Report - smartrnd.net/click.php?key=eoyg8aoozyxoyutr0wg2&click_id=v2-1664725785311-4-9590-1134395-a5f6060e-54b5-a13e-54e1-dea13a76e940&pub_id=775186&source_id=direct-link&pub_id

Report Overview

Submitted URL
smartrnd.net/click.php?key=eoyg8aoozyxoyutr0wg2&click_id=v2-1664725785311-4-9590-1134395-a5f6060e-54b5-a13e-54e1-dea13a76e940&pub_id=775186&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475
IP
34.192.29.125
ASN
#14618 AMAZON-AES
Submitted
2022-10-02 15:50:06
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.sectigo.com	487	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	328 B	963 B	172.64.155.188
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	52.38.146.2
6.lands.ninja	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.9 kB	32 kB	162.210.198.167
richinfo.co	285236	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	4.1 kB	46.105.199.75
smartrnd.net	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	525 B	602 B	34.192.29.125
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	18.165.201.80
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	108.156.28.39
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
sweetbird.net	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.2 kB	1.5 kB	34.192.29.125
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	54 kB	34.120.237.76
datatechonert.com	46154	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	479 B	482 B	139.45.195.253
rtb.pushdom.co	244282	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	671 B	158 B	38.100.129.136
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1.6 kB	4.4 kB	23.36.76.226
cdntechone.com	64371	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	799 B	748 B	172.67.149.153

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-10-02	medium	datatechonert.com	Sinkholed

JavaScript (4)

	URL	Size	First Seen	Last Seen
	6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO	714 B	2023-03-08	2023-03-26
Pretty URL 6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO IP 162.210.198.167 ASN #30633 LEASEWEB-USA-WDC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 03:10:37 Last Seen2023-03-26 07:30:32 Times Seen2 Hash bcb109cd5a5a0457fdac24986c43f342 d0723548048f6c2914b0d517b93ee4385058b6c0 21eafa92aa0067a1e3e1e0f0aa9a11b1734beb42bceb1cf670fa086190a2761b Loading...

	cdntechone.com/r.html?axcid=b11df4a5-b02c-4bff-b483-c91f3b797763&axaffid=82f5721cb5884d0edf7b84b3cce58475&clid=7a23e17sce8a26o2d3&axfu=https%3A%2F%2Fsweetbird.net%2Fclick.php%3Fkey%3D97xwtzyoopcwl3bwxl6v%26click_id%3D%7Bclid%7D%26source_id%3D%7Baxtsid%7D%26pub_id_hash%3D%7Baxaffid%7D&axft=2&r=https%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D5407553%26var%3D%7Baxaffid%7D%26ymid%3D%7Bclid%7D	2.1 kB	2023-03-08	2023-03-17
Pretty URL cdntechone.com/r.html?axcid=b11df4a5-b02c-4bff-b483-c91f3b797763&axaffid=82f5721cb5884d0edf7b84b3cce58475&clid=7a23e17sce8a26o2d3&axfu=https%3A%2F%2Fsweetbird.net%2Fclick.php%3Fkey%3D97xwtzyoopcwl3bwxl6v%26click_id%3D%7Bclid%7D%26source_id%3D%7Baxtsid%7D%26pub_id_hash%3D%7Baxaffid%7D&axft=2&r=https%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D5407553%26var%3D%7Baxaffid%7D%26ymid%3D%7Bclid%7D IP 172.67.149.153 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 00:34:02 Last Seen2023-03-17 10:41:28 Times Seen1 Hash 60ce02fbc2e3e9b4e60c1deb330bc1b6 31045b73098c3085cd40cf09b1381fc7a4f51531 fd11e986d07d96bf5e9917e0680e5b686ea0c59c3e3140dd440aacfb690d54e3 Loading...

	richinfo.co/richpartners/push/js/rp-cl-ob.js?pubid=775186&siteid=312014&niche=33	11 kB	2023-03-07	2023-03-17
Pretty URL richinfo.co/richpartners/push/js/rp-cl-ob.js?pubid=775186&siteid=312014&niche=33 IP 46.105.199.75 ASN #16276 OVH SAS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:06:55 Last Seen2023-03-17 10:26:27 Times Seen1 Hash d9ddb293bf3aa95164450fbfafe5dbbb eb0062080d8b2c5fd569d0dade70cb892820a77d 0584f032260564bf1d68de7fef6bd3b6507cd30ab150c1a93eb5fc2af750fba7 Loading...

	6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO	826 B	2023-03-08	2023-03-11
Pretty URL 6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO IP 162.210.198.167 ASN #30633 LEASEWEB-USA-WDC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 03:10:37 Last Seen2023-03-11 21:32:00 Times Seen1 Hash cb6359e77237b4b44002d41ad8d78b0e 838f38e7b9f964467842cce1e92017917f7e5cd0 98343c53b9b16700369009171af6330914b3da01fbf09474f433db8c9f212885 Loading...

HTTP Transactions (29)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
60e4edea7b5f4d19f3547a3bb2d5df57
3ee076bab4da3416c2c5808f730cb316c28baef7
763e2dadfdd286a51327cd2000ca335e30cd0b9b7267875d22ca33f7556ba200

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "763E2DADFDD286A51327CD2000CA335E30CD0B9B7267875D22CA33F7556BA200"
Last-Modified: Fri, 30 Sep 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8226
Expires: Sun, 02 Oct 2022 18:07:01 GMT
Date: Sun, 02 Oct 2022 15:49:55 GMT
Connection: keep-alive

smartrnd.net/click.php?key=eoyg8aoozyxoyutr0wg2&click_id=v2-1664725785311-4-9590-1134395-a5f6060e-54b5-a13e-54e1-dea13a76e940&pub_id=775186&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475

34.192.29.125

302 Found

0 B

URL HTTP/1.1
smartrnd.net/click.php?key=eoyg8aoozyxoyutr0wg2&click_id=v2-1664725785311-4-9590-1134395-a5f6060e-54b5-a13e-54e1-dea13a76e940&pub_id=775186&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475
IP
34.192.29.125:0
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /click.php?key=eoyg8aoozyxoyutr0wg2&click_id=v2-1664725785311-4-9590-1134395-a5f6060e-54b5-a13e-54e1-dea13a76e940&pub_id=775186&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475 HTTP/1.1
Host: smartrnd.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Found
Server: nginx/1.20.2
Date: Sun, 02 Oct 2022 15:49:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uclick=17sce8a2i4; expires=Mon, 03-Oct-2022 15:49:55 GMT; Max-Age=86400; path=/
uclickhash=17sce8a2i4-17sce8a2i4-1z-0-rnbl-heoj-he7v-1c17e4; expires=Mon, 03-Oct-2022 15:49:55 GMT; Max-Age=86400; path=/
Location: https://sweetbird.net/click.php?key=c1t0rpuyx4suwqsucwav&click_id=5075b17sce8a2i412e&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475&ln={t4}
Strict-Transport-Security: max-age=31536000

firefox.settings.services.mozilla.com/v1/

18.165.201.80

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
18.165.201.80:0
ASN
#0

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
1b3053fa528e28810f8a2cc9284cc921
cca9eb471d941881a6b9a1793aecb6c281908f6a
a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Backoff, Content-Length, Retry-After
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 02 Oct 2022 15:03:11 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 4ae6e5888b43b4133973ba1aadad8194.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: 8gcvW9YiIs1OQequaxGdiFYqGZOgjqUHMoLbgvCH_uTakjKrpTSHqw==
Age: 2804

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

108.156.28.39

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
108.156.28.39:0
ASN
#16509 AMAZON-02

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 02 Oct 2022 03:33:17 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 7309328e91f012108061822748228b68.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: c0EJ4ZEgsYhvXFAYDggZoq2lCOqX5HEqWnive3YFhfX_gklzDxddUQ==
age: 44199
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sun, 02 Oct 2022 15:49:55 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

18.165.201.80

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
18.165.201.80:0
ASN
#0

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Cache-Control, Alert, Last-Modified, Backoff, Retry-After, Expires, Content-Length, Pragma, ETag
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Sun, 02 Oct 2022 15:32:53 GMT
Expires: Sun, 02 Oct 2022 15:32:59 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: LHR50-P3
X-Amz-Cf-Id: jxQx3Bpc0her5veK8aPNnlDtSs5kYT7nFUM2RVJ4_AN3j34iXECd4w==
Age: 1023

sweetbird.net/click.php?key=c1t0rpuyx4suwqsucwav&click_id=5075b17sce8a2i412e&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475&ln={t4}

34.192.29.125

302 Found

0 B

URL HTTP/1.1
sweetbird.net/click.php?key=c1t0rpuyx4suwqsucwav&click_id=5075b17sce8a2i412e&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475&ln={t4}
IP
34.192.29.125:0
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /click.php?key=c1t0rpuyx4suwqsucwav&click_id=5075b17sce8a2i412e&source_id=direct-link&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475&ln={t4} HTTP/1.1
Host: sweetbird.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 302 Found
Server: nginx/1.20.2
Date: Sun, 02 Oct 2022 15:49:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uclick=17sce8a26o; expires=Mon, 03-Oct-2022 15:49:55 GMT; Max-Age=86400; path=/; secure; SameSite=none
uclickhash=17sce8a26o-17sce8a26o-1z6o-0-370-oj6j-7vyd-8b50f4; expires=Mon, 03-Oct-2022 15:49:55 GMT; Max-Age=86400; path=/; secure; SameSite=none
Location: https://cdntechone.com/r.html?axcid=b11df4a5-b02c-4bff-b483-c91f3b797763&axaffid=82f5721cb5884d0edf7b84b3cce58475&clid=7a23e17sce8a26o2d3&axfu=https%3A%2F%2Fsweetbird.net%2Fclick.php%3Fkey%3D97xwtzyoopcwl3bwxl6v%26click_id%3D%7Bclid%7D%26source_id%3D%7Baxtsid%7D%26pub_id_hash%3D%7Baxaffid%7D&axft=2&r=https%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D5407553%26var%3D%7Baxaffid%7D%26ymid%3D%7Bclid%7D
Strict-Transport-Security: max-age=31536000

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
4eb30b4a4234809cf7d5f89fa1f6ceeb
797242aab2f13c820050aa9accd11b7b950cd177
ce9d833a0ac321a908184b655d6632c481f758a04a9c936a7c303bb253444146

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2461
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 02 Oct 2022 15:49:56 GMT
Last-Modified: Sun, 02 Oct 2022 15:08:55 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 471

ocsp.sectigo.com/

172.64.155.188

200 OK

471 B

URL HTTP/1.1
ocsp.sectigo.com/
IP
172.64.155.188:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
471 B (471 bytes)
Hash
43c135dfee10be0f365ee8808b0b8542
3fad11c98d889f4893eb5d528a6e53cc5fcc142d
058e059f70b9620ec203987d7c390a858ba9484843f26e1a1e51e23ed97656b3

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Oct 2022 15:49:56 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 30 Sep 2022 13:33:17 GMT
Expires: Fri, 07 Oct 2022 13:33:16 GMT
Etag: "3fad11c98d889f4893eb5d528a6e53cc5fcc142d"
Cache-Control: max-age=423199,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 753e9743add50b61-OSL

datatechonert.com/log/add?cid=b11df4a5-b02c-4bff-b483-c91f3b797763

139.45.195.253

200 OK

12 B

URL HTTP/1.1
datatechonert.com/log/add?cid=b11df4a5-b02c-4bff-b483-c91f3b797763
IP
139.45.195.253:0
ASN
#9002 RETN Limited

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
adb4650bfc9d2a73d4dd69583b0ceb14
1ce399d6e936232aaf2192cd7903a279c5015f22
21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

POST /log/add?cid=b11df4a5-b02c-4bff-b483-c91f3b797763 HTTP/1.1
Host: datatechonert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cdntechone.com/
Content-Type: text/plain;charset=UTF-8
Origin: https://cdntechone.com
Content-Length: 1895
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Sun, 02 Oct 2022 15:49:56 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 12
Connection: keep-alive
Access-Control-Allow-Origin: https://cdntechone.com
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true

push.services.mozilla.com/

52.38.146.2

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.38.146.2:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: CvlYseRdwIk5/qPuf2l3lg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: AuJaq8o+qaMVwthY+78MyBFfU1g=

sweetbird.net/click.php?key=97xwtzyoopcwl3bwxl6v&click_id=7a23e17sce8a26o2d3&source_id=null&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475

34.192.29.125

302 Found

0 B

URL HTTP/1.1
sweetbird.net/click.php?key=97xwtzyoopcwl3bwxl6v&click_id=7a23e17sce8a26o2d3&source_id=null&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475
IP
34.192.29.125:0
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /click.php?key=97xwtzyoopcwl3bwxl6v&click_id=7a23e17sce8a26o2d3&source_id=null&pub_id_hash=82f5721cb5884d0edf7b84b3cce58475 HTTP/1.1
Host: sweetbird.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cdntechone.com/
Cookie: uclick=17sce8a26o; uclickhash=17sce8a26o-17sce8a26o-1z6o-0-370-oj6j-7vyd-8b50f4
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/1.1 302 Found
Server: nginx/1.20.2
Date: Sun, 02 Oct 2022 15:49:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uclick=17sce8a26o; expires=Mon, 03-Oct-2022 15:49:56 GMT; Max-Age=86400; path=/; secure; SameSite=none
uclickhash=17sce8a26o-17sce8a3i4-3zbl-0-m70-oj7v-oj8r-d21c0f; expires=Mon, 03-Oct-2022 15:49:56 GMT; Max-Age=86400; path=/; secure; SameSite=none
Location: https://6.lands.ninja?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO
Strict-Transport-Security: max-age=31536000

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
3d7f3762ce36e91f8cc436d0c234aab7
d7ab45f952964908a23e413d1d275591c837e9f0
a4bc095da4cb765fd2573b8d5626e9010b25f005079fd439aaa61f66e1f1c535

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A4BC095DA4CB765FD2573B8D5626E9010B25F005079FD439AAA61F66E1F1C535"
Last-Modified: Fri, 30 Sep 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6501
Expires: Sun, 02 Oct 2022 17:38:17 GMT
Date: Sun, 02 Oct 2022 15:49:56 GMT
Connection: keep-alive

6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO

162.210.198.167

200 OK

7.8 kB

URL HTTP/2
6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO
IP
162.210.198.167:0
ASN
#30633 LEASEWEB-USA-WDC

File type
data
Size
7.8 kB (7777 bytes)
Hash
041e378172f5639f609d468c5fa06143
c6b997ecb4dab93a7112702dbf85ba77d8002a8c
02c882911a1d6b9c525ac1ed329281d43621a380c411db84756bb61a89042924

HTTP Headers

GET /?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO HTTP/1.1
Host: 6.lands.ninja
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cdntechone.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 02 Oct 2022 15:49:56 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 07 Sep 2022 06:31:42 GMT
etag: W/"33dd-5e810774ddbfd"
content-encoding: gzip
X-Firefox-Spdy: h2

richinfo.co/richpartners/push/js/rp-cl-ob.js?pubid=775186&siteid=312014&niche=33

46.105.199.75

200 OK

3.7 kB

URL HTTP/2
richinfo.co/richpartners/push/js/rp-cl-ob.js?pubid=775186&siteid=312014&niche=33
IP
46.105.199.75:0
ASN
#16276 OVH SAS

File type
ASCII text, with very long lines (10684), with no line terminators
Size
3.7 kB (3662 bytes)
Hash
0a5e7593c2e1f0fdef758ce96955729b
a2ac38f1e36c8d0a8eea1d97d27b2158f7ee406c
06d1c90e841057de6b6098e9fe4a357a77d10c18e0de07c8101c2d5e36a1bb4f

HTTP Headers

GET /richpartners/push/js/rp-cl-ob.js?pubid=775186&siteid=312014&niche=33 HTTP/1.1
Host: richinfo.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6.lands.ninja/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Tue, 27 Sep 2022 00:16:43 GMT
last-modified: Fri, 02 Sep 2022 13:55:56 GMT
etag: "63120b6c-29bc"
expires: Tue, 11 Oct 2022 00:16:43 GMT
cache-control: max-age=1209600
x-request-id: 460981946
content-type: application/javascript
content-encoding: br
x-cdn-pop: sbg
x-cdn-pop-ip: 137.74.120.0/27
x-cacheable: Matched cache
accept-ranges: bytes
content-length: 3662
X-Firefox-Spdy: h2

6.lands.ninja/img/man.png

162.210.198.167

200 OK

11 kB

URL HTTP/2
6.lands.ninja/img/man.png
IP
162.210.198.167:0
ASN
#30633 LEASEWEB-USA-WDC

File type
PNG image data, 179 x 278, 8-bit colormap, non-interlaced\012- data
Size
11 kB (10591 bytes)
Hash
a6fa8154cc36da494df7b5103329c15a
3a2310088bcec14f7c0187f8409a5af5395665e8
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837

HTTP Headers

GET /img/man.png HTTP/1.1
Host: 6.lands.ninja
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 02 Oct 2022 15:49:56 GMT
content-type: image/png
content-length: 10591
last-modified: Fri, 19 Aug 2022 17:54:25 GMT
etag: "295f-5e69bc9efa59f;5d3a990daefa5"
accept-ranges: bytes
X-Firefox-Spdy: h2

6.lands.ninja/img/logo.png

162.210.198.167

200 OK

1.1 kB

URL HTTP/2
6.lands.ninja/img/logo.png
IP
162.210.198.167:0
ASN
#30633 LEASEWEB-USA-WDC

File type
PNG image data, 94 x 19, 8-bit colormap, non-interlaced\012- data
Size
1.1 kB (1061 bytes)
Hash
d708fbf0358752a082f5a394b74adda8
231c1527b4b039eb3af7d7e9eb5587ed87f6ea81
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5

HTTP Headers

GET /img/logo.png HTTP/1.1
Host: 6.lands.ninja
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 02 Oct 2022 15:49:56 GMT
content-type: image/png
content-length: 1061
last-modified: Fri, 19 Aug 2022 17:54:24 GMT
etag: "425-5e69bc9e23c07;5d3a990daefa5"
accept-ranges: bytes
X-Firefox-Spdy: h2

6.lands.ninja/img/bot.png

162.210.198.167

200 OK

11 kB

URL HTTP/2
6.lands.ninja/img/bot.png
IP
162.210.198.167:0
ASN
#30633 LEASEWEB-USA-WDC

File type
PNG image data, 260 x 260, 8-bit colormap, non-interlaced\012- data
Size
11 kB (11043 bytes)
Hash
ca1f4de0ad1d4fad72d299a6411e6959
c9f6d409f09264a34ee8bac4265233c56c280d1a
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f

HTTP Headers

GET /img/bot.png HTTP/1.1
Host: 6.lands.ninja
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6.lands.ninja/?q=4278117sce8a3i4426&s=null&var=82f5721cb5884d0edf7b84b3cce58475&geo=NO
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Sun, 02 Oct 2022 15:49:57 GMT
content-type: image/png
content-length: 11043
last-modified: Fri, 19 Aug 2022 17:54:24 GMT
etag: "2b23-5e69bc9e22497;5d3a990daefa5"
accept-ranges: bytes
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7368
Expires: Sun, 02 Oct 2022 17:52:45 GMT
Date: Sun, 02 Oct 2022 15:49:57 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7368
Expires: Sun, 02 Oct 2022 17:52:45 GMT
Date: Sun, 02 Oct 2022 15:49:57 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
f5e503471cc78b95c0a3e75785615e5f
145b1e4d850c145a78577b5d7d4fadae9658d7a4
61bf2bddece68c7876ab5481c14ed1b1879343e55c86ee013b4f3a8d3353e6b4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61BF2BDDECE68C7876AB5481C14ED1B1879343E55C86EE013B4F3A8D3353E6B4"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7368
Expires: Sun, 02 Oct 2022 17:52:45 GMT
Date: Sun, 02 Oct 2022 15:49:57 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6315 bytes)
Hash
206fb65e75dbadf119512f71e0b78402
58ff0bf8ce7528b303d28bab01a80ad721705569
56c8d5f3b3060ee54bf81995269b86c070855d8c33bf437161339a45b309703f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6315
x-amzn-requestid: 6aa75b16-32e4-48a7-9fb0-9e3d5528c2d5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWSdsHUnIAMFXtw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338cabd-742d8a436403683e0cd9368f;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 23:18:21 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 5sAzc5Ewv4g6Wqq6JJiLylG3Jyy_nlWrr5Oteeo6ebEgq7Rvss4XaQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Sun, 02 Oct 2022 04:41:39 GMT
age: 40098
etag: "58ff0bf8ce7528b303d28bab01a80ad721705569"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7d657f8a-70bc-42c6-9aae-1127c4403047.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.6 kB (8602 bytes)
Hash
94d82ad8d70761f6ee1384b4183335f3
5d3389a965cfa45dab2202d89b40264368674e8a
ad495dc0ede3bfcbaebfd3bf2eb55fc5596cd7643a539e030ccce0b8a3bcf8dd

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7d657f8a-70bc-42c6-9aae-1127c4403047.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8602
x-amzn-requestid: 89329169-bc7a-46b1-85fc-20383a85cae8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDf9GxzoAMFg0A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b2cc-27952f8357fa25c956b1cd72;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:36:12 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: YDfn3Xd8m6jaBrj_M9hs4dePku_eEhJbYv3NJSHjCdAWifhBkiKUhw==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:53:38 GMT
age: 64579
etag: "5d3389a965cfa45dab2202d89b40264368674e8a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11083 bytes)
Hash
edded48f558f739287a040151349ef67
d63b6ba630736d32c364b0e6a369274b2389b7ff
33b4a459df0ba7b36b907ba96d74e08660cc75640c42a5748b97d18ec2e9d533

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccb5f775-a073-47ba-b076-ad1c96659b64.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11083
x-amzn-requestid: 53e2c961-bcc0-4977-8648-ee3c1aed9cde
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEHRFWfIAMFhlA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3c7-070212d7386d5efa1b4aa8d3;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Z1KmxHJh9QNfg5x0enkqOjbmiqHvg7nlQiMnuDuCRNWQUBFEiKELbw==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 31119c39c5a6dc62dfa1fe940afd7be2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:53:35 GMT
etag: "d63b6ba630736d32c364b0e6a369274b2389b7ff"
content-type: image/jpeg
age: 64582
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd4280e4-6b15-45b7-9469-d13ba14c37db.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.9 kB (6871 bytes)
Hash
9dddb9d84a16a3004821d89836b83dc3
087521979efd5936416fd7f030779fa5725f0a8f
a6251ac43958031d765b5743d43e14bc04b1e465bed81f757c3609ee6f2bea66

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd4280e4-6b15-45b7-9469-d13ba14c37db.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6871
x-amzn-requestid: e1fdb2ee-c0e7-4a0c-ae26-d968aef00503
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEIOGp2IAMFxSQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3ce-24b26a8048ffd84071a2ad57;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:30 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: -svKnYBuiMSdWObzJyNah9TDIi6IuPP6VMzEJWmn0zxoZbFmwpzkJw==
via: 1.1 c07670802688417c8b871124c547eb0a.cloudfront.net (CloudFront), 1.1 35575576af8067e30cfb17c6b9fde8e2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:53:35 GMT
age: 64582
etag: "087521979efd5936416fd7f030779fa5725f0a8f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.0 kB (4987 bytes)
Hash
463bdcfbec5426e18ecef83b1c373b71
2e533332ee5c49143e58dad32ee3717a39179532
2c40befd28781482b9be249a792571612d68d7045324083d2c832fa5ec42f04b

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F59054e54-a013-42c5-98a5-abe2b6af4fc6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4987
x-amzn-requestid: 763edd04-7f8d-42ae-8864-482be3549958
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWEHpFs4oAMFbqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b3ca-2f7b67e85aa83b69183e62b5;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:40:26 GMT
x-amz-cf-pop: SFO5-P2, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 2Zoggf30lA-Kvt5QYa-IdhGePHCNiphR7pfFiOaFvL8ZkWZIaiK4pA==
via: 1.1 f4367b41311e3e9a490d7461b7b85490.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:54:45 GMT
etag: "2e533332ee5c49143e58dad32ee3717a39179532"
content-type: image/jpeg
age: 64512
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F589e050c-3794-45f2-a218-269b944ae739.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.6 kB (9600 bytes)
Hash
11f2e40823827b62bca89d18ee279cb2
fa7e61b4f2864b8e51acb2cc887c15d5cb41ef38
c7811cb947483a033f31ff1e93b813f1bbc49b03ed78fcedab2090c71e5c4d1f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F589e050c-3794-45f2-a218-269b944ae739.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9600
x-amzn-requestid: e83a86d3-f5ab-4645-92df-4b2da3d4afa3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWDgmFdlIAMFzQA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338b2d0-48c3fa150800475c790b95bd;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 21:36:16 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: f1aqkuvCub_vq9gBDgA4VL8hNf16FXzXhQjSHC1yDLISm85uOqJF9w==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 6396e88c437c096ef98930ce29f731a2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 01 Oct 2022 21:54:50 GMT
etag: "fa7e61b4f2864b8e51acb2cc887c15d5cb41ef38"
content-type: image/jpeg
age: 64507
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

rtb.pushdom.co/pixels/storage/custom/pixel.gif?datasource=adx_reports&publisher_id=775186&site_id=312014&hits=1&ssp_id=1447&traffic_channel=XML_PUSH&script_type=content-locker&custom_1=https&custom_2=1&custom_3=https%3A%2F%2F6.lands.ninja%2F%3Fq%3D4278117sce8a3i4426%26s%3Dnull%26var%3D82f5721cb5884d0edf7b84b3cce58475%26geo%3DNO

38.100.129.136

200 OK

0 B

URL HTTP/2
rtb.pushdom.co/pixels/storage/custom/pixel.gif?datasource=adx_reports&publisher_id=775186&site_id=312014&hits=1&ssp_id=1447&traffic_channel=XML_PUSH&script_type=content-locker&custom_1=https&custom_2=1&custom_3=https%3A%2F%2F6.lands.ninja%2F%3Fq%3D4278117sce8a3i4426%26s%3Dnull%26var%3D82f5721cb5884d0edf7b84b3cce58475%26geo%3DNO
IP
38.100.129.136:0
ASN
#174 COGENT-174

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /pixels/storage/custom/pixel.gif?datasource=adx_reports&publisher_id=775186&site_id=312014&hits=1&ssp_id=1447&traffic_channel=XML_PUSH&script_type=content-locker&custom_1=https&custom_2=1&custom_3=https%3A%2F%2F6.lands.ninja%2F%3Fq%3D4278117sce8a3i4426%26s%3Dnull%26var%3D82f5721cb5884d0edf7b84b3cce58475%26geo%3DNO HTTP/1.1
Host: rtb.pushdom.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://6.lands.ninja/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: openresty/1.15.8.3
date: Sun, 02 Oct 2022 15:49:58 GMT
content-type: text/html;charset=UTF-8
content-length: 0
X-Firefox-Spdy: h2

cdntechone.com/r.html?axcid=b11df4a5-b02c-4bff-b483-c91f3b797763&axaffid=82f5721cb5884d0edf7b84b3cce58475&clid=7a23e17sce8a26o2d3&axfu=https%3A%2F%2Fsweetbird.net%2Fclick.php%3Fkey%3D97xwtzyoopcwl3bwxl6v%26click_id%3D%7Bclid%7D%26source_id%3D%7Baxtsid%7D%26pub_id_hash%3D%7Baxaffid%7D&axft=2&r=https%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D5407553%26var%3D%7Baxaffid%7D%26ymid%3D%7Bclid%7D

172.67.149.153

200 OK

0 B

URL HTTP/2
cdntechone.com/r.html?axcid=b11df4a5-b02c-4bff-b483-c91f3b797763&axaffid=82f5721cb5884d0edf7b84b3cce58475&clid=7a23e17sce8a26o2d3&axfu=https%3A%2F%2Fsweetbird.net%2Fclick.php%3Fkey%3D97xwtzyoopcwl3bwxl6v%26click_id%3D%7Bclid%7D%26source_id%3D%7Baxtsid%7D%26pub_id_hash%3D%7Baxaffid%7D&axft=2&r=https%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D5407553%26var%3D%7Baxaffid%7D%26ymid%3D%7Bclid%7D
IP
172.67.149.153:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /r.html?axcid=b11df4a5-b02c-4bff-b483-c91f3b797763&axaffid=82f5721cb5884d0edf7b84b3cce58475&clid=7a23e17sce8a26o2d3&axfu=https%3A%2F%2Fsweetbird.net%2Fclick.php%3Fkey%3D97xwtzyoopcwl3bwxl6v%26click_id%3D%7Bclid%7D%26source_id%3D%7Baxtsid%7D%26pub_id_hash%3D%7Baxaffid%7D&axft=2&r=https%3A%2F%2Fgtoonfd.com%2Flink%3Fz%3D5407553%26var%3D%7Baxaffid%7D%26ymid%3D%7Bclid%7D HTTP/1.1
Host: cdntechone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 200 OK
date: Sun, 02 Oct 2022 15:49:56 GMT
content-type: text/html
last-modified: Thu, 04 Aug 2022 15:17:49 GMT
link: <https://datatechone.com/>; rel=preconnect; crossorigin, <https://datatechonert.com/>; rel=preconnect; crossorigin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=coid1mwsT7OjgCLnv2jl%2BPrPRg%2B7C4jJC2om5zRxeHlIIMoJaWcR6jmMdvdmNZkp95DIkqR4tizuJJmHLhXyWmGh0v5xauJjyuledJrnNjCtztbH2I%2Frp%2BrVP%2FsK0EhNHw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 753e97419cabb50c-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (29)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size