w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
95.217.172.118302 Found 2 B URL HTTP/1.1 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type ASCII text, with CRLF line terminators
Hash 81051bcc2cf1bedf378224b0a93e2877
ba8ab5a0280b953aa97435ff8946cbcbb2755a27
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
GET /htu/general/ps/wsx/lp1_tr_hlmnot/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
server: nginx
date: Thu, 01 Dec 2022 15:47:18 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
location: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13467
Expires: Thu, 01 Dec 2022 19:31:45 GMT
Date: Thu, 01 Dec 2022 15:47:18 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 0c748388899e8a8d3680355da2ea5020
903c620cd137613daafb0da0508c37b2f4a67212
39eab80e022a9a1732872d9926b0ace80f818ec5c535e36a18b539ea63786fb2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2116
Cache-Control: max-age=155950
Content-Type: application/ocsp-response
Date: Thu, 01 Dec 2022 15:47:18 GMT
Etag: "63888270-1d7"
Expires: Sat, 03 Dec 2022 11:06:28 GMT
Last-Modified: Thu, 01 Dec 2022 10:31:12 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6858
Expires: Thu, 01 Dec 2022 17:41:36 GMT
Date: Thu, 01 Dec 2022 15:47:18 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: KuXVzHvWRx6toY9FfTYDw8rY9a9debR/qZnqzjTEfS3Poiw3aV/ah1hnSADgq5p1oqWeVGSdosQ=
x-amz-request-id: EJ86R230ZX0P70YK
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 01 Dec 2022 15:45:43 GMT
age: 95
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 01 Dec 2022 15:19:46 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 1652
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:18 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 7b04b931cf7f2b70847170aa96eae677
1f8a0658fc72e6259f34f172563d6b5f84d23660
b6ae4ae77d326bb288f2cf7578395f9cf61b8789438460b8558deaba5e400bf5
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B6AE4AE77D326BB288F2CF7578395F9CF61B8789438460B8558DEABA5E400BF5"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21572
Expires: Thu, 01 Dec 2022 21:46:51 GMT
Date: Thu, 01 Dec 2022 15:47:19 GMT
Connection: keep-alive
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/getUrlParams.min.js
95.217.172.118200 OK 385 B URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/getUrlParams.min.js
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (384)
Hash cc1acce764300df28d1f8ec237a09748
6943f37618a64ebb658a04fc141ed7fe11eb34df
a4ca1a54a710a7ade14dc4b2ecfb270d0fbfe01fb868decbf3e6a453f340e1ee
Analyzer Verdict Alert fortinet Phishing
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/js/getUrlParams.min.js HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: application/javascript
content-length: 385
last-modified: Fri, 02 Sep 2022 09:30:58 GMT
etag: "6311cd52-181"
accept-ranges: bytes
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/img/main.svg
95.217.172.118200 OK 339 B URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/img/main.svg
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type SVG Scalable Vector Graphics image\012- , ASCII text
Hash 552f0e14ddf7a3e09dcc767010cfa974
ccf1aab55c427af5a001e363247ca3f69e4b3b01
ec800dd5d5780c0ba4efc6fd6ccf7a9cad06ba8689f063c89b44cf75ce2224d1
Analyzer Verdict Alert fortinet Phishing
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/img/main.svg HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: image/svg+xml
content-length: 339
last-modified: Tue, 21 Dec 2021 16:35:55 GMT
etag: "61c2026b-153"
accept-ranges: bytes
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/css/style.css
95.217.172.118200 OK 14 kB URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/css/style.css
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash a5ec637a209808497a6505e7e2d3f5fe
0e904b6187770af4f099055cb9bf536c5e155060
d01a84a32861f4717931d0dc40778a7b103a0fa50e3136b5277242495e747416
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/css/style.css HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: text/css
content-length: 14037
last-modified: Wed, 02 Nov 2022 09:36:50 GMT
etag: "63623a32-36d5"
accept-ranges: bytes
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
95.217.172.118200 OK 6.2 kB URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (595)
Hash 48139ddb641349e83bb49d928151b754
70aaaf8341df86330688f12ff10afec37d9eaa75
5aec609f4fed7823283ed2a9d11549bf5817b82e84ef0fdd122eb40c74458ada
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: text/html; charset=UTF-8
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/jquery.maskedinput.js
95.217.172.118200 OK 10 kB URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/jquery.maskedinput.js
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
Hash 90f608018092e1b4327d3098e9bde1d3
e8bbf769eab41ad201a59045dcbfe3f9f60a9e9f
8021c83ec0beb15ed36bb869014c8bd451bedb1187664ce3e9e191bf76ce670c
Analyzer Verdict Alert fortinet Phishing
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/js/jquery.maskedinput.js HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: application/javascript
content-length: 10314
last-modified: Tue, 20 Sep 2022 13:23:27 GMT
etag: "6329becf-284a"
accept-ranges: bytes
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/main.min.js
95.217.172.118200 OK 493 B URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/main.min.js
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (493), with no line terminators
Hash 2c5383a758190d01e1d755fa2edb08af
1c89b109553de7353a2e838ba7dce4f7e0bea399
ada16d4790e35cd0a55bd4f255e6d7d760a8baade9f576d2da30762a0ba8338b
Analyzer Verdict Alert fortinet Phishing
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/js/main.min.js HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: application/javascript
content-length: 493
last-modified: Tue, 01 Nov 2022 13:38:36 GMT
etag: "6361215c-1ed"
accept-ranges: bytes
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/ajax-support.min.js
95.217.172.118200 OK 2.1 kB URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/ajax-support.min.js
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (2090), with no line terminators
Hash 6e0e455ff59717a2926476ced403a647
6bf3b770d94f92583ea5422173469c6c8f3f0066
fa77fd852f908cff2bb36c6b4046573d78310754b365ce6c0394fdf715cbde7d
Analyzer Verdict Alert fortinet Phishing
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/js/ajax-support.min.js HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: application/javascript
content-length: 2090
last-modified: Tue, 01 Nov 2022 13:38:30 GMT
etag: "63612156-82a"
accept-ranges: bytes
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/ajax.min.js
95.217.172.118200 OK 2.4 kB URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/js/ajax.min.js
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (2409), with no line terminators
Hash cecdf85d4701c940977a5dc8c807e573
126c3eb5c48c7f84bfcec76cf9a81952350f5e56
54823188de1ebdd90ebaedde4b788bcb38b85bca73e07b782f9fd634bb5b96c8
Analyzer Verdict Alert fortinet Phishing
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/js/ajax.min.js HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: application/javascript
content-length: 2409
last-modified: Wed, 02 Nov 2022 09:32:40 GMT
etag: "63623938-969"
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jquery.com/jquery-3.6.0.min.js
69.16.175.10200 OK 31 kB URL HTTP/2 code.jquery.com/jquery-3.6.0.min.js
IP 69.16.175.10:0
File type ASCII text, with very long lines (65447)
Hash 899f0189aaf034bbba5340f724d91dfa
210ea9de03968edb9d839ba4a0ce2d48666a8ab8
949b6597c5ea907a7ef3c8ca6d5ffc73be2352f9df485b78704e5c4dabac5d0f
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://w0wtimelands.com
Connection: keep-alive
Referer: https://w0wtimelands.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 01 Dec 2022 15:47:19 GMT
content-encoding: gzip
content-length: 30875
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-15d9d"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1669909639.dop069.sk1.t,1669909639.cds242.sk1.hn,1669909639.cds210.sk1.c
X-Firefox-Spdy: h2
w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/img/favicon.png
95.217.172.118200 OK 642 B URL HTTP/2 w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/img/favicon.png
IP 95.217.172.118:0
ASN #24940 Hetzner Online GmbH
File type PNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data
Hash c1c04af5edcf0d8d1d22a354717c280e
dd8b4d6114e7a267c23a637e7c1f03bdfe5a5a51
f8caf23df5a3b869393eeb1081b2385063b759853c40b51cbd631aae485544d7
GET /htu/general/ps/wsx/lp1_tr_hlmnot/web/img/favicon.png HTTP/1.1
Host: w0wtimelands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/htu/general/ps/wsx/lp1_tr_hlmnot/web/?clickid=2790eovttslaxdjf&trackingid=ccc2ffna93z6j6of95&affclickid=6388cc79028bcf0001226e95&fat=M0PrFy8o4UATwLRSDcaqyuTuRfZkcbGfrILunrRkuM13N9UVjDNH5bUA+BcFx7f/y/eByqP5dE/fwwgid/cAoKY/SeXqDJrRuD/gcLebaGKFOeD1U0HZCezxbN2ebyJ7rg+nP5imrzqmRAByMuFVWg==&sub1=1694&sub4=Unknown&sub5=Unknown&ssid=unknown
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 01 Dec 2022 15:47:19 GMT
content-type: image/png
content-length: 642
last-modified: Tue, 21 Dec 2021 16:35:54 GMT
etag: "61c2026a-282"
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 1601a7c8a96ebe5b2af6fe1abcb6b90b
fb19f5121052f37c9cef4640791964583618560c
893364204eb010f01c891762b80db20df137be75ecb85fa4e22dbc68143b53fb
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5885
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 01 Dec 2022 15:47:19 GMT
Last-Modified: Thu, 01 Dec 2022 14:09:14 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471
connect.facebook.net/en_US/fbevents.js
31.13.72.12200 OK 27 kB URL HTTP/2 connect.facebook.net/en_US/fbevents.js
IP 31.13.72.12:0
File type ASCII text, with very long lines (64348)
Hash 44ecaa3c2a4929a40141edc4540aaf84
f29a573182333b2500d41bfc389d6c5232dfb348
6589fe14578dedd4df678a909afadd7e5bc7f57c7e3e24518a7f5faac7383396
GET /en_US/fbevents.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://w0wtimelands.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: Dx7x4T+ayRKI4FdccWCYigY2270lGTUUmpMJc8ldjM2unV5hWRv4hzcs+Nsw+jdnYWeiJgu5jUhtJuB3HyupKg==
content-length: 27340
x-fb-trip-id: 1904183273
date: Thu, 01 Dec 2022 15:47:19 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
34.102.187.140200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 01 Dec 2022 15:11:15 GMT
cache-control: public,max-age=3600
age: 2164
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 1601a7c8a96ebe5b2af6fe1abcb6b90b
fb19f5121052f37c9cef4640791964583618560c
893364204eb010f01c891762b80db20df137be75ecb85fa4e22dbc68143b53fb
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5885
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 01 Dec 2022 15:47:19 GMT
Last-Modified: Thu, 01 Dec 2022 14:09:14 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 1f88399f3fdd89dbb9ca1229cb67143a
325c9dbfd932cf9a6fb9fab2dd8e27083f55a9a3
831ecd45dcd2d5ae2ae86cd63ea5e94ecd85281b7e51054af5df9a6386fb8d79
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2120
Cache-Control: max-age=150890
Content-Type: application/ocsp-response
Date: Thu, 01 Dec 2022 15:47:19 GMT
Etag: "63886ea9-1d7"
Expires: Sat, 03 Dec 2022 09:42:09 GMT
Last-Modified: Thu, 01 Dec 2022 09:06:49 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
54.71.202.2101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 54.71.202.2:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: YgHm1L0My5Kjb1XJnMXkqw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 7ma69o8Qac22xoEOAQ76cvRBG7I=
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15160
Expires: Thu, 01 Dec 2022 20:00:01 GMT
Date: Thu, 01 Dec 2022 15:47:21 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15160
Expires: Thu, 01 Dec 2022 20:00:01 GMT
Date: Thu, 01 Dec 2022 15:47:21 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15160
Expires: Thu, 01 Dec 2022 20:00:01 GMT
Date: Thu, 01 Dec 2022 15:47:21 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15160
Expires: Thu, 01 Dec 2022 20:00:01 GMT
Date: Thu, 01 Dec 2022 15:47:21 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15160
Expires: Thu, 01 Dec 2022 20:00:01 GMT
Date: Thu, 01 Dec 2022 15:47:21 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F83cd87b8-4041-419b-ab34-9f8e5a326f4b.jpeg
34.120.237.76200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F83cd87b8-4041-419b-ab34-9f8e5a326f4b.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 820cf89fcab8380adff42982c9fb11ed
84241ddddbbfd7de30118307fb1a62800d0a4cb3
0d051495f06ac84de934283b40cbfee7a042d32153a73486dd7c017430e882d8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F83cd87b8-4041-419b-ab34-9f8e5a326f4b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12898
x-amzn-requestid: 9b594c3c-6b8c-4589-8fcb-b3d7518b46f6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cQZBNFxToAMF_9A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63833ba1-767f510d72eef86d0cc892df;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 10:27:45 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: gsn5uUFEzDZDOMPTvW9UQxtccvRfJKUM4eJ8U99jvUGzNIKkF9SzeA==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:49:20 GMT
age: 64681
etag: "84241ddddbbfd7de30118307fb1a62800d0a4cb3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0e1339e-3c63-4033-8b5b-e21137509777.jpeg
34.120.237.76200 OK 16 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0e1339e-3c63-4033-8b5b-e21137509777.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ffd12f9c423ffc627d9e3b3145944fe4
5cf9a7a784952e1bb0cbe499104f1774b1269d08
a25f1b752d9af599aefd73073c105853130f1759905269de3d582d2eb35fe167
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb0e1339e-3c63-4033-8b5b-e21137509777.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 16038
x-amzn-requestid: 9d34c42b-ba0c-498f-8f99-d4ab527ffa89
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cbzMdHXNIAMFgaw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6387cbe9-376846f31dc9b995797cbd18;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 21:32:25 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: DngCuOTO9fQAwWe_ip6EtBcgruigZN6Bl1_v5BHM2dsWlhqCXCL3gg==
via: 1.1 efcf7b9d0f917f9ebf314db03e52d9b6.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:45:33 GMT
age: 64908
etag: "5cf9a7a784952e1bb0cbe499104f1774b1269d08"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F051e025a-c892-4a7d-8a1d-95f6d77ebb3c.jpeg
34.120.237.76200 OK 4.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F051e025a-c892-4a7d-8a1d-95f6d77ebb3c.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d2dd5a4bcfd47db8f38544bf39ce3031
fa2217bae05b7beca2e12597eaad835298276b82
3266004f5e73af5359b71622eea31f1e28abb4bbc443b5f9e481b5a8b2e9249e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F051e025a-c892-4a7d-8a1d-95f6d77ebb3c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4762
x-amzn-requestid: b7c0e28a-de0d-443d-8bf4-900a964bf110
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cP7uSFcMoAMF2CQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63830cc1-7abade3a670201cf1906b79f;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 07:07:45 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: gZSkafSw8cXo9AChLOTVJW7r_hHLW8kaHlA-ED2_zFJwuUk1uS3VRw==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 13:29:36 GMT
age: 8265
etag: "fa2217bae05b7beca2e12597eaad835298276b82"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F966ff24e-ea85-4a2e-aead-22f1a723c59f.jpeg
34.120.237.76200 OK 9.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F966ff24e-ea85-4a2e-aead-22f1a723c59f.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5508d05a290b663fd89ead9b58f2efd8
53650399f9a986ba54addd668b4557109d12003b
65704a961410fdd318c491fedf002c8e9b184cd34b76fe1b67026d42ce21be3f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F966ff24e-ea85-4a2e-aead-22f1a723c59f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9674
x-amzn-requestid: 7e7d0183-9667-462a-8d44-d125998c1ae3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cYgEoHVAoAMFvAQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63867a1d-280ba97e3fe1bf7244cbde35;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 21:31:09 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: qftF-GQkcjKTs30KMGCTDymw2SVSXeAYKGNWUnaMfvIb8HjtfHUx8A==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 30 Nov 2022 21:44:47 GMT
age: 64954
etag: "53650399f9a986ba54addd668b4557109d12003b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F600016d1-5abb-4a6c-996a-933a8d4bc6df.jpeg
34.120.237.76200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F600016d1-5abb-4a6c-996a-933a8d4bc6df.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 26d6dffbf400da4803a2e76e2a8ef2f8
2e62f9ed8f5e7b2f888a73320dd98b0cda9303b8
04c6e31623fe48cbe83dc91635bfa47b337590f18919995b08d5bde27e929e03
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F600016d1-5abb-4a6c-996a-933a8d4bc6df.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8740
x-amzn-requestid: 4823cf63-98eb-40d3-bb8b-e09cd2262f36
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cP7SqHjYIAMF8xw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63830c10-316b213c33ce9bc2355c0900;Sampled=0
x-amzn-remapped-date: Sun, 27 Nov 2022 07:04:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: tK4wl-g5kcUhVFE3iZGILhZhZSsaMzQD9JTBHj1JXV95yXs_e3gMGw==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 559326ad73233233a9e52cb9e8601ede.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 12:31:43 GMT
age: 11738
etag: "2e62f9ed8f5e7b2f888a73320dd98b0cda9303b8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc2b4ec6-0955-4089-983c-0abf7fd13bf2.jpeg
34.120.237.76200 OK 9.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc2b4ec6-0955-4089-983c-0abf7fd13bf2.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e1e6b6ba4f82221b41c3d9129008c76d
2f9532d698b4c28df23e18bbb66399ec776d5b9f
218c6f41a16e6087c611d4db5784a7cc1d027084d0bf2bd6dc3843ee5dfd560f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc2b4ec6-0955-4089-983c-0abf7fd13bf2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9459
x-amzn-requestid: c08f55b2-7ac6-4dec-b53c-fd3f4533f9c9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cMpBiGoHIAMFR2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6381bba3-69c2c2d05e55fd745caf1dce;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 07:09:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: w_Mb-0pBwp-pUyU2bdJ8MhrGHkk6VQgJmcGV9MfHwj_yGUMIYZkyrg==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 10:48:24 GMT
age: 17937
etag: "2f9532d698b4c28df23e18bbb66399ec776d5b9f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2