Overview

URL 142.93.253.50/Logins/Senha.php
IP142.93.253.50
ASNDIGITALOCEAN-ASN
Location United States
Report completed2022-09-30 08:37:43 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish
Scan Date Severity Indicator Comment
2022-09-29 2 142.93.253.50/Logins/Senha.php Outlook
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-09-30 2 142.93.253.50/Logins/Senha.php Phishing
mnemonic secure dns  No alerts detected
Quad9 DNS  No alerts detected


Files

No files detected



Passive DNS (9)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS 142.93.253.50 (5) 0 2022-06-25 02:16:43 UTC 2022-06-25 02:16:43 UTC 142.93.253.50 Unknown ranking
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-09-29 04:56:09 UTC 34.117.237.239
mnemonic passive DNS ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2022-09-30 04:20:26 UTC 93.184.220.29
mnemonic passive DNS img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-09-30 04:01:52 UTC 34.120.237.76
mnemonic passive DNS r3.o.lencr.org (4) 344 2020-12-02 08:52:13 UTC 2022-09-29 04:57:37 UTC 23.36.77.32
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-05-27 20:08:30 UTC 2022-09-30 04:56:18 UTC 143.204.55.115
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-09-30 05:34:07 UTC 143.204.55.110
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-09-29 05:06:32 UTC 35.164.146.235
mnemonic passive DNS auth.gfx.ms (5) 41421 2013-09-06 19:50:07 UTC 2022-09-30 05:53:30 UTC 104.110.18.148


Recent reports on same IP/ASN/Domain/Screenshot

Last 2 reports on IP: 142.93.253.50

Date UQ / IDS / BL URL IP
2022-09-30 08:37:43 +0000
0 - 0 - 2 142.93.253.50/Logins/Senha.php 142.93.253.50
2022-09-30 08:37:24 +0000
0 - 0 - 1 142.93.253.50/Logins/Entrar.php?U2v/FyQ5Tlvyn (...) 142.93.253.50

Last 5 reports on ASN: DIGITALOCEAN-ASN

Date UQ / IDS / BL URL IP
2022-11-30 15:11:10 +0000
0 - 0 - 22 128.199.72.185/pasang-iklan-judi-online/ 128.199.72.185
2022-11-30 15:02:32 +0000
0 - 0 - 1 192.241.206.77/gamepadtool/GamepadTool.win.la (...) 192.241.206.77
2022-11-30 15:02:27 +0000
0 - 0 - 1 192.241.206.77/gamepadtool/GamepadTool.osx.la (...) 192.241.206.77
2022-11-30 13:59:00 +0000
0 - 0 - 4 eu.lnslagging.click/za/i14s22/brand/loot/?ts= (...) 207.154.225.165
2022-11-30 13:58:15 +0000
0 - 0 - 4 besttestexperience.top/?u=rlgk605&o=9p8p5bv&c (...) 188.166.47.204

Last 2 reports on domain: 142.93.253.50.

Date UQ / IDS / BL URL IP
2022-09-30 08:37:43 +0000
0 - 0 - 2 142.93.253.50/Logins/Senha.php 142.93.253.50
2022-09-30 08:37:24 +0000
0 - 0 - 1 142.93.253.50/Logins/Entrar.php?U2v/FyQ5Tlvyn (...) 142.93.253.50

Last 1 reports with similar screenshot

Date UQ / IDS / BL URL IP
2022-09-29 09:26:35 +0000
0 - 0 - 2 143.198.169.66/Logins/Senha.php 143.198.169.66


JavaScript

Executed Scripts (6)


Executed Evals (0)


Executed Writes (3)

#1 JavaScript::Write (size: 62, repeated: 1) - SHA256: 9060f7f21935005d8aa85f5d626dcdc17518492b8f3f6c7208b9f2dfc3db68ce

                                        < style type = "text/css" > body {
    display: block!important;
} < /style>
                                    

#2 JavaScript::Write (size: 122, repeated: 1) - SHA256: db7fe17245a827cdd2ba4555f730e29f842f6d51f14540046d96c2eeaa8bb041

                                        < script type = "text/javascript"
src = "https://auth.gfx.ms/16.000.27497.00/ConvergedLoginPaginatedStrings.PT-BR.js" > < /script>
                                    

#3 JavaScript::Write (size: 106, repeated: 1) - SHA256: bdc5a7d5243dac249e7b7e31d346190d5e0c467695b8caf41c1511334b4ac5fb

                                        < script type = "text/javascript"
src = "https://auth.gfx.ms/16.000.27497.00/ConvergedLogin_PCore.js" > < /script>
                                    


HTTP Transactions (26)


Request Response
                                        
                                            GET /Logins/Senha.php HTTP/1.1 
Host: 142.93.253.50
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         142.93.253.50
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Fri, 30 Sep 2022 08:37:32 GMT
Server: Apache/2.4.29 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 6143
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4663)
Size:   6143
Md5:    983b10ce957c51da9bb87dbbd79be825
Sha1:   e60c89022820ee21fc3c4760cae1611ca7bd301d
Sha256: 3b0c9ae9282e735c86ef0500ebc7a22352594a897740e715b72e1d35d25f97f3

Alerts:
  Blocklists:
    - openphish: Outlook
    - fortinet: Phishing
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "A382476D14B6AE14003333E7ACDFBBD9AE8775D4C1A7D5C31116F33987043CFF"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7658
Expires: Fri, 30 Sep 2022 10:45:10 GMT
Date: Fri, 30 Sep 2022 08:37:32 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.115
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Fri, 30 Sep 2022 08:16:05 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 c9f2a4d2bcd548d1a3cbe1617a22f216.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: IsCBBuOyCBTJjjAOxTFrnDhqKXRpHnguiuVk2JQhVPNNkue0gpqusA==
Age: 1287


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    2d12f67fe57a87e7366b662d153a5582
Sha1:   d7b02d81cc74f24a251d9363e0f4b0a149264ec1
Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.110
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Fri, 30 Sep 2022 05:28:28 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: lRfnwvnErPS3nanXd-XGCTbOmM_sC-7RS5y_Uz4zAdOT7W-6oBU1aw==
age: 11345
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Fri, 30 Sep 2022 08:37:32 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /Logins/Senha_files/Converged1046.css HTTP/1.1 
Host: 142.93.253.50
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://142.93.253.50/Logins/Senha.php

                                         
                                         142.93.253.50
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Fri, 30 Sep 2022 08:37:32 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Mon, 21 Aug 2017 21:48:36 GMT
ETag: "153be-5574a70d8b500-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 16603
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (61112)
Size:   16603
Md5:    19b4d1c1da355d6b587f52337804f9e9
Sha1:   e468730f40bb1b18a5e6e851f9fc70ecfacc49d6
Sha256: 7b616be0f475f17af8e9f27a65c3059345b1169f78664cfaee99ba87ed291aa3
                                        
                                            GET /Logins/Senha_files/ConvergedLogin_PCore.js.download HTTP/1.1 
Host: 142.93.253.50
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://142.93.253.50/Logins/Senha.php

                                         
                                         142.93.253.50
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Fri, 30 Sep 2022 08:37:32 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Mon, 21 Aug 2017 21:48:36 GMT
ETag: "40d6d-5574a70d8b500-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  ASCII text, with very long lines (32002), with CRLF, LF line terminators
Size:   77993
Md5:    12c3ce9e6d85ca30b8850afbf48cbe23
Sha1:   2776374387c69637924f9a5ddaaa612182ec5937
Sha256: 714257a74f82eab7b09bf46d6c5f73d3413d1e4a69d4ed9c4bc2e718087945c7
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.115
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Fri, 30 Sep 2022 08:29:33 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Fri, 30 Sep 2022 08:42:47 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 4f01f770085624552bc30a98954f963a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: I6R8bnVZVO7je_djDECeEH5dpumTXoNPOEZ_o2vMzgPW4Lsb6KSp2Q==
Age: 480


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /Logins/Senha_files/microsoft_logo.svg HTTP/1.1 
Host: 142.93.253.50
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://142.93.253.50/Logins/Senha.php

                                         
                                         142.93.253.50
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Date: Fri, 30 Sep 2022 08:37:32 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Mon, 21 Aug 2017 21:48:36 GMT
ETag: "e43-5574a70d8b500"
Accept-Ranges: bytes
Content-Length: 3651
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (3651), with no line terminators
Size:   3651
Md5:    ee5c8d9fb6248c938fd0dc19370e90bd
Sha1:   d01a22720918b781338b5bbf9202b241a5f99ee4
Sha256: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
                                        
                                            GET /Logins/Senha_files/picker_account_msa.svg HTTP/1.1 
Host: 142.93.253.50
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://142.93.253.50/Logins/Senha.php

                                         
                                         142.93.253.50
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Date: Fri, 30 Sep 2022 08:37:33 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Mon, 21 Aug 2017 21:48:36 GMT
ETag: "17b-5574a70d8b500"
Accept-Ranges: bytes
Content-Length: 379
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (379), with no line terminators
Size:   379
Md5:    2d8f86059be176833897099ee6ddedeb
Sha1:   93a2e327027deed53076e86bfa7d9eebbf0cc4b9
Sha256: 34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1718
Cache-Control: 'max-age=158059'
Date: Fri, 30 Sep 2022 08:37:33 GMT
Last-Modified: Fri, 30 Sep 2022 08:08:55 GMT
Server: ECS (ska/F712)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: qbgSaFxQjZ//Gq0TcBfWeA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         35.164.146.235
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: VDu99ICZ5hH1fOUQhG451rg7gPc=

                                        
                                            GET /16.000.27497.00/ConvergedLoginPaginatedStrings.PT-BR.js HTTP/1.1 
Host: auth.gfx.ms
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://142.93.253.50/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.110.18.148
HTTP/1.1 503 Service Unavailable
Content-Type: text/html
                                        
Server: AkamaiGHost
Mime-Version: 1.0
Content-Length: 175
Expires: Fri, 30 Sep 2022 08:37:33 GMT
Date: Fri, 30 Sep 2022 08:37:33 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text
Size:   175
Md5:    73249715b7534f4013d4c0c497b17b9a
Sha1:   79f61bbee764efa0dde06b55f3387d1229ad81f5
Sha256: 8ed786caa62438c3d9aac94bc55ecf199b2c99923b08ff8db7b93402394e088b
                                        
                                            GET /16.000.27497.00/ConvergedLogin_PCore.js HTTP/1.1 
Host: auth.gfx.ms
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://142.93.253.50/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.110.18.148
HTTP/1.1 503 Service Unavailable
Content-Type: text/html
                                        
Server: AkamaiGHost
Mime-Version: 1.0
Content-Length: 175
Expires: Fri, 30 Sep 2022 08:37:34 GMT
Date: Fri, 30 Sep 2022 08:37:34 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text
Size:   175
Md5:    669625a1ba3addb5068907a772ab4496
Sha1:   757dcd3a6692c93ae3126bb0521da1dee9646e1b
Sha256: f0bd14b10e41bcf50b3d4cc7c8ced435bb198d50b41d46830c15a2716341efcc
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3876
Expires: Fri, 30 Sep 2022 09:42:10 GMT
Date: Fri, 30 Sep 2022 08:37:34 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3876
Expires: Fri, 30 Sep 2022 09:42:10 GMT
Date: Fri, 30 Sep 2022 08:37:34 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "25F075EFFBD8ACDED8F38D69EA17F673DE3E197B635274D4C52411EF577FE8E7"
Last-Modified: Thu, 29 Sep 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3876
Expires: Fri, 30 Sep 2022 09:42:10 GMT
Date: Fri, 30 Sep 2022 08:37:34 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff846d550-1085-41f0-ab5c-5cbdba5d3a00.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5094
x-amzn-requestid: 49ace90a-85a0-45ea-8c0d-6a498fb89042
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZPd60Eo9oAMFtkw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63361045-6b8a1c42300d4d6024186bfd;Sampled=0
x-amzn-remapped-date: Thu, 29 Sep 2022 21:38:13 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: RlSYyyYERUy_dGxSBuCqq7KOrtHEhq02w2Clbo5flJYC4NBmY-Pphg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 22:15:16 GMT
age: 37338
etag: "f15bb6564adddb9a3bb9949321482e65714c047a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5094
Md5:    39d9370f63a9d19ea9c05fa1926ce1d0
Sha1:   f15bb6564adddb9a3bb9949321482e65714c047a
Sha256: cf9353ff328f1afced61c19b48b2add29f4a212bd97cb4d874d5e7747850b3e7
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4f0344fb-c824-4eac-9d71-05a217499bf9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9281
x-amzn-requestid: 85c111f8-8883-4f7a-8e94-2e4e12e923b8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZPdZZF7-oAMF0Vw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63360f6f-5f4e26bd047866fb170cae01;Sampled=0
x-amzn-remapped-date: Thu, 29 Sep 2022 21:34:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: j2TJHo66aMJ_s9Vtr_Tqf0YbBcCwFTprSzk2aUNyOzEPgON6NW5Npw==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 22:21:29 GMT
age: 36965
etag: "6fbb164a7a1b894c6f5b2be20e66cbc8914f6a10"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9281
Md5:    7bb7bc234f1a5c9b04670d89d99c7957
Sha1:   6fbb164a7a1b894c6f5b2be20e66cbc8914f6a10
Sha256: c4e2ad314004e1e8c97c02575823f376379292c55ba4033362713d84f62e1432
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ae1e7d3-41cb-4400-8cae-870baa006b86.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7777
x-amzn-requestid: d035ce80-1700-4e69-8b75-e0bf47ca9ddf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZDCWCFw4oAMFVDA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63311759-0412900d669b5381058ec9a2;Sampled=0
x-amzn-remapped-date: Mon, 26 Sep 2022 03:07:05 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: qzrjS6zkJKNsHq2s5ooiWCPdM5nPY6isIJfpcGtUi4r4uvXkJBlS8w==
via: 1.1 73b60e9a9fd08eae9e034cedba707280.cloudfront.net (CloudFront), 1.1 9c675215120a4ade8754c4357ef2f3ea.cloudfront.net (CloudFront), 1.1 google
date: Fri, 30 Sep 2022 07:24:48 GMT
age: 4366
etag: "2973e908318c68489bba9b4242254769a4f3d1ba"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7777
Md5:    5a137925cb6116c46ce21c6e27933c44
Sha1:   2973e908318c68489bba9b4242254769a4f3d1ba
Sha256: 737bf9c3d2906a937ed0b082c8830982163be90acf8dd01dacc7ec80c5c8bcd1
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9789cead-4e6c-4a12-9b45-25d0efd38fc9.png HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 16011
x-amzn-requestid: d58dfdcd-383a-45ac-8ae2-2b97f016b6a4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZPdbjFy1IAMF84A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63360f7c-1ca9707a5e5087fd769d9ab6;Sampled=0
x-amzn-remapped-date: Thu, 29 Sep 2022 21:34:52 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: f7RrSV82yxUNWPUohKYX-_PBShMw7Qk82bepr3WAGkzHTjLR-gIXBA==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 ee8246c5442dace7525c74f6a799bb46.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 22:53:34 GMT
age: 35040
etag: "78b798f2cfa7db13a6b5ca2ca2783bece5e77d5d"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   16011
Md5:    1389b1d624b44706c7a6f6b7eb769241
Sha1:   78b798f2cfa7db13a6b5ca2ca2783bece5e77d5d
Sha256: c3c2526b98be06fc7e793e1150bacde2a7bd718e29a851a6e6992e8d84333790
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4b307b2d-4d65-4a44-bdc9-02e2eb3040fe.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6058
x-amzn-requestid: 5895a9dc-4ec5-41cb-b0fa-b3f47677affe
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZPda6H8toAMFz7g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63360f78-0941b5457484dc0c534333e2;Sampled=0
x-amzn-remapped-date: Thu, 29 Sep 2022 21:34:48 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1Raa8DphZfTmcxIv1z70MMHpeboGmlsoY7k24hpc4GvYqAv4x2NGZQ==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 22:05:17 GMT
age: 37937
etag: "64012d0a87c77d8409fa1be7d8d29124a81e3206"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6058
Md5:    a7660f52ff0ccc2805e4186bfaeb86f3
Sha1:   64012d0a87c77d8409fa1be7d8d29124a81e3206
Sha256: c4c2c65c2f830c5820dd019ada07607e31d338b824e2d66f7b4449c1026e123b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe12af206-9f17-40de-9764-14d3cdcb4d2f.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6722
x-amzn-requestid: 6aca2e04-02b4-4e42-8bba-9bbe2ace1ed0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZPeLrGq1oAMFuAw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633610b0-65b0664d0233107029ef0157;Sampled=0
x-amzn-remapped-date: Thu, 29 Sep 2022 21:40:00 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: AJBSzj2-oh3i6UOpOUtGTcsdTFfHlZhIQchgvcnIeF-4mnNKRly5HQ==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 29 Sep 2022 21:47:14 GMT
etag: "3248ca3a8b88efd5be8499898fce957d096cf211"
age: 39020
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6722
Md5:    5b8d0a19bc0a56bb40a975c5c71af05a
Sha1:   3248ca3a8b88efd5be8499898fce957d096cf211
Sha256: da44d6dd845dc400b0b76f19c67e5a79d9359ce24fe5e4490477f195b23203b4
                                        
                                            GET /16.000.27497.00/images/Backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5 HTTP/1.1 
Host: auth.gfx.ms
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://142.93.253.50/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.110.18.148
HTTP/1.1 503 Service Unavailable
Content-Type: text/html
                                        
Server: AkamaiGHost
Mime-Version: 1.0
Content-Length: 175
Expires: Fri, 30 Sep 2022 08:37:34 GMT
Date: Fri, 30 Sep 2022 08:37:34 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text
Size:   175
Md5:    1c2f2251e4728611042606d0c2006412
Sha1:   f3b2cb62eae2cef9bc682e88102e0d4b7a0a4016
Sha256: 22529b1a1ff86fdb43f4cc977442d61a22487485a32f8decd411a78dbc65f782
                                        
                                            GET /16.000.27497.00/images/Backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f HTTP/1.1 
Host: auth.gfx.ms
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://142.93.253.50/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.110.18.148
HTTP/1.1 503 Service Unavailable
Content-Type: text/html
                                        
Server: AkamaiGHost
Mime-Version: 1.0
Content-Length: 175
Expires: Fri, 30 Sep 2022 08:37:35 GMT
Date: Fri, 30 Sep 2022 08:37:35 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text
Size:   175
Md5:    10fea29dd8e7020159a899099355c89c
Sha1:   6a6e17085dd69494f85a786e596f78906bfa1fd1
Sha256: 315eabf4876dc54cf9a3e1365941adab48ccc73e97fb8f4e45f35eaf9cff404d
                                        
                                            GET /16.000.27497.00/images/favicon.ico HTTP/1.1 
Host: auth.gfx.ms
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://142.93.253.50/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         104.110.18.148
HTTP/1.1 503 Service Unavailable
Content-Type: text/html
                                        
Server: AkamaiGHost
Mime-Version: 1.0
Content-Length: 175
Expires: Fri, 30 Sep 2022 08:37:35 GMT
Date: Fri, 30 Sep 2022 08:37:35 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text
Size:   175
Md5:    ca6686555617826ce5e34b7c0203a9fe
Sha1:   734c4e381f16ec909471c98ef93d92b82d355094
Sha256: 2e014987b1d6343711bababd9ecad073ee77565590a489289c5cd4ec922013ed