urlquery - report: _.opdfvxrrlv.duckdns.org/

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	Sent bytes	Received bytes	IP
_.opdfvxrrlv.duckdns.org (2)	0	2023-03-10T05:33:15Z	2023-03-11T06:51:39Z	676	3878	45.88.168.143
r3.o.lencr.org (9)	344	2020-12-02T09:52:13Z	2023-03-25T05:09:02Z	3042	7975	23.36.76.226
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-24T18:14:23Z	782	2374	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-24T18:20:20Z	413	5882	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-25T05:09:25Z	333	391	34.117.237.239
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-24T18:17:07Z	606	127	54.149.203.40
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-24T16:33:49Z	3246	47374	34.120.237.76

Timestamp	Severity	Source IP	Destination IP	Alert
2023-03-13 09:55:58 UTC	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-03-13 09:55:58 UTC	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-03-13 09:55:58 UTC	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2023-03-13 09:55:58 UTC	low	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2023-03-13 09:56:05 UTC	medium	Client IP	45.88.168.143	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
2023-03-13 09:56:06 UTC	medium	Client IP	45.88.168.143	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

Scan Date	Severity	Indicator	Comment
2023-03-13	medium	_.opdfvxrrlv.duckdns.org/	Phishing

Date	UQ / IDS / BL	URL	IP
2023-05-23 21:17:43 UTC	3 - 12 - 1	rkdibybchc.duckdns.org/	45.88.168.143
2023-05-21 19:45:20 UTC	3 - 12 - 1	iamqllgqwa.duckdns.org/	45.88.168.143
2023-05-21 06:34:11 UTC	3 - 10 - 1	uwnnhcoeuy.duckdns.org/	45.88.168.143
2023-05-19 16:29:59 UTC	3 - 10 - 1	snffeqmezu.duckdns.org/	45.88.168.143
2023-05-19 10:27:52 UTC	3 - 12 - 1	bfonakljnz.duckdns.org/	45.88.168.143

Date	UQ / IDS / BL	URL	IP
2023-06-01 19:22:11 UTC	3 - 16 - 0	mpexxngknz.duckdns.org/	45.12.138.22
2023-06-01 19:20:06 UTC	4 - 15 - 0	noelntftob.duckdns.org/	45.88.168.205
2023-06-01 19:19:14 UTC	3 - 14 - 0	jumjmdehce.duckdns.org/	45.88.168.229
2023-06-01 18:54:29 UTC	24 - 61 - 0	fnogfjsmdz.duckdns.org/	66.150.66.238
2023-06-01 18:38:45 UTC	4 - 15 - 0	dftgolloub.duckdns.org/	45.12.138.87

Date	UQ / IDS / BL	URL	IP
2023-03-13 09:56:09 UTC	3 - 6 - 1	_.opdfvxrrlv.duckdns.org/	45.88.168.143

Date	UQ / IDS / BL	URL	IP
2023-03-29 14:32:46 UTC	2 - 5 - 1	wdmjepdata.duckdns.org/	45.88.168.143
2023-03-27 17:47:35 UTC	2 - 5 - 0	oamzwymyga.duckdns.org/	45.88.168.143
2023-01-07 14:18:39 UTC	3 - 4 - 1	oemybejnde.duckdns.org/	66.150.66.238
2023-03-17 08:37:19 UTC	2 - 5 - 1	_.mgtxwaejxf.duckdns.org/	45.88.168.143
2023-03-13 09:50:16 UTC	3 - 7 - 1	_.waefyyhrjl.duckdns.org/	45.88.168.143

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "370104DF5DD8F739601A4BE42AE41BB92F365DCF585823A3C14733F7C394E926" Last-Modified: Sun, 12 Mar 2023 14:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10525 Expires: Mon, 13 Mar 2023 12:51:24 GMT Date: Mon, 13 Mar 2023 09:55:59 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 234b80a5a27f3d377e322e680413479d Sha1: 3da8ba535ec19898f5b83ece48cd4038ac2bf557 Sha256: 370104df5dd8f739601a4be42ae41bb92f365dcf585823a3c14733f7c394e926
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "BDEF4E5EDFE0BF3FEFB4DC5625E41F3FAEB23A0AFD24C4E6255F40F757568C35" Last-Modified: Sun, 12 Mar 2023 06:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6470 Expires: Mon, 13 Mar 2023 11:43:49 GMT Date: Mon, 13 Mar 2023 09:55:59 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 405abd45d42535567c1ecb518f4bdb04 Sha1: 0505c27fe2921bfa89657173fb77ca7280f04772 Sha256: bdef4e5edfe0bf3fefb4dc5625e41f3faeb23a0afd24c4e6255f40f757568c35
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "B704031D560770485C9552DCF56B911B7B5AD45D8A3F73ACD17DBBBEEFF294F4" Last-Modified: Sun, 12 Mar 2023 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2695 Expires: Mon, 13 Mar 2023 10:40:54 GMT Date: Mon, 13 Mar 2023 09:55:59 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: ae4d7bec26e013433e638f87260aa632 Sha1: 62384e39bc90d0b2ab92895220f0383e678669f4 Sha256: b704031d560770485c9552dcf56b911b7b5ad45d8a3f73acd17dbbbeeff294f4
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Content-Length, Retry-After, Content-Type, Alert, Backoff content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Mon, 13 Mar 2023 09:09:19 GMT age: 2800 cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: bc86ef2a0cee04915bc360f5821adc8f Sha1: 3658f9028cce204d38f7f48fcfaa2a8e4f54383a Sha256: aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: XNQBSq9WlGSz1JMqlXYzepPpcIOuZ8J4WP6lElELISKM9Xkf9RLMH6uAh1QOTHmTgIYczIIteyk= x-amz-request-id: 32E2EJVJ6WKWK6V5 x-amz-server-side-encryption: AES256 content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Mon, 13 Mar 2023 09:20:04 GMT age: 2155 last-modified: Sat, 18 Feb 2023 20:28:27 GMT etag: "b5ba6334e73496995e3e3a9ecd0eb323" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: b5ba6334e73496995e3e3a9ecd0eb323 Sha1: ad80d3b7718c28364e8c2004fb38a13a1747e462 Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Mon, 13 Mar 2023 09:55:59 GMT content-length: 12 vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-credentials: true access-control-expose-headers: content-type strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Cache-Control, Content-Length, Retry-After, Content-Type, Expires, Alert, Pragma, ETag, Backoff, Last-Modified content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Mon, 13 Mar 2023 09:06:47 GMT age: 2952 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "5C910268B5C4F0244540C5570056673F8CBE4A0979F301363CB56DC359C147DF" Last-Modified: Sun, 12 Mar 2023 06:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3851 Expires: Mon, 13 Mar 2023 11:00:10 GMT Date: Mon, 13 Mar 2023 09:55:59 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: db27ecc2f481e8871b2e99584e751660 Sha1: e671ecb839d53e296f4ec303208ddb713c72aecc Sha256: 5c910268b5c4f0244540c5570056673f8cbe4a0979f301363cb56dc359c147df
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: SMk+dC8KsW8JuXYVgiJY9w== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	54.149.203.40 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: I0IrDzFKDi6NdNPZRqN5Fo0c/co= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "87E4699D8DED9C722F137C21826DFE419BEB8675F226B91081342C90838CB818" Last-Modified: Sat, 11 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2686 Expires: Mon, 13 Mar 2023 10:40:47 GMT Date: Mon, 13 Mar 2023 09:56:01 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 2573307db8caef0a070ba3ebd4f61e2e Sha1: 28e8cb63280e9b5e4184017cb22aa5f197007450 Sha256: 87e4699d8ded9c722f137c21826dfe419beb8675f226b91081342c90838cb818
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "87E4699D8DED9C722F137C21826DFE419BEB8675F226B91081342C90838CB818" Last-Modified: Sat, 11 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2686 Expires: Mon, 13 Mar 2023 10:40:47 GMT Date: Mon, 13 Mar 2023 09:56:01 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 2573307db8caef0a070ba3ebd4f61e2e Sha1: 28e8cb63280e9b5e4184017cb22aa5f197007450 Sha256: 87e4699d8ded9c722f137c21826dfe419beb8675f226b91081342c90838cb818
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "B3FBD505775AB4D16C1A8B22E367B9D3B2698BD920D0C4578659B6C63E3D3F6F" Last-Modified: Sat, 11 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3142 Expires: Mon, 13 Mar 2023 10:48:23 GMT Date: Mon, 13 Mar 2023 09:56:01 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: f1cb274086a7fc07be41dfeb65ec1dbf Sha1: c6339993814eda4b9629ef179222b060d1f5143b Sha256: b3fbd505775ab4d16c1a8b22e367b9d3b2698bd920d0c4578659b6c63e3d3f6f
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.33.119.27 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "B3FBD505775AB4D16C1A8B22E367B9D3B2698BD920D0C4578659B6C63E3D3F6F" Last-Modified: Sat, 11 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3142 Expires: Mon, 13 Mar 2023 10:48:23 GMT Date: Mon, 13 Mar 2023 09:56:01 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: f1cb274086a7fc07be41dfeb65ec1dbf Sha1: c6339993814eda4b9629ef179222b060d1f5143b Sha256: b3fbd505775ab4d16c1a8b22e367b9d3b2698bd920d0c4578659b6c63e3d3f6f
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "87E4699D8DED9C722F137C21826DFE419BEB8675F226B91081342C90838CB818" Last-Modified: Sat, 11 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2686 Expires: Mon, 13 Mar 2023 10:40:47 GMT Date: Mon, 13 Mar 2023 09:56:01 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 2573307db8caef0a070ba3ebd4f61e2e Sha1: 28e8cb63280e9b5e4184017cb22aa5f197007450 Sha256: 87e4699d8ded9c722f137c21826dfe419beb8675f226b91081342c90838cb818
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2bf0ac20-16ad-460d-8fcb-a873994d420a.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5853 x-amzn-requestid: c8b1593f-4bd9-452d-a904-87b58194d599 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: Br_WlHEwoAMFyqw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640e45c3-461a986e5a5544cf574899e4;Sampled=0 x-amzn-remapped-date: Sun, 12 Mar 2023 21:36:03 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: C6xTwOtJHWOoB4SIZ7qDzhmjdyRpZtrJEQ4iSWw5SHWVIKSxfirSCw== via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Mar 2023 21:57:44 GMT age: 43097 etag: "1008882db3829f830b0f58c9c5b09792e844a31b" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5853 Md5: bbfef97312a1bc4792615717a63a48ba Sha1: 1008882db3829f830b0f58c9c5b09792e844a31b Sha256: 2b096364b450b4845252b7a22a9f9aadadf220e7a6a4134558647d308529d2a1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F87df4bcd-c6cd-4a0c-a9f5-dffb7f36d2e4.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8487 x-amzn-requestid: 92381f1a-0140-47e9-a971-594a7de36c3c x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BkEcBGizoAMFgOA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640b1ab3-1a54b65a5d7083e62dcb85ab;Sampled=0 x-amzn-remapped-date: Fri, 10 Mar 2023 11:55:31 GMT x-amz-cf-pop: SEA19-C3 x-cache: Hit from cloudfront x-amz-cf-id: Nn4eV-UeuWZ02ANOxzTUSgE4UODtaZxeIjp8UJfU8PgUny2shFaDjQ== via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 74ab105148338444981d1b2277ffd9c4.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Mar 2023 21:42:57 GMT age: 43984 etag: "79c7d22c8df6d305f46c5779ccb9f25169d4d111" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8487 Md5: be71491cee9b47dc3ffb23b4fdff25b3 Sha1: 79c7d22c8df6d305f46c5779ccb9f25169d4d111 Sha256: e785896e5840fb901ddd0118bef3ccad6b59a96d8eef0e8ccd9c95a3c261ba45
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fff929360-22f8-4802-b525-97c8ccc02f76.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8300 x-amzn-requestid: 8ae58717-22c9-4515-9c68-0943d5ac87eb x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BmohcEMloAMFkQQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640c213c-171988c90b96561c361c9317;Sampled=0 x-amzn-remapped-date: Sat, 11 Mar 2023 06:35:40 GMT x-amz-cf-pop: SEA19-C3 x-cache: Hit from cloudfront x-amz-cf-id: 342Nd9DLDwt780oglZ2ITP1YyI_KRA0p89KJoTxgwPs5kgydaMt0wg== via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 b2d3922a177f6cecf9222a78a0a1ad32.cloudfront.net (CloudFront), 1.1 google date: Mon, 13 Mar 2023 03:10:21 GMT age: 24340 etag: "84c4a6401f2fd62a40c09d609f19f2b24a786c91" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8300 Md5: 4be7958680e9e469b2ead9cfe57e0167 Sha1: 84c4a6401f2fd62a40c09d609f19f2b24a786c91 Sha256: b5121f8e1d95f843e7f072a75342138de0a5f66c626cb54bf179a3206ec1d9b3
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5fb91136-3d0c-40e5-ae3d-577c7de0682f.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7321 x-amzn-requestid: d296268a-a47f-4484-ac65-f52acbd78825 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: Br_UmHgcoAMFtcQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640e45b6-2b7176b31ad67c851fd4a639;Sampled=0 x-amzn-remapped-date: Sun, 12 Mar 2023 21:35:50 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: Cgh4IUci_WTdwPjeF8gIY_v7RnQR1Da-K7Xs31C83hhEO9GhgECuqw== via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 5397b304713f6301c7c94ac084b6ed08.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Mar 2023 21:54:03 GMT age: 43318 etag: "24d6051afcfe2726dfcdec03960587da22e367b9" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7321 Md5: 147b8a5a71b1df3397ba6586e6d9b538 Sha1: 24d6051afcfe2726dfcdec03960587da22e367b9 Sha256: 513852a577f3106f3ad970e6ee626eb945ffc998d1fe8ef0b1296df0942a313b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fde56a182-6d55-402d-b240-1fe8746a0a76.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4743 x-amzn-requestid: 307f30a9-ba32-4ff5-a987-990d05f07b64 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BpjcvEHvIAMFR-Q= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640d4c51-3f20ae277aa76e175a7a3c44;Sampled=0 x-amzn-remapped-date: Sun, 12 Mar 2023 03:51:45 GMT x-amz-cf-pop: HIO50-C1, SEA19-C3 x-cache: Miss from cloudfront x-amz-cf-id: gVYwfArTGE1PoLnLX7VI3aaaqbu5yA8hcn2MdtqWl3IpZF8U5r-Qwg== via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 d15b6a95f7c8298444f59a99d8027cec.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Mar 2023 10:52:40 GMT etag: "6d895fec65f4d11af82d1a417fdec5d2df2a9cd1" age: 83001 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4743 Md5: 780098f209d535b5c802e280f41c2ed7 Sha1: 6d895fec65f4d11af82d1a417fdec5d2df2a9cd1 Sha256: 5b66b48774c284e271f0e4938e304b98e8e3642c9e479768b64fe4186055e886
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F041d108b-a02d-463a-b8bc-16a820bcaec7.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 6311 x-amzn-requestid: 2b7244ec-0beb-4755-a295-5c925d4e5e78 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: Br_kfG8xIAMF5pw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-640e461c-6ed1bdff68e8988a141e86d9;Sampled=0 x-amzn-remapped-date: Sun, 12 Mar 2023 21:37:32 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: bC0qKmaWkNBo6MQN9tmsMSBLFaog0JowDxyASwb0v3QHSocitnbVhw== via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Mar 2023 21:55:43 GMT age: 43218 etag: "eb4e56764e88672f9efd7a15ffe16b50e26a0248" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 6311 Md5: 5f530c45a5cd68b455ef2198ed86ad3f Sha1: eb4e56764e88672f9efd7a15ffe16b50e26a0248 Sha256: cc594af89a6db9aafed4451e84c68d47e4f602ca53eef170d94889aabdbd03ed
GET / HTTP/1.1 Host: _.opdfvxrrlv.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	45.88.168.143 HTTP/1.1 200 OK Content-Type: text/html Date: Mon, 13 Mar 2023 09:56:05 GMT Server: Apache/2.4.54 (Debian) Last-Modified: Wed, 23 Nov 2022 18:52:53 GMT ETag: "29cd-5ee27cbc8b409-gzip" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 3041 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text Size: 3041 Md5: 1081969672137773e7c5abd2670f490d Sha1: 0c65333e8a3cfd26756655b404fe57f7e86f7719 Sha256: 9daa91f56a67ed8e92a2c50412de6ffb0425db4e0cd640452e461c2bd380e905 urlquery: - Suspicious - DynDNS domain Blocklists: - fortinet: Phishing IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
GET /favicon.ico HTTP/1.1 Host: _.opdfvxrrlv.duckdns.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Referer: http://_.opdfvxrrlv.duckdns.org/	45.88.168.143 HTTP/1.1 404 Not Found Content-Type: text/html; charset=iso-8859-1 Date: Mon, 13 Mar 2023 09:56:06 GMT Server: Apache/2.4.54 (Debian) Content-Length: 286 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size: 286 Md5: fb6224a05a5c192adf3eeb2a7356948c Sha1: 13017f4ee2339e5be9b6ad127217b04d2a9d08a0 Sha256: 5310618bee5631884f37a5faab441cbbff850c3418a9dca5399f61fc285fe128 urlquery: - Suspicious - DynDNS domain IDS: - ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.76.226

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "370104DF5DD8F739601A4BE42AE41BB92F365DCF585823A3C14733F7C394E926" 

                                            
                                                
Last-Modified: Sun, 12 Mar 2023 14:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=10525 

                                            
                                                
Expires: Mon, 13 Mar 2023 12:51:24 GMT 

                                            
                                                
Date: Mon, 13 Mar 2023 09:55:59 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    234b80a5a27f3d377e322e680413479d

                                                Sha1:   3da8ba535ec19898f5b83ece48cd4038ac2bf557

                                                Sha256: 370104df5dd8f739601a4be42ae41bb92f365dcf585823a3c14733f7c394e926

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.76.226

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "B704031D560770485C9552DCF56B911B7B5AD45D8A3F73ACD17DBBBEEFF294F4" 

                                            
                                                
Last-Modified: Sun, 12 Mar 2023 05:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=2695 

                                            
                                                
Expires: Mon, 13 Mar 2023 10:40:54 GMT 

                                            
                                                
Date: Mon, 13 Mar 2023 09:55:59 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    ae4d7bec26e013433e638f87260aa632

                                                Sha1:   62384e39bc90d0b2ab92895220f0383e678669f4

                                                Sha256: b704031d560770485c9552dcf56b911b7b5ad45d8a3f73acd17dbbbeeff294f4

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1 

                                        
                                            
Host: content-signature-2.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: binary/octet-stream

                                            

                                            
                                                
x-amz-id-2: XNQBSq9WlGSz1JMqlXYzepPpcIOuZ8J4WP6lElELISKM9Xkf9RLMH6uAh1QOTHmTgIYczIIteyk= 

                                            
                                                
x-amz-request-id: 32E2EJVJ6WKWK6V5 

                                            
                                                
x-amz-server-side-encryption: AES256 

                                            
                                                
content-disposition: attachment 

                                            
                                                
accept-ranges: bytes 

                                            
                                                
server: AmazonS3 

                                            
                                                
content-length: 5348 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Mon, 13 Mar 2023 09:20:04 GMT 

                                            
                                                
age: 2155 

                                            
                                                
last-modified: Sat, 18 Feb 2023 20:28:27 GMT 

                                            
                                                
etag: "b5ba6334e73496995e3e3a9ecd0eb323" 

                                            
                                                
cache-control: public,max-age=3600 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  PEM certificate\012- , ASCII text

                                                Size:   5348

                                                Md5:    b5ba6334e73496995e3e3a9ecd0eb323

                                                Sha1:   ad80d3b7718c28364e8c2004fb38a13a1747e462

                                                Sha256: aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: application/json 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/json 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: application/json

                                            

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
access-control-expose-headers: Cache-Control, Content-Length, Retry-After, Content-Type, Expires, Alert, Pragma, ETag, Backoff, Last-Modified 

                                            
                                                
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                            
                                                
strict-transport-security: max-age=31536000 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
content-length: 329 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Mon, 13 Mar 2023 09:06:47 GMT 

                                            
                                                
age: 2952 

                                            
                                                
last-modified: Fri, 25 Mar 2022 17:45:46 GMT 

                                            
                                                
etag: "1648230346554" 

                                            
                                                
cache-control: max-age=3600,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators

                                                Size:   329

                                                Md5:    0333b0655111aa68de771adfcc4db243

                                                Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb

                                                Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

                                        
                                            GET / HTTP/1.1 

                                        
                                            
Host: push.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Sec-WebSocket-Version: 13 

                                        
                                            
Origin: wss://push.services.mozilla.com/ 

                                        
                                            
Sec-WebSocket-Protocol: push-notification 

                                        
                                            
Sec-WebSocket-Extensions: permessage-deflate 

                                        
                                            
Sec-WebSocket-Key: SMk+dC8KsW8JuXYVgiJY9w== 

                                        
                                            
Connection: keep-alive, Upgrade 

                                        
                                            
Sec-Fetch-Dest: websocket 

                                        
                                            
Sec-Fetch-Mode: websocket 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
Upgrade: websocket

                                        
                                             54.149.203.40

                                            
                                                HTTP/1.1 101 Switching Protocols

                                            

                                            
                                                
Connection: Upgrade 

                                            
                                                
Upgrade: websocket 

                                            
                                                
Sec-WebSocket-Accept: I0IrDzFKDi6NdNPZRqN5Fo0c/co= 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.76.226

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "87E4699D8DED9C722F137C21826DFE419BEB8675F226B91081342C90838CB818" 

                                            
                                                
Last-Modified: Sat, 11 Mar 2023 15:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=2686 

                                            
                                                
Expires: Mon, 13 Mar 2023 10:40:47 GMT 

                                            
                                                
Date: Mon, 13 Mar 2023 09:56:01 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    2573307db8caef0a070ba3ebd4f61e2e

                                                Sha1:   28e8cb63280e9b5e4184017cb22aa5f197007450

                                                Sha256: 87e4699d8ded9c722f137c21826dfe419beb8675f226b91081342c90838cb818

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.33.119.27

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "B3FBD505775AB4D16C1A8B22E367B9D3B2698BD920D0C4578659B6C63E3D3F6F" 

                                            
                                                
Last-Modified: Sat, 11 Mar 2023 15:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=3142 

                                            
                                                
Expires: Mon, 13 Mar 2023 10:48:23 GMT 

                                            
                                                
Date: Mon, 13 Mar 2023 09:56:01 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    f1cb274086a7fc07be41dfeb65ec1dbf

                                                Sha1:   c6339993814eda4b9629ef179222b060d1f5143b

                                                Sha256: b3fbd505775ab4d16c1a8b22e367b9d3b2698bd920d0c4578659b6c63e3d3f6f

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2bf0ac20-16ad-460d-8fcb-a873994d420a.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 5853 

                                            
                                                
x-amzn-requestid: c8b1593f-4bd9-452d-a904-87b58194d599 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: Br_WlHEwoAMFyqw= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-640e45c3-461a986e5a5544cf574899e4;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Sun, 12 Mar 2023 21:36:03 GMT 

                                            
                                                
x-amz-cf-pop: HIO50-C1, SEA73-P1 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: C6xTwOtJHWOoB4SIZ7qDzhmjdyRpZtrJEQ4iSWw5SHWVIKSxfirSCw== 

                                            
                                                
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Sun, 12 Mar 2023 21:57:44 GMT 

                                            
                                                
age: 43097 

                                            
                                                
etag: "1008882db3829f830b0f58c9c5b09792e844a31b" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   5853

                                                Md5:    bbfef97312a1bc4792615717a63a48ba

                                                Sha1:   1008882db3829f830b0f58c9c5b09792e844a31b

                                                Sha256: 2b096364b450b4845252b7a22a9f9aadadf220e7a6a4134558647d308529d2a1

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fff929360-22f8-4802-b525-97c8ccc02f76.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 8300 

                                            
                                                
x-amzn-requestid: 8ae58717-22c9-4515-9c68-0943d5ac87eb 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: BmohcEMloAMFkQQ= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-640c213c-171988c90b96561c361c9317;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Sat, 11 Mar 2023 06:35:40 GMT 

                                            
                                                
x-amz-cf-pop: SEA19-C3 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: 342Nd9DLDwt780oglZ2ITP1YyI_KRA0p89KJoTxgwPs5kgydaMt0wg== 

                                            
                                                
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 b2d3922a177f6cecf9222a78a0a1ad32.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Mon, 13 Mar 2023 03:10:21 GMT 

                                            
                                                
age: 24340 

                                            
                                                
etag: "84c4a6401f2fd62a40c09d609f19f2b24a786c91" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   8300

                                                Md5:    4be7958680e9e469b2ead9cfe57e0167

                                                Sha1:   84c4a6401f2fd62a40c09d609f19f2b24a786c91

                                                Sha256: b5121f8e1d95f843e7f072a75342138de0a5f66c626cb54bf179a3206ec1d9b3

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fde56a182-6d55-402d-b240-1fe8746a0a76.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 4743 

                                            
                                                
x-amzn-requestid: 307f30a9-ba32-4ff5-a987-990d05f07b64 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: BpjcvEHvIAMFR-Q= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-640d4c51-3f20ae277aa76e175a7a3c44;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Sun, 12 Mar 2023 03:51:45 GMT 

                                            
                                                
x-amz-cf-pop: HIO50-C1, SEA19-C3 

                                            
                                                
x-cache: Miss from cloudfront 

                                            
                                                
x-amz-cf-id: gVYwfArTGE1PoLnLX7VI3aaaqbu5yA8hcn2MdtqWl3IpZF8U5r-Qwg== 

                                            
                                                
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 d15b6a95f7c8298444f59a99d8027cec.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Sun, 12 Mar 2023 10:52:40 GMT 

                                            
                                                
etag: "6d895fec65f4d11af82d1a417fdec5d2df2a9cd1" 

                                            
                                                
age: 83001 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   4743

                                                Md5:    780098f209d535b5c802e280f41c2ed7

                                                Sha1:   6d895fec65f4d11af82d1a417fdec5d2df2a9cd1

                                                Sha256: 5b66b48774c284e271f0e4938e304b98e8e3642c9e479768b64fe4186055e886

URL	_.opdfvxrrlv.duckdns.org/
IP	45.88.168.143 (United States)
ASN	#35913 DEDIPATH-LLC
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access	public
Report completed	2023-03-13 09:56:09 UTC
Status	Loading report..
IDS alerts	6
Blocklist alert	1
urlquery alerts	3 Suspicious - DynDNS domain
Tags	dyndns

Overview

Domain Summary (7)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 45.88.168.143

Last 5 reports on ASN: DEDIPATH-LLC

Last 1 reports on domain: opdfvxrrlv.duckdns.org

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (22)

Overview

Domain Summary (7)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 45.88.168.143

Last 5 reports on ASN: DEDIPATH-LLC

Last 1 reports on domain: opdfvxrrlv.duckdns.org

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (22)

Network Intrusion Detection Systems