urlquery - report: static.updatestar.net/dl/pchute/PCPEInstaller.exe

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	Sent bytes	Received bytes	IP
firefox.settings.services.mozilla.com (2)	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782	2374	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413	5882	34.160.144.191
contile.services.mozilla.com (1)	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333	391	34.117.237.239
push.services.mozilla.com (1)	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606	127	100.20.30.105
img-getpocket.cdn.mozilla.net (7)	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3801	57150	34.120.237.76
static.updatestar.net (1)	0	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	380	282	5.35.253.150
r3.o.lencr.org (7)	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2366	6203	23.36.77.32

Timestamp	Severity	Source IP	Destination IP	Alert
2023-03-03 20:33:06 UTC	high	5.35.253.150	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2023-03-03 20:33:06 UTC	low	5.35.253.150	Client IP	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)

Scan Date	Severity	Indicator	Comment
2023-03-03	medium	static.updatestar.net/dl/pchute/PCPEInstaller.exe	Malware

Date	UQ / IDS / BL	URL	IP
2023-06-02 16:25:34 UTC	0 - 1 - 0	static.updatestar.net/dl/frostwire/frostwire- (...)	5.35.253.150
2023-06-02 09:14:18 UTC	0 - 1 - 0	static.updatestar.net/dl/intel/idcc.exe	5.35.253.150
2023-05-29 14:40:04 UTC	0 - 1 - 1	static.updatestar.net/dl/epson/epson326328eu.exe	5.35.253.150
2023-05-27 20:14:39 UTC	0 - 1 - 1	static.updatestar.net/dl/easeus/mover_free_In (...)	5.35.253.150
2023-05-26 05:32:12 UTC	0 - 0 - 1	static.updatestar.net/dl/netsurveillance/NetS (...)	5.35.253.150

Date	UQ / IDS / BL	URL	IP
2023-06-04 01:45:28 UTC	0 - 1 - 0	schenerland.de/wp-content/themes/tempera/ex_m (...)	5.175.14.129
2023-06-03 18:35:56 UTC	0 - 20 - 48	kindart.at/	92.204.55.171
2023-06-03 01:14:19 UTC	0 - 17 - 0	banyantrade.biz/	80.86.87.181
2023-06-02 17:05:52 UTC	0 - 4 - 0	kompatscher.biz/	87.230.94.194
2023-06-02 16:42:35 UTC	0 - 2 - 0	arniworx.de/tools/awxqs.exe	92.204.55.204

Date	UQ / IDS / BL	URL	IP
2023-06-02 16:25:34 UTC	0 - 1 - 0	static.updatestar.net/dl/frostwire/frostwire- (...)	5.35.253.150
2023-06-02 09:14:18 UTC	0 - 1 - 0	static.updatestar.net/dl/intel/idcc.exe	5.35.253.150
2023-05-29 14:40:04 UTC	0 - 1 - 1	static.updatestar.net/dl/epson/epson326328eu.exe	5.35.253.150
2023-05-27 20:14:39 UTC	0 - 1 - 1	static.updatestar.net/dl/easeus/mover_free_In (...)	5.35.253.150
2023-05-26 05:32:12 UTC	0 - 0 - 1	static.updatestar.net/dl/netsurveillance/NetS (...)	5.35.253.150

Date	UQ / IDS / BL	URL	IP
2023-04-04 21:26:40 UTC	0 - 5 - 0	transfer.sh/get/o7WlhU/upplagins.exe	144.76.136.153
2023-04-04 17:43:54 UTC	0 - 0 - 2	dl2.topfiles.net/files/2/61/42618/UWcxSGbqjJZ (...)	95.216.39.22
2023-04-04 16:26:03 UTC	0 - 5 - 0	transfer.sh/get/1yXHcv/VoiceControlEngine.exe	144.76.136.153
2023-04-04 16:02:28 UTC	0 - 1 - 3	walkindrivetoday.com/fb5djyes.rar	104.206.225.200
2023-04-04 14:04:59 UTC	0 - 0 - 2	raw.githubusercontent.com/bnffomento/bnf/main (...)	185.199.108.133

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "D1ADF9C8C7E63C33674A6AF4B4111FE0CE1092D362CA4BF7C7DD00E6B6034F09" Last-Modified: Thu, 02 Mar 2023 14:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2508 Expires: Fri, 03 Mar 2023 21:14:55 GMT Date: Fri, 03 Mar 2023 20:33:07 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: a39c6b0123e56e5b89743a8ad25c746e Sha1: feb61559594a73b319532dec130f10068fdf1242 Sha256: d1adf9c8c7e63c33674a6af4b4111fe0ce1092d362ca4bf7c7dd00e6b6034f09
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "D74374D27BBE6DF8C6D8F7DA2E5DB0E0B07EFB07A711131B500BC66A12594B88" Last-Modified: Thu, 02 Mar 2023 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=19516 Expires: Sat, 04 Mar 2023 01:58:23 GMT Date: Fri, 03 Mar 2023 20:33:07 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: cf3bd7bf954753a40867593f59828a19 Sha1: 8812b6b5e4e0725e3a5a7700be3ef0b4c3db4e24 Sha256: d74374d27bbe6df8c6d8f7da2e5db0e0b07efb07a711131b500bc66a12594b88
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Retry-After, Alert, Content-Length, Backoff, Content-Type content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Fri, 03 Mar 2023 20:08:20 GMT age: 1488 cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: 84db75194692d4afe13196bda6f22da8 Sha1: 4c1f49bc973a4917f146d93c8d598344edc021f6 Sha256: a3bec66f95b3bdf1d310c726e8ed05f7b06c1901c62381a94582d581844d2c23
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "5463C186F7F30F83BE61E91A980C749B70089E48B234D73A6E7EEB179CFD7EE9" Last-Modified: Thu, 02 Mar 2023 19:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7541 Expires: Fri, 03 Mar 2023 22:38:49 GMT Date: Fri, 03 Mar 2023 20:33:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: d2383d0b67af7368d8e13a3013f4065a Sha1: cdf951e84f87d010cf40b76f7b91e82ad17f374f Sha256: 5463c186f7f30f83be61e91a980c749b70089e48b234d73a6e7eeb179cfd7ee9
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: LgKp8OBH18QgWd/hV+T/OqP/idQM+FktbEzXTjb97PFst1SCfJHdPAG4fjpqADuVNIHjEF+BrW4= x-amz-request-id: GFT0PYAV6R60H1YK x-amz-server-side-encryption: AES256 content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Fri, 03 Mar 2023 20:15:57 GMT age: 1031 last-modified: Sat, 18 Feb 2023 20:28:27 GMT etag: "b5ba6334e73496995e3e3a9ecd0eb323" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: b5ba6334e73496995e3e3a9ecd0eb323 Sha1: ad80d3b7718c28364e8c2004fb38a13a1747e462 Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Fri, 03 Mar 2023 20:33:08 GMT content-length: 12 vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-credentials: true access-control-expose-headers: content-type strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: ETag, Cache-Control, Expires, Alert, Content-Type, Pragma, Retry-After, Last-Modified, Backoff, Content-Length content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Fri, 03 Mar 2023 20:12:26 GMT age: 1242 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "083C886AFCE548AAD4F54CAA7F7766E38D9376D55077D4072DBDDBDAFA086F85" Last-Modified: Thu, 02 Mar 2023 06:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7392 Expires: Fri, 03 Mar 2023 22:36:21 GMT Date: Fri, 03 Mar 2023 20:33:09 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 51e95d61b93964116033d39ca29d8e87 Sha1: f4b94d787ce49da21c28fe7853b1a85d2b9494dc Sha256: 083c886afce548aad4f54caa7f7766e38d9376d55077d4072dbddbdafa086f85
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: JCwNdL1wNLP6CEpIck90fA== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	100.20.30.105 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: NwRhzMd4z3g6r98WxIHszmryEGs= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "77E1A8623EEADFA78646A661F4541B47B8F0A4AC6AD73825CE3A43FC57C21CD1" Last-Modified: Thu, 02 Mar 2023 19:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3919 Expires: Fri, 03 Mar 2023 21:38:28 GMT Date: Fri, 03 Mar 2023 20:33:09 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 0880782ffbede81650c9d4a97c298bdf Sha1: 0e35c0d6cba0bef0b9eeb039ebc9104b39b24e2e Sha256: 77e1a8623eeadfa78646a661f4541b47b8f0a4ac6ad73825ce3a43fc57c21cd1
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "77E1A8623EEADFA78646A661F4541B47B8F0A4AC6AD73825CE3A43FC57C21CD1" Last-Modified: Thu, 02 Mar 2023 19:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3919 Expires: Fri, 03 Mar 2023 21:38:28 GMT Date: Fri, 03 Mar 2023 20:33:09 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 0880782ffbede81650c9d4a97c298bdf Sha1: 0e35c0d6cba0bef0b9eeb039ebc9104b39b24e2e Sha256: 77e1a8623eeadfa78646a661f4541b47b8f0a4ac6ad73825ce3a43fc57c21cd1
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "77E1A8623EEADFA78646A661F4541B47B8F0A4AC6AD73825CE3A43FC57C21CD1" Last-Modified: Thu, 02 Mar 2023 19:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3919 Expires: Fri, 03 Mar 2023 21:38:28 GMT Date: Fri, 03 Mar 2023 20:33:09 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 0880782ffbede81650c9d4a97c298bdf Sha1: 0e35c0d6cba0bef0b9eeb039ebc9104b39b24e2e Sha256: 77e1a8623eeadfa78646a661f4541b47b8f0a4ac6ad73825ce3a43fc57c21cd1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F080edfd7-ca45-4d02-a82e-695dc100f1bc.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7507 x-amzn-requestid: d9b61fbe-db88-4902-92d2-b3d97bd7be88 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BLCh4FTuoAMFeIg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640117a5-4ced7773195e43cd4c4f8e25;Sampled=0 x-amzn-remapped-date: Thu, 02 Mar 2023 21:39:49 GMT x-amz-cf-pop: HIO50-C1, YVR50-C1 x-cache: Hit from cloudfront x-amz-cf-id: MU2eMq-Brvy0sLy-WZoszctLcITqVnwsftxXaFujYHgmKqM6PZMQTA== via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 3dcf7c8001b07734617b28e9bacc90ac.cloudfront.net (CloudFront), 1.1 google date: Thu, 02 Mar 2023 22:15:47 GMT age: 80242 etag: "86bd68def54b0b50e6f728690b2ddf08f858bc33" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7507 Md5: 9562ddfb26d6176ec12e8e71cc55895c Sha1: 86bd68def54b0b50e6f728690b2ddf08f858bc33 Sha256: b51ad98c7c8cb4b2be7af430f4a5963457661d4f13e8029a4bb2cd2ebeb00498
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdba647c7-b8d3-4043-b8c8-caba179b5589.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4371 x-amzn-requestid: 4996a003-e275-4edb-a0a3-f5d7e72cd1ce x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BLChFE_NoAMFYPQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640117a0-31d3ea3b1e196aaa372dd016;Sampled=0 x-amzn-remapped-date: Thu, 02 Mar 2023 21:39:44 GMT x-amz-cf-pop: HIO50-C1, YVR50-C1 x-cache: Hit from cloudfront x-amz-cf-id: 6TMBH_aSock0V22r3Xt99HQs1N7qY65SsSyiYPrtXYAPW-l3d3lC7g== via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 3aed32068dbe2f7fb3a27284c9c26498.cloudfront.net (CloudFront), 1.1 google date: Thu, 02 Mar 2023 22:14:32 GMT age: 80317 etag: "07cb3900b31e286c0ee6ef4e6344969a5ad893b4" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4371 Md5: e6c6971746047136e4cbf0dd381a2bf1 Sha1: 07cb3900b31e286c0ee6ef4e6344969a5ad893b4 Sha256: 4f35efad14bd441063c58fff5a44e05a9497c91266ff5b4c48a9386288bbc886
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fecd5f51d-c165-4228-b31e-35e9516c7ad5.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 10504 x-amzn-requestid: ee0a1e46-71ea-4647-ba9b-b350c7ca2ad0 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BLCyvEy5oAMF8NQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-64011811-7f3cecd06abd02671a7af460;Sampled=0 x-amzn-remapped-date: Thu, 02 Mar 2023 21:41:37 GMT x-amz-cf-pop: HIO50-C1, YVR50-C1 x-cache: Hit from cloudfront x-amz-cf-id: crclJpITavT8kxEfiamR2T29A8XLbGSRSebzv4BV5cPhZWQ-9_UusQ== via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 a02a98c09aaf2561c8ca019e473cf172.cloudfront.net (CloudFront), 1.1 google date: Thu, 02 Mar 2023 22:14:39 GMT age: 80310 etag: "e2b327c261d113b17053f475f2d4ef06fe5fb770" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 10504 Md5: d7b980c564a4ca7c7b68c4716e2398db Sha1: e2b327c261d113b17053f475f2d4ef06fe5fb770 Sha256: 478886f4d7ac80275da33753926320384665b246f85ede4c2547aba2f724e97e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4dc93829-4f5e-47fc-82e7-abc095364d12.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5104 x-amzn-requestid: 816fb8a0-1a9c-4572-bc8b-614693204c13 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BLC66FkjIAMFcZg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-64011845-4bf667bb15439fbf648be139;Sampled=0 x-amzn-remapped-date: Thu, 02 Mar 2023 21:42:29 GMT x-amz-cf-pop: HIO50-C1, SEA19-C3 x-cache: Miss from cloudfront x-amz-cf-id: Xe1NtmKZCmZg1gvtUK0eY_d_pVhDDnEBiS05sUMX3lK-pT9VQvfFow== via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 a9e73292d0b92053c3e38dcec15fd0e2.cloudfront.net (CloudFront), 1.1 google date: Thu, 02 Mar 2023 21:58:13 GMT etag: "7a3a48fbe78936df3795ae3181534e7a6652c956" age: 81296 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5104 Md5: 780855222ea785d3000e1b40b74a487a Sha1: 7a3a48fbe78936df3795ae3181534e7a6652c956 Sha256: 427e23d44cddf206d393500e1b2500fa9ef829c078dd953e28e9be8bf0d6a8d2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0c3b178-ee57-465b-aa8c-fb6f93e35cab.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 3381 x-amzn-requestid: 8b89e7ab-b8b3-45cd-af3a-cc419e61f1fc x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: A-PNPFynoAMFn8Q= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63fbf8ba-616bedc230d1c2b13a09beae;Sampled=0 x-amzn-remapped-date: Mon, 27 Feb 2023 00:26:34 GMT x-amz-cf-pop: SEA19-C3 x-cache: Hit from cloudfront x-amz-cf-id: 20gfRWuEZKeWijeUdUr10sCx8uqri-zpK-KTXBJrZaQOm3V1Gk8KQw== via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 0ec9ddba08fcd99386924593dbdbd44a.cloudfront.net (CloudFront), 1.1 google date: Fri, 03 Mar 2023 11:26:52 GMT age: 32777 etag: "4619a0418ee08d6618ead537f31823c98f355b5a" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 3381 Md5: 4726917eabc29a977873ad26e264e70d Sha1: 4619a0418ee08d6618ead537f31823c98f355b5a Sha256: d3c6b43d46ccff30f0003a063b6c4c78d4a782262bfdeb138e6c015555ce2dcb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc81172d5-849a-4947-895d-7b645a656f98.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9043 x-amzn-requestid: b198e6ac-b731-4300-ba73-0dae7c426334 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BLC6CHbBIAMF59w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6401183f-4e716af671ac66683937eaca;Sampled=0 x-amzn-remapped-date: Thu, 02 Mar 2023 21:42:23 GMT x-amz-cf-pop: HIO50-C1, YVR50-C1 x-cache: Hit from cloudfront x-amz-cf-id: knLOY1TnJUV4G5JGbFN96KbF_HOGaLh_HbnHdh3FbIlZI-KUBitLZQ== via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 7f5c6f79ed16052a7a2f78b6025bcf5e.cloudfront.net (CloudFront), 1.1 google date: Thu, 02 Mar 2023 22:15:58 GMT age: 80231 etag: "0fda39fd9db63f210a73fe14d6cb445d877303f1" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9043 Md5: 4c627140fb587a52035e07a0e4849aa4 Sha1: 0fda39fd9db63f210a73fe14d6cb445d877303f1 Sha256: ef144a10c04afa87fe3ae0c30906495f42b87678d6a5bab9ac934e8425d8ced3
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2cb94071-e9a3-41a5-a749-2673fe94c69d.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9807 x-amzn-requestid: f855150d-9f03-40a3-a425-0704a4334db1 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BLC6uFzSoAMFzWQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-64011844-3db631d0459704b904a0701a;Sampled=0 x-amzn-remapped-date: Thu, 02 Mar 2023 21:42:28 GMT x-amz-cf-pop: HIO50-C1, YVR50-C1 x-cache: Hit from cloudfront x-amz-cf-id: dx5LohAarY33i0QOrqHSuzTOGoN5if6-pqPMn_8_FO3bMK-eCjJpDg== via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 9c335c5f85533b11cbfd38dc7cc60c16.cloudfront.net (CloudFront), 1.1 google date: Thu, 02 Mar 2023 22:14:40 GMT age: 80316 etag: "0c84cf11487867cc6b9f955b12de4d6199804e4d" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9807 Md5: 0434a796c70c1df5c82845eb5b19b8cb Sha1: 0c84cf11487867cc6b9f955b12de4d6199804e4d Sha256: c43e2da686b91d44e8a619413c5439973246ce31722745d96c0a6a6286dad155
GET /dl/pchute/PCPEInstaller.exe HTTP/1.1 Host: static.updatestar.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	5.35.253.150 HTTP/1.1 200 OK Content-Type: application/octet-stream Cache-Control: public,max-age=31536000 Last-Modified: Fri, 01 Sep 2017 08:43:28 GMT Accept-Ranges: bytes ETag: "5aacd061fe22d31:0" Server: Microsoft-IIS/7.5 Date: Fri, 03 Mar 2023 19:33:04 GMT Content-Length: 15922552 --- Additional Info --- Magic: Size: 0 Md5: Sha1: Sha256: Blocklists: - fortinet: Malware IDS: - ET POLICY PE EXE or DLL Windows file download HTTP - ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.77.32

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "D1ADF9C8C7E63C33674A6AF4B4111FE0CE1092D362CA4BF7C7DD00E6B6034F09" 

                                            
                                                
Last-Modified: Thu, 02 Mar 2023 14:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=2508 

                                            
                                                
Expires: Fri, 03 Mar 2023 21:14:55 GMT 

                                            
                                                
Date: Fri, 03 Mar 2023 20:33:07 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    a39c6b0123e56e5b89743a8ad25c746e

                                                Sha1:   feb61559594a73b319532dec130f10068fdf1242

                                                Sha256: d1adf9c8c7e63c33674a6af4b4111fe0ce1092d362ca4bf7c7dd00e6b6034f09

                                        
                                            GET /v1/ HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: application/json

                                            

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
access-control-expose-headers: Retry-After, Alert, Content-Length, Backoff, Content-Type 

                                            
                                                
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                            
                                                
strict-transport-security: max-age=31536000 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
content-length: 939 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Fri, 03 Mar 2023 20:08:20 GMT 

                                            
                                                
age: 1488 

                                            
                                                
cache-control: max-age=3600,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators

                                                Size:   939

                                                Md5:    84db75194692d4afe13196bda6f22da8

                                                Sha1:   4c1f49bc973a4917f146d93c8d598344edc021f6

                                                Sha256: a3bec66f95b3bdf1d310c726e8ed05f7b06c1901c62381a94582d581844d2c23

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 

                                        
                                            
Host: content-signature-2.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: binary/octet-stream

                                            

                                            
                                                
x-amz-id-2: LgKp8OBH18QgWd/hV+T/OqP/idQM+FktbEzXTjb97PFst1SCfJHdPAG4fjpqADuVNIHjEF+BrW4= 

                                            
                                                
x-amz-request-id: GFT0PYAV6R60H1YK 

                                            
                                                
x-amz-server-side-encryption: AES256 

                                            
                                                
content-disposition: attachment 

                                            
                                                
accept-ranges: bytes 

                                            
                                                
server: AmazonS3 

                                            
                                                
content-length: 5348 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Fri, 03 Mar 2023 20:15:57 GMT 

                                            
                                                
age: 1031 

                                            
                                                
last-modified: Sat, 18 Feb 2023 20:28:27 GMT 

                                            
                                                
etag: "b5ba6334e73496995e3e3a9ecd0eb323" 

                                            
                                                
cache-control: public,max-age=3600 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  PEM certificate\012- , ASCII text

                                                Size:   5348

                                                Md5:    b5ba6334e73496995e3e3a9ecd0eb323

                                                Sha1:   ad80d3b7718c28364e8c2004fb38a13a1747e462

                                                Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: application/json 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/json 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: application/json

                                            

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
access-control-expose-headers: ETag, Cache-Control, Expires, Alert, Content-Type, Pragma, Retry-After, Last-Modified, Backoff, Content-Length 

                                            
                                                
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                            
                                                
strict-transport-security: max-age=31536000 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
content-length: 329 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Fri, 03 Mar 2023 20:12:26 GMT 

                                            
                                                
age: 1242 

                                            
                                                
last-modified: Fri, 25 Mar 2022 17:45:46 GMT 

                                            
                                                
etag: "1648230346554" 

                                            
                                                
cache-control: max-age=3600,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators

                                                Size:   329

                                                Md5:    0333b0655111aa68de771adfcc4db243

                                                Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb

                                                Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

                                        
                                            GET / HTTP/1.1 

                                        
                                            
Host: push.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Sec-WebSocket-Version: 13 

                                        
                                            
Origin: wss://push.services.mozilla.com/ 

                                        
                                            
Sec-WebSocket-Protocol: push-notification 

                                        
                                            
Sec-WebSocket-Extensions: permessage-deflate 

                                        
                                            
Sec-WebSocket-Key: JCwNdL1wNLP6CEpIck90fA== 

                                        
                                            
Connection: keep-alive, Upgrade 

                                        
                                            
Sec-Fetch-Dest: websocket 

                                        
                                            
Sec-Fetch-Mode: websocket 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
Upgrade: websocket

                                        
                                             100.20.30.105

                                            
                                                HTTP/1.1 101 Switching Protocols

                                            

                                            
                                                
Connection: Upgrade 

                                            
                                                
Upgrade: websocket 

                                            
                                                
Sec-WebSocket-Accept: NwRhzMd4z3g6r98WxIHszmryEGs= 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.77.32

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "77E1A8623EEADFA78646A661F4541B47B8F0A4AC6AD73825CE3A43FC57C21CD1" 

                                            
                                                
Last-Modified: Thu, 02 Mar 2023 19:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=3919 

                                            
                                                
Expires: Fri, 03 Mar 2023 21:38:28 GMT 

                                            
                                                
Date: Fri, 03 Mar 2023 20:33:09 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    0880782ffbede81650c9d4a97c298bdf

                                                Sha1:   0e35c0d6cba0bef0b9eeb039ebc9104b39b24e2e

                                                Sha256: 77e1a8623eeadfa78646a661f4541b47b8f0a4ac6ad73825ce3a43fc57c21cd1

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F080edfd7-ca45-4d02-a82e-695dc100f1bc.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 7507 

                                            
                                                
x-amzn-requestid: d9b61fbe-db88-4902-92d2-b3d97bd7be88 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: BLCh4FTuoAMFeIg= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-640117a5-4ced7773195e43cd4c4f8e25;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Thu, 02 Mar 2023 21:39:49 GMT 

                                            
                                                
x-amz-cf-pop: HIO50-C1, YVR50-C1 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: MU2eMq-Brvy0sLy-WZoszctLcITqVnwsftxXaFujYHgmKqM6PZMQTA== 

                                            
                                                
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 3dcf7c8001b07734617b28e9bacc90ac.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Thu, 02 Mar 2023 22:15:47 GMT 

                                            
                                                
age: 80242 

                                            
                                                
etag: "86bd68def54b0b50e6f728690b2ddf08f858bc33" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   7507

                                                Md5:    9562ddfb26d6176ec12e8e71cc55895c

                                                Sha1:   86bd68def54b0b50e6f728690b2ddf08f858bc33

                                                Sha256: b51ad98c7c8cb4b2be7af430f4a5963457661d4f13e8029a4bb2cd2ebeb00498

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fecd5f51d-c165-4228-b31e-35e9516c7ad5.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 10504 

                                            
                                                
x-amzn-requestid: ee0a1e46-71ea-4647-ba9b-b350c7ca2ad0 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: BLCyvEy5oAMF8NQ= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-64011811-7f3cecd06abd02671a7af460;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Thu, 02 Mar 2023 21:41:37 GMT 

                                            
                                                
x-amz-cf-pop: HIO50-C1, YVR50-C1 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: crclJpITavT8kxEfiamR2T29A8XLbGSRSebzv4BV5cPhZWQ-9_UusQ== 

                                            
                                                
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 a02a98c09aaf2561c8ca019e473cf172.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Thu, 02 Mar 2023 22:14:39 GMT 

                                            
                                                
age: 80310 

                                            
                                                
etag: "e2b327c261d113b17053f475f2d4ef06fe5fb770" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   10504

                                                Md5:    d7b980c564a4ca7c7b68c4716e2398db

                                                Sha1:   e2b327c261d113b17053f475f2d4ef06fe5fb770

                                                Sha256: 478886f4d7ac80275da33753926320384665b246f85ede4c2547aba2f724e97e

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0c3b178-ee57-465b-aa8c-fb6f93e35cab.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 3381 

                                            
                                                
x-amzn-requestid: 8b89e7ab-b8b3-45cd-af3a-cc419e61f1fc 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: A-PNPFynoAMFn8Q= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-63fbf8ba-616bedc230d1c2b13a09beae;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Mon, 27 Feb 2023 00:26:34 GMT 

                                            
                                                
x-amz-cf-pop: SEA19-C3 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: 20gfRWuEZKeWijeUdUr10sCx8uqri-zpK-KTXBJrZaQOm3V1Gk8KQw== 

                                            
                                                
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 0ec9ddba08fcd99386924593dbdbd44a.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Fri, 03 Mar 2023 11:26:52 GMT 

                                            
                                                
age: 32777 

                                            
                                                
etag: "4619a0418ee08d6618ead537f31823c98f355b5a" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   3381

                                                Md5:    4726917eabc29a977873ad26e264e70d

                                                Sha1:   4619a0418ee08d6618ead537f31823c98f355b5a

                                                Sha256: d3c6b43d46ccff30f0003a063b6c4c78d4a782262bfdeb138e6c015555ce2dcb

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2cb94071-e9a3-41a5-a749-2673fe94c69d.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 9807 

                                            
                                                
x-amzn-requestid: f855150d-9f03-40a3-a425-0704a4334db1 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: BLC6uFzSoAMFzWQ= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-64011844-3db631d0459704b904a0701a;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Thu, 02 Mar 2023 21:42:28 GMT 

                                            
                                                
x-amz-cf-pop: HIO50-C1, YVR50-C1 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: dx5LohAarY33i0QOrqHSuzTOGoN5if6-pqPMn_8_FO3bMK-eCjJpDg== 

                                            
                                                
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 9c335c5f85533b11cbfd38dc7cc60c16.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Thu, 02 Mar 2023 22:14:40 GMT 

                                            
                                                
age: 80316 

                                            
                                                
etag: "0c84cf11487867cc6b9f955b12de4d6199804e4d" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   9807

                                                Md5:    0434a796c70c1df5c82845eb5b19b8cb

                                                Sha1:   0c84cf11487867cc6b9f955b12de4d6199804e4d

                                                Sha256: c43e2da686b91d44e8a619413c5439973246ce31722745d96c0a6a6286dad155

URL	static.updatestar.net/dl/pchute/PCPEInstaller.exe
IP	5.35.253.150 (France)
ASN	#8972 Host Europe GmbH
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access
Report completed	2023-03-03 20:33:18 UTC
Status	Loading report..
IDS alerts	2
Blocklist alert	1
urlquery alerts	No alerts detected
Tags	None

Overview

Domain Summary (7)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 5.35.253.150

Last 5 reports on ASN: Host Europe GmbH

Last 5 reports on domain: updatestar.net

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (20)

Overview

Domain Summary (7)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 5.35.253.150

Last 5 reports on ASN: Host Europe GmbH

Last 5 reports on domain: updatestar.net

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (20)

Network Intrusion Detection Systems