Report - hlstatsx.css-bierwiese.de/

Report Overview

Submitted URL
hlstatsx.css-bierwiese.de/
IP
5.9.157.218
ASN
#24940 Hetzner Online GmbH
Submitted
2022-11-30 01:33:38
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
54

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	229 B	34.117.237.239
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	53 kB	34.120.237.76
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	682 B	1.1 kB	93.184.220.29
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	34.102.187.140
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191
94.249.194.218	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	11 kB	113 kB	94.249.194.218
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	34.214.236.46
hlstatsx.css-bierwiese.de	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	357 B	551 B	5.9.157.218
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.7 kB	4.4 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed
2022-11-30	medium	94.249.194.218	Sinkholed

JavaScript (5)

	URL	Size	First Seen	Last Seen
	94.249.194.218/hlstats/includes/js/tabs.js	3.1 kB	2023-03-10	2024-01-31
Pretty URL 94.249.194.218/hlstats/includes/js/tabs.js IP 94.249.194.218 ASN #12586 GHOSTnet GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 02:01:03 Last Seen2024-01-31 01:21:41 Times Seen59 Hash 7993f8012146f4439a57cb36ac246581 4d9fd22c09e13b042eab2c193deaf75a5e4e1b10 832008946ebc9885743f0f73711c31cf50582a0859185ce79d411e556c61d6ac Loading...

	94.249.194.218/hlstats/hlstats.php	33 B	2023-03-10	2023-04-01
Pretty URL 94.249.194.218/hlstats/hlstats.php IP 94.249.194.218 ASN #12586 GHOSTnet GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 02:01:03 Last Seen2023-04-01 10:35:36 Times Seen2 Hash e56e61b424c948058f7a491fd8407682 bb60d9e421728265b666cc65d363eebb1cf41e76 5a4408f05bdada05e6404017dabbd545fea4568e4e24968b98ab9b9edb669ed1 Loading...

	94.249.194.218/hlstats/includes/js/SqueezeBox.js	13 kB	2023-03-10	2024-01-31
Pretty URL 94.249.194.218/hlstats/includes/js/SqueezeBox.js IP 94.249.194.218 ASN #12586 GHOSTnet GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 02:01:03 Last Seen2024-01-31 01:21:41 Times Seen59 Hash e7bbc6dbbd279d1b2dca2cf0e7f76dfc e3e4d2a364d56c60c3beb561507343c6dbf85dcd 17e26f93def54415d0a261ac8d909f81d9e7dac2bcd09d7e7c6365d1b2297d98 Loading...

	94.249.194.218/hlstats/includes/js/mootools.js	67 kB	2023-03-10	2024-01-31
Pretty URL 94.249.194.218/hlstats/includes/js/mootools.js IP 94.249.194.218 ASN #12586 GHOSTnet GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 02:01:03 Last Seen2024-01-31 01:21:41 Times Seen59 Hash 2d3e9d76d5b27cceb3b0ba9fffb99fe2 21d060ce8ded8aa252986559bb382322590275b5 62223021cffa3d4da1476e147df4cbd8c278eabad9de3bcaf568a469a901bab9 Loading...

	94.249.194.218/hlstats/includes/js/heatmap.js	210 B	2023-03-10	2024-01-31
Pretty URL 94.249.194.218/hlstats/includes/js/heatmap.js IP 94.249.194.218 ASN #12586 GHOSTnet GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 02:01:03 Last Seen2024-01-31 01:21:41 Times Seen59 Hash 6ca95d885dc983fcef9a9a1fc2e19cca 75e1056f23ab864dacd924e6fcb64396e3c6e204 29aa708f02cc9dbb5b89b63cb35dfd1d6c2afb6fed6e1779f73fb98f95bbb60b Loading...

HTTP Transactions (46)

URL IP Response Size

hlstatsx.css-bierwiese.de/

5.9.157.218

301 Moved Permanently

324 B

URL HTTP/1.1
hlstatsx.css-bierwiese.de/
IP
5.9.157.218:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
324 B (324 bytes)
Hash
8f47d702e59cde4ce7c9d45a86b82254
df8b70c43dfc6c9a736cfe0d6efbcea352aea7c8
af99b8322b657993925216ae9e5e816af2c8e9608b2a98a8d1a349d7429eb968

HTTP Headers

GET / HTTP/1.1
Host: hlstatsx.css-bierwiese.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 30 Nov 2022 01:33:27 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 324
Connection: keep-alive
Location: http://94.249.194.218/hlstats/hlstats.php

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2d2e7649ce9e9ba6fc8b68aa89352e3c
0153d1d3d830a457043e16bb40d48a0b9ddef4b8
8eed57c91b42ef7b2d5eff1309e306e23e13c3de21219af24a693cbf3e8977fc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8EED57C91B42EF7B2D5EFF1309E306E23E13C3DE21219AF24A693CBF3E8977FC"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5190
Expires: Wed, 30 Nov 2022 02:59:57 GMT
Date: Wed, 30 Nov 2022 01:33:27 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
4ed065cb23b5fca1a179dd73b3c5b7b2
4422eb24688f5e056fc1b18b127c7f63b1dbf5e0
b723d770d0dec7441d8505dc5a4e7d34f55c9f564ec52f20d9b70c7c3a0d9d35

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4913
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 30 Nov 2022 01:33:27 GMT
Last-Modified: Wed, 30 Nov 2022 00:11:34 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9fce5679881bf302a8978a0b462f01a9
b699fe030ea13ac73813e655c42ed9b531925e2b
a3ec545a8f9364ac9062eddb41279e1465687a1b60f9c1dec6b3a3df8b033eb3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A3EC545A8F9364AC9062EDDB41279E1465687A1B60F9C1DEC6B3A3DF8B033EB3"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8041
Expires: Wed, 30 Nov 2022 03:47:28 GMT
Date: Wed, 30 Nov 2022 01:33:27 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 30 Nov 2022 01:19:38 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 829
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: /TSnKTWcpnfPjux06MzxpXwOvSo7gaHUP2brChq0ws70MtU691hRmKg10qO08XndePQin6n51/c=
x-amz-request-id: 1SS5J1S4MVWS8XJY
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 30 Nov 2022 00:45:01 GMT
age: 2906
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

94.249.194.218/hlstats/hlstats.php

94.249.194.218

200 OK

2.3 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstats.php
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (319)
Size
2.3 kB (2307 bytes)
Hash
8eb8e85e5393edb9886770cf274219e2
249eccb674020093e73a8377a20640abf35ebbdf
47d7471995b60dc0bef74e4b09224ddc805254eb6f9fffeedd974bf89423b024

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstats.php HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; path=/
ELstatsNEO_Visit=1; expires=Wed, 30-Nov-2022 01:38:27 GMT; Max-Age=300; path=/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2307
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 30 Nov 2022 01:33:27 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

94.249.194.218/hlstats/hlstats.css

94.249.194.218

200 OK

596 B

URL HTTP/1.1
94.249.194.218/hlstats/hlstats.css
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
ASCII text
Size
596 B (596 bytes)
Hash
e86104a554b202d4820f32aeca8e4849
07dc47b1bc6ee0e1c292f96134ad54f7570aa37a
b43f2c0360393ddf19e2401bad701cd0db5ca126835f90d3bbda7144f4f9c162

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstats.css HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Wed, 15 Oct 2014 00:24:54 GMT
ETag: "51d-5056b292ce180-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 596
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

94.249.194.218/hlstats/styles/sourcebans.css

94.249.194.218

200 OK

1.6 kB

URL HTTP/1.1
94.249.194.218/hlstats/styles/sourcebans.css
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
ASCII text, with CRLF line terminators
Size
1.6 kB (1594 bytes)
Hash
d0d19c971eb620c0614aa185d1f2852a
b2015b5408a4200f49575ff5d641ff3f017fb821
5341f8137a5bac915bd4f194dd14dbb65dd102d961f6d32e27376e5bec00e330

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/styles/sourcebans.css HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:50 GMT
ETag: "1a59-4fcf757fa8480-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1594
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

94.249.194.218/hlstats/css/SqueezeBox.css

94.249.194.218

200 OK

809 B

URL HTTP/1.1
94.249.194.218/hlstats/css/SqueezeBox.css
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
ASCII text, with CRLF line terminators
Size
809 B (809 bytes)
Hash
0e6be0736fc5aa1ee64c0e9d092fbfa3
be7e0bd9b1502d74edc05da5d7c324c89b1a1dca
bd27e44507aa61d8dcb2de3cb6ccfd4754e3fb79fad58ce8a7ab09fa3eadc028

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/css/SqueezeBox.css HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:42 GMT
ETag: "9b4-4fcf757807280-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 809
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

94.249.194.218/hlstats/includes/js/SqueezeBox.js

94.249.194.218

200 OK

3.7 kB

URL HTTP/1.1
94.249.194.218/hlstats/includes/js/SqueezeBox.js
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
ASCII text, with CRLF line terminators
Size
3.7 kB (3720 bytes)
Hash
f835d6ebbe22f89deef2a069da4c9d88
b8940654bfeebbb0843ceda6b7d7768a8f1d909e
0ca22d091c08d14354d5bec94d327d55b10dc7bd26e496ec4628153a37c718bf

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/includes/js/SqueezeBox.js HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "318e-4fcf757dc0000-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3720
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

94.249.194.218/hlstats/includes/js/heatmap.js

94.249.194.218

200 OK

181 B

URL HTTP/1.1
94.249.194.218/hlstats/includes/js/heatmap.js
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
ASCII text, with CRLF line terminators
Size
181 B (181 bytes)
Hash
dd10f3332c32e897c5ed40b2b9c2919c
26d27839511400f7e1b5fc8a3a7c833f83cb7080
15c3c802b54c2175b394c382d8533ec1622a852d36c5a939a62b68a5d4f4f2c7

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/includes/js/heatmap.js HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "d2-4fcf757dc0000-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 181
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

94.249.194.218/hlstats/includes/js/tabs.js

94.249.194.218

200 OK

1.2 kB

URL HTTP/1.1
94.249.194.218/hlstats/includes/js/tabs.js
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
ASCII text, with CRLF line terminators
Size
1.2 kB (1221 bytes)
Hash
6b41cad1dcc21e8c05ff8831656df738
bda96e37acb045c2f26764fd1114c1fbe181dbf5
bb32df991fbd5ef64467f1d5c6b122fb7a690fe352e126da2d71b9b8fe18efaf

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/includes/js/tabs.js HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "c2d-4fcf757dc0000-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1221
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript

94.249.194.218/hlstats/includes/js/mootools.js

94.249.194.218

200 OK

21 kB

URL HTTP/1.1
94.249.194.218/hlstats/includes/js/mootools.js
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
ASCII text, with very long lines (65375), with CRLF line terminators
Size
21 kB (20850 bytes)
Hash
7810a4f06f83be3e2c96648dc6d50f2e
a251bcff4bb8f268d8b1b1bc0b5fe4d52d050e8f
bda8c20436b59f3a4da16d115842862955561b38ffc3c01e7f3a5fcbd75bce97

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/includes/js/mootools.js HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "10553-4fcf757dc0000-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20850
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

94.249.194.218/hlstats/hlstatsimg/games/css_off/game.png

94.249.194.218

200 OK

1.1 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/games/css_off/game.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 24 x 21, 8-bit colormap, non-interlaced\012- data
Size
1.1 kB (1061 bytes)
Hash
47ef6aa08c9afef522066f707262b91f
0cfc20c990a20661f13a514be135b16de9418e0e
c5b4110cc15326cf572f2a72f025a3b6bdaa7bc58a0ba85510ebd0a51ae380cd

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/games/css_off/game.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Mon, 07 Sep 2020 13:40:07 GMT
ETag: "425-5aeb95b4ee88e"
Accept-Ranges: bytes
Content-Length: 1061
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/footer-small.png

94.249.194.218

200 OK

3.8 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/footer-small.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 120 x 28, 8-bit/color RGBA, non-interlaced\012- data
Size
3.8 kB (3795 bytes)
Hash
a78e6a94854c926df0289e0d7986cd4e
6e4e0ab3fb02112904c57537abd4764f4b4215bb
fed370bbbf0721d4336b8149ae8752ed557bc4865d12592d086e2c1f7feadb16

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/footer-small.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:42 GMT
ETag: "ed3-4fcf757807280"
Accept-Ranges: bytes
Content-Length: 3795
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/player.gif

94.249.194.218

200 OK

289 B

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/player.gif
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
GIF image data, version 89a, 16 x 16\012- data
Size
289 B (289 bytes)
Hash
4876c00ce5b2605ad8a7906b1f3c26c7
07bc9631c9dac9ec1e5dc461b79e6a6d9e2a9091
892fa4bf3dccfe4e177f4c5d5463813ce486bc6a44f09764357198561a491b34

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/player.gif HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "121-4fcf757dc0000"
Accept-Ranges: bytes
Content-Length: 289
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/gif

94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title-help.png

94.249.194.218

200 OK

1.2 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title-help.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 62 x 18, 8-bit colormap, non-interlaced\012- data
Size
1.2 kB (1168 bytes)
Hash
6df4e87666ef66301f017389eefa5c0d
d59750ac95b407e5aedafcfa44e60f2f3c4920ff
43b23b3f493032d3f2bc733d7dd276b61806fa654c4b0ce895ccf63db2dd8025

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/icons/sourcebans/title-help.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "490-4fcf757dc0000"
Accept-Ranges: bytes
Content-Length: 1168
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/downarrow.gif

94.249.194.218

200 OK

826 B

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/downarrow.gif
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
GIF image data, version 89a, 9 x 6\012- data
Size
826 B (826 bytes)
Hash
f5878e903dea67c973b1eff4271aea17
c722ef0e70b55dbd9be93b16f0de5702bb3a5187
74a4d0a034c45907bab5618ed99dd064c6516349cdc32234cb23be75c45f20a4

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/downarrow.gif HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:42 GMT
ETag: "33a-4fcf757807280"
Accept-Ranges: bytes
Content-Length: 826
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/gif

94.249.194.218/hlstats/hlstatsimg/games/dust2/game.png

94.249.194.218

200 OK

1.1 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/games/dust2/game.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 24 x 21, 8-bit colormap, non-interlaced\012- data
Size
1.1 kB (1061 bytes)
Hash
47ef6aa08c9afef522066f707262b91f
0cfc20c990a20661f13a514be135b16de9418e0e
c5b4110cc15326cf572f2a72f025a3b6bdaa7bc58a0ba85510ebd0a51ae380cd

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/games/dust2/game.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Mon, 07 Sep 2020 15:23:10 GMT
ETag: "425-5aebacbd357d5"
Accept-Ranges: bytes
Content-Length: 1061
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/games/ass1/game.png

94.249.194.218

200 OK

1.1 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/games/ass1/game.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 24 x 21, 8-bit colormap, non-interlaced\012- data
Size
1.1 kB (1061 bytes)
Hash
47ef6aa08c9afef522066f707262b91f
0cfc20c990a20661f13a514be135b16de9418e0e
c5b4110cc15326cf572f2a72f025a3b6bdaa7bc58a0ba85510ebd0a51ae380cd

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/games/ass1/game.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 06 Sep 2020 13:24:12 GMT
ETag: "425-5aea50488c969"
Accept-Ranges: bytes
Content-Length: 1061
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/games/random/game.png

94.249.194.218

200 OK

1.1 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/games/random/game.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 24 x 21, 8-bit colormap, non-interlaced\012- data
Size
1.1 kB (1061 bytes)
Hash
47ef6aa08c9afef522066f707262b91f
0cfc20c990a20661f13a514be135b16de9418e0e
c5b4110cc15326cf572f2a72f025a3b6bdaa7bc58a0ba85510ebd0a51ae380cd

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/games/random/game.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Mon, 07 Sep 2020 17:14:15 GMT
ETag: "425-5aebc591a0863"
Accept-Ranges: bytes
Content-Length: 1061
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title-contents.png

94.249.194.218

200 OK

1.3 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title-contents.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 81 x 18, 8-bit colormap, non-interlaced\012- data
Size
1.3 kB (1250 bytes)
Hash
85022c6cbf4bc43c43c973dcc683a69b
862629c71cf5a0978faa5496e2afd2893d20cd48
2028f041ac4399bdf16ae09dd1bb0b3659e4a1095a8e168ff9b977a1ade5e679

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/icons/sourcebans/title-contents.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "4e2-4fcf757dc0000"
Accept-Ranges: bytes
Content-Length: 1250
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/clan.gif

94.249.194.218

200 OK

1.1 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/clan.gif
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
GIF image data, version 89a, 16 x 16\012- data
Size
1.1 kB (1068 bytes)
Hash
1c29af25d474c283db40d6a68d197e77
fb4b17c59c80ddd05ad2829f10826dcf528fdf54
22c0da735e8a6b602794ff45a4b2d00494e83d9fd511efbd197e0cb4757aaaf1

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/clan.gif HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:42 GMT
ETag: "42c-4fcf757807280"
Accept-Ranges: bytes
Content-Length: 1068
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/gif

94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title.png

94.249.194.218

200 OK

54 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 320 x 42, 8-bit/color RGBA, non-interlaced\012- data
Size
54 kB (53530 bytes)
Hash
61ffa326bdb59ee536b26a9028768dcb
302561e9960bfc4bdfe5cc7fdf1d824fc3623539
1e1a9fd389d15c352db8f8b8cbb18144ac18b70193288ba69ef2888f3c06d390

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/icons/sourcebans/title.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "d11a-4fcf757dc0000"
Accept-Ranges: bytes
Content-Length: 53530
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title-search.png

94.249.194.218

200 OK

1.2 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/icons/sourcebans/title-search.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 66 x 18, 8-bit colormap, non-interlaced\012- data
Size
1.2 kB (1212 bytes)
Hash
9bec4e0b22862b4484ea255118e3328f
2b4e58b62a796278914822807416528359600016
164b47d4e0aa561f27cf2e0a6ff2c1ad5c95289214758ab019efda51b5f3c7bd

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/icons/sourcebans/title-search.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:48 GMT
ETag: "4bc-4fcf757dc0000"
Accept-Ranges: bytes
Content-Length: 1212
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstatsimg/games/Italy1/game.png

94.249.194.218

200 OK

1.1 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstatsimg/games/Italy1/game.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 24 x 21, 8-bit colormap, non-interlaced\012- data
Size
1.1 kB (1061 bytes)
Hash
47ef6aa08c9afef522066f707262b91f
0cfc20c990a20661f13a514be135b16de9418e0e
c5b4110cc15326cf572f2a72f025a3b6bdaa7bc58a0ba85510ebd0a51ae380cd

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/hlstatsimg/games/Italy1/game.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 06 Sep 2020 12:12:11 GMT
ETag: "425-5aea402feffe7"
Accept-Ranges: bytes
Content-Length: 1061
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/hlstats.php

94.249.194.218

200 OK

2.1 kB

URL HTTP/1.1
94.249.194.218/hlstats/hlstats.php
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (319)
Size
2.1 kB (2068 bytes)
Hash
0edbf6db53b264de943bfc65e7a5688b
8606f76b9f6df7460bd0d4bb553a66d19fc33b2f
e4cdb10db95a6044aec17fb96484166e23c9c3b3fb5419c870c9a3b48a907be3

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

POST /hlstats/hlstats.php HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 7
Origin: http://94.249.194.218
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2068
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

94.249.194.218/hlstats/styles/sourcebans/title-background.png

94.249.194.218

200 OK

218 B

URL HTTP/1.1
94.249.194.218/hlstats/styles/sourcebans/title-background.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 1 x 87, 8-bit/color RGB, non-interlaced\012- data
Size
218 B (218 bytes)
Hash
324969b23bd3f260b52847cbb89865ca
1f9b4b2ece8973b3efa0940a58913971930d04e6
7ae3a919ab9d0bf27e6d06ab837324b052faae59a00b320a9b2d0e0e3ecd70a3

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/styles/sourcebans/title-background.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/styles/sourcebans.css
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:50 GMT
ETag: "da-4fcf757fa8480"
Accept-Ranges: bytes
Content-Length: 218
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/styles/sourcebans/table_location.png

94.249.194.218

200 OK

278 B

URL HTTP/1.1
94.249.194.218/hlstats/styles/sourcebans/table_location.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 1 x 22, 4-bit colormap, non-interlaced\012- data
Size
278 B (278 bytes)
Hash
982e32b24e3c0d2b3714038a349eba16
6579b0ad934e0c7548b90dcda567f4db580e8d6b
7159ab480c74c76c0790d56ef14eac44bd2dfb78d82b25bed26e3f36e0fac63b

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/styles/sourcebans/table_location.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/styles/sourcebans.css
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:50 GMT
ETag: "116-4fcf757fa8480"
Accept-Ranges: bytes
Content-Length: 278
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/styles/sourcebans/location_under.png

94.249.194.218

200 OK

280 B

URL HTTP/1.1
94.249.194.218/hlstats/styles/sourcebans/location_under.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 1 x 15, 4-bit colormap, non-interlaced\012- data
Size
280 B (280 bytes)
Hash
911e5f3fede876c502903528ed31dee7
58a29d2e03f9f3c3a1f2eabb86b6fc392bbfa587
300432f78281f3cea9a114ca11aac9eb69a5d0bc1b03bf2eed559770b05adc83

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/styles/sourcebans/location_under.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/styles/sourcebans.css
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:50 GMT
ETag: "118-4fcf757fa8480"
Accept-Ranges: bytes
Content-Length: 280
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/styles/sourcebans/detail_head.png

94.249.194.218

200 OK

710 B

URL HTTP/1.1
94.249.194.218/hlstats/styles/sourcebans/detail_head.png
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
PNG image data, 24 x 24, 8-bit colormap, non-interlaced\012- data
Size
710 B (710 bytes)
Hash
c5fd986bbea4d238d8f158b7646e64dd
b4dc36b8a3a188ee5994279f12cd56d9f741f26f
482916d47851857f87374820f437a215faa2e44c737720dc98da5916eb5587ea

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/styles/sourcebans/detail_head.png HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/styles/sourcebans.css
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:50 GMT
ETag: "2c6-4fcf757fa8480"
Accept-Ranges: bytes
Content-Length: 710
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

94.249.194.218/hlstats/favicon.ico

94.249.194.218

200 OK

1.4 kB

URL HTTP/1.1
94.249.194.218/hlstats/favicon.ico
IP
94.249.194.218:0
ASN
#12586 GHOSTnet GmbH

File type
MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel\012- data
Size
1.4 kB (1406 bytes)
Hash
e051039c186b3b866ae8e39b9403ca25
c965fb223e4e55e6e820c6ac67cd1fc28ab9290d
a3a93600747590d926fa97d0eec7026b877d9872c670cfd1ab9d9ce45c806302

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /hlstats/favicon.ico HTTP/1.1
Host: 94.249.194.218
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://94.249.194.218/hlstats/hlstats.php
Cookie: PHPSESSID=smglad23mmt1hfb16iq2uef166; ELstatsNEO_Visit=1

HTTP/1.1 200 OK
Date: Wed, 30 Nov 2022 01:33:27 GMT
Server: Apache/2.4.10 (Debian)
Last-Modified: Sun, 29 Jun 2014 10:52:42 GMT
ETag: "57e-4fcf757807280"
Accept-Ranges: bytes
Content-Length: 1406
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/vnd.microsoft.icon

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
34.102.187.140:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 30 Nov 2022 01:08:56 GMT
cache-control: public,max-age=3600
age: 1471
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

55 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
HTML document, ASCII text
Size
55 B (55 bytes)
Hash
9f073354411bbaf7a319b1519f10b4b7
571498f38548829bf186f49f5be9d5fa6e689a68
4a7aaaa1c093dee8a191d4469c9f701c5e62e88896bc778a13cc4ffedf9be89a

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5888
Cache-Control: public, max-age=1209600
Content-Type: text/html
Date: Wed, 30 Nov 2022 01:33:28 GMT
Etag: "63866b9f-37"
Last-Modified: Tue, 29 Nov 2022 20:29:19 GMT
Server: ECS (ska/F707)
X-Cache: HIT
Content-Length: 55

push.services.mozilla.com/

34.214.236.46

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.214.236.46:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: TgJMgKr8UXFycMYewD2tzw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: cwZCgMWsQ1wNhbjbDFD+Yo60peM=

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2594
Expires: Wed, 30 Nov 2022 02:16:43 GMT
Date: Wed, 30 Nov 2022 01:33:29 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2594
Expires: Wed, 30 Nov 2022 02:16:43 GMT
Date: Wed, 30 Nov 2022 01:33:29 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ac3edd07bb0a4ebdaae6ec26e91d2079
b6efe3811dfa37cdcde1e9d411c171732ac7e12a
c5dbd471d178ae4505b28e30aee1e8eed77fffd81b9f7815ad2bda1a0d09a02c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C5DBD471D178AE4505B28E30AEE1E8EED77FFFD81B9F7815AD2BDA1A0D09A02C"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2594
Expires: Wed, 30 Nov 2022 02:16:43 GMT
Date: Wed, 30 Nov 2022 01:33:29 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe74cbd5b-36b7-497f-97d1-4e7073a47375.jpeg

34.120.237.76

200 OK

4.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe74cbd5b-36b7-497f-97d1-4e7073a47375.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.7 kB (4706 bytes)
Hash
9b96b63164d7dc37268951510afb359f
5991d60e238558f9fe4e1759fe18dde628cb7be4
cd7a88b3173bae9ad466d41b9ae9a2ed9e18157660697f1f1b070043194c3db4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe74cbd5b-36b7-497f-97d1-4e7073a47375.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4706
x-amzn-requestid: ce0b287a-7242-402b-8261-c519a1310309
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cYhHxETjoAMFcTw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63867bcb-7a69d6d14ad0fd707ede2882;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 21:38:19 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YOLFLV-a93jrA__gtWEzu2Vz8fpQJgvYGDk5fVsjhKVULRHdnKmfHw==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 21:44:35 GMT
age: 13734
etag: "5991d60e238558f9fe4e1759fe18dde628cb7be4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd170538c-f8cf-4acb-ba33-2ead00b9db73.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10958 bytes)
Hash
777ce44582c70bf01a31da4cab366f36
57e1d34f146d5ccd9943aa97bcc3158f7103bb07
fbdc8f65ae74dc13b7aafec464f08fdc9902af519946200ec52432ac3ca55982

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd170538c-f8cf-4acb-ba33-2ead00b9db73.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10958
x-amzn-requestid: abfea5b0-58f5-49e1-b78e-7cf456d03cb3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cYgFHF9oIAMF5lg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63867a20-5ab719292d440d083b07a478;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 21:31:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: e4GuUolL0WIMXvnF7BZ80j-dMMSILN2gd-1mqFwNns-zCUBsJa8iHQ==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 21:43:04 GMT
age: 13825
etag: "57e1d34f146d5ccd9943aa97bcc3158f7103bb07"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F52cf4797-5177-4859-9523-faeb4e38f224.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.8 kB (9812 bytes)
Hash
5c5277610f3a542571abb53ffb3d4df1
ce411cc5b0a37bbd89551d06d7d0349f45734e97
3bf1105631ef7fda0249a46390ca90f904ea73b0a4f017c2db85326550a80a3f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F52cf4797-5177-4859-9523-faeb4e38f224.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9812
x-amzn-requestid: 70bfeb68-0703-44bf-8550-50c759d52d86
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cYgDbFolIAMFYBQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63867a15-73fb65ee2b9161372819207f;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 21:31:01 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: jpQ-1qUf3ysXSe_j4z4PIc5e1zj0MaDF9qliEVxU_4RR66yWHwCWzg==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 21:44:35 GMT
etag: "ce411cc5b0a37bbd89551d06d7d0349f45734e97"
content-type: image/jpeg
age: 13734
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F13e1db4e-7108-464a-85b6-24ac0c4609f9.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.3 kB (9330 bytes)
Hash
bbe350ea797a0fec5a19a450fc5de4b4
2f3a39a528d3b759060203931de33c12303592e1
4d661dac2e19e07ae15d0f8cf00bd268c6c2defb2f5e4de38fcb6e7031dfd605

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F13e1db4e-7108-464a-85b6-24ac0c4609f9.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9330
x-amzn-requestid: 3fad352d-7664-43e0-9395-e840f671ca61
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cYgFQFIdoAMFSmw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63867a21-5e9847852f8435231d401fe6;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 21:31:13 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: mCEtSOenWKxay4vNy5mN9cexxXKXKt7TMuLaLw-M86tLKwQ2MwuxPg==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 22:11:32 GMT
age: 12117
etag: "2f3a39a528d3b759060203931de33c12303592e1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4f88ec5-5875-45d1-bcd3-d997040d6d42.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.7 kB (3719 bytes)
Hash
ceb8e975fb408de32c43f55febaa6414
453067f6ab356aa87a3ad3b56e33545376597852
e0ecbb6052b4fef75f58da8dae589c81ab9ec9d304de08f26c144a2c3ce9eaac

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4f88ec5-5875-45d1-bcd3-d997040d6d42.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3719
x-amzn-requestid: 6fab3454-fedd-4a1e-ae47-468ddd6233bc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cYgDaGQ4IAMFUkQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63867a15-4b313cf054d6301e71cdc0c1;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 21:31:01 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: KpgPP5VdjjU4rHaunbn3Yf-F5vLzZC7PhWu_QCF4WfuDHTqw3ufoyw==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 21:44:35 GMT
etag: "453067f6ab356aa87a3ad3b56e33545376597852"
content-type: image/jpeg
age: 13734
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fde294fb7-e851-4e57-83be-aa3374862dcb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.0 kB (7971 bytes)
Hash
9e135c29a8769eb12ef8c26f99097400
87447d20e9c0a6a6aeefe6ca107f93cd3598cd0d
ce41ff79c382efc54aa2fd3ab64293d2d2b706a7f21585f4bd8bbcd9a3566126

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fde294fb7-e851-4e57-83be-aa3374862dcb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7971
x-amzn-requestid: e47d10e4-2b60-4998-b5fa-5b145e60aac2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cYhgWHgGoAMFcLA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63867c68-5b9710a07b0a59730e73dce4;Sampled=0
x-amzn-remapped-date: Tue, 29 Nov 2022 21:40:56 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: OURSF_raDXrHV3-3ScaEdorNpW9ZKSIQjv6WUCQYHhruGz372BU_QA==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Tue, 29 Nov 2022 22:11:32 GMT
age: 12117
etag: "87447d20e9c0a6a6aeefe6ca107f93cd3598cd0d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (46)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size