r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 5ceaca9fd4ad000cb435820812fc69c8
8168397aaf7b572c89a9c83f46c0b65e4ac509f2
9c4e52e7e17158307d752db0bc3d1fbedae4f305cc301fd73b260f73ab796492
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9C4E52E7E17158307D752DB0BC3D1FBEDAE4F305CC301FD73B260F73AB796492"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4189
Expires: Wed, 07 Dec 2022 16:30:40 GMT
Date: Wed, 07 Dec 2022 15:20:51 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 2630c6482aef4e822d6634e417f65ab6
6bd1264568eb9647d1665e51521b3bfc15d4df4a
e00eaad18ffa9f5181fe540b156608df88565b09e98ca78b87eba97f3fbc6e79
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E00EAAD18FFA9F5181FE540B156608DF88565B09E98CA78B87EBA97F3FBC6E79"
Last-Modified: Wed, 07 Dec 2022 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20916
Expires: Wed, 07 Dec 2022 21:09:27 GMT
Date: Wed, 07 Dec 2022 15:20:51 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash a0abf10fb7e96c1c98dacf2f013a68b4
acdd839bce85eadc78a8e821e32e00a958d5c0c8
b85d98f8df05431777d96c767ce4c152302ec3f653cdf6e61c8c3fa9574f3255
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B85D98F8DF05431777D96C767CE4C152302EC3F653CDF6E61C8C3FA9574F3255"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5375
Expires: Wed, 07 Dec 2022 16:50:26 GMT
Date: Wed, 07 Dec 2022 15:20:51 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 07 Dec 2022 15:08:03 GMT
content-type: application/json
age: 768
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: hI+wyXTvLbWEZFHgfVTzitJbM1be4EddTEACF96qVH/F/U0jcR+x0LR9+Cfab4u9z1Enb9wYA/s=
x-amz-request-id: PMXKWK0TM5M9BDGG
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 07 Dec 2022 14:49:24 GMT
age: 1887
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
ulqmpxoz.com/
34.149.198.43200 OK 2.5 kB IP 34.149.198.43:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5034), with no line terminators
Hash aaf8006d42a00e20de3b9ca18aadce8f
10da280f0a17c6ae6f623c10c43abc54eec16620
6b0600e475043c519a873f78a20d5321d941581defab00b9b6cf69be05283141
Analyzer Verdict Alert quad9 Sinkholed
GET / HTTP/1.1
Host: ulqmpxoz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Wed, 07 Dec 2022 15:20:51 GMT
Content-Type: text/html
Last-Modified: Wed, 24 Aug 2022 10:00:55 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
ETag: W/"6305f6d7-1480"
Cache-Control: no-cache
Content-Encoding: gzip
Via: 1.1 google
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 07 Dec 2022 15:20:51 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
ocsp2.globalsign.com/gsorganizationvalsha2g2
104.18.20.226200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP 104.18.20.226:0
Hash 3725fbdbae92b82ea1d32d3d9521d861
80803fc60fb4a0cae30833f73d3fc384300c8b1c
8976179a41e23f242cc90df3723531f7f7e624585096e896a4652ee9359deca9
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:51 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Sun, 11 Dec 2022 12:11:23 GMT
ETag: "80803fc60fb4a0cae30833f73d3fc384300c8b1c"
Last-Modified: Wed, 07 Dec 2022 12:11:24 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2611
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 775e3f6b0d6fb4fa-OSL
ocsp2.globalsign.com/gsorganizationvalsha2g2
104.18.20.226200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP 104.18.20.226:0
Hash 3725fbdbae92b82ea1d32d3d9521d861
80803fc60fb4a0cae30833f73d3fc384300c8b1c
8976179a41e23f242cc90df3723531f7f7e624585096e896a4652ee9359deca9
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:51 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Sun, 11 Dec 2022 12:11:23 GMT
ETag: "80803fc60fb4a0cae30833f73d3fc384300c8b1c"
Last-Modified: Wed, 07 Dec 2022 12:11:24 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2611
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 775e3f6b19941c0e-OSL
ocsp2.globalsign.com/gsorganizationvalsha2g2
104.18.20.226200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP 104.18.20.226:0
Hash 3725fbdbae92b82ea1d32d3d9521d861
80803fc60fb4a0cae30833f73d3fc384300c8b1c
8976179a41e23f242cc90df3723531f7f7e624585096e896a4652ee9359deca9
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:51 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Sun, 11 Dec 2022 12:11:23 GMT
ETag: "80803fc60fb4a0cae30833f73d3fc384300c8b1c"
Last-Modified: Wed, 07 Dec 2022 12:11:24 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2611
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 775e3f6b19860b59-OSL
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 07 Dec 2022 15:07:58 GMT
age: 773
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
47.246.44.251200 OK 2.6 kB URL HTTP/2 g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
IP 47.246.44.251:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type Unicode text, UTF-8 text, with very long lines (5590), with no line terminators
Hash f49861f7636aadb27a024d3d327fbb25
82d26ff970d346ff9499dabd512da4d4f2d510fd
0c13df5677c2932a7340feb5c20541ef8ce0fff70c86ba3d5b42482b81d0fb4e
GET /woodpeckerx/jssdk/plugins/performance.js HTTP/1.1
Host: g.alicdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ulqmpxoz.com
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: application/javascript
content-length: 2599
date: Wed, 07 Dec 2022 15:13:32 GMT
vary: Accept-Encoding
x-oss-request-id: 6390AD9CB3DB4D3434134E54
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 2070989353891993244
x-oss-storage-class: Standard
cache-control: max-age=86400,s-maxage=600
content-md5: 72grTNXk41NbFNiTZX/juA==
x-oss-server-time: 2
content-encoding: gzip
access-control-allow-origin: *
x-bucket-code: 3
ali-swift-global-savetime: 1670426012
via: cache25.l2de2[0,0,200-0,H], cache4.l2de2[1,0], cache4.l2de2[1,0], cache5.se1[0,0,200-0,H], cache3.se1[3,0]
age: 439
x-cache: HIT TCP_MEM_HIT dirn:11:360976463
x-swift-savetime: Wed, 07 Dec 2022 15:14:02 GMT
x-swift-cachetime: 570
timing-allow-origin: *
eagleid: 2ff62c9716704264517291026e
X-Firefox-Spdy: h2
g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
47.246.44.251200 OK 2.3 kB URL HTTP/2 g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
IP 47.246.44.251:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type Unicode text, UTF-8 text, with very long lines (4876), with no line terminators
Hash f78716c5a1fff72e097316f24b9aee5a
b2990170c010e0adfe42d936917255e1e11a3ee0
d8a7ce594fcb6c837841cf554a72f68f0aea2068c2ce2a6fd363717ff3d5d090
GET /woodpeckerx/jssdk/plugins/globalerror.js HTTP/1.1
Host: g.alicdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ulqmpxoz.com
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: application/javascript
content-length: 2327
date: Wed, 07 Dec 2022 15:13:32 GMT
vary: Accept-Encoding
x-oss-request-id: 6390AD9C601F623031DF5DDB
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 3550805993065637141
x-oss-storage-class: Standard
cache-control: max-age=86400,s-maxage=600
content-md5: pHvdOGTILjKRxbGaMvxS0w==
x-oss-server-time: 2
content-encoding: gzip
access-control-allow-origin: *
x-bucket-code: 3
ali-swift-global-savetime: 1670426012
via: cache3.l2de2[0,0,200-0,H], cache8.l2de2[0,0], cache8.l2de2[1,0], cache5.se1[0,0,200-0,H], cache3.se1[2,0]
age: 439
x-cache: HIT TCP_MEM_HIT dirn:4:356110385
x-swift-savetime: Wed, 07 Dec 2022 15:14:02 GMT
x-swift-cachetime: 570
timing-allow-origin: *
eagleid: 2ff62c9716704264517301027e
X-Firefox-Spdy: h2
g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
47.246.44.251200 OK 14 kB URL HTTP/2 g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
IP 47.246.44.251:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type Unicode text, UTF-8 text, with very long lines (38201), with no line terminators
Hash d8012ba35338072216df325d67843cd9
cdfe0d09e370775fa0c45ca3e8ac9f08462646f4
c3e884d2f7ae455bdfcc01388a2f27d082d4b0993b9e49dbd25a252e1fc8da7a
GET /woodpeckerx/jssdk/wpkReporter.js HTTP/1.1
Host: g.alicdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://ulqmpxoz.com
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: application/javascript
content-length: 14109
date: Wed, 07 Dec 2022 15:18:55 GMT
vary: Accept-Encoding
x-oss-request-id: 6390AEDFCA02BA3034EB0F92
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 9067772452337582436
x-oss-storage-class: Standard
cache-control: max-age=86400,s-maxage=600
content-md5: cORM7hjRZUESVhoCM898HQ==
x-oss-server-time: 1
content-encoding: gzip
access-control-allow-origin: *
x-bucket-code: 3
ali-swift-global-savetime: 1670426335
via: cache3.l2de2[0,0,200-0,H], cache11.l2de2[2,0], cache11.l2de2[2,0], cache7.se1[0,0,200-0,H], cache3.se1[2,0]
age: 116
x-cache: HIT TCP_MEM_HIT dirn:5:31653889
x-swift-savetime: Wed, 07 Dec 2022 15:19:47 GMT
x-swift-cachetime: 548
timing-allow-origin: *
eagleid: 2ff62c9716704264517331030e
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 053aff7451e55d4269dd9610ab070f3f
b3376256d11d159b0c7280ba1515b78d7d9e12ca
24114ca560fe70d03185bd66985603fd5a03dc310aa9a8ea7a7b3723ed46ce3e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4117
Cache-Control: max-age=154476
Content-Type: application/ocsp-response
Date: Wed, 07 Dec 2022 15:20:51 GMT
Etag: "639057aa-1d7"
Expires: Fri, 09 Dec 2022 10:15:27 GMT
Last-Modified: Wed, 07 Dec 2022 09:06:50 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
35.86.38.2101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.86.38.2:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Zzr8kyeG8ZU4Wy79SEZZZQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: HkIz0lsZt7+sbp0mOKbWGN8uenQ=
ocsp2.globalsign.com/gsorganizationvalsha2g2
104.18.20.226200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP 104.18.20.226:0
Hash d67c9f66aa2d5554573e805902d521bc
66d8b8789568bfe7c7fdc0f2f87a77a68c2f054a
784f5d4aa16263f20530667d66a7adc60a9019325c8d4f9bc03c597295d25fb4
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Sun, 11 Dec 2022 12:54:36 GMT
ETag: "66d8b8789568bfe7c7fdc0f2f87a77a68c2f054a"
Last-Modified: Wed, 07 Dec 2022 12:54:37 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 775e3f6d3840b4fa-OSL
ocsp2.globalsign.com/gsorganizationvalsha2g2
104.18.20.226200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP 104.18.20.226:0
Hash d67c9f66aa2d5554573e805902d521bc
66d8b8789568bfe7c7fdc0f2f87a77a68c2f054a
784f5d4aa16263f20530667d66a7adc60a9019325c8d4f9bc03c597295d25fb4
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Sun, 11 Dec 2022 12:54:36 GMT
ETag: "66d8b8789568bfe7c7fdc0f2f87a77a68c2f054a"
Last-Modified: Wed, 07 Dec 2022 12:54:37 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 775e3f6d3beb1c0e-OSL
image.uc.cn/s/uae/g/3o/berg/static/archer_index.b0a57cbbe8efd7017472.js
47.246.44.224200 OK 10 kB URL HTTP/2 image.uc.cn/s/uae/g/3o/berg/static/archer_index.b0a57cbbe8efd7017472.js
IP 47.246.44.224:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type Unicode text, UTF-8 text, with very long lines (24206)
Hash 4ad542712c03f776bf7c7c91c2948534
4c41b15848b7c3ca29246c20795acf0d67ddc018
31599310289aa4155e6f297cae356a6ee597a7da314f356e629042b69fb5f7a2
GET /s/uae/g/3o/berg/static/archer_index.b0a57cbbe8efd7017472.js HTTP/1.1
Host: image.uc.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: text/javascript
content-length: 10285
date: Fri, 02 Dec 2022 10:13:14 GMT
etag: 63f0ea27-7f1b
expires: Sun, 28 Aug 2022 14:08:05 GMT
cache-control: max-age=8640000
vary: Accept-Encoding
access-control-allow-origin: *
ali-swift-global-savetime: 1669975994
via: cache9.l2ot7-1[0,0,304-0,H], cache37.l2ot7-1[1,0], cache3.se1[0,0,200-0,H], cache7.se1[1,0]
content-encoding: gzip
age: 66
x-cache: HIT TCP_MEM_HIT dirn:1:26704777
x-swift-savetime: Fri, 02 Dec 2022 10:14:40 GMT
x-swift-cachetime: 8639914
timing-allow-origin: *
eagleid: 2ff62c9b16704264522135963e
X-Firefox-Spdy: h2
image.uc.cn/s/uae/g/3o/berg/static/index.e39146d1af90e9bff26d.css
47.246.44.224200 OK 1.0 kB URL HTTP/2 image.uc.cn/s/uae/g/3o/berg/static/index.e39146d1af90e9bff26d.css
IP 47.246.44.224:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type ASCII text, with very long lines (2268), with no line terminators
Hash 9b2f608962d3087b1b58069d2b6f9137
95e84ba42f2c1492686a536cfc3b35d7aac5d730
4eae767d1b55c5c4ed7efdd60ed4b92190e3055d252c0f0735d1460bf044df0d
GET /s/uae/g/3o/berg/static/index.e39146d1af90e9bff26d.css HTTP/1.1
Host: image.uc.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: text/css
content-length: 1014
date: Fri, 02 Dec 2022 10:13:14 GMT
etag: 19c47a7f-8dc
expires: Sun, 28 Aug 2022 14:08:04 GMT
cache-control: max-age=8640000
vary: Accept-Encoding
access-control-allow-origin: *
ali-swift-global-savetime: 1669975994
via: cache1.l2ot7-1[0,0,304-0,H], cache3.l2ot7-1[1,0], cache4.se1[0,0,200-0,H], cache7.se1[1,0]
content-encoding: gzip
age: 66
x-cache: HIT TCP_MEM_HIT dirn:4:163751989
x-swift-savetime: Fri, 02 Dec 2022 10:14:40 GMT
x-swift-cachetime: 8639914
timing-allow-origin: *
eagleid: 2ff62c9b16704264522155964e
X-Firefox-Spdy: h2
ocsp.globalsign.com/gsrsaovsslca2018
104.18.20.226200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP 104.18.20.226:0
Hash 44bad493266cd20d9ecea3806f425dc1
1877579df7f72dbe0f4c897760dc7707370a84a0
538872c3a325a089994773b480816e6f00fe666758febf63501c1a6770d22600
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:52 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Sun, 11 Dec 2022 13:26:40 GMT
ETag: "1877579df7f72dbe0f4c897760dc7707370a84a0"
Last-Modified: Wed, 07 Dec 2022 13:26:41 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2872
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 775e3f6f69f4b512-OSL
px.effirst.com/api/v1/jconfig?wpk-header=app%3Dberg-download%26tm%3D1670426451%26ud%3Deff03272-414b-41e3-8ca7-00a275c39753%26sver%3D1.2.1%26sign%3Dc41e43c828c16c16a6eb1c9c1e68e8ce
106.8.139.29200 OK 130 B URL HTTP/1.1 px.effirst.com/api/v1/jconfig?wpk-header=app%3Dberg-download%26tm%3D1670426451%26ud%3Deff03272-414b-41e3-8ca7-00a275c39753%26sver%3D1.2.1%26sign%3Dc41e43c828c16c16a6eb1c9c1e68e8ce
IP 106.8.139.29:0
File type JSON data\012- , Unicode text, UTF-8 text
Hash 04cc1e34677b23803e7715ad8358b532
64a287c5ecca8549d3d618320d62143bc75c27a4
4045ffc963669b8c2768835649bb10298ee733b22f882a0be657462d749c8aa7
GET /api/v1/jconfig?wpk-header=app%3Dberg-download%26tm%3D1670426451%26ud%3Deff03272-414b-41e3-8ca7-00a275c39753%26sver%3D1.2.1%26sign%3Dc41e43c828c16c16a6eb1c9c1e68e8ce HTTP/1.1
Host: px.effirst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://ulqmpxoz.com
Connection: keep-alive
Referer: http://ulqmpxoz.com/
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:52 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE
Content-Encoding: gzip
hm.baidu.com/hm.js?42296466acbd6a1e84224ab1433a06cc
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?42296466acbd6a1e84224ab1433a06cc
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (622)
Hash 9975ec0e87aae320bec71c34e2c5beea
57488ffbf71f132f95d2b96b6258a9c3b8d2b7b1
e9d3157afb971324b2ae43036347643410d4c0e014df8f6799bdb2838b0425bc
GET /hm.js?42296466acbd6a1e84224ab1433a06cc HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11260
Content-Type: application/javascript
Date: Wed, 07 Dec 2022 15:20:52 GMT
Etag: 239ef2497f8878ef4894fbca16aa5cdf
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=6FDBAC14F42C8BD7; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2745
Expires: Wed, 07 Dec 2022 16:06:38 GMT
Date: Wed, 07 Dec 2022 15:20:53 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2745
Expires: Wed, 07 Dec 2022 16:06:38 GMT
Date: Wed, 07 Dec 2022 15:20:53 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2745
Expires: Wed, 07 Dec 2022 16:06:38 GMT
Date: Wed, 07 Dec 2022 15:20:53 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2745
Expires: Wed, 07 Dec 2022 16:06:38 GMT
Date: Wed, 07 Dec 2022 15:20:53 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg
34.120.237.76200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b15136d60fd0a5e0f657a4f5c75d540f
36082b7329d473829178f280cb71a83b1531e486
79478269b1f5dcfd1e45ccd4264fa44805b37c5c8fec820bcbd2fa1689dfbbd8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11224
x-amzn-requestid: 938de0b8-1055-4416-9ad7-162ab5f4db9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csUINEwdoAMFuOw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e6701-38b079ef341bb17e567de773;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:47:45 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ViuPsZBEVJ-aGOcsfrl3nXu244mzMUMQVhpPeNlO7W3sBrrfuUfXpA==
via: 1.1 f0ac467993db44dbfc36b778dfcaf73c.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 22:32:04 GMT
age: 60529
etag: "36082b7329d473829178f280cb71a83b1531e486"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg
34.120.237.76200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 210b27f5f6310d8fad640acce3d9ae0e
08d241e56622cb900754d95bc5d58ed8826d9f32
64410e13759cdfa24976dcba0c64aca27edc3ee56358f344e55f60793422e3ea
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6557
x-amzn-requestid: 0232ddcd-8274-431e-a55e-8298fbfd6dfc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cmcuMG6bIAMFUng=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638c0e5a-3cc17121425f87321ce7ae7e;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 03:04:58 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: va_vly0iX6rzm_aTWrryPRjoTWlI-_0m6rpS6VrTx-nsd71dk1cSZw==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 06:11:41 GMT
age: 32952
etag: "08d241e56622cb900754d95bc5d58ed8826d9f32"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F079bc299-d390-4250-a91a-db3c535c9ca3.jpeg
34.120.237.76200 OK 8.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F079bc299-d390-4250-a91a-db3c535c9ca3.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 98d2cf29c710d25bd2f03ff216fdd369
b8eb2e11f9655f19334befc036f21489a6473827
614c9b4a7ace908c1ef807964709cb292b33b48ce1d81ccbd2959c2c0ee156ac
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F079bc299-d390-4250-a91a-db3c535c9ca3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8351
x-amzn-requestid: 607d07ab-6833-4001-82ed-699ea91f84c9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cvlitFk9oAMFakQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638fb611-3e5f14f833b332647ef7358d;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 21:37:21 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 0w5Usq-LJMNHxw9UrwUqSslSVROXVHTmY_UhSHNaGh4k4xqh-FSa0A==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 21:55:40 GMT
etag: "b8eb2e11f9655f19334befc036f21489a6473827"
content-type: image/jpeg
age: 62713
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F51c41646-4c8f-4a18-bf60-2b67be5db8d0.jpeg
34.120.237.76200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F51c41646-4c8f-4a18-bf60-2b67be5db8d0.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 604a4132da78a0c013b5818644adb121
ddf982c6ff7a0d8e5376c119b6642fe7e0ba8566
eecab519c33596c67f2d2021dfd1af24e7fd8f2ed403f99b4ba0c265c08a259f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F51c41646-4c8f-4a18-bf60-2b67be5db8d0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8701
x-amzn-requestid: 653284c3-ee7f-45f1-9513-3a6c81e1d6e3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cm3-2HRWIAMFjfg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638c39f8-6f8969a26787a9463ba6c2ec;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 06:11:04 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: EpyIdH9YEXjxbGhZpBIfzoZHQxMvAKl0eCFQsgMt0e1SSeWsiuey7g==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 22:15:06 GMT
age: 61547
etag: "ddf982c6ff7a0d8e5376c119b6642fe7e0ba8566"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22142ca2-85b4-47d4-8eaa-fcf2823b2c28.jpeg
34.120.237.76200 OK 8.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22142ca2-85b4-47d4-8eaa-fcf2823b2c28.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e95ebce9d79ba46cb96af9a45af1762f
985c6761675e6bcc0186f64d55f94cf09352f05c
5837d6bf31e57f955ba2577f112281cc33a5502b358c83192f4e396b57042ac0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22142ca2-85b4-47d4-8eaa-fcf2823b2c28.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8438
x-amzn-requestid: 0f5d1b0e-1193-4006-8a54-555681d9f62e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cvlqVGMjoAMFS6w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638fb641-6366ea6464122d857407cdff;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 21:38:09 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2j9gqNvWYRFM-li9Nj4nLAWe_eKWMSwagPgU3eAtk0pjcJUX4Q8XEA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 21:55:40 GMT
etag: "985c6761675e6bcc0186f64d55f94cf09352f05c"
content-type: image/jpeg
age: 62713
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feeb81330-af0b-4cc3-bd0e-591ba064667a.jpeg
34.120.237.76200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feeb81330-af0b-4cc3-bd0e-591ba064667a.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c9257f2e3b9bd1b3aa262b0f4bf57968
4bcdd6ecd63834aa1010faf19457a97f37ae99fa
9afd592279c51b533b3bf72a860cf4a8f2bc6cf01b07d1ab6f11f0ff302e0ef6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feeb81330-af0b-4cc3-bd0e-591ba064667a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7392
x-amzn-requestid: f4b6890a-7a8f-48f8-b2af-365cb5f681e4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cpwREFiXoAMFSMw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d60d3-009e524f30c72d0629c877bb;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 03:09:07 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: C0-H0LUbxaxMEXoDf6PXEFAvVTj2D9K2M7eshRo39QzAAWSk2ubepA==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 03:27:19 GMT
age: 42814
etag: "4bcdd6ecd63834aa1010faf19457a97f37ae99fa"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp2.globalsign.com/gsorganizationvalsha2g2
104.18.20.226200 OK 1.5 kB URL HTTP/1.1 ocsp2.globalsign.com/gsorganizationvalsha2g2
IP 104.18.20.226:0
Hash e7203483b1650428674577646257fea8
ed14aa2db8b0b11c3dd2aa1734584adf3ee52d60
fb9b6ace03fa0dc3a455ca0f18f88cb0b8809ea76e3e87772176ff5ae3abfc2e
POST /gsorganizationvalsha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:53 GMT
Content-Type: application/ocsp-response
Content-Length: 1459
Connection: keep-alive
Expires: Sun, 11 Dec 2022 13:17:01 GMT
ETag: "ed14aa2db8b0b11c3dd2aa1734584adf3ee52d60"
Last-Modified: Wed, 07 Dec 2022 13:17:02 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 627
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 775e3f75dc180b59-OSL
ulqmpxoz.com/favicon.ico
34.149.198.43404 Not Found 153 B IP 34.149.198.43:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash a53e183b2c571a68b246ad570b76da19
7eac95d26ba1e92a3b4d6fd47ee057f00274ac13
29574dc19a017adc4a026deb6d9a90708110eafe9a6acdc6496317382f9a4dc7
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: ulqmpxoz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Cookie: __wpkreporterwid_=8f9f1e7f-7919-49e5-3768-1d7e0d76513e
HTTP/1.1 404 Not Found
Server: nginx/1.20.2
Date: Wed, 07 Dec 2022 15:20:53 GMT
Content-Type: text/html
Content-Length: 153
Via: 1.1 google
track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_first&page_h5=page_loading_first<=pageview&c_lt=pageview&event_id=2001&keyword=&referrer=&host=ulqmpxoz.com&url=http%3A%2F%2Fulqmpxoz.com%2F&cookie=__wpkreporterwid_%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e&time=1670426451422&entry=&_ua=Mozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A105.0)+Gecko%2F20100101+Firefox%2F105.0&isUC=false&isQuark=false&is_duannei=false&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv
123.183.235.127200 OK 33 B URL HTTP/2 track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_first&page_h5=page_loading_first<=pageview&c_lt=pageview&event_id=2001&keyword=&referrer=&host=ulqmpxoz.com&url=http%3A%2F%2Fulqmpxoz.com%2F&cookie=__wpkreporterwid_%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e&time=1670426451422&entry=&_ua=Mozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A105.0)+Gecko%2F20100101+Firefox%2F105.0&isUC=false&isQuark=false&is_duannei=false&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv
IP 123.183.235.127:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 55199048ae64f13bfc67cd2fec307e1a
0febd20edc3ebbaa60bf312be0e1d977ddd3a319
7c677a0c1ba67a4335c821aa3af6031428be641e33887fc719ce8f52f926898d
GET /collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_first&page_h5=page_loading_first<=pageview&c_lt=pageview&event_id=2001&keyword=&referrer=&host=ulqmpxoz.com&url=http%3A%2F%2Fulqmpxoz.com%2F&cookie=__wpkreporterwid_%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e&time=1670426451422&entry=&_ua=Mozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A105.0)+Gecko%2F20100101+Firefox%2F105.0&isUC=false&isQuark=false&is_duannei=false&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv HTTP/1.1
Host: track.uc.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 07 Dec 2022 15:20:53 GMT
content-type: image/avif;charset=UTF-8
content-length: 33
cache-control: no-cache
access-control-allow-origin: *
X-Firefox-Spdy: h2
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1391016954&si=42296466acbd6a1e84224ab1433a06cc&v=1.3.0&lv=1&sn=4838&r=0&ww=1280&u=http%3A%2F%2Fulqmpxoz.com%2F&tt=ulqmpxoz.com
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1391016954&si=42296466acbd6a1e84224ab1433a06cc&v=1.3.0&lv=1&sn=4838&r=0&ww=1280&u=http%3A%2F%2Fulqmpxoz.com%2F&tt=ulqmpxoz.com
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1391016954&si=42296466acbd6a1e84224ab1433a06cc&v=1.3.0&lv=1&sn=4838&r=0&ww=1280&u=http%3A%2F%2Fulqmpxoz.com%2F&tt=ulqmpxoz.com HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Wed, 07 Dec 2022 15:20:53 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=45A6D135BCA9FE52; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_cn&page_h5=page_loading_cn&keyword=&referrer=&host=ulqmpxoz.com&url=http%3A%2F%2Fulqmpxoz.com%2F&cookie=__wpkreporterwid_%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e&time=1670426451880&entry=&_ua=Mozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A105.0)+Gecko%2F20100101+Firefox%2F105.0&isUC=false&isQuark=false&is_duannei=false<=pageview&c_lt=pageview&event_id=2001&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv
123.183.235.127200 OK 33 B URL HTTP/2 track.uc.cn/collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_cn&page_h5=page_loading_cn&keyword=&referrer=&host=ulqmpxoz.com&url=http%3A%2F%2Fulqmpxoz.com%2F&cookie=__wpkreporterwid_%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e&time=1670426451880&entry=&_ua=Mozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A105.0)+Gecko%2F20100101+Firefox%2F105.0&isUC=false&isQuark=false&is_duannei=false<=pageview&c_lt=pageview&event_id=2001&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv
IP 123.183.235.127:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 55199048ae64f13bfc67cd2fec307e1a
0febd20edc3ebbaa60bf312be0e1d977ddd3a319
7c677a0c1ba67a4335c821aa3af6031428be641e33887fc719ce8f52f926898d
GET /collect?appid=29351a4155a4&stat_a=berg&stat_b=download&ev_ct=berg_download&page=page_loading_cn&page_h5=page_loading_cn&keyword=&referrer=&host=ulqmpxoz.com&url=http%3A%2F%2Fulqmpxoz.com%2F&cookie=__wpkreporterwid_%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e&time=1670426451880&entry=&_ua=Mozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A105.0)+Gecko%2F20100101+Firefox%2F105.0&isUC=false&isQuark=false&is_duannei=false<=pageview&c_lt=pageview&event_id=2001&uc_param_str=dsfrpfvedncpssntnwbipreimeutsv HTTP/1.1
Host: track.uc.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 07 Dec 2022 15:20:53 GMT
content-type: image/avif;charset=UTF-8
content-length: 33
cache-control: no-cache
access-control-allow-origin: *
X-Firefox-Spdy: h2
img.alicdn.com/tfs/TB1qlPp4EY1gK0jSZFMXXaWcVXa-256-256.png
47.246.44.252200 OK 1.0 kB URL HTTP/2 img.alicdn.com/tfs/TB1qlPp4EY1gK0jSZFMXXaWcVXa-256-256.png
IP 47.246.44.252:0
ASN #24429 Zhejiang Taobao Network Co.,Ltd
File type PNG image data, 256 x 256, 4-bit colormap, non-interlaced\012- data
Hash bad18458fe151b0db354c1ce464feacb
3d15cd9538209b6eae7475d266642d90eba6c63c
7a78bd339e3752b369262cb8f38e6cbd24e42823f2b5bfd682f86265b6f7635f
GET /tfs/TB1qlPp4EY1gK0jSZFMXXaWcVXa-256-256.png HTTP/1.1
Host: img.alicdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://image.uc.cn/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: Tengine
content-type: image/png
content-length: 1009
date: Mon, 21 Feb 2022 03:23:08 GMT
last-modified: Wed, 09 Dec 2020 09:28:47 GMT
expires: Tue, 21 Feb 2023 03:23:08 GMT
cache-control: max-age=31536000
ali-swift-global-savetime: 1645413788
via: cache33.l2ot7-1[0,0,200-0,H], cache31.l2ot7-1[0,0], cache4.se1[0,0,200-0,H], cache8.se1[1,0]
access-control-allow-origin: *
age: 25012666
x-cache: HIT TCP_MEM_HIT dirn:4:377733237
x-swift-savetime: Wed, 31 Aug 2022 14:34:01 GMT
x-swift-cachetime: 14993347
s-rt: 1
timing-allow-origin: *
eagleid: 2ff62c9c16704264548188551e
X-Firefox-Spdy: h2
px.effirst.com/api/v1/jssdk/upload?wpk-header=app%3Dberg-download%26cp%3Dnone%26de%3D4%26seq%3D1670426453664%26tm%3D1670426453%26ud%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e%26ver%3D2.34.0%26type%3Dflow%26sver%3D1.2.1%26sign%3D9bf8a190ef82c5049df7b199c599c45b
106.8.139.29200 OK 20 B URL HTTP/1.1 px.effirst.com/api/v1/jssdk/upload?wpk-header=app%3Dberg-download%26cp%3Dnone%26de%3D4%26seq%3D1670426453664%26tm%3D1670426453%26ud%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e%26ver%3D2.34.0%26type%3Dflow%26sver%3D1.2.1%26sign%3D9bf8a190ef82c5049df7b199c599c45b
IP 106.8.139.29:0
Hash 7029066c27ac6f5ef18d660d5741979a
46c6643f07aa7f6bfe7118de926b86defc5087c4
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2
POST /api/v1/jssdk/upload?wpk-header=app%3Dberg-download%26cp%3Dnone%26de%3D4%26seq%3D1670426453664%26tm%3D1670426453%26ud%3D8f9f1e7f-7919-49e5-3768-1d7e0d76513e%26ver%3D2.34.0%26type%3Dflow%26sver%3D1.2.1%26sign%3D9bf8a190ef82c5049df7b199c599c45b HTTP/1.1
Host: px.effirst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain;charset=UTF-8
Content-Length: 903
Origin: http://ulqmpxoz.com
Connection: keep-alive
Referer: http://ulqmpxoz.com/
HTTP/1.1 200 OK
Date: Wed, 07 Dec 2022 15:20:56 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE
Content-Encoding: gzip
pre-mpnewyear.uc.cn/iceberg/page/log?domain=ulqmpxoz.com&uc_param_str=dsdnfrpfbivesscpgimibtbmnijblauputogpintnwktprchmt
106.11.208.131404 Not Found 0 B URL HTTP/2 pre-mpnewyear.uc.cn/iceberg/page/log?domain=ulqmpxoz.com&uc_param_str=dsdnfrpfbivesscpgimibtbmnijblauputogpintnwktprchmt
IP 106.11.208.131:0
ASN #37963 Hangzhou Alibaba Advertising Co.,Ltd.
GET /iceberg/page/log?domain=ulqmpxoz.com&uc_param_str=dsdnfrpfbivesscpgimibtbmnijblauputogpintnwktprchmt HTTP/1.1
Host: pre-mpnewyear.uc.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://ulqmpxoz.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
date: Wed, 07 Dec 2022 15:20:53 GMT
content-type: application/json
server: Tengine
vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-encoding: gzip
eagleeye-traceid: 0b57c2e216704264537776314efeff
X-Firefox-Spdy: h2