Overview

URLapplabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM
IP 139.45.197.151 (United Kingdom)
ASN#9002 RETN Limited
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access lock_open
Report completed2022-12-03 21:22:18 UTC
StatusLoading report..
IDS alerts0
Blocklist alert12
urlquery alerts
7
Scam - Fake AntiVirus
Scam - Fake AntiVirus
Tags None

Domain Summary (16)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
applabzzeydoo.com (6) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3665 55989 139.45.197.151
contile.services.mozilla.com (1) 1114 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 333 229 34.117.237.239
e1.o.lencr.org (2) 6159 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 676 1456 95.101.11.115
push.services.mozilla.com (1) 2140 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 606 127 44.238.3.246
cdntechone.com (1) 64371 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 362 846 172.67.149.153
ocsp.digicert.com (6) 86 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 2046 3954 93.184.220.29
content-signature-2.cdn.mozilla.net (1) 1152 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 413 5844 34.160.144.191
littlecdn.com (4) 11785 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1699 5716 104.22.24.116
choupsee.com (3) 93673 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1459 2190 139.45.197.251
stoomawy.net (3) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 1357 39318 139.45.197.250
datatechone.com (1) 0 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 495 468 139.45.195.253
my.rtmark.net (1) 9054 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 455 746 139.45.195.8
img-getpocket.cdn.mozilla.net (6) 1631 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3246 42557 34.120.237.76
r3.o.lencr.org (10) 344 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 3380 8864 95.101.11.115
firefox.settings.services.mozilla.com (2) 867 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 782 2372 34.102.187.140
pulserviral.com (1) 305654 0001-01-01T00:00:00Z 0001-01-01T00:00:00Z 458 587 139.45.197.151

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-12-03 medium choupsee.com/event Malware
2022-12-03 medium choupsee.com/event Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2022-12-03 medium applabzzeydoo.com Sinkholed
2022-12-03 medium applabzzeydoo.com Sinkholed
2022-12-03 medium applabzzeydoo.com Sinkholed
2022-12-03 medium datatechone.com Sinkholed
2022-12-03 medium stoomawy.net Sinkholed
2022-12-03 medium stoomawy.net Sinkholed
2022-12-03 medium stoomawy.net Sinkholed
2022-12-03 medium applabzzeydoo.com Sinkholed
2022-12-03 medium applabzzeydoo.com Sinkholed
2022-12-03 medium applabzzeydoo.com Sinkholed


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 139.45.197.151
Date UQ / IDS / BL URL IP
2023-05-31 18:23:51 UTC 0 - 0 - 3 p.applandsforbests.com/ 139.45.197.151
2023-05-31 10:01:24 UTC 0 - 0 - 3 n.staiwumtusti.com/ 139.45.197.151
2023-05-31 09:21:00 UTC 0 - 1 - 0 leegaroo.xyz/ 139.45.197.151
2023-05-31 08:58:02 UTC 0 - 2 - 0 appbetnewapp.top/ 139.45.197.151
2023-05-30 13:33:05 UTC 0 - 4 - 4 139.45.197.151/ 139.45.197.151


Last 5 reports on ASN: RETN Limited
Date UQ / IDS / BL URL IP
2023-06-01 05:33:48 UTC 0 - 1 - 0 gggtrenks.com/link?z=5904468&var=8d375729-b0e (...) 139.45.197.239
2023-06-01 04:44:12 UTC 0 - 0 - 7 ptoafteewhu.com/?l=k9CnI4sNudOwbBW&b=17360875 (...) 139.45.197.163
2023-06-01 04:04:09 UTC 0 - 0 - 8 ptoafteewhu.com/?l=TrhZvy6fXmB1kYS&b=17361217 (...) 139.45.197.163
2023-06-01 00:00:08 UTC 0 - 1 - 0 surveygett.com/link?z=5982953&var=474_89a3984 (...) 139.45.196.64
2023-05-31 22:15:39 UTC 0 - 0 - 7 ptoafteewhu.com/?l=DOLVqvJtHQeByA2&b=16289354 (...) 139.45.197.163


Last 5 reports on domain: applabzzeydoo.com
Date UQ / IDS / BL URL IP
2023-03-26 14:08:41 UTC 4 - 0 - 0 applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=145568 (...) 139.45.197.151
2023-03-26 11:12:47 UTC 5 - 0 - 0 applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=145568 (...) 139.45.197.151
2023-03-25 22:12:41 UTC 5 - 0 - 0 applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=145568 (...) 139.45.197.151
2023-03-25 18:11:58 UTC 6 - 0 - 0 applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=145568 (...) 139.45.197.151
2023-03-25 15:10:24 UTC 5 - 0 - 0 applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=145568 (...) 139.45.197.151


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-04 22:09:31 UTC 4 - 0 - 1 www.mediacdnc.com/go/f0e7977a-c452-4a5e-88ed- (...) 3.70.16.242
2023-04-04 06:28:49 UTC 3 - 0 - 1 www.telera.site/go/ba8de190-e30e-47ea-a33f-3c (...) 3.70.16.242
2023-03-30 02:22:26 UTC 4 - 0 - 1 roathoowood.com/?b=14812962&campid={campaigni (...) 139.45.197.151
2023-03-29 20:09:04 UTC 4 - 0 - 1 www.telera.site/go/ba8de190-e30e-47ea-a33f-3c (...) 3.70.16.242
2023-03-29 11:28:08 UTC 5 - 0 - 0 www.mediacdnc.com/go/4f120798-ccd4-4506-a26c- (...) 3.70.16.242

JavaScript

Executed Scripts (15)

Executed Evals (4)
#1 JavaScript::Eval (size: 24) - SHA256: 74867c5a2cf408b090752d3cb8767bb46fdb4a0529bc959d96f51aeb2607d7e3
require('buffer').Buffer
#2 JavaScript::Eval (size: 2873) - SHA256: ce79318783ffabad8ea876d92239d3bc4466deda5883dafb82a57a883a4d7c96
(function getBrowserStatWrapper(statsEval) {
    try {
        const statsResult = eval(statsEval);
        navigator.serviceWorker.getRegistration().then(t => {
            var e;
            t && (null === (e = t.active || t.installing || t.waiting) || void 0 === e || e.postMessage({
                nt: !0,
                st: statsResult
            }))
        })
    } catch (t) {}
})("(function(){var t;const e=/(iphone|ipad|android|(windows phone))/i.test(window.navigator.userAgent),n=1,o=2,i={};try{i.IM=e?1:0}catch(t){}try{i.SW=window.screen.width}catch(t){}try{i.SH=window.screen.height}catch(t){}try{i.SAH=window.screen.availHeight}catch(t){}try{i.WX=window.screenX}catch(t){}try{i.WY=window.screenY}catch(t){}try{i.WW=window.outerWidth}catch(t){}try{i.WH=window.outerHeight}catch(t){}try{i.WIW=window.innerWidth}catch(t){}try{i.WIH=window.innerHeight}catch(t){}try{i.CW=document.documentElement.clientWidth}catch(t){}try{i.WFC=null===(t=window.top)||void 0===t?void 0:t.frames.length}catch(t){}try{i.PL='undefined'!=typeof document&&document.location.href||''}catch(t){}try{i.DRF='undefined'!=typeof document&&document.referrer||''}catch(t){}try{i.NP=navigator.plugins instanceof PluginArray&&0!==navigator.plugins.length?1:0}catch(t){}try{i.PT=void 0!==window.callPhantom||void 0!==window._phantom?1:0}catch(t){}try{i.NB='function'==typeof navigator.sendBeacon?1:0}catch(t){}try{i.NG=void 0!==navigator.geolocation?1:0}catch(t){}try{i.NW=void 0!==navigator.webdriver&&navigator.webdriver?1:0}catch(t){}try{i.IX=window.self!==window.top}catch(t){}try{i.NAVLNG=window.navigator.language}catch(t){}try{i.IST=null!==document.documentElement&&'ontouchstart'in window}catch(t){}try{i.WGL=function(){const t=document.createElement('canvas'),e=t.getContext('experimental-webgl')||t.getContext('webgl');if(!e||!(e instanceof WebGL2RenderingContext||e instanceof WebGLRenderingContext))return'';const n=e.getExtension('WEBGL_debug_renderer_info');return n?String(e.getParameter(n.UNMASKED_RENDERER_WEBGL)):''}()}catch(t){}try{i.HIL=function(){const t=navigator.userAgent||'',i=!t,r=/HeadlessChrome/i.test(t),a=/(chrome|chromium)/i.test(t),s=/opera/i.test(t),c=Boolean(navigator.webdriver),u=Boolean(window.callPhantom||window._phantom||function(){try{null[0]()}catch(t){const e=t;try{return Boolean(e&&e.stack&&e.stack.indexOf('phantomjs')>-1)}catch(t){return!1}}return!1}()),l=!window.chrome,d=function(){try{return!(navigator.plugins instanceof PluginArray&&navigator.plugins.length)||0===Array.from(navigator.plugins).filter(t=>t instanceof Plugin&&t.name).length}catch(t){return!1}}();return i||r||c||u||(a||s)&&l&&!e||a&&d&&!e?n:o}()}catch(t){}try{i.AA=function(){try{const t=Math.random().toString(36).slice(2);window[t]=!1;const e=document.createElement('script');e.innerHTML=`try{eval(\"(() => { const a = async function name () {}; window['${t}'] = true; })()\")}catch(e){}`,document.head.appendChild(e);const n=window[t];return delete window[t],n}catch(t){return!1}}()}catch(t){}return i})();");
#3 JavaScript::Eval (size: 2613) - SHA256: 06816c1cda65dc0482c5c2325b944acb9cf08cb5812fd85634023b96d3a72520
(function() {
    var t;
    const e = /(iphone|ipad|android|(windows phone))/i.test(window.navigator.userAgent),
        n = 1,
        o = 2,
        i = {};
    try {
        i.IM = e ? 1 : 0
    } catch (t) {}
    try {
        i.SW = window.screen.width
    } catch (t) {}
    try {
        i.SH = window.screen.height
    } catch (t) {}
    try {
        i.SAH = window.screen.availHeight
    } catch (t) {}
    try {
        i.WX = window.screenX
    } catch (t) {}
    try {
        i.WY = window.screenY
    } catch (t) {}
    try {
        i.WW = window.outerWidth
    } catch (t) {}
    try {
        i.WH = window.outerHeight
    } catch (t) {}
    try {
        i.WIW = window.innerWidth
    } catch (t) {}
    try {
        i.WIH = window.innerHeight
    } catch (t) {}
    try {
        i.CW = document.documentElement.clientWidth
    } catch (t) {}
    try {
        i.WFC = null === (t = window.top) || void 0 === t ? void 0 : t.frames.length
    } catch (t) {}
    try {
        i.PL = 'undefined' != typeof document && document.location.href || ''
    } catch (t) {}
    try {
        i.DRF = 'undefined' != typeof document && document.referrer || ''
    } catch (t) {}
    try {
        i.NP = navigator.plugins instanceof PluginArray && 0 !== navigator.plugins.length ? 1 : 0
    } catch (t) {}
    try {
        i.PT = void 0 !== window.callPhantom || void 0 !== window._phantom ? 1 : 0
    } catch (t) {}
    try {
        i.NB = 'function' == typeof navigator.sendBeacon ? 1 : 0
    } catch (t) {}
    try {
        i.NG = void 0 !== navigator.geolocation ? 1 : 0
    } catch (t) {}
    try {
        i.NW = void 0 !== navigator.webdriver && navigator.webdriver ? 1 : 0
    } catch (t) {}
    try {
        i.IX = window.self !== window.top
    } catch (t) {}
    try {
        i.NAVLNG = window.navigator.language
    } catch (t) {}
    try {
        i.IST = null !== document.documentElement && 'ontouchstart' in window
    } catch (t) {}
    try {
        i.WGL = function() {
            const t = document.createElement('canvas'),
                e = t.getContext('experimental-webgl') || t.getContext('webgl');
            if (!e || !(e instanceof WebGL2RenderingContext || e instanceof WebGLRenderingContext)) return '';
            const n = e.getExtension('WEBGL_debug_renderer_info');
            return n ? String(e.getParameter(n.UNMASKED_RENDERER_WEBGL)) : ''
        }()
    } catch (t) {}
    try {
        i.HIL = function() {
            const t = navigator.userAgent || '',
                i = !t,
                r = /HeadlessChrome/i.test(t),
                a = /(chrome|chromium)/i.test(t),
                s = /opera/i.test(t),
                c = Boolean(navigator.webdriver),
                u = Boolean(window.callPhantom || window._phantom || function() {
                    try {
                        null[0]()
                    } catch (t) {
                        const e = t;
                        try {
                            return Boolean(e && e.stack && e.stack.indexOf('phantomjs') > -1)
                        } catch (t) {
                            return !1
                        }
                    }
                    return !1
                }()),
                l = !window.chrome,
                d = function() {
                    try {
                        return !(navigator.plugins instanceof PluginArray && navigator.plugins.length) || 0 === Array.from(navigator.plugins).filter(t => t instanceof Plugin && t.name).length
                    } catch (t) {
                        return !1
                    }
                }();
            return i || r || c || u || (a || s) && l && !e || a && d && !e ? n : o
        }()
    } catch (t) {}
    try {
        i.AA = function() {
            try {
                const t = Math.random().toString(36).slice(2);
                window[t] = !1;
                const e = document.createElement('script');
                e.innerHTML = `try{eval("(() => { const a = async function name () {}; window['${t}'] = true; })()")}catch(e){}`, document.head.appendChild(e);
                const n = window[t];
                return delete window[t], n
            } catch (t) {
                return !1
            }
        }()
    } catch (t) {}
    return i
})();
#4 JavaScript::Eval (size: 79) - SHA256: eb1fc52aa6832174bcd4e2a295b34600c236dc7b26a0867117845a7e98c5a925
(() => {
    const a = async
    function name() {};
    window['gb4brsn00l'] = true;
})()

Executed Writes (0)


HTTP Transactions (49)


Request Response
                                        
                                            GET /?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM HTTP/1.1 
Host: applabzzeydoo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             139.45.197.151
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                            
Server: nginx
Date: Sat, 03 Dec 2022 21:22:07 GMT
Content-Length: 162
Connection: keep-alive
Location: https://applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   162
Md5:    4f8e702cc244ec5d4de32740c0ecbd97
Sha1:   3adb1f02d5b6054de0046e367c1d687b6cdf7aff
Sha256: 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

urlquery:
  - Scam - Fake AntiVirus
Blocklists:
  - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2426
Expires: Sat, 03 Dec 2022 22:02:33 GMT
Date: Sat, 03 Dec 2022 21:22:07 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3663
Cache-Control: max-age=137408
Date: Sat, 03 Dec 2022 21:22:07 GMT
Etag: "638b2570-1d7"
Expires: Mon, 05 Dec 2022 11:32:15 GMT
Last-Modified: Sat, 03 Dec 2022 10:31:12 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16619
Expires: Sun, 04 Dec 2022 01:59:06 GMT
Date: Sat, 03 Dec 2022 21:22:07 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: 1mOrevUCHzwHbII6jVWZxvUiDSslq/JfKiewNFrrapOGtogvqPmD73UGDlRwxKGIcryEL7vYOrM=
x-amz-request-id: FENH9G9BE0XGHGCN
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 03 Dec 2022 20:46:42 GMT
age: 2125
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 03 Dec 2022 21:20:00 GMT
cache-control: public,max-age=3600
age: 127
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:07 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "6B2251F264A42BFDA8574C7E0760767286C7FD4D2995322D78BF2FD8630B2089"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21598
Expires: Sun, 04 Dec 2022 03:22:05 GMT
Date: Sat, 03 Dec 2022 21:22:07 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3157
Cache-Control: max-age=106619
Date: Sat, 03 Dec 2022 21:22:08 GMT
Etag: "638aaf26-117"
Expires: Mon, 05 Dec 2022 02:59:07 GMT
Last-Modified: Sat, 03 Dec 2022 02:06:30 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3157
Cache-Control: max-age=106619
Date: Sat, 03 Dec 2022 21:22:08 GMT
Etag: "638aaf26-117"
Expires: Mon, 05 Dec 2022 02:59:07 GMT
Last-Modified: Sat, 03 Dec 2022 02:06:30 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 5226
Cache-Control: 'max-age=158059'
Date: Sat, 03 Dec 2022 21:22:08 GMT
Last-Modified: Sat, 03 Dec 2022 19:55:02 GMT
Server: ECS (ska/F6FD)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 2695
Cache-Control: max-age=106157
Date: Sat, 03 Dec 2022 21:22:08 GMT
Etag: "638aaf26-117"
Expires: Mon, 05 Dec 2022 02:51:25 GMT
Last-Modified: Sat, 03 Dec 2022 02:06:30 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 345
ETag: "9658E8DED15174A6F5DE101C65FD485F8F12723713683DFE58EBF2213D118F9C"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7092
Expires: Sat, 03 Dec 2022 23:20:20 GMT
Date: Sat, 03 Dec 2022 21:22:08 GMT
Connection: keep-alive

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 03 Dec 2022 21:11:18 GMT
cache-control: public,max-age=3600
age: 650
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /contents/s/d9/c1/60/cdf387dbad88bf3862072e2593/01109594612996.jpeg HTTP/1.1 
Host: applabzzeydoo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM
Cookie: reverse=bjVDu_BCTuaVXVChgDdOUkd6LMWt2eDWOoEMkwkiMqM
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             139.45.197.151
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:07 GMT
content-length: 52948
last-modified: Wed, 08 Sep 2021 11:39:17 GMT
vary: Accept-Encoding
etag: "6138a0e5-ced4"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 740x1600, components 3\012- data
Size:   52948
Md5:    d9c160cdf387dbad88bf3862072e2593
Sha1:   682d1572c405d3e307e127884788f3bc28518918
Sha256: 55b39e0443cb0436fd8ee4c860ba541685d8ea440f1d2769ed382375b942696f

urlquery:
  - Scam - Fake AntiVirus
Blocklists:
  - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: e1.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 345
ETag: "9658E8DED15174A6F5DE101C65FD485F8F12723713683DFE58EBF2213D118F9C"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7092
Expires: Sat, 03 Dec 2022 23:20:20 GMT
Date: Sat, 03 Dec 2022 21:22:08 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Accept-Ranges: bytes
Age: 3633
Cache-Control: max-age=132316
Date: Sat, 03 Dec 2022 21:22:08 GMT
Etag: "638b11ab-1d7"
Expires: Mon, 05 Dec 2022 10:07:24 GMT
Last-Modified: Sat, 03 Dec 2022 09:06:51 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "09E2466399C483D1A22B57169FD886AD9A4B8499EE716CB0AE8159B864D47744"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Sun, 04 Dec 2022 03:22:08 GMT
Date: Sat, 03 Dec 2022 21:22:08 GMT
Connection: keep-alive

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: applabzzeydoo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM
Cookie: reverse=bjVDu_BCTuaVXVChgDdOUkd6LMWt2eDWOoEMkwkiMqM
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        
                                             139.45.197.151
HTTP/2 204 No Content
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
strict-transport-security: max-age=60
x-content-type-options: nosniff
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

urlquery:
  - Scam - Fake AntiVirus
Blocklists:
  - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "E94E0554D9D0125E2448AF7C146C603694CF92944487FBC9E24680BD1186AE67"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11186
Expires: Sun, 04 Dec 2022 00:28:34 GMT
Date: Sat, 03 Dec 2022 21:22:08 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Jo3aSatZpJYTXPCqBvfx6g==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             44.238.3.246
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 6eeHqIwsABc2ST7vrrRdDuTiBjo=

                                        
                                            GET /apps/templates/constructor/constructor-app-lab-v1/build/css/main.css?v4321212 HTTP/1.1 
Host: littlecdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.22.24.116
HTTP/2 200 OK
content-type: text/css
                                            
date: Sat, 03 Dec 2022 21:22:08 GMT
last-modified: Fri, 02 Dec 2022 15:55:17 GMT
vary: Accept-Encoding
etag: W/"638a1fe5-2c38"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control: max-age=3600
cf-cache-status: HIT
age: 4156
server: cloudflare
cf-ray: 773f5b203a2d1c16-OSL
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (11319)
Size:   2805
Md5:    33f9ec37b9afc23ac8155eb2a1fa12a7
Sha1:   fae79c22c584da4cd1c957ee1065b933677f71e6
Sha256: ee2d9e5e52fa4ed9a05a0293293e822b5508735adfe849de2257cac964185b64
                                        
                                            POST /log/add?cid=79b8b31a-f5b5-449e-9c97-e907dd6cec81 HTTP/1.1 
Host: datatechone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1050
Origin: https://applabzzeydoo.com
Connection: keep-alive
Referer: https://applabzzeydoo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             139.45.195.253
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
                                            
Server: nginx/1.19.10
Date: Sat, 03 Dec 2022 21:22:08 GMT
Content-Length: 2
Connection: keep-alive
Access-Control-Allow-Origin: https://applabzzeydoo.com
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   2
Md5:    444bcb3a3fcf8389296c49467f27e1d6
Sha1:   7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
Sha256: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

urlquery:
  - Scam - Fake AntiVirus
Blocklists:
  - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "83203278DADEC9319A72CCB142C413696D8BD09A25F1B6C8D1EDEF20405E90F0"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3967
Expires: Sat, 03 Dec 2022 22:28:15 GMT
Date: Sat, 03 Dec 2022 21:22:08 GMT
Connection: keep-alive

                                        
                                            GET /gid.js?pub=0&userId=&zoneId=5225408&checkDuplicate=true&ymid=&var=5332574 HTTP/1.1 
Host: my.rtmark.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://applabzzeydoo.com/
Origin: https://applabzzeydoo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             139.45.195.8
HTTP/2 200 OK
content-type: application/json; charset=utf-8
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
content-length: 65
access-control-allow-origin: https://applabzzeydoo.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=3bfedb8975a643368be42ea3189381c6; expires=Sun, 03 Dec 2023 21:22:08 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text
Size:   65
Md5:    6920107a3014d176acc152d1c79a5df7
Sha1:   8dfa34e51859ad6c0eccee8a1580c7fd965ce0bf
Sha256: a44eba6705c2814dbb75fec98d30bb98464d521a99517615cce4a78664316098
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "27256D1CDC3822EAA6DB641DD36CAE321E912814731D8ED1A0FA9F56D0B299FE"
Last-Modified: Sat, 03 Dec 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9253
Expires: Sat, 03 Dec 2022 23:56:21 GMT
Date: Sat, 03 Dec 2022 21:22:08 GMT
Connection: keep-alive

                                        
                                            OPTIONS /event HTTP/1.1 
Host: choupsee.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://applabzzeydoo.com/
Origin: https://applabzzeydoo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             139.45.197.251
HTTP/2 200 OK
content-type: text/plain; charset=utf-8
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
content-length: 0
access-control-allow-origin: https://applabzzeydoo.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-max-age: 86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Blocklists:
  - fortinet: Malware
                                        
                                            GET /pfe/current/sw.perm.check.min.js?r=sw HTTP/1.1 
Host: stoomawy.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             139.45.197.250
HTTP/2 200 OK
content-type: application/javascript
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
last-modified: Thu, 01 Dec 2022 15:42:47 GMT
etag: W/"6388cb77-1c7cb"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   37998
Md5:    1548a3e2b3001e7b0bdead90cea43013
Sha1:   c520287cf8012428e699ce27aec1631008f98453
Sha256: 6db5ff20b6e1f689567de1b2969da2a8bdc119cd2f6d762c7ec320d890436321

Blocklists:
  - quad9: Sinkholed
                                        
                                            GET /zone?&pub=0&zone_id=5225408&is_mobile=false&domain=applabzzeydoo.com&var=5332574&ymid=&var_3=&dsig=&nt=true&action=settings HTTP/1.1 
Host: choupsee.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://applabzzeydoo.com/
Origin: https://applabzzeydoo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             139.45.197.251
HTTP/2 200 OK
content-type: application/json; charset=utf-8
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
content-length: 728
x-trace-id: 88c0f28ca32c245b39383b59f023a664
access-control-allow-origin: https://applabzzeydoo.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (727)
Size:   728
Md5:    9df15f9652b0263c6d54b343edbf6714
Sha1:   350cf07e20faf32c5b3fbb61141dd2acd8beadbd
Sha256: c32bc695973537f04df45b6121e745fca60342ea32f05cd4a5996a3d2aa75f10
                                        
                                            POST /event HTTP/1.1 
Host: choupsee.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://applabzzeydoo.com/
Content-Type: application/json
Origin: https://applabzzeydoo.com
Content-Length: 469
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             139.45.197.251
HTTP/2 200 OK
content-type: application/json; charset=utf-8
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
content-length: 94
x-trace-id: 78a9cf92497eed8432d840ce9b70940e
access-control-allow-origin: https://applabzzeydoo.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text
Size:   94
Md5:    1a7332e6f8b83bbbb8411de9c75db4d5
Sha1:   c70ec41a9342542609c48e972ccd826d99ba476d
Sha256: 58a7431e0ee78d4e2c6532db9b16288ca13c8a6e612fa2d17f32fa260940755e

Blocklists:
  - fortinet: Malware
                                        
                                            OPTIONS /event HTTP/1.1 
Host: stoomawy.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://applabzzeydoo.com/
Origin: https://applabzzeydoo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             139.45.197.250
HTTP/2 200 OK
content-type: text/plain; charset=utf-8
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:09 GMT
content-length: 0
access-control-allow-origin: https://applabzzeydoo.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-max-age: 86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

urlquery:
  - Scam - Fake AntiVirus
Blocklists:
  - quad9: Sinkholed
                                        
                                            POST /event HTTP/1.1 
Host: stoomawy.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://applabzzeydoo.com/
Content-Type: application/json
Origin: https://applabzzeydoo.com
Content-Length: 386
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        
                                             139.45.197.250
HTTP/2 200 OK
content-type: application/json; charset=utf-8
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:09 GMT
content-length: 94
x-trace-id: 22abba3f949b25874626f42b72c1a3b9
access-control-allow-origin: https://applabzzeydoo.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text
Size:   94
Md5:    1a7332e6f8b83bbbb8411de9c75db4d5
Sha1:   c70ec41a9342542609c48e972ccd826d99ba476d
Sha256: 58a7431e0ee78d4e2c6532db9b16288ca13c8a6e612fa2d17f32fa260940755e

Blocklists:
  - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2157
Expires: Sat, 03 Dec 2022 21:58:06 GMT
Date: Sat, 03 Dec 2022 21:22:09 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2157
Expires: Sat, 03 Dec 2022 21:58:06 GMT
Date: Sat, 03 Dec 2022 21:22:09 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             95.101.11.115
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2157
Expires: Sat, 03 Dec 2022 21:58:06 GMT
Date: Sat, 03 Dec 2022 21:22:09 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F683f066f-699d-4765-8f4f-33c72e1672e2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 6174
x-amzn-requestid: f78f1e9d-8c0c-495d-a862-61838f8297e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cZ0iyH2WoAMFQdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63870144-45442a8544259930564f685b;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 07:07:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: QIOz71_Kr08pIIwOm2GUkWr421fO7-UyUI7LYld0JBaGnYQ0j3IDFg==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 06:00:50 GMT
age: 55279
etag: "6e6c8bd2bce144cc4da1cd7be375b046b60dca79"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6174
Md5:    b986f9fcbeca91ed5c8d58fbfaf47d19
Sha1:   6e6c8bd2bce144cc4da1cd7be375b046b60dca79
Sha256: 07a8938d2841f8c13bd646f4e79e41e46acd6463aa019cd70871b3741f12bb4f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd7dc00fa-a8d3-44bf-ba84-1998d8dd7c5a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4309
x-amzn-requestid: c824c317-e6e3-4006-9f9d-ea54e8170a4c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cf2_tGErIAMF8_A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63896b97-7fc523296afea4dd4b5d1de8;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 03:05:59 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tp50A9LYeT1RvSPImBUoQNKtarPryKb8Zacm_nxqDh-gegwdQov7Nw==
via: 1.1 40b967aa4aa18637c4b91214147f3cb4.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 03:50:52 GMT
age: 63077
etag: "544428cdad754b1bb7be3cd46a79bf078fd5b450"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    fcb89ca25035b2bbb71ae5dd175fcd40
Sha1:   544428cdad754b1bb7be3cd46a79bf078fd5b450
Sha256: 36dcbbe6cd2710ee502776b4bcf32053e92b750a55e2bd4cdeadbc694c7c2699
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73b53015-e415-4fff-9252-8a16bbe000f5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 9715
x-amzn-requestid: c8102cfa-78dc-4d81-ad6a-e16b9132e238
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZO2HQKIAMF8IA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f2b-350c586b568e6565763376bd;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:31 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0QkVKyYm9UwlF5FEeli9UsRAQwEi3-c3bMR-QSJxIKRQe7WWT76dGQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:37:54 GMT
age: 85455
etag: "d4b3052021ff3ad1dc4134fa25eb12a98e7c17da"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9715
Md5:    45182367fd4f8b6dd234eef1022acdb1
Sha1:   d4b3052021ff3ad1dc4134fa25eb12a98e7c17da
Sha256: a57fadaf74db2fb457cfe761314d56f021d22146f5bdb6a8bf11b6519e8a558d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F864be807-d5f6-42e3-bd58-f7641a256b9a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7732
x-amzn-requestid: 3781c2b7-082a-468a-a186-f7483494e749
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoEq3IAMFnKg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-679fe9f905e07abf4e6a812c;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: V4Z3TZtTDMjnyxZx7VdJrKtZ-PbZkWnsQ0-1eFDem4TVyRGvk0dc7A==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:53:36 GMT
age: 84513
etag: "d45dceb3dc58a07197aa5077582b5b1cd2ff791a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7732
Md5:    379a4a1b95d3aa3c5a4f8e7f9abb030f
Sha1:   d45dceb3dc58a07197aa5077582b5b1cd2ff791a
Sha256: 1b92dec5bf90beffbcd9060052b8788f08645dd4ba34219f7ddb2d40bbd2d151
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XvG2dAUeB914GQ1qJwQRHovAtra8OSjG-CsXeR8UOBq5r8qVjEbPBQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 22:39:04 GMT
age: 81785
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   2942
Md5:    b47431190f34eccf0a6efb98e2a32b7d
Sha1:   9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
Sha256: 08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F627a3f86-b7fa-44c4-a119-2e3d23eb8b6a.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5354
x-amzn-requestid: 3d58ffea-3433-4c5c-a60b-17f6de3a33e5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cSsnvG44oAMFfyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638427ca-63b375f04189b7ce7d84cd5d;Sampled=0
x-amzn-remapped-date: Mon, 28 Nov 2022 03:15:22 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GBhAilKMKo9RvIzqzF9V4jTZbvpa2rPZeoy6Jy8fMc1-JO078OAYzQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 03 Dec 2022 05:53:40 GMT
age: 55709
etag: "65c8b4abf957f9b54d99d0f78559e639adb29efb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5354
Md5:    1e74254b3fdce7d6b84a71a7aff43789
Sha1:   65c8b4abf957f9b54d99d0f78559e639adb29efb
Sha256: f278c3cc6734da7188862a8c651c803e7ac1fda82234e191761453cb1359d3ee
                                        
                                            GET /?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM HTTP/1.1 
Host: applabzzeydoo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             139.45.197.151
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:07 GMT
vary: Accept-Encoding
x-powered-by: PHP/7.4.27
set-cookie: reverse=bjVDu_BCTuaVXVChgDdOUkd6LMWt2eDWOoEMkwkiMqM; expires=Sat, 03-Dec-2022 22:22:07 GMT; Max-Age=3600; path=/
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

Blocklists:
  - quad9: Sinkholed
                                        
                                            GET /apps/templates/constructor/constructor-app-lab-v1/themes/glass-dark.css?31212 HTTP/1.1 
Host: littlecdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.22.24.116
HTTP/2 200 OK
content-type: text/css
                                            
date: Sat, 03 Dec 2022 21:22:08 GMT
last-modified: Fri, 02 Dec 2022 15:55:17 GMT
vary: Accept-Encoding
etag: W/"638a1fe5-4ef"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control: max-age=3600
cf-cache-status: HIT
age: 2270
server: cloudflare
cf-ray: 773f5b204a301c16-OSL
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /apps/templates/_assets/scripts/vanillaqr.min.js HTTP/1.1 
Host: littlecdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.22.24.116
HTTP/2 200 OK
content-type: application/javascript
                                            
date: Sat, 03 Dec 2022 21:22:08 GMT
last-modified: Fri, 02 Dec 2022 15:55:17 GMT
vary: Accept-Encoding
etag: W/"638a1fe5-2d08"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control: max-age=3600
cf-cache-status: HIT
age: 4156
server: cloudflare
cf-ray: 773f5b204a331c16-OSL
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            POST /?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM&mprtr=1 HTTP/1.1 
Host: applabzzeydoo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://applabzzeydoo.com
Connection: keep-alive
Referer: https://applabzzeydoo.com/?l=Ik3Z1hRmgbrHuHy&b=14556889&z=5332574&s=HD8JuXCJmfDJbG4ohxZHJM&campid={campaignid}&var=&ymid=HD8JuXCJmfDJbG4ohxZHJM&ymid=HD8JuXCJmfDJbG4ohxZHJM
Cookie: reverse=bjVDu_BCTuaVXVChgDdOUkd6LMWt2eDWOoEMkwkiMqM
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 0
TE: trailers

                                        
                                             139.45.197.151
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
vary: Accept-Encoding
x-powered-by: PHP/7.4.27
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

Blocklists:
  - quad9: Sinkholed
                                        
                                            GET /sw-check-permissions/5225408?z=5225408&ymid=&var=5332574 HTTP/1.1 
Host: applabzzeydoo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: reverse=bjVDu_BCTuaVXVChgDdOUkd6LMWt2eDWOoEMkwkiMqM
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        
                                             139.45.197.151
HTTP/2 200 OK
content-type: application/javascript
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:07 GMT
vary: Accept-Encoding
x-powered-by: PHP/7.4.25
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 

Blocklists:
  - quad9: Sinkholed
                                        
                                            GET /apps/templates/constructor/constructor-app-lab-v1/build/js/main.js HTTP/1.1 
Host: littlecdn.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             104.22.24.116
HTTP/2 200 OK
content-type: application/javascript
                                            
date: Sat, 03 Dec 2022 21:22:08 GMT
last-modified: Fri, 02 Dec 2022 15:55:17 GMT
vary: Accept-Encoding
etag: W/"638a1fe5-16ae"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
cache-control: max-age=3600
cf-cache-status: HIT
age: 5339
server: cloudflare
cf-ray: 773f5b204a341c16-OSL
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /stattag.js HTTP/1.1 
Host: cdntechone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://applabzzeydoo.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             172.67.149.153
HTTP/2 200 OK
content-type: application/javascript
                                            
date: Sat, 03 Dec 2022 21:22:08 GMT
last-modified: Wed, 23 Nov 2022 15:07:35 GMT
etag: W/"637e3737-3284"
link: <https://datatechone.com/>; rel=preconnect; crossorigin, <https://datatechonert.com/>; rel=preconnect; crossorigin
cache-control: max-age=14400
cf-cache-status: HIT
age: 3678
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b24BACIwI177mBwEt6qrAzWJunCxLSi0bm1uKgGc%2F2%2B3ymX1UIWZNzBTZySkg%2B%2FjQS6jcsJhMw1zPUjT7eqCOqicRHN1XsJ52Gnm0BaSSrZCAzsWc4ihtnDNU1UMk2kO%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 773f5b207ffc1c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: 
                                        
                                            GET /leadgen/track-impression/?z=5332574&b=14556889&ymid=HD8JuXCJmfDJbG4ohxZHJM HTTP/1.1 
Host: pulserviral.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://applabzzeydoo.com/
Origin: https://applabzzeydoo.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             139.45.197.151
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Sat, 03 Dec 2022 21:22:08 GMT
vary: Accept-Encoding
x-powered-by: PHP/7.4.25
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  
Size:   0
Md5:    
Sha1:   
Sha256: