Report - dratingmaject.com/f9afda66-0e59-41e9-8746-dab6f4d69019

Report Overview

Submitted URL
dratingmaject.com/f9afda66-0e59-41e9-8746-dab6f4d69019
IP
18.195.149.11
ASN
#16509 AMAZON-02
Submitted
2022-11-26 23:11:50
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
deefauph.com	135892	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	493 B	304 B	139.45.197.251
dratingmaject.com	821761	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.4 kB	4.8 kB	18.195.149.11
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
fonts.gstatic.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	485 B	17 kB	216.58.207.195
fonts.googleapis.com	8877	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	459 B	18 kB	142.250.74.10
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	54.191.210.155
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.8 kB	60 kB	34.120.237.76
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	7.1 kB	23.36.77.32
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.4 kB	2.7 kB	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.9 kB	34.160.144.191
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	3.5 kB	142.250.74.35
babesroulette.com	281754	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	954 B	650 B	104.21.72.186

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-11-26	medium	dratingmaject.com/f9afda66-0e59-41e9-8746-dab6f4d69019	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa	660 B	2023-03-07	2023-04-05
Pretty URL babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa IP 104.21.72.186 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:00 Last Seen2023-04-05 01:55:44 Times Seen17 Hash 97441e7379ca32ad9f6044c50451ff13 80fb696604e2b6e293615725845d9642cc4171d7 976578c853ded099ba704b2fda49934f67dbbb03e53d81b589d332ffaa543fdc Loading...

	babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa	1.4 kB	2023-03-07	2023-04-05
Pretty URL babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa IP 104.21.72.186 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:00 Last Seen2023-04-05 01:55:44 Times Seen17 Hash 8d9b1690a74f07a3810d671b838dd1bd 636798778433d0449d1a29d4a1dbdd1a23af8c46 185faac7437690399b751628e681b202ceb6f5dc205874483379a82cddd2e737 Loading...

	dratingmaject.com/d/.js?lpref=&lpurl=https%3A%2F%2Fbabesroulette.com%2Flanders%2F18c%2F%3Fclickid%3Dwkb453u0akorrnokibs80dhg%26source%3Df9afda66-0e59-41e9-8746-dab6f4d69019%26cep%3DVk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug%26lptoken%3D1647698950c160b398aa&lpt=Title%20here&t=1669504299485	3.0 kB	2023-03-11	2023-03-11
Pretty URL dratingmaject.com/d/.js?lpref=&lpurl=https%3A%2F%2Fbabesroulette.com%2Flanders%2F18c%2F%3Fclickid%3Dwkb453u0akorrnokibs80dhg%26source%3Df9afda66-0e59-41e9-8746-dab6f4d69019%26cep%3DVk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug%26lptoken%3D1647698950c160b398aa&lpt=Title%20here&t=1669504299485 IP 18.195.149.11 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 21:00:49 Last Seen2023-03-11 21:00:49 Times Seen1 Hash aab5304450651c98750d13421136cb70 0b6d4a5647be7ac85c2cd9e5d6e6ea2be2c6d7f4 8799f7728b3ff1976ae6849efbb6faecb92d98d3af9ac390b28e10aeb647b34f Loading...

	deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=wkb453u0akorrnokibs80dhg&var=f9afda66-0e59-41e9-8746-dab6f4d69019&sw=/sw-check-permissions-2e801.js	78 kB	2023-03-09	2023-03-17
Pretty URL deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=wkb453u0akorrnokibs80dhg&var=f9afda66-0e59-41e9-8746-dab6f4d69019&sw=/sw-check-permissions-2e801.js IP 139.45.197.251 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 23:03:50 Last Seen2023-03-17 22:46:33 Times Seen1 Hash 2ff31a855f49b8556bc52e2c0e4742c4 6e4a4532a83fa78fff0719b7e13f644fb842dc68 46c4d68f925af64956704d5ff2389c648fba60ac4baaf1963624e84abd4b6c1f Loading...

	babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa	102 B	2023-03-11	2023-03-11
Pretty URL babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa IP 104.21.72.186 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 21:00:49 Last Seen2023-03-11 21:00:49 Times Seen1 Hash 8a05bbea602e00bc7dfcb96bc4cb6a97 5a06b205174e7561e3e4ec016507d4696a2a96f2 9d7a3e67197b63cab4b54e3748ee1927a474ce8018c79bcb5c8deaf44f18dad3 Loading...

		Size	First Seen	Last Seen
	#1 Eval - b175f701779df0bcc418cfadf9f23ffc	79 B	2023-03-11	2023-03-11
Pretty Observations First Seen2023-03-11 21:00:49 Last Seen2023-03-11 21:00:49 Times Seen1 Hash b175f701779df0bcc418cfadf9f23ffc 7dcac7238d0c653f1d2278afbd1c7db3ad2b4763 61502a7088fc855f7c16d3d720def8c27d6f83a50a2c50f6683b19e8a4a2c090 Loading...

HTTP Transactions (35)

URL IP Response Size

dratingmaject.com/f9afda66-0e59-41e9-8746-dab6f4d69019

18.195.149.11

302

0 B

URL HTTP/1.1
dratingmaject.com/f9afda66-0e59-41e9-8746-dab6f4d69019
IP
18.195.149.11:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /f9afda66-0e59-41e9-8746-dab6f4d69019 HTTP/1.1
Host: dratingmaject.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 
Server: nginx
Date: Sat, 26 Nov 2022 23:11:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa
Pragma: no-cache
Set-Cookie: f9afda66-0e59-41e9-8746-dab6f4d69019-v4=qlXDtnqpvd0kmcqeqMmdasLMhwL8EJmpABrzXBeIMfU; Max-Age=86400; Expires=Sun, 27-Nov-2022 23:11:38 GMT; Domain=dratingmaject.com; Path=/; HttpOnly
cep-v4=PDtSHVeC6WlZ80m8w4YnB4O8ffXBqhW1Zc2S7Cdw2D50dkO5w81iiWdiLz602HN1efEY5S4Wp4APhygRcjSF5aV3PDpxdkWE_ynYH1NJsBL2ol04L58UA6NdCSrecGwNPSiExzMYfQBKkyyn3AoV8qPGzt5WVP4LF2JPK-No3vIkRJc_2zRQGPAEEgBCTm1XawYwlUBNSeWCNN0X93n1KJQBDHZYLTxvBMMLeNfnW32ccTvpDtqO3B51H9O4Ks3TeUBQn2wzLhPz2xIkg2WYQZO-X059LElQlFYWq3YvBSECtL4jwqENgz2iaEv241TQ2gBSj1ia35sIcdTCJixEsBxPta_T9TOVQke6w0EIUNYhOgnfXyEMsugb26IdxnBv; Max-Age=86400; Expires=Sun, 27-Nov-2022 23:11:38 GMT; Domain=dratingmaject.com; Path=/; HttpOnly

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a9f1d4d98705c281fed3b60343463200
db6f8aa98d2eda4e5473b116a222c3055568bb78
164d11173045b569cafb32e300e4c1ec6d6ab177fd34d0414cc40c541268779f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "164D11173045B569CAFB32E300E4C1EC6D6AB177FD34D0414CC40C541268779F"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3635
Expires: Sun, 27 Nov 2022 00:12:14 GMT
Date: Sat, 26 Nov 2022 23:11:39 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
15b59d5e62caedb4bec3ba6724906c1e
960f801e608a56fdd11449f4face29f62cad2b21
8c72a45737c2eeddf328b0ed3236f3243551d904e94ec9dd7254972ebfb9229e

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 948
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Last-Modified: Sat, 26 Nov 2022 22:55:51 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 471

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
4d7e4eed097b9c4e5d509419f1cfc85a
290bb3d428a7c6330e2e3d73a952b16f820896c8
0dc9ca0f57af15adcd416035e92794711434e3d53a1feff21d8481d6d500986c

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Length, Alert, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 26 Nov 2022 22:17:33 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3246
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
260e9998c20d831b66f1029c8f47aac9
716d630f647c54dc69a7f9c63a6cac294b3df7f7
c9951a909f354174f0075a01c01c3c3aa6960983040e328bfbbbea81aeb405c2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C9951A909F354174F0075A01C01C3C3AA6960983040E328BFBBBEA81AEB405C2"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4485
Expires: Sun, 27 Nov 2022 00:26:24 GMT
Date: Sat, 26 Nov 2022 23:11:39 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: c4AEIUtcSspFZxrD1ZPoIYZx2iAMwTF24HghXcIn/9D7vuj80hNhPmA03zj1ycp6qq+fq7vRtsPrfaT7+gF+WQ==
x-amz-request-id: 846KZYX5WE8ER9PR
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 26 Nov 2022 22:44:24 GMT
age: 1635
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
2d666196aa23f6967cec5010296ea5d4
9f778694bc57bbb3a0c1ef5e705d804a8040b0e4
dc3bc0e9415e49a7163c780180538f65f13a459088cf7527cd940ae5e7add8dc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4558
Cache-Control: max-age=158722
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Etag: "6382545f-117"
Expires: Mon, 28 Nov 2022 19:17:01 GMT
Last-Modified: Sat, 26 Nov 2022 18:01:03 GMT
Server: ECS (amb/6BB7)
X-Cache: HIT
Content-Length: 279

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 26 Nov 2022 23:11:39 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

279 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
279 B (279 bytes)
Hash
2d666196aa23f6967cec5010296ea5d4
9f778694bc57bbb3a0c1ef5e705d804a8040b0e4
dc3bc0e9415e49a7163c780180538f65f13a459088cf7527cd940ae5e7add8dc

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4558
Cache-Control: max-age=158722
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Etag: "6382545f-117"
Expires: Mon, 28 Nov 2022 19:17:01 GMT
Last-Modified: Sat, 26 Nov 2022 18:01:03 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 279

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
619fa0039b94697fc8a5bd24f57e8aa2
53a366391a51d625029cc6d32fb4e8b6060990fd
dff604305831a0399aa44b2fac806e43512afa846569ba6e5685eca6495d9fa5

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
619fa0039b94697fc8a5bd24f57e8aa2
53a366391a51d625029cc6d32fb4e8b6060990fd
dff604305831a0399aa44b2fac806e43512afa846569ba6e5685eca6495d9fa5

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
b05606331c6f88a724d9e404e62974e4
72176bc6b618fbbe567b5746ed54e14d381a9815
7179b3d4ee227d9bf6d768a5fb1a9499f285d5949d21893c9a6997da8ea7b026

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
b05606331c6f88a724d9e404e62974e4
72176bc6b618fbbe567b5746ed54e14d381a9815
7179b3d4ee227d9bf6d768a5fb1a9499f285d5949d21893c9a6997da8ea7b026

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
264e53fdf4f82e266ddcd781ab106217
afb01be02244081098dfb320e142d7022785c812
b0582996ff8bc497067a3d8193109bea2df9db29c54e2b81e90321e00bc8e96f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B0582996FF8BC497067A3D8193109BEA2DF9DB29C54E2B81E90321E00BC8E96F"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14380
Expires: Sun, 27 Nov 2022 03:11:19 GMT
Date: Sat, 26 Nov 2022 23:11:39 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 26 Nov 2022 23:08:54 GMT
cache-control: public,max-age=3600
age: 165
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

216.58.207.195

200 OK

16 kB

URL HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
216.58.207.195:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Size
16 kB (15860 bytes)
Hash
e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

HTTP Headers

GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://babesroulette.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 23 Nov 2022 18:53:49 GMT
expires: Thu, 23 Nov 2023 18:53:49 GMT
cache-control: public, max-age=31536000
age: 274670
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Roboto:100,100italic,300,400,400italic,300italic,500,500italic,700,700italic

142.250.74.10

200 OK

17 kB

URL HTTP/2
fonts.googleapis.com/css?family=Roboto:100,100italic,300,400,400italic,300italic,500,500italic,700,700italic
IP
142.250.74.10:0
ASN
#15169 GOOGLE

File type
data
Size
17 kB (16797 bytes)
Hash
6e93cee22674da9e70d048fbdbc18a4f
29a9eaa54162021a46f50181bb389b28d7f750b8
7ba811ad441aa107de905fda64e0ed2d05524ca287d191ee131b09460f6e4e63

HTTP Headers

GET /css?family=Roboto:100,100italic,300,400,400italic,300italic,500,500italic,700,700italic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://babesroulette.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 26 Nov 2022 23:11:39 GMT
date: Sat, 26 Nov 2022 23:11:39 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

dratingmaject.com/d/.js?lpref=&lpurl=https%3A%2F%2Fbabesroulette.com%2Flanders%2F18c%2F%3Fclickid%3Dwkb453u0akorrnokibs80dhg%26source%3Df9afda66-0e59-41e9-8746-dab6f4d69019%26cep%3DVk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug%26lptoken%3D1647698950c160b398aa&lpt=Title%20here&t=1669504299485

18.195.149.11

200 OK

3.0 kB

URL HTTP/2
dratingmaject.com/d/.js?lpref=&lpurl=https%3A%2F%2Fbabesroulette.com%2Flanders%2F18c%2F%3Fclickid%3Dwkb453u0akorrnokibs80dhg%26source%3Df9afda66-0e59-41e9-8746-dab6f4d69019%26cep%3DVk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug%26lptoken%3D1647698950c160b398aa&lpt=Title%20here&t=1669504299485
IP
18.195.149.11:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (961)
Size
3.0 kB (2989 bytes)
Hash
aab5304450651c98750d13421136cb70
0b6d4a5647be7ac85c2cd9e5d6e6ea2be2c6d7f4
8799f7728b3ff1976ae6849efbb6faecb92d98d3af9ac390b28e10aeb647b34f

HTTP Headers

GET /d/.js?lpref=&lpurl=https%3A%2F%2Fbabesroulette.com%2Flanders%2F18c%2F%3Fclickid%3Dwkb453u0akorrnokibs80dhg%26source%3Df9afda66-0e59-41e9-8746-dab6f4d69019%26cep%3DVk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug%26lptoken%3D1647698950c160b398aa&lpt=Title%20here&t=1669504299485 HTTP/1.1
Host: dratingmaject.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://babesroulette.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 26 Nov 2022 23:11:39 GMT
content-type: application/javascript;charset=UTF-8
content-length: 2989
access-control-allow-origin: *
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
b05606331c6f88a724d9e404e62974e4
72176bc6b618fbbe567b5746ed54e14d381a9815
7179b3d4ee227d9bf6d768a5fb1a9499f285d5949d21893c9a6997da8ea7b026

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
d3df71aab146eefc49acb608796aab63
8401892995193919376dfcd798b09c8261579454
a616c1e54e896576601e6107c1814adbebf35364d8ed807cdd89ac36b8200c88

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2207
Cache-Control: max-age=124319
Content-Type: application/ocsp-response
Date: Sat, 26 Nov 2022 23:11:39 GMT
Etag: "6381d72b-1d7"
Expires: Mon, 28 Nov 2022 09:43:38 GMT
Last-Modified: Sat, 26 Nov 2022 09:06:51 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

54.191.210.155

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.191.210.155:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: uf6G4ekTOXWqKnsDgSgnnQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 2zN6fuE12ev603mIbgQV4+P/SdI=

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13111
Expires: Sun, 27 Nov 2022 02:50:12 GMT
Date: Sat, 26 Nov 2022 23:11:41 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13111
Expires: Sun, 27 Nov 2022 02:50:12 GMT
Date: Sat, 26 Nov 2022 23:11:41 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13111
Expires: Sun, 27 Nov 2022 02:50:12 GMT
Date: Sat, 26 Nov 2022 23:11:41 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13111
Expires: Sun, 27 Nov 2022 02:50:12 GMT
Date: Sat, 26 Nov 2022 23:11:41 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6827d82f488045e02e40d6a2fdbae4b3
4944139a4b08769511ffc6aa913857d88a0db7bc
0e4ef6ddef97ec03d43df4c0bada61d792b9f030e4d9fab5bd3cf904aeaa3bc9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13111
Expires: Sun, 27 Nov 2022 02:50:12 GMT
Date: Sat, 26 Nov 2022 23:11:41 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8387 bytes)
Hash
4e97baa4851785eac92c719abf481c64
c32a57038d3cdbc514c9081c9938eca6a04fb481
adb59e982648082e5421f58899a5331b2747e9d45be33c495fbe3ab8cc872b22

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcfaef414-0c01-4bb9-800d-29da0ef5607d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8387
x-amzn-requestid: e4ce369f-7654-4c1a-94c2-70c913eb1a01
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cFL0tEcqIAMFXHw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637ec01d-37bd969f4cdfe220096b8c1f;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 00:51:41 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: __2hrJIdzCKzhuJ_YfbSSfz-WwyIqnPugk7P6SuYSjn6b2wwm0otCw==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 20:58:18 GMT
age: 8003
etag: "c32a57038d3cdbc514c9081c9938eca6a04fb481"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.8 kB (4803 bytes)
Hash
cc0a257323f882caff067adb86d906e4
cedf2f21be7cd366bd46055b62b5513db3011dfc
c16a9296d5e840a468fef7fb2764b9f7d4b3131d7ade2ce4999de1eead5469e0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4803
x-amzn-requestid: 80f7f1c8-0316-4181-83ac-2787b1ae825f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4iFHoIAMF2-g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-2c0a081b07e0785b4350c10c;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: AVwDLlKoy5pc9NNuR_OakMB0ONGAoO-k2AKwV--b2sjiaqYSKAWlZg==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:51:37 GMT
age: 4804
etag: "cedf2f21be7cd366bd46055b62b5513db3011dfc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F31dafe91-0b1b-40e9-927c-c01863516712.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9073 bytes)
Hash
ccb536b51f31391c89fb2abe3be6c749
c9a5ab962bfdd174aecd4809d770f0fe305ab8e4
b4b6f70603ab79399aeda1d8b7e8f2662da37b51a2d076b8e754c812b6fa5b47

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F31dafe91-0b1b-40e9-927c-c01863516712.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9073
x-amzn-requestid: 6cf20b75-6b27-4a34-97a8-017d7169f31b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b8JuVHY7IAMFtRg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637b2328-1ca76b3537613fb26358b8f2;Sampled=0
x-amzn-remapped-date: Mon, 21 Nov 2022 07:05:12 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Miss from cloudfront
x-amz-cf-id: lg8rdnHT_ndB-9CMrHcVN8a2xZCubuTEpUQ2m6i77l-NfdNfhfITEQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 cca7d60248a961ff8fc8c5640024b652.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 16:41:41 GMT
age: 23400
etag: "c9a5ab962bfdd174aecd4809d770f0fe305ab8e4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa78e81d9-dbc4-4911-9711-219f64026531.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10944 bytes)
Hash
5e586c141835f4ac8819c55dcb811b4d
a23fd98701ac35cd8740d1f7a832118c770e20c8
4296f391f755a649897a2211f9072c69a0510e43a313674908bb0a771b12650e

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa78e81d9-dbc4-4911-9711-219f64026531.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10944
x-amzn-requestid: ed714e4a-0f80-4b2d-ae82-b28d617fe927
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b42xTGpSoAMF9Vw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6379d1a1-1235a4ad16a6bfee50615fbb;Sampled=0
x-amzn-remapped-date: Sun, 20 Nov 2022 07:05:05 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: UzVSiMniBPN9LTEIutLmWn7BZX7d5RWIxtH0H-RpLfIGqdIBTovGMg==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 28fdf6e146f70e7372911f118404fb20.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 22:36:11 GMT
age: 2130
etag: "a23fd98701ac35cd8740d1f7a832118c770e20c8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a7e16e2-9f5f-4739-817a-8a5447d80ee4.png
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.5 kB (9549 bytes)
Hash
099add42d39565e1a14ba60a61261a8d
7b0d859df11485329882daddcdd8ca85a1010e56
01a81962c06247835668581bcdd337320c62ba2121e94570f663396b6647c2b1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4a7e16e2-9f5f-4739-817a-8a5447d80ee4.png HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9549
x-amzn-requestid: b99fc256-bdbd-4e59-bdec-b3f453cdfaac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b-50OFDDIAMFr1A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637c3ce7-75bc0aba74d71992450b11cb;Sampled=0
x-amzn-remapped-date: Tue, 22 Nov 2022 03:07:19 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: VOzEGsb5YWPA9-k63Jsb1Ejw9qoHfkH84GtbM2s7evsvv53iuh3Lug==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:54:18 GMT
age: 4643
etag: "7b0d859df11485329882daddcdd8ca85a1010e56"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F297e7532-86f8-4631-9062-cdd6a291b40b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.1 kB (5099 bytes)
Hash
433875a1b1fef34e45f2d8ac344c07e3
f2129466436cbbdd58abe42a47fb7af19eba58e6
ab1e7b46f3804640c7dd94d70c8c31ec2dfc3e2f0f015a8556d04d9d9089c450

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F297e7532-86f8-4631-9062-cdd6a291b40b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5099
x-amzn-requestid: 57648043-7820-453d-9549-0f743b6c2557
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4jFBvoAMFl1w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-53b59d607b82c264180f469d;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: VsdLWuh4rCawI5V0YYGaHxEMl2YEVNgsbjfCwzDsrnCZhRK2FkCkVw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:51:41 GMT
age: 4800
etag: "f2129466436cbbdd58abe42a47fb7af19eba58e6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F597d0b25-8af2-425a-be32-195ac8e4bc00.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.4 kB (4374 bytes)
Hash
514b4077fad50ba782e4bbb2c95c6852
4770f56d4d9489df43f33952e4bfa84d8e46414e
a97ce7c911625345342731b96cf423ee36182e101e3039694a666d6508a702ef

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F597d0b25-8af2-425a-be32-195ac8e4bc00.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
server: nginx
content-length: 4374
x-amzn-requestid: 16fa9401-4b57-4300-9377-3a7d96de3a38
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cGB7uFWJIAMFfTg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637f16b1-3386c7b54d828c3b1393b9ce;Sampled=0
x-amzn-remapped-date: Thu, 24 Nov 2022 07:01:05 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 6XMNeYqDwM9yHZf1rkBRhZ6k_iZE92MWKavu0vlQnT2jZ--tswQwWw==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 08:08:31 GMT
age: 54197
etag: "4770f56d4d9489df43f33952e4bfa84d8e46414e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa

104.21.72.186

200 OK

0 B

URL HTTP/2
babesroulette.com/landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa
IP
104.21.72.186:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /landers/18c/?clickid=wkb453u0akorrnokibs80dhg&source=f9afda66-0e59-41e9-8746-dab6f4d69019&cep=Vk8dJYahBKBEOnhq-m4pEMoNmMManObdMGZTN35tP52leWld6vKzi8aptPaTxG-zy7j6D2IRQp7li43bxY9R-rRimxXsYVUwBfV3h3k3fEM50YBmeyVmtxDWkw7FmksvnlFm0XY8ah1PBG0OEYBDiyikSfsSp5hqofIsYwesEUsOedNUF6QRU9s_nLiDHxgvmBcsM5RBRYTQ8s8QSkfB3fUknQUTbzrtP_9Nbp54upiZA-DpHH5n1aWxB1LMtuDeomDvSlx1WV5Hs-C9bwMaRij_931nnrIXs71uoBszDtYoH3PNUcdjibODOVMY1OzYaVXlKPAV1kGxgTxqhVW_xPoWN5y51eEsiiadKtrng8Wf-O3hJ05OPgcxHkOG4Wug&lptoken=1647698950c160b398aa HTTP/1.1
Host: babesroulette.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
date: Sat, 26 Nov 2022 23:11:39 GMT
content-type: text/html
last-modified: Thu, 25 Aug 2022 23:06:23 GMT
x-powered-by: PleskLin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aj8henp1mPemc4nCumARHUYdl3%2BMEmlt%2B29RgqqWkp6axFWhAtW5mi6oNfIwQNFnGl03SQvlJHn6ShbDpnutFfdaW7DQtZbD7eWz8t6z5vSneQh4awHTp3rzgxrs7i7Yca%2BNLw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77064dedbecab511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=wkb453u0akorrnokibs80dhg&var=f9afda66-0e59-41e9-8746-dab6f4d69019&sw=/sw-check-permissions-2e801.js

139.45.197.251

200 OK

0 B

URL HTTP/2
deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=wkb453u0akorrnokibs80dhg&var=f9afda66-0e59-41e9-8746-dab6f4d69019&sw=/sw-check-permissions-2e801.js
IP
139.45.197.251:0
ASN
#9002 RETN Limited

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /pfe/current/micro.tag.min.js?z=4740019&ymid=wkb453u0akorrnokibs80dhg&var=f9afda66-0e59-41e9-8746-dab6f4d69019&sw=/sw-check-permissions-2e801.js HTTP/1.1
Host: deefauph.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://babesroulette.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 26 Nov 2022 23:11:39 GMT
content-type: application/javascript
last-modified: Thu, 24 Nov 2022 15:53:54 GMT
etag: W/"637f9392-12fca"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (35)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP