Overview

URLugcibbjxtm.duckdns.org/
IP 66.150.66.64 (United States)
ASN#35913 DEDIPATH-LLC
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2023-01-18 11:28:55 UTC
StatusLoading report..
IDS alerts14
Blocklist alert5
urlquery alerts
11
Suspicious - DynDNS domain
Tags dyndns

Domain Summary (8)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2023-01-18 03:04:53 UTC 34.120.237.76
r3.o.lencr.org (7) 344 2020-12-02 08:52:13 UTC 2023-01-17 17:12:09 UTC 23.36.76.226
firefox.settings.services.mozilla.com (2) 867 2020-05-25 20:06:39 UTC 2023-01-18 03:04:51 UTC 35.241.9.150
ugcibbjxtm.duckdns.org (10) 0 2022-11-06 08:51:03 UTC 2023-01-18 07:13:46 UTC 66.150.66.64 Unknown ranking
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2023-01-18 03:04:50 UTC 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2023-01-18 03:04:50 UTC 34.117.237.239
ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2023-01-18 03:09:32 UTC 93.184.220.29
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2023-01-18 03:04:51 UTC 52.41.131.197

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-01-18 11:28:44 UTC 2 Client IP Internal IP ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain 
2023-01-18 11:28:44 UTC 3 Client IP Internal IP ET INFO DYNAMIC_DNS Query to *.duckdns. Domain 
2023-01-18 11:28:44 UTC 2 Client IP Internal IP ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain 
2023-01-18 11:28:44 UTC 3 Client IP Internal IP ET INFO DYNAMIC_DNS Query to *.duckdns. Domain 
2023-01-18 11:28:45 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:45 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 
2023-01-18 11:28:46 UTC 2 Client IP  66.150.66.64 ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-01-18 2 ugcibbjxtm.duckdns.org/ Phishing
2023-01-18 2 ugcibbjxtm.duckdns.org/noindex/css/fonts/Light/OpenSans-Light.woff Phishing
2023-01-18 2 ugcibbjxtm.duckdns.org/noindex/css/fonts/Bold/OpenSans-Bold.woff Phishing
2023-01-18 2 ugcibbjxtm.duckdns.org/noindex/css/fonts/Light/OpenSans-Light.ttf Phishing
2023-01-18 2 ugcibbjxtm.duckdns.org/noindex/css/fonts/Bold/OpenSans-Bold.ttf Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 66.150.66.64
Date UQ / IDS / BL URL IP
2023-03-12 23:40:31 +0000 11 - 14 - 5 untgvwcscv.duckdns.org/ 66.150.66.64
2023-03-11 14:25:05 +0000 11 - 14 - 5 bdyakkvoro.duckdns.org/ 66.150.66.64
2023-03-07 04:56:17 +0000 11 - 14 - 5 gluhpcwcga.duckdns.org/ 66.150.66.64
2023-03-06 23:38:20 +0000 11 - 14 - 5 tzomdxhvft.duckdns.org/ 66.150.66.64
2023-03-05 23:29:36 +0000 11 - 14 - 5 nkilhruqry.duckdns.org/ 66.150.66.64


Last 5 reports on ASN: DEDIPATH-LLC
Date UQ / IDS / BL URL IP
2023-03-28 14:24:27 +0000 0 - 0 - 49 www.on-kotayamatoo-co.jp.hai-song.com.cn/third.php 23.147.226.72
2023-03-28 14:23:50 +0000 0 - 0 - 1 www.to-kotayamata-co.jp.ythotel.com.cn/third.php 23.147.226.72
2023-03-28 08:59:34 +0000 0 - 0 - 1 185.161.70.67/b2f628/cronb.sh 185.161.70.67
2023-03-28 05:17:41 +0000 0 - 0 - 20 www.on-kotayamatoo-co.jp.hai-song.com.cn/card (...) 23.147.226.72
2023-03-27 18:14:03 +0000 0 - 4 - 0 neqquchsud.duckdns.org/ 193.239.146.81


Last 1 reports on domain: ugcibbjxtm.duckdns.org
Date UQ / IDS / BL URL IP
2023-01-18 11:28:55 +0000 11 - 14 - 5 ugcibbjxtm.duckdns.org/ 66.150.66.64


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-03-26 04:10:55 +0000 0 - 1 - 1 www.parcotigli.it/nais.crne/login.php?session (...) 213.32.71.224
2023-03-21 20:35:01 +0000 0 - 0 - 88 acnc.tech/ 162.241.217.207
2023-03-21 15:17:40 +0000 0 - 1 - 24 www.cmfoods.co.uk/cmde.imrc/5/login.php?sessi (...) 67.207.68.140
2023-03-21 12:36:06 +0000 0 - 1 - 0 polkainmajolka.si/nais.crne/login.php?session (...) 178.172.60.30
2023-03-21 00:22:43 +0000 0 - 0 - 1 pastebin.com/raw/s7znV8xF 172.67.34.170

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (29)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E069730519F658E767EC8EDB57EDD8E2B1CCB18D4F0ADE0920654EAC18F83456"
Last-Modified: Tue, 17 Jan 2023 07:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9322
Expires: Wed, 18 Jan 2023 14:04:07 GMT
Date: Wed, 18 Jan 2023 11:28:45 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EEE3CA879A67CC25EA89CB83DE9521EEA1B82845705C3E82169D4787ECB7DD3A"
Last-Modified: Mon, 16 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10416
Expires: Wed, 18 Jan 2023 14:22:21 GMT
Date: Wed, 18 Jan 2023 11:28:45 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "64DC0508D3FCEA1EC92FB60310E9B3F5454C0B69F61E8453FD443BC46AB9471B"
Last-Modified: Tue, 17 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9155
Expires: Wed, 18 Jan 2023 14:01:20 GMT
Date: Wed, 18 Jan 2023 11:28:45 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 18 Jan 2023 10:49:19 GMT
age: 2366
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    ff250d3ef3fa45322bf05039a0122a9f
Sha1:   b3e7a2c383bce1bab807dbe1a03c375258b51f1d
Sha256: d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
                                        
                                            GET / HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         66.150.66.64
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=UTF-8
                                        
Date: Wed, 18 Jan 2023 11:28:45 GMT
Server: Apache/2.4.6 (CentOS)
Last-Modified: Thu, 16 Oct 2014 13:20:58 GMT
ETag: "1321-5058a1e728280"
Accept-Ranges: bytes
Content-Length: 4897
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Size:   4897
Md5:    5f3664ed52f6df47c88ec162bb36add4
Sha1:   8e66f78c4d0f075066205823d110bc1902157fcf
Sha256: 9ec2f0698f1c3497de39a192dd1c3f3e4506ff1a84dbf85082344297dc52e681

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  Blocklists:
    - fortinet: Phishing
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: MgKd9ak3ZZMJUONYvj2sU8L6NZHOxI2OBVaLlu8uiv8zK2ViFaj3X7RFGKOiSb46bpDGD7dOWA8=
x-amz-request-id: XZS64GNKAETET5FH
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 18 Jan 2023 10:45:22 GMT
age: 2603
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    7b922915ebf1fa3639b333f994c74f24
Sha1:   144a3f80b98fd0652d4614f24cf6cbbee40f8938
Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Wed, 18 Jan 2023 11:28:45 GMT
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /noindex/css/open-sans.css HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/

search
                                         66.150.66.64
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Wed, 18 Jan 2023 11:28:45 GMT
Server: Apache/2.4.6 (CentOS)
Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT
ETag: "13d9-4fc0a3f32a9c0"
Accept-Ranges: bytes
Content-Length: 5081
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text
Size:   5081
Md5:    0ca7398a3e9ef11b70b5dfd1a052fe58
Sha1:   8bb7623c7027e927c0eced114d6011c57101a26f
Sha256: 65e9f0d6919c412dd5a04c322ce9cf9db80a1182f57778606a76110086c49fca

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Expires, Pragma, Content-Type, Backoff, Last-Modified, Cache-Control, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 18 Jan 2023 11:17:25 GMT
age: 680
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2044
Cache-Control: 'max-age=158059'
Date: Wed, 18 Jan 2023 11:28:46 GMT
Last-Modified: Wed, 18 Jan 2023 10:54:42 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /noindex/css/bootstrap.min.css HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/

search
                                         66.150.66.64
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT
ETag: "4b8d-4fc0a3f32a9c0"
Accept-Ranges: bytes
Content-Length: 19341
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (19170)
Size:   19341
Md5:    44c7856dea679ebcccf8fe201fbe1a7c
Sha1:   192a297f8aeda2bcdd0faa5320ffff825d24116f
Sha256: bc40aeafcd25bc944d0d6357298c1b198b4a1fe294e0b84015d04b72cf942c10

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: taifpgbSdVTzu965zP9WgA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         52.41.131.197
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: qO2jEMYM1odsSjA0aKM0BcRkmfo=

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/

search
                                         66.150.66.64
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 209
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   209
Md5:    18ffb59b61525f781cf9251045be575d
Sha1:   bd7318b00b15b7a1c8a48524419fa2e5c27a5b6d
Sha256: b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /images/poweredby.png HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/

search
                                         66.150.66.64
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT
ETag: "f74-4fc0a3f32a9c0"
Accept-Ranges: bytes
Content-Length: 3956
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive


--- Additional Info ---
Magic:  PNG image data, 88 x 31, 8-bit/color RGB, non-interlaced\012- data
Size:   3956
Md5:    5b1ca9f747c1b73dfa1c508765d9056a
Sha1:   6b319c943d8c69e212e7de8385802891dbafe8a3
Sha256: 5b720d579bbc1f8fee3b64df9290d41a28c747a5802589e48e05b7ebbfe9fc2f

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /noindex/css/fonts/Light/OpenSans-Light.woff HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/noindex/css/open-sans.css

search
                                         66.150.66.64
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 241
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   241
Md5:    d5d3f08fc8f1b36bac0b06b89d5384ca
Sha1:   cafebd0173cce7edfcbadcea5b8eabc4d7a20511
Sha256: c4183128dc59a2ce673414a77fcab7ca0250ef354ef636df49d2b83580734ee0

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  Blocklists:
    - fortinet: Phishing
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/noindex/css/open-sans.css

search
                                         66.150.66.64
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 239
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   239
Md5:    55e916743163813c7b8f4524f6e36b99
Sha1:   e1353703fda388ec26bf105b4132b0459f10163e
Sha256: b5b54ea0662073c401cabb250a4f107c4763241fa43418503ae5764cff7e9ee4

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  Blocklists:
    - fortinet: Phishing
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /images/apache_pb.gif HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/

search
                                         66.150.66.64
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Last-Modified: Tue, 17 Jun 2014 16:00:47 GMT
ETag: "916-4fc0a3f32a9c0"
Accept-Ranges: bytes
Content-Length: 2326
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  GIF image data, version 89a, 259 x 32\012- data
Size:   2326
Md5:    48bc8b181b36c9289866a2e30f6afedd
Sha1:   7bcc5d916d33ab08929a9f7c1d07c33ac1ba47ba
Sha256: 1654416fec35a8b5d36ee0257025cec63e56dfe8572b6ff67c6b0d0d43158cbb

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /noindex/css/fonts/Light/OpenSans-Light.ttf HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/noindex/css/open-sans.css

search
                                         66.150.66.64
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 240
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   240
Md5:    5a99182bd45553a369543ec2937fa690
Sha1:   c8766a2b6d830b3d38263d54b0e88c1e384664b7
Sha256: 67db0d028a14f7beb79f8bc441b5d687ca683511965d60e40faebec708d85612

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  Blocklists:
    - fortinet: Phishing
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            GET /noindex/css/fonts/Bold/OpenSans-Bold.ttf HTTP/1.1 
Host: ugcibbjxtm.duckdns.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ugcibbjxtm.duckdns.org/noindex/css/open-sans.css

search
                                         66.150.66.64
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 18 Jan 2023 11:28:46 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 238
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size:   238
Md5:    75a28665a8da5eb0e3200d8279c7ef42
Sha1:   ee945af618fe1976e31cd1c467ae0cd68a7fad29
Sha256: e163df3b08c83f6bdc15321fb0403d1dd059f2846037916a3d12ad2806cb5978

Alerts:
  urlquery:
    - Suspicious - DynDNS domain
  Blocklists:
    - fortinet: Phishing
  IDS:
    - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CA8AD2A520681EFA3BD19DC19B9414AE238D6EC5CF8D443103CABD16099C2117"
Last-Modified: Tue, 17 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7630
Expires: Wed, 18 Jan 2023 13:35:57 GMT
Date: Wed, 18 Jan 2023 11:28:47 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CA8AD2A520681EFA3BD19DC19B9414AE238D6EC5CF8D443103CABD16099C2117"
Last-Modified: Tue, 17 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7630
Expires: Wed, 18 Jan 2023 13:35:57 GMT
Date: Wed, 18 Jan 2023 11:28:47 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CA8AD2A520681EFA3BD19DC19B9414AE238D6EC5CF8D443103CABD16099C2117"
Last-Modified: Tue, 17 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7630
Expires: Wed, 18 Jan 2023 13:35:57 GMT
Date: Wed, 18 Jan 2023 11:28:47 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "CA8AD2A520681EFA3BD19DC19B9414AE238D6EC5CF8D443103CABD16099C2117"
Last-Modified: Tue, 17 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7630
Expires: Wed, 18 Jan 2023 13:35:57 GMT
Date: Wed, 18 Jan 2023 11:28:47 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6543a616-79f5-4c5d-8f34-be53cb4c622d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13111
x-amzn-requestid: 7a9bb405-c68d-496f-b608-e9d295c44c50
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e0MStGBBIAMFXag=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c4c0dd-75d87c0d763744951f13febd;Sampled=0
x-amzn-remapped-date: Mon, 16 Jan 2023 03:13:33 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: jkIL919Q7OFO6bACXTrDan0f9D9rgrN0DJMQv1DYPLeWqT1CywCAEg==
via: 1.1 1ec2938341958d70d56193d709c89dee.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 04:00:46 GMT
age: 26881
etag: "aa47af3e7517390d10e89f0f18237cfdcc63cbed"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13111
Md5:    d134f7ac9a5ca8ab7a9461bd20706bb7
Sha1:   aa47af3e7517390d10e89f0f18237cfdcc63cbed
Sha256: 3431c8027f09bb284fe48ef8e4458fd43d8cc961250601b3028b83a7ba19f6ce
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4ce66831-56e0-4f6e-ba05-da99c3485e5e.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3599
x-amzn-requestid: 5b743b27-b6d4-4d98-9984-3a5e17cb28e6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e6A1xH8BIAMFuZQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c714f1-2f1031db0871abae4760d5b6;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 21:36:49 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: jyWosZVSdPHomvHRyf-MuxVp0gR7sKIJ0-jmMStDeixhd8Bhoqzitg==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Tue, 17 Jan 2023 22:01:09 GMT
age: 48458
etag: "ce4aadc6b3500508d1c4b42b76f09be4414b6eee"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3599
Md5:    928e970121a035e9f8d537e4bfe6bf5c
Sha1:   ce4aadc6b3500508d1c4b42b76f09be4414b6eee
Sha256: 2da1438b17cf05aed64e565350dcc706420f2bae7e8c5e36d1b5bad38248c275
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc498ee0b-a2b9-47cf-8161-03c86caa8c9f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5213
x-amzn-requestid: 324586fa-41fa-4995-a9d9-3bfbddea69f0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e0LSaEdgIAMFnjw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c4bf42-51c2249d0761a5146a8d20fb;Sampled=0
x-amzn-remapped-date: Mon, 16 Jan 2023 03:06:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: LXZFvt44IpTLZioHxzJ4q7GakB_10TdOSufsVcm0dY9LBgOoDQtmYg==
via: 1.1 0cf6c59c77f0fff670ae085179adc458.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 04:05:17 GMT
age: 26610
etag: "7e7c3f015d1478c7dc0c108fc0bf6e74cb00d37a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5213
Md5:    822378a3438fdf79b5ae81c485cf9a9c
Sha1:   7e7c3f015d1478c7dc0c108fc0bf6e74cb00d37a
Sha256: 345345df1e67f4700a81059901cc4050196910c9dd2f635197301c21e420eee4
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce2d78c9-2134-471e-bdb1-875c1b61ff8b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5663
x-amzn-requestid: 9a1c75a4-1c8d-4bd2-b6ca-7fccb8b43c12
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e6A0gF5goAMFveA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c714e9-1d274e8074771db651e80979;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 21:36:41 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: sAxuQECVKx0dfc2UM_E_70nKN8za1SBN4opMWr_74gT5ScurgZGVLw==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 17 Jan 2023 21:46:36 GMT
age: 49331
etag: "cc6b64ff3f09853843b62e555456a1ad9f0909fb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5663
Md5:    4ec6c49f056e786896d54fe22c242391
Sha1:   cc6b64ff3f09853843b62e555456a1ad9f0909fb
Sha256: 42f0571efba18630c8deee17e98c6939a7050b04f613ad10515caf503e496b4d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1983f844-6675-400d-b957-26ce8e636ae7.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8939
x-amzn-requestid: 5fbb2a5d-5731-4fb0-8b95-cc59338862de
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e6A1nGMvoAMFrQA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c714f0-14de6c94416a9ced1c284d5b;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 21:36:48 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 9a9h9cp9BmYqM6hR_X8VOYLSvbH8PxNs0AYpdil6CjSEy0zuZkSvsg==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 17 Jan 2023 21:52:59 GMT
age: 48948
etag: "55b5ce93ba3ab53b227aa1fdb60b6062d35ae2f0"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8939
Md5:    015e1f23253643036d718d5a785be61b
Sha1:   55b5ce93ba3ab53b227aa1fdb60b6062d35ae2f0
Sha256: 78045e55e5e9966b1fddb9e3f734972611ea78e7cb78b92beb2e4adf56f724ed
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1a78cd6d-1eab-47b0-b5c7-f2d1f91acc3a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8853
x-amzn-requestid: ff98ec33-294a-4a13-b064-3cd4744cd2b2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e0LLKHPnIAMF0vQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c4bf14-233cbc6407c6b138144d7abb;Sampled=0
x-amzn-remapped-date: Mon, 16 Jan 2023 03:05:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QZZaGtGl3Z-4G4DxO4R_gjfDdQVgJc30Ur9EyLAvbGFhv4LfaXziPQ==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 04:00:29 GMT
age: 26898
etag: "dacc584338546bf60f26b2a0bec48e9b584640dc"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8853
Md5:    3f112ea3865f38cbbcc8400b58320fa0
Sha1:   dacc584338546bf60f26b2a0bec48e9b584640dc
Sha256: 7feb3c0691f40354701d1cb0bf3c834d1eeead4a7297fac3afc0f4a7ca2c94cb