/rou/js/confetti.js

104.26.2.176

200 OK

1.8 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/js/confetti.js
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text
Size
1.8 kB (1824 bytes)
Hash
bd7a4f75c0510c913be45f26e8a0d290
ef3dee892eb3fcdbececf83bd1d778ac701268de
bf75850c9d05647af28103b1c310c922991acb5d98ec9e6fb44101dbada14cbd

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /land/rou/js/confetti.js HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
vary: Accept-Encoding
etag: W/"636515e1-19a6"
content-encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Upb5eSQbnR%2BEbY2Y8FfCDtWmySR6Yhi19vt%2FnVLtZOncgeZL13xF7ikFVzOBDZKA2LZUXTxFlIBra8NJ3k8SCP4q8QsSObwHL63K22KgaQ4Rd4%2BqITCDx8ASYbC3ZUt6Kzty"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7656066adfbdb51b-OSL
alt-svc: h2=":443"; ma=60

myjollyrudder.com/land/rou/js/winwheel_game.min.js

104.26.2.176

200 OK

1.4 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/js/winwheel_game.min.js
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (3852), with no line terminators
Size
1.4 kB (1418 bytes)
Hash
db1080d57c9c6f264e9948ffdd957991
24474e868acaba498ab25a87bbfbb453fa59acd6
3aa429e499ecba64be486b2161db4db8622ad8b25991a25d4e151bb510f21172

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /land/rou/js/winwheel_game.min.js HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
vary: Accept-Encoding
etag: W/"636515e1-f0c"
content-encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AEc17%2FC3vJgQ3xl7PdUCt6ucJi4O8xe6xEctaoNlGbSfAmZenw7U%2BMFRZ7fvEJkyPkFBM5TVr9Bf1J1nJx88tpAIfbU2qoxuylHdlevJZs1mW6XycCjDICfBZEIrbOBI0N%2Bx"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7656066ad910b524-OSL
alt-svc: h2=":443"; ma=60

myjollyrudder.com/land/rou/css/default.min.css

104.26.2.176

200 OK

1.3 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/css/default.min.css
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (4484), with no line terminators
Size
1.3 kB (1299 bytes)
Hash
95022669ccbe3e12d2c1f357b5f2afda
031531ccc39783b53cfebffb1cd88b8bd6567efc
865126d029eab39fa8b6f6b0d7e4bca046e546ebf5f636ecc698bd7de412dcb8

HTTP Headers

GET /land/rou/css/default.min.css HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
vary: Accept-Encoding
etag: W/"636515e1-1184"
content-encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rro3wcXg%2FAKmak4eEqKs%2BbZz2Tycjy0zzamfzH%2BIzax3MUCNsvW25bAoe5gBi8maKFkW84eGYu6vjlbGM%2B%2FN8fDdkEEdqc2mBZ%2FpRfInDIKZxpzrDQd%2Fe4AUaAd68s3eroZn"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7656066aee29b4ff-OSL
alt-svc: h2=":443"; ma=60

code.jquery.com/jquery-3.6.0.min.js

69.16.175.10

200 OK

31 kB

URL HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
69.16.175.10:0
ASN
#20446 STACKPATH-CDN

File type
ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
899f0189aaf034bbba5340f724d91dfa
210ea9de03968edb9d839ba4a0ce2d48666a8ab8
949b6597c5ea907a7ef3c8ca6d5ffc73be2352f9df485b78704e5c4dabac5d0f

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://myjollyrudder.com
Connection: keep-alive
Referer: http://myjollyrudder.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 05 Nov 2022 13:44:36 GMT
content-encoding: gzip
content-length: 30875
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-15d9d"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1667655876.dop212.sk1.t,1667655876.cds201.sk1.hn,1667655876.cds210.sk1.c
X-Firefox-Spdy: h2

cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css

151.101.85.229

200 OK

24 kB

URL HTTP/2
cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
IP
151.101.85.229:0
ASN
#54113 FASTLY

File type
ASCII text, with very long lines (65326)
Size
24 kB (24100 bytes)
Hash
849f3e827da80e4e4c6a8c49689f057d
035d81aaaf6da3ffa5ce241179a9e14d533e7a3b
9546dbb82c3facf833e4adb713ce7e57a34dd53f6b55697ef1e1877bdbd8bb73

HTTP Headers

GET /npm/bootstrap@4.6.0/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://myjollyrudder.com
Connection: keep-alive
Referer: http://myjollyrudder.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 4.6.0
x-jsd-version-type: version
etag: W/"27681-LKxK/BIJg5IUESlr1Oj9ipS6I34"
content-encoding: gzip
accept-ranges: bytes
date: Sat, 05 Nov 2022 13:44:36 GMT
age: 4112651
x-served-by: cache-fra19147-FRA, cache-bma1665-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 24100
X-Firefox-Spdy: h2

myjollyrudder.com/land/rou/img/spin_Roulette00.png

104.26.2.176

200 OK

13 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/img/spin_Roulette00.png
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 170 x 190, 8-bit/color RGBA, non-interlaced\012- data
Size
13 kB (12991 bytes)
Hash
834a8095777aee926381dd13a5a8b3ab
c0f06099eea950232f33e02355d84dda44a6e35e
589d62b11a4171fb3a9b7c97b6963447601e36f8c2dcb36370dce75f5bd9687e

HTTP Headers

GET /land/rou/img/spin_Roulette00.png HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: image/png
Content-Length: 12991
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
etag: "636515e1-32bf"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Za%2BWwDcJo3gVOfjepM4DeXF4Fetav3tD9zKUNUGgIt4ihFDMawphxpJUqK9HuRAuobn%2FML2Llflkz2goMDP5HftE9CwjTGjoTtpvqTgrUXvlVDW5P7BYv9oGy%2Fd35SSeH%2B0D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7656066b6ea9b4ff-OSL
alt-svc: h2=":443"; ma=60

myjollyrudder.com/land/rou/img/spin_Roulette01.png

104.26.2.176

200 OK

43 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/img/spin_Roulette01.png
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 540 x 540, 8-bit colormap, non-interlaced\012- data
Size
43 kB (43403 bytes)
Hash
6e422805365b1b64d8da6b0d29ae8c69
37d523943fb63f409cd9a6da32fb5d7663a692da
a0c05360734297aae902dc48ed95cd7d3d3f818897f111c54aae6f042428b665

HTTP Headers

GET /land/rou/img/spin_Roulette01.png HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: image/png
Content-Length: 43403
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
etag: "636515e1-a98b"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rdIbZ0KxO5NKe0%2FJOtNbd2ZnDbufT9%2BPp4OQYim5XlyQlNLTeE0XTQrTwYjXFWCkVA80uE2Hkb91CZbbhAXFxlaNno9DxEsX70CWC%2BOSpGJvJo7fNbKPlGeD8Ds%2Bbhw9E%2FAA"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7656066b69b8b524-OSL
alt-svc: h2=":443"; ma=60

myjollyrudder.com/land/rou/img/spin_Roulette03.png

104.26.2.176

200 OK

1.3 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/img/spin_Roulette03.png
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 269 x 138, 8-bit/color RGBA, non-interlaced\012- data
Size
1.3 kB (1316 bytes)
Hash
5e45d498bdb0b010e058b92e5d5097ac
8a1b41ef4c12fc85b4e4c7d28e3fcf48774054f7
9e860a039b138a3e94b704ff4aae7896c678d88d3c5e1ab2d08e3af5ceecdee6

HTTP Headers

GET /land/rou/img/spin_Roulette03.png HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: image/png
Content-Length: 1316
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
etag: "636515e1-524"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CT0xV%2BzcsbgdpHBIeCV4wtz8Vb6U9LT59TkA6Gx9zvt8nplxgkGN9z%2BLtTvBdtefPdhddCqRD352womJcNZpG1H%2B%2FQLgOPtl11lPFVx%2BwWqw9pv6RcMLW4lDQqeLtvz1HuLn"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7656066b683db51b-OSL
alt-svc: h2=":443"; ma=60

cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js

151.101.85.229

200 OK

22 kB

URL HTTP/2
cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js
IP
151.101.85.229:0
ASN
#54113 FASTLY

File type
ASCII text, with very long lines (65299)
Size
22 kB (21830 bytes)
Hash
a5cbb97cf034dd181106adecdafe3035
5fca1af6c76dd3e609f7f92841e564df1281927a
5ae018daf5df2cd903f80162efbaa3e138e0ed47ff90a315f2e2c497dc88a890

HTTP Headers

GET /npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://myjollyrudder.com
Connection: keep-alive
Referer: http://myjollyrudder.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 4.6.0
x-jsd-version-type: version
etag: W/"1499a-rsVR5NVzRjCI/KfRT7ZE6zifGDk"
content-encoding: gzip
accept-ranges: bytes
date: Sat, 05 Nov 2022 13:44:36 GMT
age: 13344519
x-served-by: cache-fra19162-FRA, cache-bma1665-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 21830
X-Firefox-Spdy: h2

ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1

104.18.20.226

200 OK

1.5 kB

URL HTTP/1.1
ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1
IP
104.18.20.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
1.5 kB (1462 bytes)
Hash
17fbcef0d99a54d0d9390f658b0e5ee5
095c54f315d11080066d9c78a4eb4199fcd0b0f0
047085b171c322c7745e34b89a4f179203574f32770d77098d1a2360a8514f0f

HTTP Headers

POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "83A2A812B11B2850AC530046FDA6C5AB6D752A48"
Expires: Sun, 06 Nov 2022 00:00:00 GMT
Last-Modified: Sat, 05 Nov 2022 12:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 2258
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7656066b9fcab51e-OSL

myjollyrudder.com/land/rou/img/spin_bg_desk.png

104.26.2.176

200 OK

110 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/img/spin_bg_desk.png
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 870 x 650, 8-bit colormap, non-interlaced\012- data
Size
110 kB (110359 bytes)
Hash
eafcb5a49ddbee590cfe266b1b0c8820
254de127e096c137b1a8c8e62cf3c96b7c6492e5
da07ed253e14bcf56880e11d0eddb2276a7da9b4f679d49fb17976b97b81172b

HTTP Headers

GET /land/rou/img/spin_bg_desk.png HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou/css/default.min.css

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: image/png
Content-Length: 110359
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
etag: "636515e1-1af17"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c6rYtyhTnvHZJFGSYKS8l9SYf%2BJ2tTJc%2Bd3rRh4G2sTPhEjjIXv9pZjCDoOq5fjBiSsWA%2BwTV0qMveMthVm1BsaRWnHnPWoa8eINkRBh9knuNt%2FbqP2CB8sOWyhxcBGSxEXz"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7656066bea37b524-OSL
alt-svc: h2=":443"; ma=60

myjollyrudder.com/land/rou/img/spin_Roulette02.png

104.26.2.176

200 OK

35 kB

URL HTTP/1.1
myjollyrudder.com/land/rou/img/spin_Roulette02.png
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 434 x 434, 8-bit colormap, non-interlaced\012- data
Size
35 kB (35051 bytes)
Hash
320aa52aa7ccfde051920d20967e0baa
7a6dc94d3aa311664e94d1259322f081b2f074f7
673f4069c0d4e4e256cd84e482cfc0e60fa76547aa6f62578b3f47c60299d4c1

HTTP Headers

GET /land/rou/img/spin_Roulette02.png HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: image/png
Content-Length: 35051
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
etag: "636515e1-88eb"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DnBzTEVfqBnyN1EOff7ABf6rBAzJjnKxMjUtIpgJq9YmUIm1NfUJhIiQYs1FajyhPNuC%2F6ZlmKZDN0px36CUJdc40gr%2FPuYerce6dgBVI4Zke6jMjbwBZDLdAW3%2FkJQ6uRM0"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7656066c0a61b524-OSL
alt-svc: h2=":443"; ma=60

gauvaiho.net/pfe/current/micro.tag.min.js?z=4681922&sw=/sw-check-permissions-7c336.js

139.45.197.251

200 OK

27 kB

URL HTTP/1.1
gauvaiho.net/pfe/current/micro.tag.min.js?z=4681922&sw=/sw-check-permissions-7c336.js
IP
139.45.197.251:0
ASN
#9002 RETN Limited

File type
ASCII text, with very long lines (65536), with no line terminators
Size
27 kB (27306 bytes)
Hash
90c4eb43169f8de0f6cc9e4d3bb0ea77
2e425e1b2663f9cf7c70ececa32e8c3934b3289b
a093a3e437453a5da20bebdef3f2afcfcb00af092e8fe17bd053fa6c2cc2014a

HTTP Headers

GET /pfe/current/micro.tag.min.js?z=4681922&sw=/sw-check-permissions-7c336.js HTTP/1.1
Host: gauvaiho.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: application/javascript
Last-Modified: Wed, 02 Nov 2022 13:02:54 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"63626a7e-12fd9"
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Pragma: no-cache
Content-Encoding: gzip

myjollyrudder.com/favicon.ico

104.26.2.176

200 OK

62 B

URL HTTP/1.1
myjollyrudder.com/favicon.ico
IP
104.26.2.176:0
ASN
#13335 CLOUDFLARENET

File type
MS Windows icon resource - 2 icons, 1x1, 2 colors, 1x1, 2 colors\012- data
Size
62 B (62 bytes)
Hash
70515ac92cadd905fa8fecef584d0083
c50b7f0f44d82b3f7dc4aff73145371232b0f703
03901e6846adfc7d2216e031eab780e4605c70d24af897afda998c40b53a3d30

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: myjollyrudder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://myjollyrudder.com/land/rou?campaign=ThIi&web=1&utm_campaign=36963c5bc9247e54d3241438029daaf6

HTTP/1.1 200 OK
Date: Sat, 05 Nov 2022 13:44:36 GMT
Content-Type: image/x-icon
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 04 Nov 2022 13:38:41 GMT
etag: W/"636515e1-96"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4195
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w6W%2BP6lUkVsKGG2WwH1s3h%2FGXLbEf9x7fq0hFCoj3A9GpboqmVmd1FodP4qLArWWJ71BoBx5nqOH0vL0WNl9HQkpgcMBAjwpujdAuP5ybkP044A%2BRTLHsw4pmw9Oa0SE%2B8S3"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7656066c8ae6b524-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
db63d54b77502dd6c7bdc792d4fd093e
026ad8186833988279468829c004c6e2a2f2626f
eff89ef67baa622e8a196ffcadc44d29aafff009bb531da3e979a1f47c3b1c36

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6491
Cache-Control: max-age=159022
Content-Type: application/ocsp-response
Date: Sat, 05 Nov 2022 13:44:36 GMT
Etag: "63661997-1d7"
Expires: Mon, 07 Nov 2022 09:54:58 GMT
Last-Modified: Sat, 05 Nov 2022 08:06:47 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

54.149.219.22

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.149.219.22:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: iKJKRlgCar1pSXD4PwKuYw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Q/W5LbvATH7LwzFKgpGCC0DpEFA=

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f6ae0db60213bfddbf2ad71a9fb116bf
915d2895adc3f022c28cc628aeb6e441cbb09d47
ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22"
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5911
Expires: Sat, 05 Nov 2022 15:23:09 GMT
Date: Sat, 05 Nov 2022 13:44:38 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f6ae0db60213bfddbf2ad71a9fb116bf
915d2895adc3f022c28cc628aeb6e441cbb09d47
ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22"
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5911
Expires: Sat, 05 Nov 2022 15:23:09 GMT
Date: Sat, 05 Nov 2022 13:44:38 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f6ae0db60213bfddbf2ad71a9fb116bf
915d2895adc3f022c28cc628aeb6e441cbb09d47
ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22"
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5911
Expires: Sat, 05 Nov 2022 15:23:09 GMT
Date: Sat, 05 Nov 2022 13:44:38 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f6ae0db60213bfddbf2ad71a9fb116bf
915d2895adc3f022c28cc628aeb6e441cbb09d47
ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22"
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5911
Expires: Sat, 05 Nov 2022 15:23:09 GMT
Date: Sat, 05 Nov 2022 13:44:38 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f6ae0db60213bfddbf2ad71a9fb116bf
915d2895adc3f022c28cc628aeb6e441cbb09d47
ac94f3fd00f0f8f8617d15a3816b07d25d3774e91b287ac181e5efb4ebf95e22

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AC94F3FD00F0F8F8617D15A3816B07D25D3774E91B287AC181E5EFB4EBF95E22"
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5911
Expires: Sat, 05 Nov 2022 15:23:09 GMT
Date: Sat, 05 Nov 2022 13:44:38 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10462 bytes)
Hash
4e2853cc6ec6223160471401e6871f4b
f052e1f8b2bf4a8eeecfa5b82e27ada1b7719a0c
bf4b9145ea043d87a30fd3aeeae21a1a0aa27004cd2467e7aa843bc894ae1f60

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10462
x-amzn-requestid: 43480a38-fd89-4c47-b8c4-e6ba90b1321c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aMF6oEz_oAMF8Hg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634e5043-6617fd2e59cab00135301cdd;Sampled=0
x-amzn-remapped-date: Tue, 18 Oct 2022 07:05:39 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 3fDf4aoep5tTAusisXhIdAf0A6SbpM5fYtYaiXtNSb0-VRJo5nu8Vg==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 ee330666adf9f04c8c30094f8ddcd004.cloudfront.net (CloudFront), 1.1 google
date: Sat, 05 Nov 2022 06:27:59 GMT
age: 26199
etag: "f052e1f8b2bf4a8eeecfa5b82e27ada1b7719a0c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F28a5f5ce-bd81-4e56-bd1b-460e13379581.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.8 kB (7783 bytes)
Hash
7a3b1551512640bb8f5e7deb80c32272
75805b9f03aef14cfad025259936ae5f217d25ca
5baa90853202e78cf9b59e9ab597e16ccfbf143d7e124583e64dc1ad1ee2c2df

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F28a5f5ce-bd81-4e56-bd1b-460e13379581.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7783
x-amzn-requestid: ab7cc6ee-976d-41a4-b5da-0aefd5cb6246
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bEJnzH15oAMFlwA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6364bc98-68f910b60bd5ecaf2947c59a;Sampled=0
x-amzn-remapped-date: Fri, 04 Nov 2022 07:17:44 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: JnvKcym5f71Ra_ZHzkTXnU7Fa3D5zBFK9JFKXA_A3G98jN9r3Jikyw==
via: 1.1 95b0ac620fa3a80ee590ecf1cda1c698.cloudfront.net (CloudFront), 1.1 91356d2137f5a7345e93da4516c49ec4.cloudfront.net (CloudFront), 1.1 google
date: Sat, 05 Nov 2022 08:24:07 GMT
age: 19231
etag: "75805b9f03aef14cfad025259936ae5f217d25ca"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F255683f8-a0b6-411a-a41e-4d042746780e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.2 kB (9150 bytes)
Hash
c7c9c908e891e7277f21a914fea9aa25
596c3c084ae3d850a5dc28e549b4e22f2b8cc71f
709c217b3ac09712d2af4366316c8977b1a4e2a73f887b3e30f10df1ed50bacd

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F255683f8-a0b6-411a-a41e-4d042746780e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9150
x-amzn-requestid: 7c179507-20a7-4fa3-993b-f79b3e7949ac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: apwiGHD_IAMFQZw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635a2e0d-337623ce79dc53c864632c72;Sampled=0
x-amzn-remapped-date: Thu, 27 Oct 2022 07:06:53 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: OM3hc6Jfl5pDWPikIlcQOexIScQavqJh9h-N-EvIGNpicWJwHMPKIA==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Fri, 04 Nov 2022 14:36:51 GMT
age: 83267
etag: "596c3c084ae3d850a5dc28e549b4e22f2b8cc71f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb94b0737-3952-4bbe-b940-e1f79fb95cbe.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.9 kB (6909 bytes)
Hash
eaf06d0fb99703abfd57b962eb21ce96
ce73b0ad22139bec863ed990e3d3af4bdc3df288
a226250245611193be882c92f2d9920cb6ceeb12823b48c0b9c8fa2aba1c8c0d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb94b0737-3952-4bbe-b940-e1f79fb95cbe.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6909
x-amzn-requestid: 7c500c29-f514-491c-b2fe-a732a546925f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: awWpEEYHoAMFWdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635cd16d-6d9c4c5c41f4fcd16cabda59;Sampled=0
x-amzn-remapped-date: Sat, 29 Oct 2022 07:08:29 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: lOCFTDiIxZDBzypATpujFz2hjWPabqjokrpq1-5An86y5lZLG5xHxQ==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 05 Nov 2022 07:40:21 GMT
age: 21857
etag: "ce73b0ad22139bec863ed990e3d3af4bdc3df288"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F005dcb42-4824-4232-94cb-b73713f73375.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.9 kB (3921 bytes)
Hash
7c1182def5cf59cf834fc33853c55d15
15ac708f7d9fdf2136c980afcd844e8fff6fb7aa
2e0b597618655aa5649787b034e18e8d7a47e03404233a516a68ee6e98a8ad43

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F005dcb42-4824-4232-94cb-b73713f73375.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3921
x-amzn-requestid: 718dc223-738a-4bd6-af0e-17ee8d58a9b7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bGIW5FuiIAMF7tw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6365875f-4d4ee14c4b6ea01715ed8e96;Sampled=0
x-amzn-remapped-date: Fri, 04 Nov 2022 21:42:55 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: hDQJ8NwyqHe6FwDNjppqAssCdAkWm2cWl948Dn5GpvDqxUcSs7mNyA==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Fri, 04 Nov 2022 21:59:43 GMT
etag: "15ac708f7d9fdf2136c980afcd844e8fff6fb7aa"
content-type: image/jpeg
age: 56695
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3d05e3a2-b178-419f-90de-a1985765ff09.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.6 kB (6557 bytes)
Hash
ca6c7517d7015fbc35fa290c1c2d6afd
594e5a82ce82fb4cd76548b6d2d6b4cc419b7e4c
a746b36be50209915a0e5657abd219aab382eee4b7556142aa1316daf3a9f5a4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3d05e3a2-b178-419f-90de-a1985765ff09.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6557
x-amzn-requestid: f2e39db1-fb8a-4a9b-8a1d-ee08000ddeb6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bC1VyFHuIAMF5Eg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636435be-7a03ef677f8dbd680f72de90;Sampled=0
x-amzn-remapped-date: Thu, 03 Nov 2022 21:42:22 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: I6mALhsUwtQqMP_p_HxFaiCyfRDTtVzPIJjeDrKSEq7Tc_d5EcNw3Q==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 73cb83fe6699afc2791b5c690c1ff8c6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 04 Nov 2022 21:52:32 GMT
age: 57126
etag: "594e5a82ce82fb4cd76548b6d2d6b4cc419b7e4c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f29b126-c6e5-4528-8307-e3c7fe12e225.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.6 kB (7619 bytes)
Hash
308da46611df43543d31ca502986bea2
0bf4de356c3a64785fe116161cb931b3b2476f5d
63996962e2763dcf2e0ae5e43aa12dfd8f8677082bb1cdf63528dfd00404f3e3

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f29b126-c6e5-4528-8307-e3c7fe12e225.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
content-length: 7619
x-amzn-requestid: 67308248-e660-4294-aafe-5f178970f822
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bGHlcHHfIAMFyGA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63658622-5b1ee875554a05eb1e8a6f16;Sampled=0
x-amzn-remapped-date: Fri, 04 Nov 2022 21:37:38 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: _-RekVvWiPI4MHy0Up2j6D6a_NcPywYvDeydP3QlbCceU7NfWk00jQ==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 73cb83fe6699afc2791b5c690c1ff8c6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 04 Nov 2022 21:52:21 GMT
age: 57144
etag: "0bf4de356c3a64785fe116161cb931b3b2476f5d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (11)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations