rdujh.com/link/87db56950059cc135d6e242761dbf91b1ffc4b24
37.228.114.189200 OK 144 B URL HTTP/1.1 rdujh.com/link/87db56950059cc135d6e242761dbf91b1ffc4b24
IP 37.228.114.189:0
ASN #50340 OOO Network of data-centers Selectel
File type HTML document, ASCII text
Hash cd509ce8d4ed09554acb08825ee5aa37
24120f6e8350d36d4fc502b4eca6ef2df4b748bf
399d7a36d26ad433eb85db0ef8858e82c39b1b92914622eed4a47cada6d96f9b
Analyzer Verdict Alert fortinet Phishing
GET /link/87db56950059cc135d6e242761dbf91b1ffc4b24 HTTP/1.1
Host: rdujh.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 08 Dec 2022 18:52:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: dpos=0; path=/; expires=Thu, 08 Dec 2022 21:00:00 GMT; httponly
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 7181eff9c60e83eb0004ece591e47dca
0fd8cd0c9d10b0547938982e57d2c43e2d98679f
89c5c0e2d6890798644174a8e31976aec03a1b3deb03812afbb520e5ed68f522
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "89C5C0E2D6890798644174A8E31976AEC03A1B3DEB03812AFBB520E5ED68F522"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2349
Expires: Thu, 08 Dec 2022 19:31:12 GMT
Date: Thu, 08 Dec 2022 18:52:03 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 388f6fea5bafa378266622b72311a6ee
447f102dc12172ce1ba44c5e94e1d7bb49d43372
a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4253
Expires: Thu, 08 Dec 2022 20:02:56 GMT
Date: Thu, 08 Dec 2022 18:52:03 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Backoff, Content-Length, Content-Type, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 08 Dec 2022 18:08:13 GMT
content-type: application/json
age: 2631
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 00e7703bd74975689fc9050356aaca6b
9788fe6a36d6f278e8da329ebc5dd87bcd212317
593bc437ff8a8233516c62613d50220fcb25b9f967ed5fb384c253f0db135103
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "593BC437FF8A8233516C62613D50220FCB25B9F967ED5FB384C253F0DB135103"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8108
Expires: Thu, 08 Dec 2022 21:07:12 GMT
Date: Thu, 08 Dec 2022 18:52:04 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: Nr4A9+f1SIsiXitifgvEHV3C205zh4tLdEDavq/EXVsCkuQnFxa3ybTducUcdpTqoFYcipDsIvs=
x-amz-request-id: 0HRADTVVJ9VRTA8V
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 08 Dec 2022 18:48:01 GMT
age: 243
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 18:52:04 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 08 Dec 2022 18:07:58 GMT
age: 2646
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.sectigo.com/
172.64.155.188200 OK 471 B IP 172.64.155.188:0
Hash 6aec14406027a271515df773cc50fe4d
955d5f5caaf6a5e398672eb7f2896ab2f8bd1c3d
7dd46dbc544468642e18feceef17b5e3ba5f2e335c63ccd963c0b68fb2a61b50
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 08 Dec 2022 18:52:04 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 05 Dec 2022 13:23:13 GMT
Expires: Mon, 12 Dec 2022 13:23:12 GMT
Etag: "955d5f5caaf6a5e398672eb7f2896ab2f8bd1c3d"
Cache-Control: max-age=325267,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7767b22f6df0b509-OSL
r.goaffmy.com/click?sub1=386b8d9e-4274-4133-90b8-40a906c12373&pid=13102&offer_id=2606
34.90.46.36302 Found 0 B URL HTTP/2 r.goaffmy.com/click?sub1=386b8d9e-4274-4133-90b8-40a906c12373&pid=13102&offer_id=2606
IP 34.90.46.36:0
ASN #396982 GOOGLE-CLOUD-PLATFORM
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?sub1=386b8d9e-4274-4133-90b8-40a906c12373&pid=13102&offer_id=2606 HTTP/1.1
Host: r.goaffmy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://rdujh.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Thu, 08 Dec 2022 18:52:04 GMT
content-length: 0
location: https://omgtds.com/c1/652d1ae4-50ba-4605-902d-143db04df43e?aff=13102&source=&externalId=63923254bec8a200019bb406&sub2=&sub3=13102&pp=1
x-adjust-use-original-forwarded-for: 1
set-cookie: afclick=63923254bec8a200019bb406; expires=Fri, 08 Dec 2023 18:52:04 GMT; secure; SameSite=None
afoffers={"2606":1670525524}; expires=Fri, 08 Dec 2023 18:52:04 GMT; secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash d8fcd72ce281b544a818244242f8e5fa
87fb2fa42d91aca8fa5f44198101c06c57f5da68
ce22a0b2483b914b9905d0f3d6bbc7bdeb40ca059d79f3fd799c155779180842
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CE22A0B2483B914B9905D0F3D6BBC7BDEB40CA059D79F3FD799C155779180842"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9133
Expires: Thu, 08 Dec 2022 21:24:17 GMT
Date: Thu, 08 Dec 2022 18:52:04 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash fd55f4aaaab6ec40bc7dc10252cd819a
a72523f60be265a391fa9edc43e0a93418ad1fd0
bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4186
Cache-Control: max-age=141874
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 18:52:04 GMT
Etag: "6391a92c-1d7"
Expires: Sat, 10 Dec 2022 10:16:38 GMT
Last-Modified: Thu, 08 Dec 2022 09:06:52 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471
omgtds.com/c1/652d1ae4-50ba-4605-902d-143db04df43e?aff=13102&source=&externalId=63923254bec8a200019bb406&sub2=&sub3=13102&pp=1
185.162.87.41302 Found 187 B URL HTTP/1.1 omgtds.com/c1/652d1ae4-50ba-4605-902d-143db04df43e?aff=13102&source=&externalId=63923254bec8a200019bb406&sub2=&sub3=13102&pp=1
IP 185.162.87.41:0
ASN #39572 DataWeb Global Group B.V.
File type HTML document, ASCII text
Hash d1c6cbd510f904a1314b4167599f7549
59e2e3e35ea633180f9ce95533da109a0fe009ef
b8a91467f21310b127bb36c9ca60fa1308af9a3fea28517493160b87f5430517
GET /c1/652d1ae4-50ba-4605-902d-143db04df43e?aff=13102&source=&externalId=63923254bec8a200019bb406&sub2=&sub3=13102&pp=1 HTTP/1.1
Host: omgtds.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://rdujh.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Server: nginx/1.22.1
Date: Thu, 08 Dec 2022 18:52:04 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 187
Connection: keep-alive
Location: https://r.goaffmy.com/click?pid=11972&offer_id=3594&sub1=ce934l5ki7qekn1int0g&sub2=&sub3=13102&sub5=63923254bec8a200019bb406&sub7=&sub8=
Set-Cookie: uid=KVO2nQgap; Path=/; Domain=omgtds.com; Max-Age=86400; HttpOnly
X-Clickid: ce934l5ki7qekn1int0g
r.goaffmy.com/click?pid=11972&offer_id=3594&sub1=ce934l5ki7qekn1int0g&sub2=&sub3=13102&sub5=63923254bec8a200019bb406&sub7=&sub8=
34.90.46.36302 Found 0 B URL HTTP/2 r.goaffmy.com/click?pid=11972&offer_id=3594&sub1=ce934l5ki7qekn1int0g&sub2=&sub3=13102&sub5=63923254bec8a200019bb406&sub7=&sub8=
IP 34.90.46.36:0
ASN #396982 GOOGLE-CLOUD-PLATFORM
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?pid=11972&offer_id=3594&sub1=ce934l5ki7qekn1int0g&sub2=&sub3=13102&sub5=63923254bec8a200019bb406&sub7=&sub8= HTTP/1.1
Host: r.goaffmy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://rdujh.com/
Connection: keep-alive
Cookie: afclick=63923254bec8a200019bb406; afoffers={"2606":1670525524}
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 302 Found
server: nginx
date: Thu, 08 Dec 2022 18:52:04 GMT
content-length: 0
location: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
x-adjust-use-original-forwarded-for: 1
referer:
referrer-policy: no-referrer
set-cookie: afclick=639232548135b700014ea8f4; expires=Fri, 08 Dec 2023 18:52:04 GMT; secure; SameSite=None
afoffers={"3594":1670525524,"2606":1670525524}; expires=Fri, 08 Dec 2023 18:52:04 GMT; secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
push.services.mozilla.com/
35.83.91.138101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.83.91.138:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 0rfeL04fi76pKzOR+6xSsg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: NRhKGlKUVo4ID9953LDsGhhX0d4=
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 114840f3101c82238d95e4485c3bb61c
85a85190c57fab3c69dc71778f837b0895a323bc
958d99b83b0ba38f7f065f584abfb8ec5be21e9dd4df6a9848a4caa8d86e772b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "958D99B83B0BA38F7F065F584ABFB8EC5BE21E9DD4DF6A9848A4CAA8D86E772B"
Last-Modified: Thu, 08 Dec 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19261
Expires: Fri, 09 Dec 2022 00:13:06 GMT
Date: Thu, 08 Dec 2022 18:52:05 GMT
Connection: keep-alive
www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
195.160.203.18200 OK 15 kB URL HTTP/2 www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
IP 195.160.203.18:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (407)
Hash a8e9815f8cdb10cb3e18568fac7444fe
10b0293bf98177bb1645ebaf425f7dc58dd5aec3
e37e6980b9a63c0eea0804bdee04c040f19b4c1fdbd51a2f2a1341b7329429c6
GET /Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4 HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
set-cookie: w=47402; expires=Thu, 08-Dec-2022 18:52:05 GMT; Max-Age=0; SameSite=Lax
ws=13102_; expires=Thu, 08-Dec-2022 18:52:05 GMT; Max-Age=0; SameSite=Lax
wt=639232548135b700014ea8f4; expires=Thu, 08-Dec-2022 18:52:05 GMT; Max-Age=0; SameSite=Lax
sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; expires=Sat, 10-Dec-2022 20:52:05 GMT; Max-Age=180000; path=/; SameSite=Strict
CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525; expires=Thu, 08-Dec-2022 19:22:05 GMT; Max-Age=1800; path=/; SameSite=Strict
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
content-length: 15236
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/bundle.e947980e25b81460bff1.css
195.160.203.18200 OK 2.2 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/bundle.e947980e25b81460bff1.css
IP 195.160.203.18:0
File type ASCII text, with very long lines (7852)
Hash c05378cba452766ae77ae1a0d5108072
0fa335bea78cc922ee9e829976d10c3b5f3b0fb3
09767706f9c64ed6669db4f94e5c1678bebf35ac3877cf75f506b8fa6d858a77
GET /DynBanner/PreUmfrage4/bundle.e947980e25b81460bff1.css HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: text/css
etag: "2147487567-br"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 2211
cache-control: public
vary: Accept-Encoding
content-encoding: br
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/plus-light.svg
195.160.203.18200 OK 659 B URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/plus-light.svg
IP 195.160.203.18:0
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash 9fdd791862dc397ba9f8230413b01a12
384def8345a48fd9c0713cd7f8d526f9e618475c
8e837f5bf50d97c60600b1ec11ee4e313487f00aec5b39d6cf5040d8e3c2ff6b
Analyzer Verdict Alert fortinet Phishing
GET /DynBanner/PreUmfrage4/img/plus-light.svg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
etag: "2147486872"
last-modified: Fri, 16 Apr 2021 12:55:43 GMT
content-length: 659
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/placeholder_male.svg
195.160.203.18200 OK 1.4 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/placeholder_male.svg
IP 195.160.203.18:0
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (1401), with no line terminators
Hash a859b99aa148d7cc5e02d919ddc8025a
ec1777f8e3ab698071dbc7de76ea45179c2af34c
f1f68bd735ad45a907446d1c7413189b883ea3a2a4bc7767e7787f688e8a3216
Analyzer Verdict Alert fortinet Phishing
GET /DynBanner/PreUmfrage4/img/placeholder_male.svg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/svg+xml
etag: "1073744841"
last-modified: Fri, 16 Apr 2021 12:55:43 GMT
content-length: 1401
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/user_01.jpg
195.160.203.18200 OK 1.8 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/user_01.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3\012- data
Hash 23e2cea11cf05ab3f8119159f6f2f152
47fd7ebdd0220965f3627280e9f69b83ce16b2e0
203f86e9e52d29515cd326c03fa134d0b200d68fe5bfe3020003596261f9ec14
GET /DynBanner/PreUmfrage4/img/18/user_01.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "3221227617"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 1804
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/user_02.jpg
195.160.203.18200 OK 1.6 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/user_02.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3\012- data
Hash 8011cc8766140de0a906cf9560a242cf
e99e1e5510db79a0f833ad9d8eec892d8a6a949c
336c516303f00e086cd62fe8ef2709bfed56d7d981384ec95f3dccae0cd8e2fa
GET /DynBanner/PreUmfrage4/img/18/user_02.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "2147486201"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 1599
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/user_03.jpg
195.160.203.18200 OK 2.2 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/user_03.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3\012- data
Hash 4f942fb4b77d9ae65b8d77a283c858de
3385cd0369738d1a21b966f8e91c3bca3abb141a
e74fffbe33c5dbacc0d36bba5cc1219d75c9c2599bc541939631879e679c2e18
GET /DynBanner/PreUmfrage4/img/18/user_03.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "3298"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 2204
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/user_04.jpg
195.160.203.18200 OK 2.2 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/user_04.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3\012- data
Hash 05ea8b7b705ffebe57375718468649a5
2024cf1e2ec1edc1d2db0ddb27ea055eddb31b16
d97b742b75527e441e3201e3ca1b0ae7db689e26c3e049665acf2be666266acd
GET /DynBanner/PreUmfrage4/img/18/user_04.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "3170"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 2188
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/user_05.jpg
195.160.203.18200 OK 1.6 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/user_05.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3\012- data
Hash c31827faf46172aee0f5889ac89a33d8
658c99c1428cb4cfa28fda54fe24c2f5f26e56bb
a2bd2d629540ce01607e269646740bdf37fc8515c51523c625e37e5b818d9eb2
GET /DynBanner/PreUmfrage4/img/18/user_05.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "2147486057"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 1581
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/user_06.jpg
195.160.203.18200 OK 1.8 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/user_06.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3\012- data
Hash f2bed9b802ce13ed8f423dae8c0fadd6
9ee1206958fdf94b026d1d9e5fb0da4c94961fa3
b75aeb6feafd137680e89f2d1ac25d6e1ef343b30ab7dc144ad3affb55682319
GET /DynBanner/PreUmfrage4/img/18/user_06.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "2147487729"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 1790
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/profile_06.jpg
195.160.203.18200 OK 41 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/profile_06.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 560x430, components 3\012- data
Hash d6b6f91b3ffc466c6238f195e39dd389
8b8a65b814e269e66635f17ff5fb1b5fc9023fc4
ab5d5382920eecc520c4361dcb460029cd6835a317ff2568407805da7ce82de3
GET /DynBanner/PreUmfrage4/img/18/profile_06.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "3221228351"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 40803
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/bundle.e947980e25b81460bff1.js
195.160.203.18200 OK 32 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/bundle.e947980e25b81460bff1.js
IP 195.160.203.18:0
File type Unicode text, UTF-8 text, with very long lines (49061), with NEL line terminators
Hash 53b1f60f4601e08b337874cec1ad7efa
67af7037bd38326845d8fe4c6300a22eb9724c54
1cd625eb8695519ab80ddf15e3091ab057919c269a38fde5d58bef0e6c3ae7fb
Analyzer Verdict Alert fortinet Phishing
GET /DynBanner/PreUmfrage4/bundle.e947980e25b81460bff1.js HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: text/javascript
etag: "2181040501-br"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 32440
cache-control: public
vary: Accept-Encoding
content-encoding: br
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/img/18/user_07.jpg
195.160.203.18200 OK 2.2 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/img/18/user_07.jpg
IP 195.160.203.18:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3\012- data
Hash 3ba2fbbcb3d0e2450f90e1c06f417777
3f8f72ab2af7412431c7be5bb0402db8dd823539
2d4d90c5c4774dd9268250e67a0384ff53841cecec79165d6f77ba929f91e814
GET /DynBanner/PreUmfrage4/img/18/user_07.jpg HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
etag: "2970"
last-modified: Wed, 02 Jun 2021 13:52:09 GMT
content-length: 2163
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/DynBanner/PreUmfrage4/fonts/roboto-v18-latin-regular.5d4aeb4e5f5ef754e307d7ffaef688bd.woff2
195.160.203.18200 OK 15 kB URL HTTP/2 www.endorico.com/DynBanner/PreUmfrage4/fonts/roboto-v18-latin-regular.5d4aeb4e5f5ef754e307d7ffaef688bd.woff2
IP 195.160.203.18:0
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Analyzer Verdict Alert fortinet Phishing
GET /DynBanner/PreUmfrage4/fonts/roboto-v18-latin-regular.5d4aeb4e5f5ef754e307d7ffaef688bd.woff2 HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://www.endorico.com/DynBanner/PreUmfrage4/bundle.e947980e25b81460bff1.css
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: application/font-woff2
etag: "3221229454"
last-modified: Fri, 16 Apr 2021 12:55:43 GMT
content-length: 15344
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/Dyn/Webpush/Pre?w=47402&ws=13102_&wt=639232548135b700014ea8f4&js=1&age=18
195.160.203.18200 OK 7.0 kB URL HTTP/2 www.endorico.com/Dyn/Webpush/Pre?w=47402&ws=13102_&wt=639232548135b700014ea8f4&js=1&age=18
IP 195.160.203.18:0
File type HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (18846)
Hash 2d8723d9bb1728f0b4442f2809dfe5f5
e069c81905813fc65ba06d0375b15040372dcb12
d9e010bcb54c489b55db6b20e5e009d1e5d5966a51e5825ae24b89c87c5990e7
GET /Dyn/Webpush/Pre?w=47402&ws=13102_&wt=639232548135b700014ea8f4&js=1&age=18 HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: *
set-cookie: w=47402; expires=Thu, 08-Dec-2022 18:52:05 GMT; Max-Age=0; SameSite=Lax
ws=13102_; expires=Thu, 08-Dec-2022 18:52:05 GMT; Max-Age=0; SameSite=Lax
wt=639232548135b700014ea8f4; expires=Thu, 08-Dec-2022 18:52:05 GMT; Max-Age=0; SameSite=Lax
sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; expires=Sat, 10-Dec-2022 20:52:05 GMT; Max-Age=180000; path=/; SameSite=Strict
CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525; expires=Thu, 08-Dec-2022 19:22:05 GMT; Max-Age=1800; path=/; SameSite=Strict
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
content-length: 6971
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
www.endorico.com/icons/ext.png
195.160.203.18200 OK 2.2 kB URL HTTP/2 www.endorico.com/icons/ext.png
IP 195.160.203.18:0
File type PNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data
Hash 3b58b839ade1bae5069a4eb40822322d
e326255ec2882ce0dcca92fb9b3eeb1050362076
4b06e0a2080f0c0ccd4442b336ab382bbf45de1092b28c4db7f1e2825daee07f
GET /icons/ext.png HTTP/1.1
Host: www.endorico.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/Smartlink/Dating?w=47402&ws=13102_&wt=639232548135b700014ea8f4
Cookie: sid=%87%B0%1B%3A%5Ew%B5Gb%F6%3Cj%B4_%90%A3%C4T%26%906%F6%E7%17Z%15%BC%D2_%87%A5%08; CSRFToken=09c3bd367a1add9436058d94efb005aaeb545d486a05f2c0614cf9d317eca092.1670525525
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
content-type: image/png
etag: "3018"
last-modified: Wed, 02 Dec 2020 08:15:40 GMT
content-length: 2169
cache-control: public
date: Thu, 08 Dec 2022 18:52:05 GMT
server: Webserver
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4402
Expires: Thu, 08 Dec 2022 20:05:28 GMT
Date: Thu, 08 Dec 2022 18:52:06 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4402
Expires: Thu, 08 Dec 2022 20:05:28 GMT
Date: Thu, 08 Dec 2022 18:52:06 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4402
Expires: Thu, 08 Dec 2022 20:05:28 GMT
Date: Thu, 08 Dec 2022 18:52:06 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4402
Expires: Thu, 08 Dec 2022 20:05:28 GMT
Date: Thu, 08 Dec 2022 18:52:06 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa9301ee5-df75-4967-a2c7-597f869e557b.jpeg
34.120.237.76200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa9301ee5-df75-4967-a2c7-597f869e557b.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 57be99ac898a37d73f2ba4a24f56248f
04e32eb45581201a6a1863200e4d139df48285e6
a20081b64fc019372843360b15aa3461ec9dd3deb50ab398bca0a5e74d5468c2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa9301ee5-df75-4967-a2c7-597f869e557b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12534
x-amzn-requestid: 2a01f2ba-cf3a-4f59-8339-214c66bcc0d2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czDbyGTcoAMF_TQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911918-5d3eba8d01e4175a71acc6cd;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 22:52:08 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: NoZlZ8WFfOuIbkWaC2pJPJQrWtjzz2gCHJWr-u-nMNYmu8MkTf6_PA==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:03:58 GMT
age: 71288
etag: "04e32eb45581201a6a1863200e4d139df48285e6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg
34.120.237.76200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 210b27f5f6310d8fad640acce3d9ae0e
08d241e56622cb900754d95bc5d58ed8826d9f32
64410e13759cdfa24976dcba0c64aca27edc3ee56358f344e55f60793422e3ea
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6557
x-amzn-requestid: 0232ddcd-8274-431e-a55e-8298fbfd6dfc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cmcuMG6bIAMFUng=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638c0e5a-3cc17121425f87321ce7ae7e;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 03:04:58 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: etWGqF-8tXSwaeZVTPK4g9CV5ZbdYv5ZDjF5Yx2PSNnTsreewpbhdA==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 08:48:08 GMT
age: 36238
etag: "08d241e56622cb900754d95bc5d58ed8826d9f32"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg
34.120.237.76200 OK 9.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c408efaa98ac2ce63bb1618368d10c15
a51bbb49ebd862d04eaee465d0a35b22dcd21391
077eb8c8739f527828c71c25a1c3aaae46afead3aac093ec11a6d5488ef2f0ec
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9596
x-amzn-requestid: e5e6ceb2-5bad-4146-a9de-92a859716029
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cy3_qH63oAMFfLg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639106ca-678bed1b7729b8aa2645688d;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 21:34:02 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: FsbiyZG0110CEANduIIWuLcxFOxfrV0YPvOSy-ScXFIX1qM6qaOdCg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 22:21:22 GMT
age: 73844
etag: "a51bbb49ebd862d04eaee465d0a35b22dcd21391"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg
34.120.237.76200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8c94003641bb5a7595e7004f80f95d22
3446450df60d732f9021d5bfd5f5f7c6c870d9ec
4d782dbf94b2163e9bc18028cd0c1a391fdcfcb019f23c4c26ea0b44432039ff
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7801
x-amzn-requestid: cb8d5aab-409f-4b39-b498-b1ba84f34e06
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFRNHX4oAMFvoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c07-7c6e3bfa3f81082b48f43fa9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 8QHhEAFHTHd-5UqS1S5qwJj_h4WNfix2CgS4MO4zR_psrzgMP3SZ5g==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:16:35 GMT
age: 70531
etag: "3446450df60d732f9021d5bfd5f5f7c6c870d9ec"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg
34.120.237.76200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 24d89b69ba37bf23c5d576aff4063caf
3d46a21b4da571d7e4962e335c18a28ca5f81ecf
09b52cdab278805c6e7282f469a02768ee62fc9ef09a6623a337e3d3aaa446fd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7268
x-amzn-requestid: ae5c231c-b1be-498a-a242-e8d641f3fe8e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFDgEzUoAMFgyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911baf-10f06dc37cac69631c823fd9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:03:11 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: QSv756DvAzOQnKae5wVg75wrQS6oDGPkfIZka86FNQ2vizBnZ7sIDQ==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:12:45 GMT
age: 70761
etag: "3d46a21b4da571d7e4962e335c18a28ca5f81ecf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg
34.120.237.76200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b87d6543345f73653ed4a49b37d7c959
c4f26846b8b72293368ff16915d49297cf12bbb9
aee6aa42e4b5b83b81f74801ff8f0039fc6d38036f42ee81875813c856cf5eef
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8659
x-amzn-requestid: 6f420d07-65d5-4bb2-9f1f-e56025de497b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFSYFArIAMF46w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c0f-0a295e5c48228d5806b4f107;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: TSh1BNzzIPhWCfYEiqvQJckSPAyhHobe-HK6msEVeEJ1ruX-_rMSSA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:33:19 GMT
age: 69527
etag: "c4f26846b8b72293368ff16915d49297cf12bbb9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
cdn.koketti.com/dynbanner/webpush/52_webpush_7835398.jpg
194.116.151.11200 OK 122 kB URL HTTP/1.1 cdn.koketti.com/dynbanner/webpush/52_webpush_7835398.jpg
IP 194.116.151.11:0
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6], baseline, precision 8, 360x360, components 3\012- data
Size 122 kB (122349 bytes)
Hash 3658b6d4cd520d8c8a6be92cafb00744
ffa7feca981fb1acea0121a751a9623ade595bf2
3da4030c4a3aa818a8f27c8fc31a5504e6de95cdbf51a601c0f1ba0a7383098a
GET /dynbanner/webpush/52_webpush_7835398.jpg HTTP/1.1
Host: cdn.koketti.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.endorico.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Headers: X-Requested-With,Content-Range,If-Range,Range,Content-Type,Authorization,X-Request,Accept
Access-Control-Allow-Methods: *
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Last-Modified: Tue, 12 Jul 2022 12:34:34 GMT
P3p: CP="OTI DSP COR IVDo IVAo PSA PSD TAI DEV ADM CUR CONo OUR IND PHY ONL UNI PUR FIN COM NAV INT CNT PRE", policyref="/w3c/p3p.xml"
Date: Thu, 08 Dec 2022 14:35:10 GMT
Content-Length: 122349
Content-Type: image/jpeg
Accept-Ranges: bytes
Connection: keep-alive