Overview

URL beachwood.ug/ghjkl.exe
IP45.143.201.4
ASNTov E-rishennya
Location Russia
Report completed2022-08-06 06:04:02 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2022-08-06 2 beachwood.ug/ghjkl.exe Malware
mnemonic secure dns
Added / Verified Severity Host Comment
2022-08-06 2 beachwood.ug Sinkholed
Quad9 DNS
Added / Verified Severity Host Comment
2022-08-06 2 beachwood.ug Sinkholed


Files

URL beachwood.ug/ghjkl.exe
IP  45.143.201.4
Magic PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data
Size 600064
MD5 131a32033cf88976a8df48361b90207d
SHA1 ce260393460fa5d4cbfa17d3329fd33594810add
SHA256 d75d7b0534ff648f16f5751be79a2c23158b6412a780180aec78c77c7e95071d
Analyzer Analysed Verdict Comment
VirusTotal 2022-08-05 14:01:18 58/70


Passive DNS (8)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
[Mnemonic Passive DNS] img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-08-05 06:49:03 UTC 34.120.237.76
[Mnemonic Passive DNS] r3.o.lencr.org (4) 344 2020-12-02 08:52:13 UTC 2022-08-05 04:57:18 UTC 23.36.77.32
[Mnemonic Passive DNS] firefox.settings.services.mozilla.com (2) 867 2016-03-17 08:25:01 UTC 2020-05-25 20:01:47 UTC 54.230.111.65
[Mnemonic Passive DNS] content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-08-06 04:57:51 UTC 54.230.111.99
[Mnemonic Passive DNS] beachwood.ug (1) 0 No data No data 45.143.201.4 Unknown ranking
[Mnemonic Passive DNS] contile.services.mozilla.com (1) 1114 No data No data 34.117.237.239
[Mnemonic Passive DNS] ocsp.digicert.com (1) 86 2012-11-29 12:49:49 UTC 2022-08-06 05:01:09 UTC 93.184.220.29
[Mnemonic Passive DNS] push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2022-08-05 05:06:17 UTC 54.189.35.180


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 45.143.201.4

Date UQ / IDS / BL URL IP
2022-08-12 12:34:01 +0000
0 - 0 - 3 goldrush.ug/zxcvb.exe 45.143.201.4
2022-08-12 12:33:50 +0000
0 - 0 - 3 goldrush.ug/zxcv.EXE 45.143.201.4
2022-08-12 12:33:45 +0000
0 - 0 - 3 mistitis.ug/zxcvb.exe 45.143.201.4
2022-08-12 12:16:37 +0000
0 - 0 - 3 charisma.ac.ug/ghjk.exe 45.143.201.4
2022-08-12 12:15:41 +0000
0 - 0 - 3 karimgousa.ug/zxcv.EXE 45.143.201.4
2022-08-12 12:15:37 +0000
0 - 0 - 3 karimgousa.ug/zxcvb.exe 45.143.201.4
2022-08-12 11:20:01 +0000
0 - 0 - 3 marnersstyler.ug/zxcv.EXE 45.143.201.4
2022-08-12 11:19:50 +0000
0 - 0 - 3 marnersstyler.ug/asdfg.exe 45.143.201.4
2022-08-12 10:27:21 +0000
0 - 0 - 3 scientific.pk/ghjkl.exe 45.143.201.4
2022-08-12 10:27:12 +0000
0 - 0 - 3 safetygear.pk/ghjk.exe 45.143.201.4

Last 10 reports on ASN: Tov E-rishennya

Date UQ / IDS / BL URL IP
2022-08-12 12:34:01 +0000
0 - 0 - 3 goldrush.ug/zxcvb.exe 45.143.201.4
2022-08-12 12:33:50 +0000
0 - 0 - 3 goldrush.ug/zxcv.EXE 45.143.201.4
2022-08-12 12:33:45 +0000
0 - 0 - 3 mistitis.ug/zxcvb.exe 45.143.201.4
2022-08-12 12:16:56 +0000
0 - 0 - 1 45.143.201.7/typedef.struct_WIN32_MEMORY_RANG (...) 45.143.201.7
2022-08-12 12:16:37 +0000
0 - 0 - 3 charisma.ac.ug/ghjk.exe 45.143.201.4
2022-08-12 12:15:41 +0000
0 - 0 - 3 karimgousa.ug/zxcv.EXE 45.143.201.4
2022-08-12 12:15:37 +0000
0 - 0 - 3 karimgousa.ug/zxcvb.exe 45.143.201.4
2022-08-12 11:20:01 +0000
0 - 0 - 3 marnersstyler.ug/zxcv.EXE 45.143.201.4
2022-08-12 11:19:50 +0000
0 - 0 - 3 marnersstyler.ug/asdfg.exe 45.143.201.4
2022-08-12 11:09:15 +0000
0 - 0 - 1 45.143.201.7/ 45.143.201.7

Last 10 reports on domain: beachwood.ug

Date UQ / IDS / BL URL IP
2022-08-12 07:49:23 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-12 01:38:10 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-11 19:27:27 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-11 13:13:52 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-11 07:04:46 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-11 00:57:46 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-09 11:22:24 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-09 05:27:14 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-08 23:36:18 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4
2022-08-08 16:04:27 +0000
0 - 0 - 3 beachwood.ug/ghjkl.exe 45.143.201.4


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (17)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F055127A4794D0F76CB4DF8F290DF8E259258A63398A700F592C859DFFE9AC34"
Last-Modified: Thu, 04 Aug 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6468
Expires: Sat, 06 Aug 2022 07:51:39 GMT
Date: Sat, 06 Aug 2022 06:03:51 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.65
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sat, 06 Aug 2022 06:02:27 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 d9fb4c3794a085bb4ee2c5798c2cb1b8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Qy554Ud3iylGDAaqJVj5WM-1EYVMqJ1YQR2nHKoxGmldSdLlbv7xRg==
Age: 84


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    91dd975a7b17b2922dd23c0e49314e40
Sha1:   57a2ece1e3cee7c4ebf927f2ba92f52cac395fe2
Sha256: 09966873bbf317f8910c59544cfde2a6d46e8acd2905797cc7c85c6b4d18ea8a
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-09-19-18-34-07.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.99
HTTP/2 200 OK
                                        
content-type: binary/octet-stream
content-length: 5348
last-modified: Sun, 31 Jul 2022 18:34:08 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sat, 06 Aug 2022 04:15:27 GMT
etag: "578b9ff83ff3950ab2a3d1a8344d2938"
x-cache: Hit from cloudfront
via: 1.1 5bcfe2deda0bdbc6bade0af9b61602ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: wt5jbXjREGDyzb2fWwpl_X-UaLldnqPBpMgqmaNJBf0D1MgpzuDvVA==
age: 6505
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    578b9ff83ff3950ab2a3d1a8344d2938
Sha1:   39d48b67ba6aa45ec01767725e726cf9b0c87a70
Sha256: 35c99da9a5463a4788ceab7cf4b027bb25506cde28ace36c70d0bc924138f2f5
                                        
                                            GET /ghjkl.exe HTTP/1.1 
Host: beachwood.ug
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         45.143.201.4
HTTP/1.1 200 OK
Content-Type: application/x-msdos-program
                                        
Server: nginx/1.18.0
Date: Sat, 06 Aug 2022 06:03:51 GMT
Content-Length: 600064
Connection: keep-alive
Last-Modified: Sun, 10 Jul 2022 12:40:40 GMT
ETag: "92800-5e372be2ee19e"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data
Size:   600064
Md5:    131a32033cf88976a8df48361b90207d
Sha1:   ce260393460fa5d4cbfa17d3329fd33594810add
Sha256: d75d7b0534ff648f16f5751be79a2c23158b6412a780180aec78c77c7e95071d

Alerts:
  Blocklists:
    - fortinet: Malware
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
  File Analyzers:
    - virustotal: 58/70
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
                                        
server: nginx
date: Sat, 06 Aug 2022 06:03:51 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         54.230.111.65
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Cache-Control, Pragma, Backoff, Last-Modified, ETag, Expires, Content-Length, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sat, 06 Aug 2022 05:16:14 GMT
Cache-Control: max-age=3600
Expires: Sat, 06 Aug 2022 05:24:55 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 4bbc14b5834fc74ccd249b954b43a08c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 1prWQccG2tfZ15P3og37n8QrEk0nLPg-IF1HZATm4mnt2wEy5fSetw==
Age: 2858


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6038
Cache-Control: max-age=99847
Date: Sat, 06 Aug 2022 06:03:52 GMT
Etag: "62eccfb9-1d7"
Expires: Sun, 07 Aug 2022 09:47:59 GMT
Last-Modified: Fri, 05 Aug 2022 08:07:21 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: JTd5P8JgTNrUJAn1L04Lhg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         54.189.35.180
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: xvN95QxRZ9Rtb+apbeeW9gSEjuk=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7266
Expires: Sat, 06 Aug 2022 08:05:00 GMT
Date: Sat, 06 Aug 2022 06:03:54 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7266
Expires: Sat, 06 Aug 2022 08:05:00 GMT
Date: Sat, 06 Aug 2022 06:03:54 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D129895DD82ACE0D70FE0D261B7C2E924E869686CEDF20C238EFA6BFDF5E632"
Last-Modified: Wed, 03 Aug 2022 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7266
Expires: Sat, 06 Aug 2022 08:05:00 GMT
Date: Sat, 06 Aug 2022 06:03:54 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47127619-5c86-4363-ad38-bd0ea52d7a06.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 3871
x-amzn-requestid: 8e2f628a-40e7-4a30-9250-e799388e3f06
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaMExESGIAMFmSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8d51-548ce53641314e2f14e5c4af;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:36:17 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: K_JIjjIoI8WKlfv4W3wDwglaTEkOabSJz7gG2zq8_1vEccPljbZilw==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 21:58:37 GMT
age: 29117
etag: "5aafd1e4d78ce8b097b9d9333f8a583a3004ed21"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3871
Md5:    2d2380784d41f22b7c39f22aa6ee89f5
Sha1:   5aafd1e4d78ce8b097b9d9333f8a583a3004ed21
Sha256: 0c0f5233c5b6e055ab79900dcd96b99dcd837a2459c75c75ba54d1289dab4ec7
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff0639416-8f2d-4ab7-9e3b-459448bd9daa.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 10949
x-amzn-requestid: c1761599-dc8d-408b-87da-b2961ac6560f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WUXu5FD2IAMFpnQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62eb3992-1c17ee5a619249e84c814b7a;Sampled=0
x-amzn-remapped-date: Thu, 04 Aug 2022 03:14:26 GMT
x-amz-cf-pop: YVR50-C1
x-cache: Miss from cloudfront
x-amz-cf-id: MgwKi7CqzjoVvketcgzMwT2q0Egm5MksC7_-AEICUW7cKe0ok2Ii7g==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 733ae4e17f2a4786e797d3450daabd46.cloudfront.net (CloudFront), 1.1 google
date: Sat, 06 Aug 2022 04:48:13 GMT
age: 4541
etag: "084b4b2e95a731acefcee158e539c4fbc74060f2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10949
Md5:    6b23b52c323b1ebf1abd497da1051b47
Sha1:   084b4b2e95a731acefcee158e539c4fbc74060f2
Sha256: d5fb15eb9611b3b67d3954a6f8c2ccd53a4c385d2beb6254d3063fc38f04f56e
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00c27fbc-f7dc-491c-92c7-70dd9c68da69.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 7911
x-amzn-requestid: d3776da5-df77-4b08-bdf4-a949df45920a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WOTuzF2-oAMF6qw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62e8ccc4-36cb6c6a64a2fcb85c4a98e8;Sampled=0
x-amzn-remapped-date: Tue, 02 Aug 2022 07:05:40 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Sa8b4L8kCsNGyke-UI-zyBEpPPGb9jghFNWPSaWLonAuTxFGHsJviQ==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 ee330666adf9f04c8c30094f8ddcd004.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 12:16:43 GMT
age: 64031
etag: "126688362f54060110b92826e9ea513fabcfde4f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7911
Md5:    662f84cbbc31ca3bd337c82f59e810fb
Sha1:   126688362f54060110b92826e9ea513fabcfde4f
Sha256: 22db946504dfb8ac5b27913a462593a14cbc4ddbb433b10f0a3e1ddee5dd6753
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbac29577-51fc-49f4-aa62-7bd10918f86c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 10404
x-amzn-requestid: 21c915ec-eda2-458b-bd7a-27b841c80e89
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaMb8GH7oAMFZ6A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8de5-68fd7ae53ae29df77e828684;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:38:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: z88Jo1fYYJyV4RdGc-UDamBtSfxz3NsQiCo1c0pziWrDGTVhvKfpZA==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 21:58:50 GMT
etag: "429ef7bfc7ee3df047dbdd1f6fe3b5fd71e627ea"
content-type: image/jpeg
age: 29104
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10404
Md5:    eb923e3f6bc2cea92c6be5adf2bd5f24
Sha1:   429ef7bfc7ee3df047dbdd1f6fe3b5fd71e627ea
Sha256: a06cb841220e89bc85c0d2800b3a47918b47dc17dd983bed59de3fda882d0f8d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4cd7946e-f5b7-437e-832a-c5baed4274a7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 8324
x-amzn-requestid: ef6e81af-87be-4150-b0fd-6b0362c90907
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaMi_F3XIAMFraw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8e12-6eccb82f12a6909a72229646;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:39:30 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: OWvvRiJsFWAQWdS00HmDYV89SER9YO031BtKeTIg1BmqP2yvX43yLg==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 567b44ed19c8caed2570b7bcd8c70034.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 21:47:29 GMT
age: 29785
etag: "bbdd2e3df3289085d43c1bc36b9531f2ebaad16f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8324
Md5:    118b1a66d5931bb8220e47ffa3db8c49
Sha1:   bbdd2e3df3289085d43c1bc36b9531f2ebaad16f
Sha256: b5458140eeeb70e9454dcc3ca55e531311d109703b59b0cbc92987ad8e9e984f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60c16ee3-3a39-4ec1-8e5b-b1410576255d.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
                                        
server: nginx
content-length: 10858
x-amzn-requestid: f52ea3bb-2b14-4316-b1ea-25883320d73e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: WaMEqHPoIAMFd8w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-62ed8d50-5d5190d20756dba80d5bdc58;Sampled=0
x-amzn-remapped-date: Fri, 05 Aug 2022 21:36:16 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 91aj3ZyKfmVEtsdnYZ9Jxxxj3lhprXSIJBF12cC2jNzU-xL2iHMlwg==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 05 Aug 2022 21:58:37 GMT
age: 29117
etag: "41e1d42e206d3214a51e63770e9cd6cc0becbb24"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10858
Md5:    afba830dc75735a2d3d2ddbc552122cf
Sha1:   41e1d42e206d3214a51e63770e9cd6cc0becbb24
Sha256: d3d4aefde36e4bc2d5369e0ce485c5e732a115055291c06d8c9a3db3beca8887