urlquery - report: phythmspeters.com/70174f76-6107-43d8-aa1f-3b29a8e3f960

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	IP	Comment
r3.o.lencr.org (8)	344	2020-12-02 08:52:13 UTC	2023-02-04 17:12:07 UTC	23.36.76.226
firefox.settings.services.mozilla.com (2)	867	2020-05-25 20:06:39 UTC	2023-02-04 17:17:03 UTC	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03 12:26:46 UTC	2023-02-04 17:50:33 UTC	34.160.144.191
ocsp.sca1b.amazontrust.com (1)	1015	2016-02-14 02:37:56 UTC	2019-03-27 04:05:54 UTC	54.230.245.100
www.win-now.click (24)	0	2022-08-24 03:29:10 UTC	2023-02-05 03:35:21 UTC	143.204.55.13	Unknown ranking
phythmspeters.com (1)	0	2022-03-24 08:45:02 UTC	2023-02-04 18:28:59 UTC	18.156.16.63	Unknown ranking
contile.services.mozilla.com (1)	1114	2021-05-27 18:32:35 UTC	2023-02-04 17:13:19 UTC	34.117.237.239
push.services.mozilla.com (1)	2140	2014-10-24 08:27:06 UTC	2023-02-04 17:24:41 UTC	52.13.249.229
fly.greenlizard.click (1)	0	2022-07-03 03:20:06 UTC	2023-02-04 16:55:04 UTC	67.212.173.77	Unknown ranking
img-getpocket.cdn.mozilla.net (6)	1631	2017-09-01 03:40:57 UTC	2023-02-04 17:49:21 UTC	34.120.237.76

Scan Date	Severity	Indicator	Comment
2023-02-05	2	phythmspeters.com/70174f76-6107-43d8-aa1f-3b29a8e3f960	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/like_user_1.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/8.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/6.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/4.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/2.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/like_user_2.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/1.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/7.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/3.jpeg	Phishing
2023-02-05	2	www.win-now.click/push/iPhone14/main_script.js	Phishing

Date	UQ / IDS / BL	URL	IP
2023-03-23 23:43:13 +0000	0 - 1 - 1	track.srvs.site/d6c2c957-b61c-4032-8268-1ec90 (...)	18.156.16.63
2023-03-23 22:54:49 +0000	0 - 0 - 1	enhotssureemed.com/76eba432-9b1b-4256-81a8-49 (...)	18.156.16.63
2023-03-23 22:54:38 +0000	0 - 0 - 5	fastweblink.com/7149d861-8e21-4433-ae8c-1b63e (...)	18.156.16.63
2023-03-23 20:54:40 +0000	0 - 0 - 5	fastweblink.com/418d1a5a-5e99-40c4-8789-07b01 (...)	18.156.16.63
2023-03-23 20:54:18 +0000	0 - 0 - 3	phythmspeters.com/810eda04-2210-4021-b314-a61 (...)	18.156.16.63

Date	UQ / IDS / BL	URL	IP
2023-03-23 23:55:49 +0000	0 - 0 - 4	track.toccha.com/5957b73f-e0e0-4c7a-ba65-a7a3 (...)	18.193.209.105
2023-03-23 23:55:13 +0000	0 - 0 - 3	qgxvbz.exceilentdate.com/?utm_source=da57dc55 (...)	63.32.216.166
2023-03-23 23:54:19 +0000	0 - 0 - 4	track.supercosmo.xyz/1f6bb963-70e1-487b-b035- (...)	18.192.108.151
2023-03-23 23:52:02 +0000	0 - 2 - 0	www1.360q.biz/?tm=1&subid4=1666844202.0458850 (...)	75.2.73.197
2023-03-23 23:50:44 +0000	0 - 2 - 0	facebook.fr.coachclub.com	13.36.95.198

Date	UQ / IDS / BL	URL	IP
2023-03-23 20:54:18 +0000	0 - 0 - 3	phythmspeters.com/810eda04-2210-4021-b314-a61 (...)	18.156.16.63
2023-03-23 17:45:08 +0000	0 - 0 - 10	phythmspeters.com/264a3a06-b280-4c94-9159-291 (...)	18.156.16.63
2023-03-22 21:03:18 +0000	0 - 0 - 3	phythmspeters.com/23748a82-48b4-40ca-b8c7-d41 (...)	18.156.16.63
2023-03-22 20:10:46 +0000	0 - 0 - 3	phythmspeters.com/2fa3a025-7b86-43e2-89a6-732 (...)	18.156.16.63
2023-03-22 14:15:12 +0000	0 - 0 - 11	phythmspeters.com/33f243b7-e9a7-4716-b54a-b9b (...)	18.156.16.63

Date	UQ / IDS / BL	URL	IP
2023-03-23 22:55:30 +0000	1 - 0 - 0	70.winprizes670.monster/en1/engsender61.html? (...)	45.76.148.82
2023-03-23 21:55:07 +0000	1 - 0 - 11	track.supercosmo.xyz/41a73f32-5ff2-41ae-b9fc- (...)	18.192.108.151
2023-03-23 21:53:41 +0000	1 - 0 - 0	tooghaghagifts.digital/ghpropel/index.html?br (...)	217.69.13.14
2023-03-23 16:56:05 +0000	1 - 1 - 0	track.rendan-compto.com/f7beabdd-d3f6-49f6-ad (...)	18.195.195.71
2023-03-23 09:00:38 +0000	1 - 0 - 0	track.supercosmo.xyz/73227d16-3cb2-442d-8118- (...)	18.192.108.151

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 8bda3aabcf331c2bfcc4c7023cd797c760fd301dc353641bb95048e072f66c66 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "8BDA3AABCF331C2BFCC4C7023CD797C760FD301DC353641BB95048E072F66C66" Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12793 Expires: Sun, 05 Feb 2023 07:10:45 GMT Date: Sun, 05 Feb 2023 03:37:32 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 1cdc095521e9ee2606059be447d1fdd5 Sha1: 02b5d0a5b5823e2338daf7e144700babe2a213af Sha256: 8bda3aabcf331c2bfcc4c7023cd797c760fd301dc353641bb95048e072f66c66
GET /70174f76-6107-43d8-aa1f-3b29a8e3f960 HTTP/1.1 Host: phythmspeters.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: phythmspeters.com/70174f76-6107-43d8-aa1f-3b29a8e3f960 FQDN: phythmspeters.com IP: 18.156.16.63 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 18.156.16.63 HTTP/1.1 302 Server: nginx Date: Sun, 05 Feb 2023 03:37:32 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-store, no-cache, pre-check=0, post-check=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT Location: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Pragma: no-cache Set-Cookie: 70174f76-6107-43d8-aa1f-3b29a8e3f960-v4=iCQuOGuMUzx6IuVeh1mBfU01zIn7Z9_K2vcMlIGWjn8; Max-Age=86400; Expires=Mon, 06-Feb-2023 03:37:32 GMT; Domain=phythmspeters.com; Path=/; HttpOnly cep-v4=HSoUdV6xs4w45umbUPmSc3SBwQAgTdm6yOH68TfQmQI2uheJ5pIJeNIkEAbs90JM6iNiBZD5RNgCXOFxjIghn8MyTKu8D8OxfJ1p8F92ZG-BtvK1Rcey5cMWdk7DarKMq6Y4_Rv6AkLWzFdQAZryaw-ef2lPPpqLuOvZiiGh7RPal-mdgIfflCq7kEh5KJ5EeyamkEsrlts_ez7_CszX6mU9BuVZ_VvhV31VdhHgGSfnuVfTsz_CW201PByp9AkCs7hmR8KFRzPD9oPv1WgzfhjactDPsNuwx_pE4rbT-cPJnDUM7czQEbcKH9qFzhL0DpP0FNkuBvP-SaI22C4aRGedi27cpiHPxiTNjFLAzEDTUvXM-m0i8Q6Q6IwoxLdL; Max-Age=86400; Expires=Mon, 06-Feb-2023 03:37:32 GMT; Domain=phythmspeters.com; Path=/; HttpOnly --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Alerts: Blocklists: - fortinet: Phishing
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 9bd0795b30e84ce63b6e2a365ca91bbffc395dd955e112152066c31e63a4ab66 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "9BD0795B30E84CE63B6E2A365CA91BBFFC395DD955E112152066C31E63A4AB66" Last-Modified: Sat, 04 Feb 2023 11:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2170 Expires: Sun, 05 Feb 2023 04:13:42 GMT Date: Sun, 05 Feb 2023 03:37:32 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: c21ba65e44ac95470c314e068e49a9eb Sha1: 17a13b13738993d889d4afa3d848dc63bf6eba64 Sha256: 9bd0795b30e84ce63b6e2a365ca91bbffc395dd955e112152066c31e63a4ab66
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 763f58b9fb838378c92033b59907b036f4c33081f5103d9bcc2ca2a8de500d64 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "763F58B9FB838378C92033B59907B036F4C33081F5103D9BCC2CA2A8DE500D64" Last-Modified: Sat, 04 Feb 2023 08:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=9684 Expires: Sun, 05 Feb 2023 06:18:56 GMT Date: Sun, 05 Feb 2023 03:37:32 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: fb7b6b46e708ad73eaaa3c21e74569ae Sha1: 950663c025acad81556af5aa3022ecc9d55097fe Sha256: 763f58b9fb838378c92033b59907b036f4c33081f5103d9bcc2ca2a8de500d64
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/ FQDN: firefox.settings.services.mozilla.com IP: 35.241.9.150 HASH: b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e 35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Content-Type, Alert, Retry-After, Content-Length, Backoff content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Sun, 05 Feb 2023 03:36:17 GMT age: 75 cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: 30db107dcf4380cef05efea409c2e6a3 Sha1: 96e6a306fbc07299aba64e5c14e2bfca35872fa9 Sha256: b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 34.160.144.191 HASH: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c 34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: NCQIcvkPx6Vn2G0+rIqjl1shGHg9B/HNPzeynv05nMU//kRtU5+sWDGXaPRrM9v26IBm2rjhvDE= x-amz-request-id: WA5V68XEM5XGFPJ8 content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Sun, 05 Feb 2023 02:53:05 GMT age: 2667 last-modified: Mon, 09 Jan 2023 18:04:21 GMT etag: "7b922915ebf1fa3639b333f994c74f24" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 7b922915ebf1fa3639b333f994c74f24 Sha1: 144a3f80b98fd0652d4614f24cf6cbbee40f8938 Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Sun, 05 Feb 2023 03:37:32 GMT content-length: 12 access-control-allow-credentials: true vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-expose-headers: content-type strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
POST / HTTP/1.1 Host: ocsp.sca1b.amazontrust.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sca1b.amazontrust.com/ FQDN: ocsp.sca1b.amazontrust.com IP: 54.230.245.100 HASH: 2c9e2617071d7d1782c5814726b1254cd9336c9703e6a433d7620e2d9b533d45 54.230.245.100 HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: 'max-age=158059' Date: Sun, 05 Feb 2023 03:37:33 GMT Server: ECS (dcb/7EEF) X-Cache: Miss from cloudfront Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-P1 X-Amz-Cf-Id: Upvo4tYeJXWdNiSDskVyZJSeVPu5P9rbqA484X_mK9Dz8Nqc4LBiXA== --- Additional Info --- Magic: data Size: 471 Md5: 9f208c918710e0bddd4febc9ab0df746 Sha1: ca75b3943d33e7e5deacf15fea78be3698e5ec89 Sha256: 2c9e2617071d7d1782c5814726b1254cd9336c9703e6a433d7620e2d9b533d45
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/buckets/main/c (...) FQDN: firefox.settings.services.mozilla.com IP: 35.241.9.150 HASH: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300 35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Sun, 05 Feb 2023 03:07:20 GMT age: 1813 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "BDDD7E3A4939F863642A7C5348C1C8B9BC569B35C10A27F4CF5EC71F7E6B9698" Last-Modified: Fri, 03 Feb 2023 20:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=18433 Expires: Sun, 05 Feb 2023 08:44:46 GMT Date: Sun, 05 Feb 2023 03:37:33 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: dedf9c519ac38c4bece9c5bc895787d7 Sha1: 4911175c3f8a435978c5301c33c7a99a5e00a1d5 Sha256: bddd7e3a4939f863642a7c5348c1c8b9bc569b35c10a27f4cf5ec71f7e6b9698
GET /push/iPhone14/i14wheel.jpg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/i14wheel.jpg FQDN: www.win-now.click IP: 143.204.55.13 HASH: cb4e4f2e6895ba24c0ee34b0404cab1de81dfa3440b54e85a3f92e072da27b8a 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 42443 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:14 GMT etag: "96609fbcc5f804cbe893946051325dbe" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: H35-7QlQlo-rNHxVNFVfBiBqVaMOtx5m5yyLggnHfJxTyq4Zer2bsQ== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 501x501, components 3\012- data Size: 42443 Md5: 96609fbcc5f804cbe893946051325dbe Sha1: 3f5a28fd0d29224836399ab8f4955c66046cd7bc Sha256: cb4e4f2e6895ba24c0ee34b0404cab1de81dfa3440b54e85a3f92e072da27b8a
GET /push/iPhone14/ix-g.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/ix-g.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: e25ba7e0c1b7e4bb61773bd32df4cf010a0d6c65e773fcc2bdc3454edf3401c0 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 5846 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:17 GMT etag: "038a492cc0a3488f0547dafc24c15838" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: g-byP5QRVFUYmgs1Gijyiw2jsMF91NFI6WP2libhwlULrO8FKfW_yw== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 203x249, components 3\012- data Size: 5846 Md5: 038a492cc0a3488f0547dafc24c15838 Sha1: e49b0adb8e08131c54b71c3325b8e9cb9ce716f9 Sha256: e25ba7e0c1b7e4bb61773bd32df4cf010a0d6c65e773fcc2bdc3454edf3401c0
GET /push/iPhone14/like_user_1.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/like_user_1.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: e7c85bfa7ba6d75dd0de72e51da2e185351ced82b32090ab35395766ef4849fa 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1293 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:21 GMT etag: "2aa0d43e70d60d76ac4bdff139f8c7cb" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: 1zp8TQ03qOBCizf2Hbdjut854waowWirVIne4O9VB2HQwE9rgptYyQ== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x50, components 3\012- data Size: 1293 Md5: 2aa0d43e70d60d76ac4bdff139f8c7cb Sha1: d7e3433297ad90f5d99249aee29b645265c9f3eb Sha256: e7c85bfa7ba6d75dd0de72e51da2e185351ced82b32090ab35395766ef4849fa Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/footer_right.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/footer_right.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: f044237e4439b415a4947127f26fb14b4d32cf1d32ff51fd8f0ff4d21d2692e5 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 4919 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:12 GMT etag: "0e786b7344ac0b63609290a3a415fc4f" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: 70yJG_IUhrMveDbxfWymBz9RUdrkfRMrlyIk5-XK8qnGN7m-9T4aCA== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 168 x 66, 8-bit colormap, non-interlaced\012- data Size: 4919 Md5: 0e786b7344ac0b63609290a3a415fc4f Sha1: c2e77827e895aaa13522f1c5c0ef79d4caef0bb2 Sha256: f044237e4439b415a4947127f26fb14b4d32cf1d32ff51fd8f0ff4d21d2692e5
GET /push/iPhone14/8.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/8.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: 54dc1727eabc97535b59704be621ca245f36376ee32acab675a40ff5ab1a389c 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1203 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:06 GMT etag: "b7f49f9e865aed63fc64a6d4c784df9e" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: B0nRAAVJzwRG8cBzyqqG9Jq5tnI5Ct2u8vwQ5Qk4sfZU51eST56asg== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data Size: 1203 Md5: b7f49f9e865aed63fc64a6d4c784df9e Sha1: b20038adf8b3312fae9f5f72a057d98c4f119ed8 Sha256: 54dc1727eabc97535b59704be621ca245f36376ee32acab675a40ff5ab1a389c Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/clip_footer_3.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/clip_footer_3.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: ef3b8785199a0a640150a9d9ceb9b7cff2b118ee377ce36317d4a3e716bd944f 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 2460 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:10 GMT etag: "e1b626392882cc25b4d891afaa68afd4" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: swbtaAR8gf9APxTkML4RQaGs_7QzKVDrR2_LCG4ec1x6BTbPXFShJQ== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 52 x 59, 8-bit colormap, non-interlaced\012- data Size: 2460 Md5: e1b626392882cc25b4d891afaa68afd4 Sha1: 454d7abdbc2548d04feb95436ea0ab4126b4f00b Sha256: ef3b8785199a0a640150a9d9ceb9b7cff2b118ee377ce36317d4a3e716bd944f
GET /push/iPhone14/6.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/6.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: 337434d918a2662370261fec6d9ec095ceaa27aa3249ef323be97f8183528eef 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1092 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:04 GMT etag: "e957fbde5c4146a2740a772ce622c1f0" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: KxM16AWkRRQC72d625Ggs7u4d-mHBE7IHXqwtl-F7Qir4A0A10MH6g== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data Size: 1092 Md5: e957fbde5c4146a2740a772ce622c1f0 Sha1: f8fc768f34f4be98f8dc098b42e8559d38523b3b Sha256: 337434d918a2662370261fec6d9ec095ceaa27aa3249ef323be97f8183528eef Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/4.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/4.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: b5958fd2d9043b4544b807259e74bba084a26acae998d2bd522d4acc62e9f4e5 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1068 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:02 GMT etag: "6f44457c62359dac93d8092d7af63672" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: D4eD36ChvowAQ0hTnGFkgbTGErKTDay7qqlKzn7hGKHUClIJwhCMbw== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data Size: 1068 Md5: 6f44457c62359dac93d8092d7af63672 Sha1: 97020a1c8bd06962b1181385963f6b72dea2c902 Sha256: b5958fd2d9043b4544b807259e74bba084a26acae998d2bd522d4acc62e9f4e5 Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/ixo.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/ixo.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: 0f3a2e2e7f8ab18b9513fd334f82e227911e2f0f378ddc63b8b34347f12534c6 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 561946 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:18 GMT etag: "3db6e9a86a250c13268be4a224a40333" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: iu4b1hSHBG4t_cRJ6JCgUg2hZDJRnwsu6NqtDLmZWQ7nNZ3quI46Xg== age: 47297 X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 423 x 880, 8-bit/color RGBA, non-interlaced\012- data Size: 561946 Md5: 3db6e9a86a250c13268be4a224a40333 Sha1: 63fdc9bdf962bd044cc99800e68a7c945298e05b Sha256: 0f3a2e2e7f8ab18b9513fd334f82e227911e2f0f378ddc63b8b34347f12534c6
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: rKeJoQBlgOyJG7xIrJUCAw== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 52.13.249.229 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 52.13.249.229 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: TqlXUZ7ioGEm4eRtK4XKp/Mv2Xo= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /js/pub.min.js HTTP/1.1 Host: fly.greenlizard.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/ Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: fly.greenlizard.click/js/pub.min.js FQDN: fly.greenlizard.click IP: 67.212.173.77 HASH: d2c713c2734353dc0ef2896d057021e9b04f35bb7c851d920d390941769c66be 67.212.173.77 HTTP/2 200 OK content-type: application/javascript server: nginx date: Sun, 05 Feb 2023 03:37:34 GMT content-length: 1482 last-modified: Fri, 09 Sep 2022 11:46:08 GMT vary: Accept-Encoding etag: "631b2780-5ca" content-encoding: gzip expires: Mon, 06 Feb 2023 03:37:34 GMT cache-control: max-age=86400 strict-transport-security: max-age=31536000; includeSubdomains X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text, with very long lines (2752) Size: 1482 Md5: 31c303586c1b78e33984bd252b8e2644 Sha1: 8083e2aad4cbf8242a4e6fb53657d49552b85f82 Sha256: d2c713c2734353dc0ef2896d057021e9b04f35bb7c851d920d390941769c66be
GET /push/iPhone14/2.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/2.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: f45eaab6cc5fad19d6aafef5daa7cf935f9139b3bcb2190eec5e1fd26a68c58d 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1254 last-modified: Thu, 22 Dec 2022 23:15:00 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "9daf82b76b8477fa503d862af8cb74b1" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: N6iIH0t8cDuYWM1wevyMUgCnRQz_c21_klIyrttD__lFm6FovVT-eA== X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 50x50, components 3\012- data Size: 1254 Md5: 9daf82b76b8477fa503d862af8cb74b1 Sha1: 541edfdc63ace3ab12f9b0cd3d79c862b1f548dc Sha256: f45eaab6cc5fad19d6aafef5daa7cf935f9139b3bcb2190eec5e1fd26a68c58d Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/like_user_2.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/like_user_2.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: ba0c57dd9fbd100462ac62c8c8b3156caf1283d250fb56ee8ce5b0f53e575ccd 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1216 last-modified: Thu, 22 Dec 2022 23:15:22 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "f9299c2023539a8f27a6e1b12ed260e5" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: DE91lYVuc5HUyuWwWPmoU7wo1IxJtoHPEWoOjHEPYgcKXWfOc6BcwA== X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 50x50, components 3\012- data Size: 1216 Md5: f9299c2023539a8f27a6e1b12ed260e5 Sha1: 046baf9bcd1bbdf9d51ca63e3899ea2e7f5de0b2 Sha256: ba0c57dd9fbd100462ac62c8c8b3156caf1283d250fb56ee8ce5b0f53e575ccd Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/1.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/1.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: 722d0fbdeea1aa70ebe7b7e4a731a7b778e35d0bab46ad45c711ace64166fdaa 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1258 last-modified: Thu, 22 Dec 2022 23:14:59 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "e28a5798007788d032feee066fa01efc" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: 8YevUiMqP6o7uRl1QXoCEmSVv9N-u54Dhp-XMTJ4WMMnm5-ilr-4Lw== X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data Size: 1258 Md5: e28a5798007788d032feee066fa01efc Sha1: af4c6ee2a4688f615cc3c2ca3bb1937c759e99d5 Sha256: 722d0fbdeea1aa70ebe7b7e4a731a7b778e35d0bab46ad45c711ace64166fdaa Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/ix-s.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/ix-s.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: 64b10a435c7d01c123b1ad3c5b6c2a3a66b95e0dd5601d6c6b5bcb786881beca 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 6271 last-modified: Thu, 22 Dec 2022 23:15:20 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "83dea2fa1f2cff1c3c228260b4bbef9f" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: JSx8ZlLLVUHhbyI-BuirS8HzydTu1McyaIvQr134cfRHR290KLLDVQ== X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 165x212, components 3\012- data Size: 6271 Md5: 83dea2fa1f2cff1c3c228260b4bbef9f Sha1: 069c3bb290335ec373202bd52e9b064a372acf5d Sha256: 64b10a435c7d01c123b1ad3c5b6c2a3a66b95e0dd5601d6c6b5bcb786881beca
GET /push/iPhone14/7.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/7.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: 9c2388e5c4d51f01e19af1c46805ca29ce7a558aad05e3eb9e565a7dc5a1127d 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1138 last-modified: Thu, 22 Dec 2022 23:15:05 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "546e8c9e22c52b3e47dd2fe58f139fc9" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: oNsqihJXyeLAAsLdColi1M80-4s3ArgwSry7BtvaO2C8SCxpjjQMhg== X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3\012- data Size: 1138 Md5: 546e8c9e22c52b3e47dd2fe58f139fc9 Sha1: 204463ece3f1e0e497463d0b30cd3c988dcd0a17 Sha256: 9c2388e5c4d51f01e19af1c46805ca29ce7a558aad05e3eb9e565a7dc5a1127d Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/3.jpeg HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/3.jpeg FQDN: www.win-now.click IP: 143.204.55.13 HASH: 1e2f3f221d8d89df1d4ca3973eb346cd4b83ebb13df118f7278bb7a6ad35d924 143.204.55.13 HTTP/2 200 OK content-type: image/jpeg content-length: 1183 last-modified: Thu, 22 Dec 2022 23:15:01 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "d10dfa46723e01a51116353ee511f4db" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: BYePMZYJYZCPFAZACX165HruCvQqly8JQOJBWyX2vpp8ldKEPi9quw== X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 50x50, components 3\012- data Size: 1183 Md5: d10dfa46723e01a51116353ee511f4db Sha1: 04dc2eb7734da000af852dd34d8e061055d61566 Sha256: 1e2f3f221d8d89df1d4ca3973eb346cd4b83ebb13df118f7278bb7a6ad35d924 Alerts: Blocklists: - fortinet: Phishing
GET /push/iPhone14/menu_2x.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/style.css Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/menu_2x.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: 455b82fa1e54fc88fe0699eabecb02155f1d6228e0ae3d7f72e1abe92dae8f3c 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 124 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:25 GMT etag: "8f68efd9388ccd80b43759b2ed542305" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: gtymQzUuwiqBHmLYPWzOZE5S0s00eDyTMgx6cLL39jNMa6h9npBnDw== age: 47298 X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 40 x 36, 8-bit gray+alpha, non-interlaced\012- data Size: 124 Md5: 8f68efd9388ccd80b43759b2ed542305 Sha1: 9f2cf96efe3bdec2ab64bc51856619cc02958fe6 Sha256: 455b82fa1e54fc88fe0699eabecb02155f1d6228e0ae3d7f72e1abe92dae8f3c
GET /push/iPhone14/spin_prize2.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/style.css Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/spin_prize2.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: 43f3e6d7e7b011430b39020bc5ff8fe6be2947100c597de44ca549ea96a0fd7c 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 2814 date: Sat, 04 Feb 2023 14:29:17 GMT last-modified: Thu, 22 Dec 2022 23:15:28 GMT etag: "f278c8d30fc51b72e0774b9ecb49214c" accept-ranges: bytes server: AmazonS3 x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: VJjFaZfG2-PRLN9WRYWX_2xwDFhBkSZZbj7z1H24L6R0Vp-zJN7YzQ== age: 47298 X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 142 x 173, 8-bit colormap, non-interlaced\012- data Size: 2814 Md5: f278c8d30fc51b72e0774b9ecb49214c Sha1: 03b574db82b31ee5758eb5093fda8ea25d1b00d8 Sha256: 43f3e6d7e7b011430b39020bc5ff8fe6be2947100c597de44ca549ea96a0fd7c
GET /push/iPhone14/notify_2x.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/style.css Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/notify_2x.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: 4566dd8f59a09f51415a7c8955f48f75298522fc6db554bc1a59ad79c3e3e314 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 229 last-modified: Thu, 22 Dec 2022 23:15:26 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "988234626ae7a880ed9c6a92f6336c0f" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: Mj1Y75ZTzwI7Mww5PxV00Pm3L44Fz9qu2fiaSA7gZcfsw_XEG6GE6A== X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 36 x 32, 8-bit gray+alpha, non-interlaced\012- data Size: 229 Md5: 988234626ae7a880ed9c6a92f6336c0f Sha1: 173967c2b59baed4a06997d874aba32ab65da201 Sha256: 4566dd8f59a09f51415a7c8955f48f75298522fc6db554bc1a59ad79c3e3e314
GET /push/iPhone14/comment_action_2x.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/style.css Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/comment_action_2x.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: a3f59e07404f1745bed88a314113a86da376526e7e1e555c99b3e249178c6ba5 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 641 last-modified: Thu, 22 Dec 2022 23:15:11 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "e9b3872b3e63e19728176d45f0aa6986" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: FNa7OlNXwKaKb7LxeLRauRvOjJDPRdZp9qqRmrxrbjXO5bINtPFnBw== X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 24 x 120, 8-bit colormap, non-interlaced\012- data Size: 641 Md5: e9b3872b3e63e19728176d45f0aa6986 Sha1: b638f89d5d80c4cd65327da973c52f778e30bd55 Sha256: a3f59e07404f1745bed88a314113a86da376526e7e1e555c99b3e249178c6ba5
GET /push/iPhone14/action_icons_20px_2x.png HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/style.css Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/action_icons_20px_2x.png FQDN: www.win-now.click IP: 143.204.55.13 HASH: 4e06866c22bb275c6c4f01265e1f3e9f00fe9face9739f6531371d688a8e7a7e 143.204.55.13 HTTP/2 200 OK content-type: image/png content-length: 1726 last-modified: Thu, 22 Dec 2022 23:15:08 GMT accept-ranges: bytes server: AmazonS3 date: Sun, 05 Feb 2023 03:37:35 GMT etag: "b699975b5fe73b087e711a33ff24ee1e" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: vqJ1YXfJBIB2DK52v0YaHiYAadNFU1dYDZ-B0FJt6hDuhkQSGUsMzQ== X-Firefox-Spdy: h2 --- Additional Info --- Magic: PNG image data, 40 x 360, 8-bit colormap, non-interlaced\012- data Size: 1726 Md5: b699975b5fe73b087e711a33ff24ee1e Sha1: 0e33cc5c32a5e7d18440751e3946076664caaf53 Sha256: 4e06866c22bb275c6c4f01265e1f3e9f00fe9face9739f6531371d688a8e7a7e
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302" Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12655 Expires: Sun, 05 Feb 2023 07:08:30 GMT Date: Sun, 05 Feb 2023 03:37:35 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: c14d3cf8ade0150a711f094be32ac474 Sha1: 11e7fb5487d364c5392e1594e09f5b49831043ea Sha256: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302" Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12655 Expires: Sun, 05 Feb 2023 07:08:30 GMT Date: Sun, 05 Feb 2023 03:37:35 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: c14d3cf8ade0150a711f094be32ac474 Sha1: 11e7fb5487d364c5392e1594e09f5b49831043ea Sha256: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302" Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12655 Expires: Sun, 05 Feb 2023 07:08:30 GMT Date: Sun, 05 Feb 2023 03:37:35 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: c14d3cf8ade0150a711f094be32ac474 Sha1: 11e7fb5487d364c5392e1594e09f5b49831043ea Sha256: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.76.226 HASH: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302" Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12655 Expires: Sun, 05 Feb 2023 07:08:30 GMT Date: Sun, 05 Feb 2023 03:37:35 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: c14d3cf8ade0150a711f094be32ac474 Sha1: 11e7fb5487d364c5392e1594e09f5b49831043ea Sha256: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6e4dfe8-8de0-4ffd-85a4-544a7e82f052.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 8268fb8aa86182e7c2113709cce8f559ac8cc831e12cfd7a75c67f30c69808a5 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5652 x-amzn-requestid: a9d8e72b-b943-4c6d-a01c-7b7b65da6ee4 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fzXDqG-eIAMFbTQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63de054a-778199ce1db9fa1b73a9d4ec;Sampled=0 x-amzn-remapped-date: Sat, 04 Feb 2023 07:12:10 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: CyZUnEQ1l6j1CZCVM63GYbV6mAnhjW3kh4E5M07jH6d3t4mwhSK4hw== via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google date: Sat, 04 Feb 2023 22:04:01 GMT age: 20014 etag: "29a73442173f75b4f3413e2c6459e8448b1cc33f" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5652 Md5: 5d907b978dc107f6e95182eee954462a Sha1: 29a73442173f75b4f3413e2c6459e8448b1cc33f Sha256: 8268fb8aa86182e7c2113709cce8f559ac8cc831e12cfd7a75c67f30c69808a5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c8da623-73ab-4c2d-afaa-03d28de3a280.png HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: e42d110060133ac05e6cdfafa6473c55473220fdc7eaf03e3a89f58aa3603670 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 11056 x-amzn-requestid: 4acc3364-4a33-4934-bdcb-41284d952113 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fPFrwEW4IAMF_Tg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63cf8317-33872f461a2faab552322837;Sampled=0 x-amzn-remapped-date: Tue, 24 Jan 2023 07:04:55 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: XhPm-ZDoEjlgeiXUwMRQZ5pOMs4qJzXagWZg302DcrYpUm5X7O8ZZA== via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google date: Sat, 04 Feb 2023 21:46:47 GMT age: 21048 etag: "1367bebb73fa652695242100b26c394f1bfe4457" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 11056 Md5: 3e0c38abfcd86f8074d4182d49fc354f Sha1: 1367bebb73fa652695242100b26c394f1bfe4457 Sha256: e42d110060133ac05e6cdfafa6473c55473220fdc7eaf03e3a89f58aa3603670
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98423c35-aa11-41c0-8f4f-52bec4c9eaa8.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4d927e74922159db5d07b9947fa1021cff74bb7b55759960cb3941d05c1e8f11 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9579 x-amzn-requestid: c474008d-a6a9-409b-88e2-c55062044575 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fzQtnFGhoAMF5Zw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63ddfb23-54dd67257ba25ad24e977a9c;Sampled=0 x-amzn-remapped-date: Sat, 04 Feb 2023 06:28:51 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: 0Of3BK3VqVMGQGDIODQthVmi7BC8Ney4zgGCpVuzYc1j6D8RRP-AxA== via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google date: Sat, 04 Feb 2023 11:55:41 GMT age: 56514 etag: "59e0b21cdf4cfdac3f1ea05badd007727939ac42" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9579 Md5: b3e7140400336984afc6093c1246f863 Sha1: 59e0b21cdf4cfdac3f1ea05badd007727939ac42 Sha256: 4d927e74922159db5d07b9947fa1021cff74bb7b55759960cb3941d05c1e8f11
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F626efb39-4b90-4979-bc7d-1a1ba9e7fc73.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 8c75170cdf9f6b97aef972568348aa4e6d67486ad1fdb7aa9d346e1cc8ae9df7 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9290 x-amzn-requestid: 5ed93026-d87a-4c82-81ce-8faa9e8dba60 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fsnFtFVUoAMF6Bw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63db5224-0e5fea32709d6f665f6b09db;Sampled=0 x-amzn-remapped-date: Thu, 02 Feb 2023 06:03:16 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: AD5rpaPGI6jezDtJBS7-XTUoJQetiG6yyo6VbDfBYzk9RwPNYN5h2Q== via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google date: Sat, 04 Feb 2023 22:57:11 GMT etag: "470c81f1cab13436da9f94e97bb152fc9d01ad04" age: 16824 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9290 Md5: eaca60722d35484e7cad5e6521465c75 Sha1: 470c81f1cab13436da9f94e97bb152fc9d01ad04 Sha256: 8c75170cdf9f6b97aef972568348aa4e6d67486ad1fdb7aa9d346e1cc8ae9df7
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3f52758-d976-47aa-a47d-f0d6026514dc.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 725d42a020d496f596074794cc2abdaca8a9b821e1a3502eee26056d0f528506 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7665 x-amzn-requestid: 001ba86d-ebc8-4819-89f7-1604bc059cd8 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fPGibFeqIAMFqMA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63cf8475-076d982b5fccf2b931a05976;Sampled=0 x-amzn-remapped-date: Tue, 24 Jan 2023 07:10:45 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: gnkjykHYcMthJkIb-A1P1rRw9FZieh3TmoTT3qVaceWw03TQNX8qfQ== via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google date: Sat, 04 Feb 2023 22:32:24 GMT age: 18311 etag: "e5d4cbfc7482d35ee2ca03a7178426f3e2e97010" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7665 Md5: f28ffcf384ce958b6302d05b6690c088 Sha1: e5d4cbfc7482d35ee2ca03a7178426f3e2e97010 Sha256: 725d42a020d496f596074794cc2abdaca8a9b821e1a3502eee26056d0f528506
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0def934-b27d-4612-bab8-84bfb73a9960.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 6ae0cec9ade23fd53e9c1407b0324a8060892a65a6b675ccffa4a4c82b66f1ff 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7589 x-amzn-requestid: 280f7003-2696-4a82-bd50-82b0a2b66faf x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: fsSpoEA0oAMFSBg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63db3170-35dcb9513c891af201b973d1;Sampled=0 x-amzn-remapped-date: Thu, 02 Feb 2023 03:43:44 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: 00Sp1Thtp-YIGYmu7qIB6GtKBxOGLgcAse2SusryA8xaBrnWQDD-Hg== via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google date: Sat, 04 Feb 2023 22:04:01 GMT age: 20014 etag: "67e7c49ea7648fc6d1dffc22588862c993b785b7" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7589 Md5: 5beaead015b2b4fb6d36009926ba0378 Sha1: 67e7c49ea7648fc6d1dffc22588862c993b785b7 Sha256: 6ae0cec9ade23fd53e9c1407b0324a8060892a65a6b675ccffa4a4c82b66f1ff
GET /push/iPhone14/style.css HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/style.css FQDN: www.win-now.click IP: 143.204.55.13 143.204.55.13 HTTP/2 200 OK content-type: text/css last-modified: Thu, 22 Dec 2022 23:15:29 GMT server: AmazonS3 content-encoding: br date: Sun, 05 Feb 2023 03:37:35 GMT etag: W/"8c24a5cb4c55b9d6cd3029f5fd2c6fe7" vary: Accept-Encoding x-cache: RefreshHit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: _mGnP_HChPnlUOxDaCnNe5Wd5Au34j1aKr6ymlHrz-Id_hpP4rT4gA== X-Firefox-Spdy: h2 --- Additional Info ---
GET /favicon.ico HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/favicon.ico FQDN: www.win-now.click IP: 143.204.55.13 143.204.55.13 HTTP/2 403 Forbidden content-type: application/xml date: Sun, 05 Feb 2023 03:37:34 GMT server: AmazonS3 x-cache: Error from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: rmYl23NGd564AZISh8v9rpnGolqOqguGTvk8uqDcH6HwANNlNLyIYQ== X-Firefox-Spdy: h2 --- Additional Info ---
GET /push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: www.win-now.click/push/iPhone14/index.html?cep=2Qh964a4 (...) FQDN: www.win-now.click IP: 143.204.55.13 143.204.55.13 HTTP/2 200 OK content-type: text/html date: Sun, 05 Feb 2023 03:37:34 GMT last-modified: Thu, 22 Dec 2022 23:15:16 GMT etag: W/"04857a3eb568b86273b84a464ce9a156" server: AmazonS3 content-encoding: br vary: Accept-Encoding x-cache: Miss from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: Ovlcq5OgdC-9Fcqx3RWnDZ66br2baVKl4NwmFuAgstaW1kO0RintAw== X-Firefox-Spdy: h2 --- Additional Info ---
GET /push/iPhone14/main_script.js HTTP/1.1 Host: www.win-now.click User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: www.win-now.click/push/iPhone14/main_script.js FQDN: www.win-now.click IP: 143.204.55.13 143.204.55.13 HTTP/2 200 OK content-type: application/javascript last-modified: Thu, 22 Dec 2022 23:15:24 GMT server: AmazonS3 content-encoding: br date: Sat, 04 Feb 2023 19:07:50 GMT etag: W/"042156744b849e8d35b7083b52607c94" vary: Accept-Encoding x-cache: Hit from cloudfront via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) x-amz-cf-pop: OSL50-C1 x-amz-cf-id: 85imR32-IJmVnUb5fQE0idv7XiC_ALBstptIsJmKp_r4a7PGVJuCFw== age: 30584 X-Firefox-Spdy: h2 --- Additional Info --- Alerts: Blocklists: - fortinet: Phishing

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.76.226

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "8BDA3AABCF331C2BFCC4C7023CD797C760FD301DC353641BB95048E072F66C66" 

                                        
                                            
Last-Modified: Sat, 04 Feb 2023 05:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=12793 

                                        
                                            
Expires: Sun, 05 Feb 2023 07:10:45 GMT 

                                        
                                            
Date: Sun, 05 Feb 2023 03:37:32 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    1cdc095521e9ee2606059be447d1fdd5

                                                Sha1:   02b5d0a5b5823e2338daf7e144700babe2a213af

                                                Sha256: 8bda3aabcf331c2bfcc4c7023cd797c760fd301dc353641bb95048e072f66c66

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.76.226

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "9BD0795B30E84CE63B6E2A365CA91BBFFC395DD955E112152066C31E63A4AB66" 

                                        
                                            
Last-Modified: Sat, 04 Feb 2023 11:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=2170 

                                        
                                            
Expires: Sun, 05 Feb 2023 04:13:42 GMT 

                                        
                                            
Date: Sun, 05 Feb 2023 03:37:32 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    c21ba65e44ac95470c314e068e49a9eb

                                                Sha1:   17a13b13738993d889d4afa3d848dc63bf6eba64

                                                Sha256: 9bd0795b30e84ce63b6e2a365ca91bbffc395dd955e112152066c31e63a4ab66

                                        
                                            GET /v1/ HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         35.241.9.150

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/json

                                        

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
access-control-expose-headers: Content-Type, Alert, Retry-After, Content-Length, Backoff 

                                        
                                            
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
content-length: 939 

                                        
                                            
via: 1.1 google 

                                        
                                            
date: Sun, 05 Feb 2023 03:36:17 GMT 

                                        
                                            
age: 75 

                                        
                                            
cache-control: max-age=3600,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators

                                                Size:   939

                                                Md5:    30db107dcf4380cef05efea409c2e6a3

                                                Sha1:   96e6a306fbc07299aba64e5c14e2bfca35872fa9

                                                Sha256: b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

                                        
                                            GET /v1/tiles HTTP/1.1 

                                        
                                            
Host: contile.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.117.237.239

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/json

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Sun, 05 Feb 2023 03:37:32 GMT 

                                        
                                            
content-length: 12 

                                        
                                            
access-control-allow-credentials: true 

                                        
                                            
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers 

                                        
                                            
access-control-expose-headers: content-type 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
via: 1.1 google 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with no line terminators

                                                Size:   12

                                                Md5:    23e88fb7b99543fb33315b29b1fad9d6

                                                Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

                                                Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: application/json 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/json 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         35.241.9.150

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/json

                                        

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type 

                                        
                                            
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
content-length: 329 

                                        
                                            
via: 1.1 google 

                                        
                                            
date: Sun, 05 Feb 2023 03:07:20 GMT 

                                        
                                            
age: 1813 

                                        
                                            
last-modified: Fri, 25 Mar 2022 17:45:46 GMT 

                                        
                                            
etag: "1648230346554" 

                                        
                                            
cache-control: max-age=3600,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators

                                                Size:   329

                                                Md5:    0333b0655111aa68de771adfcc4db243

                                                Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb

                                                Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

                                        
                                            GET /push/iPhone14/i14wheel.jpg HTTP/1.1 

                                        
                                            
Host: www.win-now.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         143.204.55.13

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
content-length: 42443 

                                        
                                            
date: Sat, 04 Feb 2023 14:29:17 GMT 

                                        
                                            
last-modified: Thu, 22 Dec 2022 23:15:14 GMT 

                                        
                                            
etag: "96609fbcc5f804cbe893946051325dbe" 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: H35-7QlQlo-rNHxVNFVfBiBqVaMOtx5m5yyLggnHfJxTyq4Zer2bsQ== 

                                        
                                            
age: 47297 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 501x501, components 3\012- data

                                                Size:   42443

                                                Md5:    96609fbcc5f804cbe893946051325dbe

                                                Sha1:   3f5a28fd0d29224836399ab8f4955c66046cd7bc

                                                Sha256: cb4e4f2e6895ba24c0ee34b0404cab1de81dfa3440b54e85a3f92e072da27b8a

                                        
                                            GET /push/iPhone14/ixo.png HTTP/1.1 

                                        
                                            
Host: www.win-now.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         143.204.55.13

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/png

                                        

                                        
                                            
content-length: 561946 

                                        
                                            
date: Sat, 04 Feb 2023 14:29:17 GMT 

                                        
                                            
last-modified: Thu, 22 Dec 2022 23:15:18 GMT 

                                        
                                            
etag: "3db6e9a86a250c13268be4a224a40333" 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: iu4b1hSHBG4t_cRJ6JCgUg2hZDJRnwsu6NqtDLmZWQ7nNZ3quI46Xg== 

                                        
                                            
age: 47297 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  PNG image data, 423 x 880, 8-bit/color RGBA, non-interlaced\012- data

                                                Size:   561946

                                                Md5:    3db6e9a86a250c13268be4a224a40333

                                                Sha1:   63fdc9bdf962bd044cc99800e68a7c945298e05b

                                                Sha256: 0f3a2e2e7f8ab18b9513fd334f82e227911e2f0f378ddc63b8b34347f12534c6

                                        
                                            GET /js/pub.min.js HTTP/1.1 

                                        
                                            
Host: fly.greenlizard.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://www.win-now.click/ 

                                        
                                            
Sec-Fetch-Dest: script 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         67.212.173.77

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: application/javascript

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Sun, 05 Feb 2023 03:37:34 GMT 

                                        
                                            
content-length: 1482 

                                        
                                            
last-modified: Fri, 09 Sep 2022 11:46:08 GMT 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
etag: "631b2780-5ca" 

                                        
                                            
content-encoding: gzip 

                                        
                                            
expires: Mon, 06 Feb 2023 03:37:34 GMT 

                                        
                                            
cache-control: max-age=86400 

                                        
                                            
strict-transport-security: max-age=31536000; includeSubdomains 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  ASCII text, with very long lines (2752)

                                                Size:   1482

                                                Md5:    31c303586c1b78e33984bd252b8e2644

                                                Sha1:   8083e2aad4cbf8242a4e6fb53657d49552b85f82

                                                Sha256: d2c713c2734353dc0ef2896d057021e9b04f35bb7c851d920d390941769c66be

                                        
                                            GET /push/iPhone14/ix-s.png HTTP/1.1 

                                        
                                            
Host: www.win-now.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         143.204.55.13

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/png

                                        

                                        
                                            
content-length: 6271 

                                        
                                            
last-modified: Thu, 22 Dec 2022 23:15:20 GMT 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
date: Sun, 05 Feb 2023 03:37:35 GMT 

                                        
                                            
etag: "83dea2fa1f2cff1c3c228260b4bbef9f" 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-cache: RefreshHit from cloudfront 

                                        
                                            
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: JSx8ZlLLVUHhbyI-BuirS8HzydTu1McyaIvQr134cfRHR290KLLDVQ== 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 165x212, components 3\012- data

                                                Size:   6271

                                                Md5:    83dea2fa1f2cff1c3c228260b4bbef9f

                                                Sha1:   069c3bb290335ec373202bd52e9b064a372acf5d

                                                Sha256: 64b10a435c7d01c123b1ad3c5b6c2a3a66b95e0dd5601d6c6b5bcb786881beca

                                        
                                            GET /push/iPhone14/spin_prize2.png HTTP/1.1 

                                        
                                            
Host: www.win-now.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://www.win-now.click/push/iPhone14/style.css 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         143.204.55.13

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/png

                                        

                                        
                                            
content-length: 2814 

                                        
                                            
date: Sat, 04 Feb 2023 14:29:17 GMT 

                                        
                                            
last-modified: Thu, 22 Dec 2022 23:15:28 GMT 

                                        
                                            
etag: "f278c8d30fc51b72e0774b9ecb49214c" 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: VJjFaZfG2-PRLN9WRYWX_2xwDFhBkSZZbj7z1H24L6R0Vp-zJN7YzQ== 

                                        
                                            
age: 47298 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  PNG image data, 142 x 173, 8-bit colormap, non-interlaced\012- data

                                                Size:   2814

                                                Md5:    f278c8d30fc51b72e0774b9ecb49214c

                                                Sha1:   03b574db82b31ee5758eb5093fda8ea25d1b00d8

                                                Sha256: 43f3e6d7e7b011430b39020bc5ff8fe6be2947100c597de44ca549ea96a0fd7c

                                        
                                            GET /push/iPhone14/comment_action_2x.png HTTP/1.1 

                                        
                                            
Host: www.win-now.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://www.win-now.click/push/iPhone14/style.css 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         143.204.55.13

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/png

                                        

                                        
                                            
content-length: 641 

                                        
                                            
last-modified: Thu, 22 Dec 2022 23:15:11 GMT 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
date: Sun, 05 Feb 2023 03:37:35 GMT 

                                        
                                            
etag: "e9b3872b3e63e19728176d45f0aa6986" 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-cache: RefreshHit from cloudfront 

                                        
                                            
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: FNa7OlNXwKaKb7LxeLRauRvOjJDPRdZp9qqRmrxrbjXO5bINtPFnBw== 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  PNG image data, 24 x 120, 8-bit colormap, non-interlaced\012- data

                                                Size:   641

                                                Md5:    e9b3872b3e63e19728176d45f0aa6986

                                                Sha1:   b638f89d5d80c4cd65327da973c52f778e30bd55

                                                Sha256: a3f59e07404f1745bed88a314113a86da376526e7e1e555c99b3e249178c6ba5

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.76.226

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302" 

                                        
                                            
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=12655 

                                        
                                            
Expires: Sun, 05 Feb 2023 07:08:30 GMT 

                                        
                                            
Date: Sun, 05 Feb 2023 03:37:35 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    c14d3cf8ade0150a711f094be32ac474

                                                Sha1:   11e7fb5487d364c5392e1594e09f5b49831043ea

                                                Sha256: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.76.226

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "2A98CE39894B7D9BEFDBA3916467BC95962376D0B308103E0A1EEA36C0BC2302" 

                                        
                                            
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=12655 

                                        
                                            
Expires: Sun, 05 Feb 2023 07:08:30 GMT 

                                        
                                            
Date: Sun, 05 Feb 2023 03:37:35 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    c14d3cf8ade0150a711f094be32ac474

                                                Sha1:   11e7fb5487d364c5392e1594e09f5b49831043ea

                                                Sha256: 2a98ce39894b7d9befdba3916467bc95962376d0b308103e0a1eea36c0bc2302

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff6e4dfe8-8de0-4ffd-85a4-544a7e82f052.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 5652 

                                        
                                            
x-amzn-requestid: a9d8e72b-b943-4c6d-a01c-7b7b65da6ee4 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: fzXDqG-eIAMFbTQ= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-63de054a-778199ce1db9fa1b73a9d4ec;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Sat, 04 Feb 2023 07:12:10 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: CyZUnEQ1l6j1CZCVM63GYbV6mAnhjW3kh4E5M07jH6d3t4mwhSK4hw== 

                                        
                                            
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Sat, 04 Feb 2023 22:04:01 GMT 

                                        
                                            
age: 20014 

                                        
                                            
etag: "29a73442173f75b4f3413e2c6459e8448b1cc33f" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   5652

                                                Md5:    5d907b978dc107f6e95182eee954462a

                                                Sha1:   29a73442173f75b4f3413e2c6459e8448b1cc33f

                                                Sha256: 8268fb8aa86182e7c2113709cce8f559ac8cc831e12cfd7a75c67f30c69808a5

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98423c35-aa11-41c0-8f4f-52bec4c9eaa8.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 9579 

                                        
                                            
x-amzn-requestid: c474008d-a6a9-409b-88e2-c55062044575 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: fzQtnFGhoAMF5Zw= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-63ddfb23-54dd67257ba25ad24e977a9c;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Sat, 04 Feb 2023 06:28:51 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Miss from cloudfront 

                                        
                                            
x-amz-cf-id: 0Of3BK3VqVMGQGDIODQthVmi7BC8Ney4zgGCpVuzYc1j6D8RRP-AxA== 

                                        
                                            
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Sat, 04 Feb 2023 11:55:41 GMT 

                                        
                                            
age: 56514 

                                        
                                            
etag: "59e0b21cdf4cfdac3f1ea05badd007727939ac42" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   9579

                                                Md5:    b3e7140400336984afc6093c1246f863

                                                Sha1:   59e0b21cdf4cfdac3f1ea05badd007727939ac42

                                                Sha256: 4d927e74922159db5d07b9947fa1021cff74bb7b55759960cb3941d05c1e8f11

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3f52758-d976-47aa-a47d-f0d6026514dc.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 7665 

                                        
                                            
x-amzn-requestid: 001ba86d-ebc8-4819-89f7-1604bc059cd8 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: fPGibFeqIAMFqMA= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-63cf8475-076d982b5fccf2b931a05976;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Tue, 24 Jan 2023 07:10:45 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: gnkjykHYcMthJkIb-A1P1rRw9FZieh3TmoTT3qVaceWw03TQNX8qfQ== 

                                        
                                            
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Sat, 04 Feb 2023 22:32:24 GMT 

                                        
                                            
age: 18311 

                                        
                                            
etag: "e5d4cbfc7482d35ee2ca03a7178426f3e2e97010" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   7665

                                                Md5:    f28ffcf384ce958b6302d05b6690c088

                                                Sha1:   e5d4cbfc7482d35ee2ca03a7178426f3e2e97010

                                                Sha256: 725d42a020d496f596074794cc2abdaca8a9b821e1a3502eee26056d0f528506

                                        
                                            GET /push/iPhone14/style.css HTTP/1.1 

                                        
                                            
Host: www.win-now.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: text/css,*/*;q=0.1 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://www.win-now.click/push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e 

                                        
                                            
Sec-Fetch-Dest: style 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         143.204.55.13

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/css

                                        

                                        
                                            
last-modified: Thu, 22 Dec 2022 23:15:29 GMT 

                                        
                                            
server: AmazonS3 

                                        
                                            
content-encoding: br 

                                        
                                            
date: Sun, 05 Feb 2023 03:37:35 GMT 

                                        
                                            
etag: W/"8c24a5cb4c55b9d6cd3029f5fd2c6fe7" 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-cache: RefreshHit from cloudfront 

                                        
                                            
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: _mGnP_HChPnlUOxDaCnNe5Wd5Au34j1aKr6ymlHrz-Id_hpP4rT4gA== 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                        
                                            GET /push/iPhone14/index.html?cep=2Qh964a46BAlFtDEZC8s5W7pGRV4FNQXKJ2Qmf0QojbpHjsP-152jZXDndHPypxrSEwZaY1e92TEKnPnqlUV1njYCt9A60wH9Di6vX-eeNVQfZaBk3ohenZbKkZ6MJZ-NKU6saVhQvTD_xuZrKsctHk7ZBgZctgooQmaXJxJwqbtp3tygyvMBY7eJWeuj0dHnfJXmcb21CfocAVzTQI0c_uZaxlPAUir9_YDkbLDPpBWtcTxKdc9gE_MSeRtizn6zKQ65AeaO0GDhuhgIAWREfmvJBcHqQ8b1D-d6VAB99iN_Y5Ax1nFDEbA4IiHQbn7lo7dgR7J1JvMD90lbnE5jXCCOTQrbzsmvwhwSqYuNnUpiKfIDzylo2qsMPIQvc64&lptoken=160c75ef57e90074522e HTTP/1.1 

                                        
                                            
Host: www.win-now.click

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: none 

                                        
                                            
Sec-Fetch-User: ?1

                                         143.204.55.13

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html

                                        

                                        
                                            
date: Sun, 05 Feb 2023 03:37:34 GMT 

                                        
                                            
last-modified: Thu, 22 Dec 2022 23:15:16 GMT 

                                        
                                            
etag: W/"04857a3eb568b86273b84a464ce9a156" 

                                        
                                            
server: AmazonS3 

                                        
                                            
content-encoding: br 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-cache: Miss from cloudfront 

                                        
                                            
via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront) 

                                        
                                            
x-amz-cf-pop: OSL50-C1 

                                        
                                            
x-amz-cf-id: Ovlcq5OgdC-9Fcqx3RWnDZ66br2baVKl4NwmFuAgstaW1kO0RintAw== 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

URL	phythmspeters.com/70174f76-6107-43d8-aa1f-3b29a8e3f960
IP	18.156.16.63 (Germany)
ASN	#16509 AMAZON-02
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed	2023-02-05 03:37:43 UTC
Status	Loading report..
IDS alerts	0
Blocklist alert	11
urlquery alerts	No alerts detected
Tags	None

Overview

Domain Summary (10)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 18.156.16.63

Last 5 reports on ASN: AMAZON-02

Last 5 reports on domain: phythmspeters.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (15)

Executed Evals (0)

Executed Writes (6)

#1 JavaScript::Write (size: 0) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

#2 JavaScript::Write (size: 16) - SHA256: 9aadd2488ce5ddfe3a65c81d69701ce30005a5bec8103dc07268d737c12f0cfd

#3 JavaScript::Write (size: 16) - SHA256: 40ade2b799e68fdae857abdfe1450045ad6ba8aa5b2b94541d723694a54b40f7

#4 JavaScript::Write (size: 16) - SHA256: ea476c7d4ccccac156c3481a405706925dc6616fc0a7be27fef8cdde2dbc2e79

#5 JavaScript::Write (size: 22) - SHA256: 7d87ff3b0d5fbf3fe9180b790feed6555b27ccc32fcbd34d9403981d6027f852

#6 JavaScript::Write (size: 4) - SHA256: 7477333df7702242f62b0ab29eabf99fe0a1c353b39259216e7098dd9289b2f4

HTTP Transactions (46)

Overview

Domain Summary (10)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 18.156.16.63

Last 5 reports on ASN: AMAZON-02

Last 5 reports on domain: phythmspeters.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (15)

Executed Evals (0)

Executed Writes (6)

#1 JavaScript::Write (size: 0) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

#2 JavaScript::Write (size: 16) - SHA256: 9aadd2488ce5ddfe3a65c81d69701ce30005a5bec8103dc07268d737c12f0cfd

#3 JavaScript::Write (size: 16) - SHA256: 40ade2b799e68fdae857abdfe1450045ad6ba8aa5b2b94541d723694a54b40f7

#4 JavaScript::Write (size: 16) - SHA256: ea476c7d4ccccac156c3481a405706925dc6616fc0a7be27fef8cdde2dbc2e79

#5 JavaScript::Write (size: 22) - SHA256: 7d87ff3b0d5fbf3fe9180b790feed6555b27ccc32fcbd34d9403981d6027f852

#6 JavaScript::Write (size: 4) - SHA256: 7477333df7702242f62b0ab29eabf99fe0a1c353b39259216e7098dd9289b2f4

HTTP Transactions (46)

Network Intrusion Detection Systems