transport20.dedyn.io/
200 OK 5.4 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1843)
Hash 9617e7f9f4357ffed3dae5533f151b79
d4c9d39717a5b50108f15c79c50de059448b8e85
2cb7c2f6801cffc1b000072467253b1c1e95220dc2c27a30422d50fdd4b3bb3f
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET / HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 5444
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b782882bdabaf3b08e64120922b4a4b7
2035ed7fc9fb5b6ee9715601ba43de5f94d0c0e9
3fe7d1a9a55b86ec25d02634749ccfae11f3477033ba8cd7ac4131b7948ba619
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3FE7D1A9A55B86EC25D02634749CCFAE11F3477033BA8CD7AC4131B7948BA619"
Last-Modified: Sat, 07 Jan 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2708
Expires: Mon, 09 Jan 2023 02:25:07 GMT
Date: Mon, 09 Jan 2023 01:39:59 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e4bdd77c0369662aa71ce2d01fd3edab
0ab1c5857e200e7e7946424c2c844537bfbb9775
a163c19fcc8fcf985e8df6ad4bd7ce73912b3df892d8236c70f9bc80820b26da
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A163C19FCC8FCF985E8DF6AD4BD7CE73912B3DF892D8236C70F9BC80820B26DA"
Last-Modified: Fri, 06 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5653
Expires: Mon, 09 Jan 2023 03:14:12 GMT
Date: Mon, 09 Jan 2023 01:39:59 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 09 Jan 2023 00:48:19 GMT
content-type: application/json
age: 3100
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 75f0037a1d53a9a5321a796206ec3e24
70d42c9bf1334f20e1cea4ce3c8212e0e780ee77
80ec1e61f9563e799c9f44ea31e616c37daea1b9670091fbbc6efc39ebafe3d3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "80EC1E61F9563E799C9F44EA31E616C37DAEA1B9670091FBBC6EFC39EBAFE3D3"
Last-Modified: Fri, 06 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3985
Expires: Mon, 09 Jan 2023 02:46:24 GMT
Date: Mon, 09 Jan 2023 01:39:59 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
File type PEM certificate\012- , ASCII text
Hash b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: w7rIAdTfeGBDeYljY+OjfOPtRxEooYQqQNjzuPYS45WZvESjQarOA2rFGjOKJXMK6FLTlgeY1/OEZogeKB92zA==
x-amz-request-id: CXJNAVVTT8VP2V86
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 09 Jan 2023 01:16:00 GMT
age: 1439
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
transport20.dedyn.io/meta/normalize.css
200 OK 2.7 kB URL HTTP/1.1 transport20.dedyn.io/meta/normalize.css
IP
Hash b165f8d0baec3b8976de14634861b941
f7eabfa6844712979ef5e274f275c5be39fdc86f
91404eaa9c2b59e842d6694c3bb2128e21253a1780a4a75e33571ed659bd4d8e
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/normalize.css HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: text/css
Last-Modified: Sun, 08 Jan 2023 22:42:13 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63bb46c5-1e5c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 09 Jan 2023 01:39:59 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash cd1d39135eb079c9842a1696f1c3bacf
ee41d3b22fed5948c20a6d1639b6955a4252fc11
c1f219c13b6c6e622515b78d1549a1dacdc6fab1a2109d540e30d07a52990db5
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:39:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
transport20.dedyn.io/meta/plx.chock.js
200 OK 311 B URL HTTP/1.1 transport20.dedyn.io/meta/plx.chock.js
IP
Hash bc6a4fa1a731b1746c1d21f104bd6064
865b9fd0868954c03f838366eb2449bab5d388d6
d88bca135a10c80b24a4185a4a08f209c151d82c946a9327ef58590fa12e211b
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/plx.chock.js HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Last-Modified: Sun, 08 Jan 2023 22:42:14 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63bb46c6-d41"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash cd1d39135eb079c9842a1696f1c3bacf
ee41d3b22fed5948c20a6d1639b6955a4252fc11
c1f219c13b6c6e622515b78d1549a1dacdc6fab1a2109d540e30d07a52990db5
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:39:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
transport20.dedyn.io/meta/tag.js.download
200 OK 7.5 kB URL HTTP/1.1 transport20.dedyn.io/meta/tag.js.download
IP
File type ASCII text, with very long lines (21652), with no line terminators
Hash 3bdf59c9ec85ec43d46e5cf9edda2e96
a06ccc8d75554a7e44dd8ce9656e90420b42f38b
d964494995ee4b7de40b3569370e33773c447c759a21fbb3e746e53b61449b35
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/tag.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Content-Length: 7541
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:17 GMT
ETag: "5494-5f1c85ce38108-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/webfont.js.download
200 OK 5.4 kB URL HTTP/1.1 transport20.dedyn.io/meta/webfont.js.download
IP
File type ASCII text, with very long lines (2134)
Hash 3fce8a085ab686f338e296d255f36db1
2da74358f4d36675c1bfa6ee5ee489e6e54bf401
9f9bbf22ba311465b6bb4c6944f94e2b97caea58227fafef64cf18b9181099c6
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/webfont.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Content-Length: 5415
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:19 GMT
ETag: "3384-5f1c85cfeb9dc-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/css
200 OK 684 B URL HTTP/1.1 transport20.dedyn.io/meta/css
IP
Hash 147429fb2ddc3861e2ae0f473f17d78e
f2bdce63e15b9f3b90c8c3b153deb75b28eb69e3
25d501d70fcb9835f935fd47e045502700dc5f862cd7e763a49bbc7316396f2a
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/css HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Length: 684
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:05 GMT
ETag: "2ac-5f1c85c24d3fa"
Accept-Ranges: bytes
transport20.dedyn.io/meta/enterprise.js.download
200 OK 614 B URL HTTP/1.1 transport20.dedyn.io/meta/enterprise.js.download
IP
File type ASCII text, with very long lines (1008), with no line terminators
Hash 533554dfe842696d43cbbe1be26c9d4b
4bc96c1c9afdca5fddb20c7b172a13afa5cb46e4
f480ee9ffad021062c3251c62acf39842c0fa7e71c7dccdd91ee30524fccb84d
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/enterprise.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Content-Length: 614
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:05 GMT
ETag: "3f0-5f1c85c2e0b61-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/analytics.js.download
200 OK 20 kB URL HTTP/1.1 transport20.dedyn.io/meta/analytics.js.download
IP
File type ASCII text, with very long lines (1325)
Hash 10a56c6d4548a14f26148658875fad03
6610f39acded54bb7561df9319bd118c46446578
83cac08947ffc888ac5ba674433da3d3b5fda4c988923228ca36aa94b919943b
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/analytics.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Content-Length: 20042
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:03 GMT
ETag: "c41d-5f1c85c0d8329-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/recaptcha__nl.js.download
200 OK 138 kB URL HTTP/1.1 transport20.dedyn.io/meta/recaptcha__nl.js.download
IP
File type ASCII text, with very long lines (820)
Size 138 kB (137504 bytes)
Hash 2128869002ee143c12253efdafd190a4
9781a8b2fa7342367a7ef81a70ad7234ad6505bb
bb787fc0dfa0c02a27b4e75825e9c4e0839637f02fda1b60b645719bbfad663b
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/recaptcha__nl.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:14 GMT
ETag: "56577-5f1c85cb4b085-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/storage.secure.min.js.download
200 OK 13 kB URL HTTP/1.1 transport20.dedyn.io/meta/storage.secure.min.js.download
IP
File type ASCII text, with very long lines (38562), with no line terminators
Hash 79e7d68549291cc082c85f94b73ee13c
e065402b005d2fd7105c9a12adf961a58a4deb96
0adedf6a93b53bc365a213c28a4b10d8af539d8fe55c283cbd3c532a0bc0875a
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/storage.secure.min.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Content-Length: 13194
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:17 GMT
ETag: "96a2-5f1c85cda7881-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/v2.js.download
200 OK 149 kB URL HTTP/1.1 transport20.dedyn.io/meta/v2.js.download
IP
File type ASCII text, with very long lines (65536), with no line terminators
Size 149 kB (148638 bytes)
Hash aabbe994076242a245286bc922bda4e8
d63478266828cbe11bafbf5102dae09818260115
48b39c6f1598c489b94e5d44ddb60514363cd904b3720b6b9730ce276bcf7cba
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/v2.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:18 GMT
ETag: "8d511-5f1c85cf51515-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/webflow.css
200 OK 9.3 kB URL HTTP/1.1 transport20.dedyn.io/meta/webflow.css
IP
File type Unicode text, UTF-8 text, with very long lines (2587)
Hash df537de16df2e7abb3a9474300085194
19823a9c07322292173a31cbb15faed3cb97855a
c808edb13043989f1d4f886fa1f0e1a3aaa472f0d8a229f74429b04c13c08813
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/webflow.css HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: text/css
Last-Modified: Sun, 08 Jan 2023 22:42:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63bb46ca-98c5"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
transport20.dedyn.io/meta/webflow.js.download
200 OK 147 kB URL HTTP/1.1 transport20.dedyn.io/meta/webflow.js.download
IP
File type Unicode text, UTF-8 text, with very long lines (50020)
Size 147 kB (147184 bytes)
Hash c4b0095b01ed8f86df80e43a2b91d041
c79105b1702e8db781c136b44bff3e26ba72cc36
581bfb791a74114e95306054d9668a80143a21e9a41328360503f5b6b09c2a9b
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/webflow.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:19 GMT
ETag: "92c10-5f1c85d05eda1-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
transport20.dedyn.io/meta/jsonp
200 OK 278 kB URL HTTP/1.1 transport20.dedyn.io/meta/jsonp
IP
File type ASCII text, with very long lines (65536), with no line terminators
Size 278 kB (278382 bytes)
Hash 7efac8c0fa8e30db7a423500ef59abab
be73717f776f24dd31498c27a1b02b784570d5bb
102411780270584690575675e14e574ef8a16cf6fdd5700d5682e68a8d2cc00d
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/jsonp HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:39:59 GMT
Content-Length: 278382
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:10 GMT
ETag: "43f6e-5f1c85c7cb83b"
Accept-Ranges: bytes
fonts.googleapis.com/css?family=Changa+One:400,400italic
200 OK 301 B URL HTTP/1.1 fonts.googleapis.com/css?family=Changa+One:400,400italic
IP
Hash 7fb212f619185f162769684274cb1dfe
414b678cfcbcd25c44569e72369a8218bea8756d
d53161ae9523414449dd0f7083f66fda679084bac2cb18a92b884a43616c1fd5
GET /css?family=Changa+One:400,400italic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Mon, 09 Jan 2023 01:39:59 GMT
Date: Mon, 09 Jan 2023 01:39:59 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
fonts.googleapis.com/icon?family=Material+Icons
200 OK 812 B URL HTTP/2 fonts.googleapis.com/icon?family=Material+Icons
IP
Hash 806e6706ad18ef1869fa4348bca2e078
81bccff710af11b89e83829dff0231379fed15ae
7e18350623fd0885e2fc1593fbfed4beddd69f010ef4f4a046d7f9a0d6c31ddb
GET /icon?family=Material+Icons HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Mon, 09 Jan 2023 01:39:59 GMT
date: Mon, 09 Jan 2023 01:39:59 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 54ac41a005cad66e958c904071ea1d4f
66932889be57eb15ab99237a69d292b12090c68d
52545e144a7ca5c37c5369d5f5b566b4e5e820b1920ab7fe8e413e7fe022e21b
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 956
Cache-Control: max-age=114166
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Etag: "63ba87aa-1d7"
Expires: Tue, 10 Jan 2023 09:22:46 GMT
Last-Modified: Sun, 08 Jan 2023 09:06:50 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
200 OK 8.4 kB URL HTTP/1.1 fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 8404, version 1.0\012- data
Hash 141119ae119bf7ca75e10ef82f66e442
adebf435aa078db3c116cb9faae15f2ad81d3ac5
c6afeb967afd466210e4061473c4855684e84b7e850b248c0533e6288acfbaff
GET /s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://transport20.dedyn.io
Connection: keep-alive
Referer: http://fonts.googleapis.com/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 8404
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 07 Jan 2023 18:36:27 GMT
Expires: Sun, 07 Jan 2024 18:36:27 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 21 Apr 2022 17:15:41 GMT
Content-Type: font/woff2
Age: 111813
fonts.gstatic.com/s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
200 OK 7.9 kB URL HTTP/1.1 fonts.gstatic.com/s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 7900, version 1.0\012- data
Hash 61e86e7a20ecf3ba181ca4b9a9a1cdbd
482a65cffc69109af26669d64accbef71db3b836
fbd0536d5b92c0dbe6ad2637800ae8da10c20755b564a3575bd12bba57f73b18
GET /s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://transport20.dedyn.io
Connection: keep-alive
Referer: http://fonts.googleapis.com/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 7900
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 07 Jan 2023 18:36:27 GMT
Expires: Sun, 07 Jan 2024 18:36:27 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 21 Apr 2022 17:15:19 GMT
Content-Type: font/woff2
Age: 111813
transport20.dedyn.io/meta/mm-logo.svg
200 OK 3.4 kB URL HTTP/1.1 transport20.dedyn.io/meta/mm-logo.svg
IP
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1001)
Hash fe5cd5ed43a0fad22921e5ccf7f227e1
700b6b72c9bf320bb0412e17de6d7bc0b8d55888
2043092e404254e6b01d4ba210ae0b703c5364d0c7404c5f0dd4853b58bc2872
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/mm-logo.svg HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: image/svg+xml
Last-Modified: Sun, 08 Jan 2023 22:42:12 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63bb46c4-2ef3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
transport20.dedyn.io/meta/wpp.gif
200 OK 3.9 kB URL HTTP/1.1 transport20.dedyn.io/meta/wpp.gif
IP
File type GIF image data, version 87a, 470 x 40\012- data
Hash 941648b845842a709da73e24652cf8a4
099e5f97e602d026c51537c9b45328dc99261d7c
2a7344e607a878f0acac7f5c9c3a65fc8a4423f00e21d3fb7a814cae051631d9
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/wpp.gif HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: image/gif
Content-Length: 3877
Last-Modified: Sun, 08 Jan 2023 22:42:20 GMT
Connection: keep-alive
ETag: "63bb46cc-f25"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
transport20.dedyn.io/meta/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
200 OK 8.4 kB URL HTTP/1.1 transport20.dedyn.io/meta/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 8364, version 1.0\012- data
Hash 7d2d5a1272e235228039f306a0a45275
5f33ba8abd5506e1c58c3e6771872eaa712ba19f
9c6596dccd4b15e7ab0a21d6b35c75d0f0531d258f342869890165ac974706b3
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2 HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://transport20.dedyn.io/meta/css
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Length: 8364
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:20 GMT
ETag: "20ac-5f1c85d0ea808"
Accept-Ranges: bytes
ocsp.digicert.com/
200 OK 279 B IP
Hash 8c2f2390ca73beb763697115b9a75fca
b680c1631bf2b41de3f8c375861f0478e4609661
f655f1a940ad2bbc0d9115048cb79e488c3131fcba1603fa6f3f0b8ac4cd31e1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5316
Cache-Control: max-age=95496
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Etag: "63ba2db5-117"
Expires: Tue, 10 Jan 2023 04:11:36 GMT
Last-Modified: Sun, 08 Jan 2023 02:43:01 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 279
transport20.dedyn.io/meta/EuclidCircularB-Bold-WebXL.woff2
200 OK 44 kB URL HTTP/1.1 transport20.dedyn.io/meta/EuclidCircularB-Bold-WebXL.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 44544, version 3.66\012- data
Hash 9024d0bf73943172297c4628d0054e20
36c3795e7b297d06589e15ef59592683d9ed0974
88fad87880ae6bb0d733c967419d5f0d68da547a88ad67e7af41f18dae2e20df
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/EuclidCircularB-Bold-WebXL.woff2 HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://transport20.dedyn.io/meta/metamask-staging-2.webflow.css
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Length: 44544
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:05 GMT
ETag: "ae00-5f1c85c307c63"
Accept-Ranges: bytes
transport20.dedyn.io/meta/saved_resource.html
200 OK 10 kB URL HTTP/1.1 transport20.dedyn.io/meta/saved_resource.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (32691)
Hash 6ded262520571cac706ff20889e39148
2d3316b6de0e7aab1ebc0b87a002dc378dfb92d7
acf89c9fb739a4433cf24f93aba185801dd45b7a56190e1851bd3a7a844f05c4
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/saved_resource.html HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: text/html
Last-Modified: Sun, 08 Jan 2023 22:42:15 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63bb46c7-d79f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
transport20.dedyn.io/meta/hero2.4.png
200 OK 590 kB URL HTTP/1.1 transport20.dedyn.io/meta/hero2.4.png
IP
File type PNG image data, 1752 x 1452, 8-bit/color RGBA, non-interlaced\012- data
Size 590 kB (589568 bytes)
Hash d0ec70f4c666fbf6ad0d30a52d08c5c9
e48f0688bc4f592824840478d12c05df0dd12002
3f4bfc7c6cc471e9d95936dc109852c4f6a4bf1163b63eeabfe840565d5ad8d1
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/hero2.4.png HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/meta/metamask-staging-2.webflow.css
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: image/png
Content-Length: 589568
Last-Modified: Sun, 08 Jan 2023 22:42:07 GMT
Connection: keep-alive
ETag: "63bb46bf-8ff00"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
transport20.dedyn.io/meta/EuclidCircularB-Regular-WebXL.woff2
200 OK 45 kB URL HTTP/1.1 transport20.dedyn.io/meta/EuclidCircularB-Regular-WebXL.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 45196, version 3.66\012- data
Hash 2d75957df3bb3aa6ed84f6591b0d5a1a
906424e75625f63b0188471067065794d0348536
8ff3b303322168b49a14878f195dbaf76d9da16e35094d1f83fa23245450155b
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/EuclidCircularB-Regular-WebXL.woff2 HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://transport20.dedyn.io/meta/metamask-staging-2.webflow.css
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Length: 45196
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:06 GMT
ETag: "b08c-5f1c85c386ba9"
Accept-Ranges: bytes
transport20.dedyn.io/meta/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
200 OK 7.9 kB URL HTTP/1.1 transport20.dedyn.io/meta/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 7924, version 1.0\012- data
Hash 8c62104f4329ec3e675fbbf952e5760e
d3acaba572770ca428956ec6be406995e6ee9c0c
e2bce7e3f85456cb30a1803f8f261157ca8922d7e0b1c5baf421d65cfd87619d
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2 HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://transport20.dedyn.io/meta/css
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Length: 7924
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:20 GMT
ETag: "1ef4-5f1c85d0ddce7"
Accept-Ranges: bytes
ocsp.digicert.com/
200 OK 280 B IP
Hash dd21090ff2ae3a8ea3c53a7f8e2a44f2
e0ac1f41140de2c6824dc15b1dc6ab8cbde95720
cceaeec6d68994f4a0ea86c6c233badef127892e9bf06e8f840e146f297297c1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2030
Cache-Control: max-age=118858
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Etag: "63ba95cc-118"
Expires: Tue, 10 Jan 2023 10:40:58 GMT
Last-Modified: Sun, 08 Jan 2023 10:07:08 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 280
transport20.dedyn.io/meta/anchor.html
200 OK 21 kB URL HTTP/1.1 transport20.dedyn.io/meta/anchor.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (33133)
Hash 1637332fad552bd7e6012b16bee6f1b2
6fcc76738c90624cf69dc22c24e1725f158b033e
04a3661e5408084c38e7a1808f4cb39e81147c4e4d460c9eef23aa3f551892c8
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/anchor.html HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: text/html
Last-Modified: Sun, 08 Jan 2023 22:42:04 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63bb46bc-a489"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
transport20.dedyn.io/meta/saved_resource(1).html
200 OK 152 B URL HTTP/1.1 transport20.dedyn.io/meta/saved_resource(1).html
IP
File type HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 09b33fa7a1116338c9b2326b08c03bfe
6d8ee025ab2df83f5765362a1ec59e14541d52d1
324967ab0642b90c52e9aa8b3650961f15deca3a70bc87e55912148740bceef3
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/saved_resource(1).html HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: text/html
Content-Length: 152
Last-Modified: Sun, 08 Jan 2023 22:42:14 GMT
Connection: keep-alive
ETag: "63bb46c6-98"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
ocsp.sectigo.com/
200 OK 471 B IP
Hash ab311b73956a8f1dec4d75090ce73669
cce53d0531c563a1c6b606d1d9b897206d3f19be
ce9b8117b94b70cda6dc2f364fb0e0320a522821fcb80f4fb5267dcae477fb74
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 06 Jan 2023 16:32:00 GMT
Expires: Fri, 13 Jan 2023 16:31:59 GMT
Etag: "cce53d0531c563a1c6b606d1d9b897206d3f19be"
Cache-Control: max-age=398518,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7869765def951c02-OSL
ocsp.digicert.com/
200 OK 279 B IP
Hash 8c2f2390ca73beb763697115b9a75fca
b680c1631bf2b41de3f8c375861f0478e4609661
f655f1a940ad2bbc0d9115048cb79e488c3131fcba1603fa6f3f0b8ac4cd31e1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5316
Cache-Control: max-age=95496
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Etag: "63ba2db5-117"
Expires: Tue, 10 Jan 2023 04:11:36 GMT
Last-Modified: Sun, 08 Jan 2023 02:43:01 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 279
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 3ptkj/7z2KL8xm5LHvK7/w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: Znx2vnODgQnNjPuct5PcTwKvRvc=
ocsp.digicert.com/
200 OK 280 B IP
Hash dd21090ff2ae3a8ea3c53a7f8e2a44f2
e0ac1f41140de2c6824dc15b1dc6ab8cbde95720
cceaeec6d68994f4a0ea86c6c233badef127892e9bf06e8f840e146f297297c1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2030
Cache-Control: max-age=118858
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Etag: "63ba95cc-118"
Expires: Tue, 10 Jan 2023 10:40:58 GMT
Last-Modified: Sun, 08 Jan 2023 10:07:08 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 280
transport20.dedyn.io/meta/styles__ltr.css
200 OK 24 kB URL HTTP/1.1 transport20.dedyn.io/meta/styles__ltr.css
IP
File type ASCII text, with very long lines (52368), with no line terminators
Hash ebdf18f77541c94124d305c6995475cb
7d3de2b58de6e2aeb9ab5a73254829544e7fe24d
db4b6017d7f9a8c675bfa68021f3eeb0246016de004efc8e28a23b97df0da71e
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/styles__ltr.css HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/meta/anchor.html
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: text/css
Last-Modified: Sun, 08 Jan 2023 22:42:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63bb46c9-cc90"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 8b33ebf66adf8ea748d256ed5248639a
54f661bd5cdfe8ec55371d0d7d63437abc1d54b7
d7b4bf07bc0c94009920239a1136dfdafa898ac2efab9d4131e68682f826e76b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/recaptcha/enterprise.js?onload=hsRecaptchaLoadCallback&render=explicit&isolated=true
200 OK 611 B URL HTTP/2 www.google.com/recaptcha/enterprise.js?onload=hsRecaptchaLoadCallback&render=explicit&isolated=true
IP
File type ASCII text, with very long lines (1008), with no line terminators
Hash f83f3c33f8ef2fd235bb823c284b8ea9
da7b9f849a8b6ff52643f7b19cbd83b7bd121f95
923c80a366a4b706e88e039641d959cde663c0e9b5d8f43cc91d0cce0da8498b
GET /recaptcha/enterprise.js?onload=hsRecaptchaLoadCallback&render=explicit&isolated=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Mon, 09 Jan 2023 01:40:00 GMT
date: Mon, 09 Jan 2023 01:40:00 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 611
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash ab311b73956a8f1dec4d75090ce73669
cce53d0531c563a1c6b606d1d9b897206d3f19be
ce9b8117b94b70cda6dc2f364fb0e0320a522821fcb80f4fb5267dcae477fb74
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 06 Jan 2023 16:32:00 GMT
Expires: Fri, 13 Jan 2023 16:31:59 GMT
Etag: "cce53d0531c563a1c6b606d1d9b897206d3f19be"
Cache-Control: max-age=398518,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7869765d9d9eb517-OSL
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 53e4963971e19408d4cf264bd653599d
271fa6d9b5843b97d579a713fbb48b388c61eba0
c3245e3793f7aab542ba2b4b719f5145a45ba29d536456ad629a364ab2df400b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
transport20.dedyn.io/meta/saved_resource(2).html
200 OK 152 B URL HTTP/1.1 transport20.dedyn.io/meta/saved_resource(2).html
IP
File type HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 09b33fa7a1116338c9b2326b08c03bfe
6d8ee025ab2df83f5765362a1ec59e14541d52d1
324967ab0642b90c52e9aa8b3650961f15deca3a70bc87e55912148740bceef3
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/saved_resource(2).html HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/meta/anchor.html
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: text/html
Content-Length: 152
Last-Modified: Sun, 08 Jan 2023 22:42:15 GMT
Connection: keep-alive
ETag: "63bb46c7-98"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
transport20.dedyn.io/meta/js
200 OK 92 kB URL HTTP/1.1 transport20.dedyn.io/meta/js
IP
File type ASCII text, with very long lines (1815)
Hash fb2ab9b8632250b0d7aa50c08150cfe1
73b3f266ac08c9fb07e1de1664fed384ccd5bc86
5d419e0ff614b331e4f8fed2ba7c1380b1f5983f98d820a6a0f7040b55f60b5b
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/js HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Length: 92325
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:09 GMT
ETag: "168a5-5f1c85c6140e7"
Accept-Ranges: bytes
transport20.dedyn.io/meta/jquery-3.5.1.min.dc5e7f18c8.js.download
200 OK 31 kB URL HTTP/1.1 transport20.dedyn.io/meta/jquery-3.5.1.min.dc5e7f18c8.js.download
IP
File type ASCII text, with very long lines (65451)
Hash 888c5fa4504182a0224b264a1fda0e73
65f058a7dead59a8063362241865526eb0148f16
7d757e510b1f0c4d44fd98cc0121da8ca4f44793f8583debdef300fb1dbd3715
Analyzer Verdict Alert urlquery phishing Phishing - Generic Crypto/Wallet
urlquery phishing Phishing - Generic Crypto/Wallet
urlquery suspicious Suspicious - DynDNS domain
GET /meta/jquery-3.5.1.min.dc5e7f18c8.js.download HTTP/1.1
Host: transport20.dedyn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Jan 2023 01:40:00 GMT
Content-Type: application/javascript
Content-Length: 30910
Connection: keep-alive
Last-Modified: Sun, 08 Jan 2023 22:42:08 GMT
ETag: "15d84-5f1c85c579c20-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 67efa309cd1a12359fd7a5f70e366655
85ee5c0f2d9deeacbfe1a38bd18eb724138f066c
6872e796d42a65959b21ea56670a5c11643aa3bc06d51275b68dd3b23b0e1844
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
accdn.lpsnmedia.net/api/account/88982875/configuration/setting/accountproperties/?cb=lpCb37040x36392
200 OK 1.6 kB URL HTTP/2 accdn.lpsnmedia.net/api/account/88982875/configuration/setting/accountproperties/?cb=lpCb37040x36392
IP
Hash 708b16b7ecc9aeca8193a92f36a96554
87875d207ee00907077e004ed45797b1278e44cd
767a9d3f09e4256209e89efe80693491f114fea23430b05dded32dbf89f0b6b8
GET /api/account/88982875/configuration/setting/accountproperties/?cb=lpCb37040x36392 HTTP/1.1
Host: accdn.lpsnmedia.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:00 GMT
content-type: application/javascript
set-cookie: ADRUM_BTa=R:28|g:82895503-744d-46a0-a70f-870d006211d6; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
ADRUM_BTa=R:28|g:82895503-744d-46a0-a70f-870d006211d6|n:livepersonltd_93a08561-b03e-475e-b29b-9ad4aa207daf; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
SameSite=None; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/; Secure
ADRUM_BT1=R:28|i:2241585; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
ADRUM_BT1=R:28|i:2241585|e:19; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
vary: Accept
expires: Mon, 09 Jan 2023 01:41:00 GMT
x-envoy-upstream-service-time: 1
server: ws
strict-transport-security: max-age=99999999999; includeSubDomains
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
x-cache-status: EXPIRED
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 6845714035871de50607bf6185f94f64
c8b0da305ef4c6a587307d87224ce7ae19ac31dc
75d805e1f96447b58ac3f8226c16c4b13d4e664e1e508be26e9968510145017a
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 315edeafe1715f46de7d38be371473a8
25e357166d0ddfff3e60f9042d56f37c1ab7163a
9869582721de4f610dca5030b9a703863d2eae2667061b2f722aebdaf60468e4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 09 Jan 2023 01:40:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
200 OK 165 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
IP
File type ASCII text, with very long lines (658)
Size 165 kB (164706 bytes)
Hash 0b7fccb24ee065a01fdde10928c03c3f
9b198014f81844820588c202cc24bf5e03bf3dd7
68756de8f0d6742525ddaca56ab350e34d822777e86939fea27eb704ae013280
GET /recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://js.hsforms.net
Connection: keep-alive
Referer: https://js.hsforms.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 164706
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 08 Jan 2023 05:56:49 GMT
expires: Mon, 08 Jan 2024 05:56:49 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 15 Dec 2022 05:24:10 GMT
content-type: text/javascript
age: 70991
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js
404 Not Found 1.6 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Hash c90524d6a02b27addb56c350fe6fbb2d
d713d1b53323c0169ffe0649be8c9d04a189f999
4aefd395113d052a874ac1919aed0e288835e0377683f1e71e98838d16c986e0
GET /recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://transport20.dedyn.io
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Mon, 09 Jan 2023 01:40:00 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1621
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 472 B IP
Hash 978413fc7e59d4b216c54b13b812f81a
afa12d331d223f35dcc603f9972b23772df2f987
fc02f08e59e79d05198d55415f9853d3aa0b4e50ff8c0ef4d463ae6a052c66bd
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 01:40:01 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 07 Jan 2023 15:43:23 GMT
Expires: Sat, 14 Jan 2023 15:43:22 GMT
Etag: "afa12d331d223f35dcc603f9972b23772df2f987"
Cache-Control: max-age=482000,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7869766258ab1c02-OSL
ocsp.sectigo.com/
200 OK 472 B IP
Hash 978413fc7e59d4b216c54b13b812f81a
afa12d331d223f35dcc603f9972b23772df2f987
fc02f08e59e79d05198d55415f9853d3aa0b4e50ff8c0ef4d463ae6a052c66bd
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Jan 2023 01:40:01 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sat, 07 Jan 2023 15:43:23 GMT
Expires: Sat, 14 Jan 2023 15:43:22 GMT
Etag: "afa12d331d223f35dcc603f9972b23772df2f987"
Cache-Control: max-age=482000,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 78697662682cb517-OSL
lptag.liveperson.net/tag/tag.js?site=88982875
200 OK 7.6 kB URL HTTP/2 lptag.liveperson.net/tag/tag.js?site=88982875
IP
File type ASCII text, with very long lines (21652), with no line terminators
Hash 6b675640425ec8551a433e26a377d954
7234f02cce1ccb2a4facf2b34b9185cfcf27299d
8c9716f14d2e964be7c93d3d8c28819cb35c529fce6206a79061cda509e05bfd
GET /tag/tag.js?site=88982875 HTTP/1.1
Host: lptag.liveperson.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:01 GMT
content-type: application/javascript
content-length: 7567
last-modified: Thu, 03 Sep 2020 08:27:49 GMT
etag: "5f50a905-1d8f"
content-encoding: gzip
server: ws
strict-transport-security: max-age=300; includeSubDomains
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
cache-control: public, max-age=630
x-content-type-options: nosniff
X-Firefox-Spdy: h2
metamask.io/images/webclip.png
404 Not Found 16 kB URL HTTP/2 metamask.io/images/webclip.png
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (33631)
Hash 6858b97b75f93c11e7de01a0f033efa2
0b63471d2407d556e31a92e0cd826d106dc2341e
1aa269dd1dd57f23a80c69e26c63bb184ce29ea49f42f9d4324dcf250751f1f8
GET /images/webclip.png HTTP/1.1
Host: metamask.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
server: GitHub.com
content-type: text/html; charset=utf-8
x-origin-cache: HIT
access-control-allow-origin: *
etag: W/"63b859d6-114dd"
content-encoding: gzip
x-proxy-cache: MISS
x-github-request-id: 44AA:A24C:228DFDA:24134B7:63BB7071
accept-ranges: bytes
date: Mon, 09 Jan 2023 01:40:01 GMT
via: 1.1 varnish
age: 0
x-served-by: cache-bma1660-BMA
x-cache: MISS
x-cache-hits: 0
x-timer: S1673228401.996217,VS0,VE113
vary: Accept-Encoding
x-fastly-request-id: b2191fca9dcba047c247f395383940b84a92fbfe
content-length: 15765
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/1.1 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Hash 285467176f7fe6bb6a9c6873b3dad2cc
ea04e4ff5142ddd69307c183def721a160e0a64e
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://transport20.dedyn.io
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15552
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 07 Jan 2023 18:24:31 GMT
Expires: Sun, 07 Jan 2024 18:24:31 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Mon, 16 Oct 2017 17:33:02 GMT
Content-Type: font/woff2
Age: 112530
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL HTTP/1.1 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://transport20.dedyn.io
Connection: keep-alive
Referer: http://transport20.dedyn.io/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15344
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 06 Jan 2023 13:38:39 GMT
Expires: Sat, 06 Jan 2024 13:38:39 GMT
Cache-Control: public, max-age=31536000
Age: 216082
Last-Modified: Mon, 16 Oct 2017 17:32:55 GMT
Content-Type: font/woff2
metamask.io/images/favicon.png
404 Not Found 16 kB URL HTTP/2 metamask.io/images/favicon.png
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (33631)
Hash 6858b97b75f93c11e7de01a0f033efa2
0b63471d2407d556e31a92e0cd826d106dc2341e
1aa269dd1dd57f23a80c69e26c63bb184ce29ea49f42f9d4324dcf250751f1f8
GET /images/favicon.png HTTP/1.1
Host: metamask.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
server: GitHub.com
content-type: text/html; charset=utf-8
x-origin-cache: HIT
access-control-allow-origin: *
etag: W/"63b859d6-114dd"
content-encoding: gzip
x-proxy-cache: MISS
x-github-request-id: EAAA:A24C:228DFDA:24134B8:63BB7071
accept-ranges: bytes
date: Mon, 09 Jan 2023 01:40:01 GMT
via: 1.1 varnish
age: 0
x-served-by: cache-bma1660-BMA
x-cache: MISS
x-cache-hits: 0
x-timer: S1673228401.997629,VS0,VE115
vary: Accept-Encoding
x-fastly-request-id: 3b8539ef9ff1fb693592db15b08975f2d1c3a490
content-length: 15765
X-Firefox-Spdy: h2
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
200 OK 24 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css
IP
File type ASCII text, with very long lines (52913), with no line terminators
Hash f4bb161deae4e93f1a82e52f82ea2af9
74cd72b02999ea35cde6dd6c1d58ca9aec94da07
3330fe65fd8dbe742211f1609fbfe70b3b94434ad5639223942d921f085ea589
GET /recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/styles__ltr.css HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 24262
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 07 Jan 2023 07:49:35 GMT
expires: Sun, 07 Jan 2024 07:49:35 GMT
cache-control: public, max-age=31536000
age: 150626
last-modified: Thu, 15 Dec 2022 05:24:10 GMT
content-type: text/css
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
200 OK 165 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
IP
File type ASCII text, with very long lines (658)
Size 165 kB (164706 bytes)
Hash 0b7fccb24ee065a01fdde10928c03c3f
9b198014f81844820588c202cc24bf5e03bf3dd7
68756de8f0d6742525ddaca56ab350e34d822777e86939fea27eb704ae013280
GET /recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 164706
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 08 Jan 2023 05:56:49 GMT
expires: Mon, 08 Jan 2024 05:56:49 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 15 Dec 2022 05:24:10 GMT
content-type: text/javascript
age: 70992
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 11aea3c23fce2f77cadf7a551f4e8b17
4963aafedcf3fc5f28f1b4a6b0212abfd5526702
d2ada7d592878b58921cd0568efa62abefd7423d40bec16133886e2c67a791b3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D2ADA7D592878B58921CD0568EFA62ABEFD7423D40BEC16133886E2C67A791B3"
Last-Modified: Fri, 06 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5363
Expires: Mon, 09 Jan 2023 03:09:24 GMT
Date: Mon, 09 Jan 2023 01:40:01 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 11aea3c23fce2f77cadf7a551f4e8b17
4963aafedcf3fc5f28f1b4a6b0212abfd5526702
d2ada7d592878b58921cd0568efa62abefd7423d40bec16133886e2c67a791b3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D2ADA7D592878B58921CD0568EFA62ABEFD7423D40BEC16133886E2C67A791B3"
Last-Modified: Fri, 06 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5363
Expires: Mon, 09 Jan 2023 03:09:24 GMT
Date: Mon, 09 Jan 2023 01:40:01 GMT
Connection: keep-alive
lpcdn.lpsnmedia.net/le_secure_storage/3.15.0.0-release_5063/storage.secure.min.js?loc=http%3A%2F%2Ftransport20.dedyn.io&site=88982875&force=1&env=prod&isCrossDomain=true
200 OK 15 kB URL HTTP/2 lpcdn.lpsnmedia.net/le_secure_storage/3.15.0.0-release_5063/storage.secure.min.js?loc=http%3A%2F%2Ftransport20.dedyn.io&site=88982875&force=1&env=prod&isCrossDomain=true
IP
Hash a28d9079458217f08aeed2c8ead2ddac
6cbad7d8303585cbceefd105f4a5ad8778ae3df2
06c984ff32336e734a4370651cb0a2aa26b0655b44496e5193c1d2b2f56e8d2a
GET /le_secure_storage/3.15.0.0-release_5063/storage.secure.min.js?loc=http%3A%2F%2Ftransport20.dedyn.io&site=88982875&force=1&env=prod&isCrossDomain=true HTTP/1.1
Host: lpcdn.lpsnmedia.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:01 GMT
content-type: application/javascript
last-modified: Fri, 05 Nov 2021 13:34:15 GMT
content-encoding: gzip
server: ws
vary: Origin
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options, x-lp-state-rev
access-control-allow-credentials: true
expires: Tue, 09 Jan 2024 01:40:01 GMT
cache-control: max-age=31536000
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cache-status: HIT
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 11aea3c23fce2f77cadf7a551f4e8b17
4963aafedcf3fc5f28f1b4a6b0212abfd5526702
d2ada7d592878b58921cd0568efa62abefd7423d40bec16133886e2c67a791b3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D2ADA7D592878B58921CD0568EFA62ABEFD7423D40BEC16133886E2C67A791B3"
Last-Modified: Fri, 06 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5363
Expires: Mon, 09 Jan 2023 03:09:24 GMT
Date: Mon, 09 Jan 2023 01:40:01 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 11aea3c23fce2f77cadf7a551f4e8b17
4963aafedcf3fc5f28f1b4a6b0212abfd5526702
d2ada7d592878b58921cd0568efa62abefd7423d40bec16133886e2c67a791b3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D2ADA7D592878B58921CD0568EFA62ABEFD7423D40BEC16133886E2C67A791B3"
Last-Modified: Fri, 06 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5363
Expires: Mon, 09 Jan 2023 03:09:24 GMT
Date: Mon, 09 Jan 2023 01:40:01 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb780c628-61fd-4fd9-82e0-dcc9f46f2fbc.jpeg
200 OK 8.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb780c628-61fd-4fd9-82e0-dcc9f46f2fbc.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2c43f2737df165a6165e8144c166de41
edbb7cd5b56b432015e258f0f1706af5667c1c28
836b2034c298d023d56354f64d4dad01c3249688236238536a049464e7a66efe
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb780c628-61fd-4fd9-82e0-dcc9f46f2fbc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8605
x-amzn-requestid: 7c516524-fbcf-418a-a81a-b3a6ea013575
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eABmyGY1oAMFa1g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63afe2f8-62a15ac4048c099d1a949381;Sampled=0
x-amzn-remapped-date: Sat, 31 Dec 2022 07:21:28 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: mwXlUVYcanixqp9NTwsEIFr455BJwVYJ4KB-OkpDK9yHIBFWLrDHfA==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 f268a165a18929fd0a24a3189fbd16b2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 08 Jan 2023 12:57:47 GMT
age: 45734
etag: "edbb7cd5b56b432015e258f0f1706af5667c1c28"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
lptag.liveperson.net/lptag/api/account/88982875/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=3
200 OK 110 kB URL HTTP/2 lptag.liveperson.net/lptag/api/account/88982875/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=3
IP
Size 110 kB (109857 bytes)
Hash 9cfc9e5a1a68dd27f94cb8fc92d12758
4cb46fb6817d1c4ef7d6ed086ef3608b8b06875c
4f69db62dc6406774ee519d5d1415762561f99c6a45460713e9f6f0933d68358
GET /lptag/api/account/88982875/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=3 HTTP/1.1
Host: lptag.liveperson.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:01 GMT
content-type: application/x-javascript
set-cookie: ADRUM_BTa=R:28|g:cab990fc-bd70-478e-8d0e-4c23e1fcb811; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
ADRUM_BTa=R:28|g:cab990fc-bd70-478e-8d0e-4c23e1fcb811|n:livepersonltd_93a08561-b03e-475e-b29b-9ad4aa207daf; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
SameSite=None; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/; Secure
ADRUM_BT1=R:28|i:1758155; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
ADRUM_BT1=R:28|i:1758155|e:2; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
ADRUM_BT1=R:28|i:1758155|e:2|d:2; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
cache-control: public, max-age=630
server: ws
strict-transport-security: max-age=300; includeSubDomains
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
x-cache-status: MISS
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb55a25ad-9b4d-40f6-a8fb-7f261c831add.jpeg
200 OK 5.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb55a25ad-9b4d-40f6-a8fb-7f261c831add.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d2a46a024ff966cc84a340920f491f61
b322aa32860ae543c3c4f30ff384ee9976b93cf9
8a2b925ff56cb27d808d90c3aa266d631e03374a0e99e15cdaa455c78f121a92
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb55a25ad-9b4d-40f6-a8fb-7f261c831add.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5456
x-amzn-requestid: acda35d7-c7e1-4a47-9ef3-77f13896a98f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eJ4DvEKroAMFYQw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b3d3b1-66f2b8ae3bb257a65bcccced;Sampled=0
x-amzn-remapped-date: Tue, 03 Jan 2023 07:05:21 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: E1166fs2lzPX1smDIyLIaDQMldYIOc-VP71vrLWtPB9M9NA85DLvMw==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Sun, 08 Jan 2023 11:03:45 GMT
age: 52576
etag: "b322aa32860ae543c3c4f30ff384ee9976b93cf9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37629fba-d878-4757-bbb5-ec6764ae2a28.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37629fba-d878-4757-bbb5-ec6764ae2a28.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 97daf64b02d7b3d266c7cd921d0684f7
74fa41865d65ef95126bcb1072bbf578bda031b0
bcaaf9e89d8af2bbddd4c000cd2facfadebce0cffb119b7583823190c5cb009e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F37629fba-d878-4757-bbb5-ec6764ae2a28.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10768
x-amzn-requestid: 321c3466-ab77-4fff-a022-436634c89dad
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ecWFvEXAoAMFltg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63bb36f1-55e48ac47077b4a270456423;Sampled=0
x-amzn-remapped-date: Sun, 08 Jan 2023 21:34:41 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: D4QpQCBbnVW8D75nMf2W8M509tXVP0asUWgUbq0LsKMJzxr-cpWbGw==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 08 Jan 2023 21:40:49 GMT
etag: "74fa41865d65ef95126bcb1072bbf578bda031b0"
content-type: image/jpeg
age: 14352
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f66a423-2d06-442e-9b60-52f1638487d5.jpeg
200 OK 4.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f66a423-2d06-442e-9b60-52f1638487d5.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f0defc5fd929d3ca7df12b102b551453
f44e4ac4a10991e12994e3b5d6f3cc1b1658967a
f551a1c156ec30405668d66bff9e1359805b773457602e44748be80cbb1f8a23
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0f66a423-2d06-442e-9b60-52f1638487d5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4687
x-amzn-requestid: 18bf71d4-030e-4a08-ae18-48fe037e6e0d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eWhZ7GzXIAMFnFQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b8e2a5-710f414a2d1b239f6d59d73a;Sampled=0
x-amzn-remapped-date: Sat, 07 Jan 2023 03:10:29 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: C8ZiSJKX_-UclWkXBCthZuyTXf_ELYlRKDIELPhGuS9byPC3SKrMhg==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 a9e73292d0b92053c3e38dcec15fd0e2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 08 Jan 2023 03:29:04 GMT
age: 79857
etag: "f44e4ac4a10991e12994e3b5d6f3cc1b1658967a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3da56b86-257e-4200-9c4e-d78ca75d157a.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3da56b86-257e-4200-9c4e-d78ca75d157a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 05c925afd89f8c0dd28b53c14962f226
52330772956e0f43c5547af9ba001fd11e97e7a7
085b951245d279ef8722476a94c6217aa5806b35a133c3b2e97bc631529ed515
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3da56b86-257e-4200-9c4e-d78ca75d157a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7391
x-amzn-requestid: 30586447-c1cd-4865-aee3-9cc3326268e9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eWhuGGZsoAMFl4w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b8e326-5b9b050a19f5fcdc578a78fc;Sampled=0
x-amzn-remapped-date: Sat, 07 Jan 2023 03:12:38 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: sfWW94XIo92bKb3Cu-MHbEY8y2z2fGVcQMgCUO8vdsOCZLE4PCBfPQ==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 50faaaa196a6b0875217ef7827f97d7c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 08 Jan 2023 03:31:56 GMT
age: 79685
etag: "52330772956e0f43c5547af9ba001fd11e97e7a7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 05 Jan 2023 21:48:03 GMT
expires: Fri, 05 Jan 2024 21:48:03 GMT
cache-control: public, max-age=31536000
age: 273119
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Hash 285467176f7fe6bb6a9c6873b3dad2cc
ea04e4ff5142ddd69307c183def721a160e0a64e
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 05 Jan 2023 16:40:43 GMT
expires: Fri, 05 Jan 2024 16:40:43 GMT
cache-control: public, max-age=31536000
age: 291559
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15340, version 1.0\012- data
Hash 19b7a0adfdd4f808b53af7e2ce2ad4e5
81d5d4c7b5035ad10cce63cf7100295e0c51fdda
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
GET /s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15340
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 04 Jan 2023 04:50:13 GMT
expires: Thu, 04 Jan 2024 04:50:13 GMT
cache-control: public, max-age=31536000
age: 420589
last-modified: Mon, 16 Oct 2017 17:33:16 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
js.hsforms.net/forms/v2.js
200 OK 0 B URL HTTP/2 js.hsforms.net/forms/v2.js
IP
GET /forms/v2.js HTTP/1.1
Host: js.hsforms.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:00 GMT
content-type: application/javascript; charset=utf-8
x-amz-replication-status: PENDING
last-modified: Fri, 06 Jan 2023 04:42:24 UTC
etag: W/"e360e1158f52f8dae1b666e06264b2f4"
x-amz-server-side-encryption: AES256
x-amz-version-id: H5wf0QzkE6qTPOOG_xpsgGwnXBeQGfnX
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 05133180bbd1649d4b8f97441bf305e8.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P3
x-amz-cf-id: iL8UUKf9B6he9erOu18naR8qDm2dw9-yd3eEu4TyVJQs5lGU3xVX8w==
cache-control: s-maxage=600, max-age=300
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2549/bundles/project-v2.js&cfRay=7855ee162b88abcf-IAD
x-hs-target-asset: forms-embed/static-1.2549/bundles/project-v2.js
access-control-allow-origin: *
x-hs-cache-status: HIT
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
cf-cache-status: HIT
age: 346
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5yPzaIXL3Y6n2abYoIifOjoH9Tat1TWo11l8bR7wKHXqHh84n18GeZWXkyrnFNj5D10lt6Y%2FwyMRgTrMGYilcZXfNEd7D5RnYN6CQPaN5u5DIdlWvbgOSZDeEwkqKRJW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7869765e0c11b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
va.v.liveperson.net/api/js/88982875?&cb=lpCb34220x85502&t=sp&ts=1673228389564&pid=5801140962&tid=3887298281&pt=MetaMask%20-%20A%20crypto%20wallet%20%26%20gateway%20to%20blockchain%20apps&u=http%3A%2F%2Ftransport20.dedyn.io%2F&df=0&os=0&identities=%5B%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
200 OK 0 B URL HTTP/2 va.v.liveperson.net/api/js/88982875?&cb=lpCb34220x85502&t=sp&ts=1673228389564&pid=5801140962&tid=3887298281&pt=MetaMask%20-%20A%20crypto%20wallet%20%26%20gateway%20to%20blockchain%20apps&u=http%3A%2F%2Ftransport20.dedyn.io%2F&df=0&os=0&identities=%5B%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
IP
GET /api/js/88982875?&cb=lpCb34220x85502&t=sp&ts=1673228389564&pid=5801140962&tid=3887298281&pt=MetaMask%20-%20A%20crypto%20wallet%20%26%20gateway%20to%20blockchain%20apps&u=http%3A%2F%2Ftransport20.dedyn.io%2F&df=0&os=0&identities=%5B%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D HTTP/1.1
Host: va.v.liveperson.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:02 GMT
content-type: application/javascript
set-cookie: LPVisitorID=RmZGZhMDNlYmQzNDRmMzA5; Expires=Tue, 09-Jan-2024 01:40:02 GMT; Path=/; HttpOnly
LPSessionID=5c0VL1jcS2uJzk-LfndvJw; Path=/api/js/88982875; HttpOnly
cache-control: no-store
server: ws
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
content-encoding: gzip
X-Firefox-Spdy: h2
accdn.lpsnmedia.net/api/account/88982875/configuration/domainprotection/refererrestrictions?cb=lpCb98396x25417
200 OK 0 B URL HTTP/2 accdn.lpsnmedia.net/api/account/88982875/configuration/domainprotection/refererrestrictions?cb=lpCb98396x25417
IP
GET /api/account/88982875/configuration/domainprotection/refererrestrictions?cb=lpCb98396x25417 HTTP/1.1
Host: accdn.lpsnmedia.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://lpcdn.lpsnmedia.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
TE: trailers
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:01 GMT
content-type: application/javascript
set-cookie: ADRUM_BTa=R:28|g:a5d75a73-3044-4c9c-8f0e-21b68ebae183; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
ADRUM_BTa=R:28|g:a5d75a73-3044-4c9c-8f0e-21b68ebae183|n:livepersonltd_93a08561-b03e-475e-b29b-9ad4aa207daf; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
SameSite=None; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/; Secure
ADRUM_BT1=R:28|i:2241585; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
ADRUM_BT1=R:28|i:2241585|e:10; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:31 GMT; Path=/
cache-control: no-store
x-envoy-upstream-service-time: 110
server: ws
strict-transport-security: max-age=99999999999; includeSubDomains
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
x-cache-status: MISS
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
va.v.liveperson.net/api/js/88982875?sid=oH2Qhzs8QzCWPk58eMieCA&cb=lpCb50195x86975&t=ip&ts=1639498872221&pid=8378416840&tid=120975428&vid=E1ZmVlMDY2Mjk2ZDhiZDg5
200 OK 0 B URL HTTP/2 va.v.liveperson.net/api/js/88982875?sid=oH2Qhzs8QzCWPk58eMieCA&cb=lpCb50195x86975&t=ip&ts=1639498872221&pid=8378416840&tid=120975428&vid=E1ZmVlMDY2Mjk2ZDhiZDg5
IP
GET /api/js/88982875?sid=oH2Qhzs8QzCWPk58eMieCA&cb=lpCb50195x86975&t=ip&ts=1639498872221&pid=8378416840&tid=120975428&vid=E1ZmVlMDY2Mjk2ZDhiZDg5 HTTP/1.1
Host: va.v.liveperson.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:00 GMT
content-type: application/javascript
cache-control: no-store
server: ws
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
content-encoding: gzip
X-Firefox-Spdy: h2
accdn.lpsnmedia.net/api/account/88982875/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB
200 OK 0 B URL HTTP/2 accdn.lpsnmedia.net/api/account/88982875/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB
IP
GET /api/account/88982875/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB HTTP/1.1
Host: accdn.lpsnmedia.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:00 GMT
content-type: application/javascript
set-cookie: ADRUM_BTa=R:28|g:02a340ca-032a-42ff-847b-d08b46aee707; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
ADRUM_BTa=R:28|g:02a340ca-032a-42ff-847b-d08b46aee707|n:livepersonltd_93a08561-b03e-475e-b29b-9ad4aa207daf; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
SameSite=None; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/; Secure
ADRUM_BT1=R:28|i:2241585; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
ADRUM_BT1=R:28|i:2241585|e:16; Max-Age=30; Expires=Mon, 09-Jan-2023 01:40:30 GMT; Path=/
vary: Accept
expires: Mon, 09 Jan 2023 01:41:00 GMT
x-envoy-upstream-service-time: 1
server: ws
strict-transport-security: max-age=99999999999; includeSubDomains
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
x-cache-status: EXPIRED
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
lpcdn.lpsnmedia.net/le_secure_storage/3.15.0.0-release_5063/storage.secure.min.html?loc=http%3A%2F%2Ftransport20.dedyn.io&site=88982875&env=prod&isCrossDomain=true
200 OK 0 B URL HTTP/2 lpcdn.lpsnmedia.net/le_secure_storage/3.15.0.0-release_5063/storage.secure.min.html?loc=http%3A%2F%2Ftransport20.dedyn.io&site=88982875&env=prod&isCrossDomain=true
IP
GET /le_secure_storage/3.15.0.0-release_5063/storage.secure.min.html?loc=http%3A%2F%2Ftransport20.dedyn.io&site=88982875&env=prod&isCrossDomain=true HTTP/1.1
Host: lpcdn.lpsnmedia.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:01 GMT
content-type: text/html
last-modified: Fri, 05 Nov 2021 13:34:15 GMT
content-encoding: gzip
server: ws
vary: Origin
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options, x-lp-state-rev
access-control-allow-credentials: true
expires: Tue, 09 Jan 2024 01:40:01 GMT
cache-control: max-age=31536000
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-cache-status: HIT
X-Firefox-Spdy: h2
forms.hsforms.com/embed/v3/form/4795067/2b64112b-f442-4840-9ace-b11dccd5f744?callback=hs_reqwest_0&hutk=
200 OK 0 B URL HTTP/2 forms.hsforms.com/embed/v3/form/4795067/2b64112b-f442-4840-9ace-b11dccd5f744?callback=hs_reqwest_0&hutk=
IP
GET /embed/v3/form/4795067/2b64112b-f442-4840-9ace-b11dccd5f744?callback=hs_reqwest_0&hutk= HTTP/1.1
Host: forms.hsforms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://transport20.dedyn.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 09 Jan 2023 01:40:00 GMT
content-type: application/javascript;charset=utf-8
x-trace: 2B58F26403BD5C50CEED93A306807C64887F3822C5000000000000000000
x-origin-hublet: na1
vary: origin
x-hubspot-correlation-id: 5ff65086-a601-4db6-873b-148474fc2a65
content-disposition: attachment; filename=no-rfd.txt
x-content-type-options: nosniff
access-control-allow-credentials: false
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7869765d5d680b65-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
195.133.40.207
104.17.183.73
208.89.12.87
178.249.101.23
23.36.77.32