r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 33c3dea45eaabae3557235f002dda989
38a1903e09bff723af30fe5080f79646247b9254
b00022c599d7a74bd264b90a1ca9f935eb8a7bc6e63a9751dddc8acfbafe58da
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B00022C599D7A74BD264B90A1CA9F935EB8A7BC6E63A9751DDDC8ACFBAFE58DA"
Last-Modified: Tue, 01 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3427
Expires: Thu, 03 Nov 2022 00:55:00 GMT
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 5f57d2cc1ab8bbee50dff2b2be18b9db
2c8acd2018995b9bbed8f4dbfa33c8044b293080
a25e2337dad42018caefae70e0e596a4006aa9c1fe6af7f29c93a21fda1554b9
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6397
Cache-Control: max-age=127189
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2022 23:57:53 GMT
Etag: "636238d9-1d7"
Expires: Fri, 04 Nov 2022 11:17:42 GMT
Last-Modified: Wed, 02 Nov 2022 09:31:05 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 43ea74d83493710eb8b64a74046ff569
74dee6d9e8b796d34f2788a472b90b3f7fc79ecd
f62eff2ad4d64d785a48e2761d7f2bda9171f1e60b0e9dc525d8f589f9ef7c60
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F62EFF2AD4D64D785A48E2761D7F2BDA9171F1E60B0E9DC525D8F589F9EF7C60"
Last-Modified: Tue, 01 Nov 2022 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2159
Expires: Thu, 03 Nov 2022 00:33:52 GMT
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 2lRX7reX+I/DfqRGB89gnsiG5cm+a2i6yGPfB2xCc3WRUS5V+6prMG6dJbcm9Uz0qXICtWXiV7Q=
x-amz-request-id: 2B72JCTKA1MWZHB4
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 02 Nov 2022 23:08:56 GMT
age: 2937
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
cqrnpddwvs.duckdns.org/
45.12.138.13200 OK 56 kB IP 45.12.138.13:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (45542)
Hash 3c74d126df7633a9ca49259a0e054c37
12cf1358724b91baa4e3c9fa997f333d85ff9ea1
60c00877a8a907b78ac846d654607c735c1208d87db54b84fcbf04620f2b45fb
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET / HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
X-Powered-By: Express
content-type: text/html; charset=utf-8
Service-Worker-Allowed: /
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Wed, 02 Nov 2022 23:57:53 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
cqrnpddwvs.duckdns.org/__neb/core/util.js
45.12.138.13200 OK 620 B URL HTTP/1.1 cqrnpddwvs.duckdns.org/__neb/core/util.js
IP 45.12.138.13:0
Hash 736d976acace0a62d7438dcc2db3d8d6
ccf9fedb6f615833dc92c1eab5788fbaf161214b
1c13ebf0afff5f0290da621eacdf567ee2d614c80b65669a1fefdc3adf320d25
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /__neb/core/util.js HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
content-type: application/javascript
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
104.17.25.14200 OK 5.6 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP 104.17.25.14:0
File type ASCII text, with very long lines (30837)
Hash 109d1ed85cd01f9cdab73a4cac5bf80d
d6c6498ad46de2d8e2008a8ff68e364ae7f16b32
8b3a74fe462f5b3c0635995fd721a60eb640e237680b0b532b96711f2823e8bc
GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Wed, 02 Nov 2022 23:57:53 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 27017
expires: Mon, 23 Oct 2023 23:57:53 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=89GUNO%2BYa%2BWGABaoDmYqOumSB4HqjQoAzZjUYVqlmv4ECnkhU1ADXkmasA6BVQmeFNgRGUF4l73ck64XuqLZypMBy00edYGt1rf8jlOsbDfHNGahIhuCI2fV6QYkVdPt0x%2F%2BF2vQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7640d0ab6d95b515-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash e539fa08ddc0ce1396c84ecc16c2bec7
69414e0693690cc9cc14b48b2f952efe942198d5
b6609b24198f2c6c9eefaa3b1cb2f2db9dd8b81c6a7135a5b46c3a9a165c8266
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2022 23:57:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash e539fa08ddc0ce1396c84ecc16c2bec7
69414e0693690cc9cc14b48b2f952efe942198d5
b6609b24198f2c6c9eefaa3b1cb2f2db9dd8b81c6a7135a5b46c3a9a165c8266
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2022 23:57:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cqrnpddwvs.duckdns.org/__neb/core/client.js
45.12.138.13200 OK 8.7 kB URL HTTP/1.1 cqrnpddwvs.duckdns.org/__neb/core/client.js
IP 45.12.138.13:0
Hash a2218bdb0c5a18ec1976c1001f63871f
68349a89fcf46144873702bebbe7225f96021f20
c136da75817d077f87ab999020eeb90f2b1dbbfac0b24f97421936f7ff52522d
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /__neb/core/client.js HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
content-type: application/javascript
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 471 B IP 142.250.74.35:0
Hash e539fa08ddc0ce1396c84ecc16c2bec7
69414e0693690cc9cc14b48b2f952efe942198d5
b6609b24198f2c6c9eefaa3b1cb2f2db9dd8b81c6a7135a5b46c3a9a165c8266
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2022 23:57:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cqrnpddwvs.duckdns.org/index.js
45.12.138.13200 OK 66 B URL HTTP/1.1 cqrnpddwvs.duckdns.org/index.js
IP 45.12.138.13:0
Hash 3b61ffbcfa6d22063278b589e886b61d
eec430a4b824049ca6219687034a05bbc639d802
aa43230adc8aed152e1979f31f2c1e7ccd88cb7f7364769142408126f49143ce
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /index.js HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
Service-Worker-Allowed: /
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 01 Nov 2022 18:47:23 GMT
ETag: W/"42-184348502a2"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 66
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
cqrnpddwvs.duckdns.org/script.js
45.12.138.13200 OK 1.2 kB URL HTTP/1.1 cqrnpddwvs.duckdns.org/script.js
IP 45.12.138.13:0
Hash 44125f0e695092e10f48c91a7237e338
bd00fa32885bd205c5e96b2794a5efbad60892e2
587d397de39eefeb393aa48fcbfff18c75427b5af67d91f911e8a36d9622d6b6
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /script.js HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
Service-Worker-Allowed: /
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 01 Nov 2022 18:47:23 GMT
ETag: W/"4c4-184348502a3"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 1220
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
cqrnpddwvs.duckdns.org/__neb/core/proxy.js
45.12.138.13200 OK 15 kB URL HTTP/1.1 cqrnpddwvs.duckdns.org/__neb/core/proxy.js
IP 45.12.138.13:0
File type ASCII text, with very long lines (4940)
Hash 62b254b7e8838b23e4bbbbd552423dcd
f02101f3551c2322a6ce441473350e6a36c4d9c3
4c1021b1b198ab303a4c84b63e547e76982242be5726082214a51bcaae2fdd02
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /__neb/core/proxy.js HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
content-type: application/javascript
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
cqrnpddwvs.duckdns.org/socket.io/socket.io.js
45.12.138.13200 OK 26 kB URL HTTP/1.1 cqrnpddwvs.duckdns.org/socket.io/socket.io.js
IP 45.12.138.13:0
Hash 2a8b9c5b417b4728855e818c53b544aa
e0fbd180d98191f855a07cb076061f4ffc1f8acb
7c0aa2146ddd58b29c3e5b047c856f434b853ebae28ccc275d6b80f3e841e4f4
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /socket.io/socket.io.js HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
Cache-Control: public, max-age=0
Content-Type: application/javascript
ETag: "4.5.1"
content-encoding: gzip
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 4873b91ff9e1327d57e6ad100a152cec
4e5c092b944615affe4ecd481c2a33fa6dbb2bb6
05467c141fbcdf4af9b8b7e1153e60509f51ce729a4dcad88f9e0d2d4debfd34
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2022 23:57:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/andadapro/v12/HhyEU5Qi9-SuOEhPe4LtKoVCuWGURPcg3DPJBb8bHr0.woff2
142.250.74.99200 OK 17 kB URL HTTP/2 fonts.gstatic.com/s/andadapro/v12/HhyEU5Qi9-SuOEhPe4LtKoVCuWGURPcg3DPJBb8bHr0.woff2
IP 142.250.74.99:0
File type Web Open Font Format (Version 2), TrueType, length 17272, version 1.0\012- data
Hash 8b4460b60ef5564e0f5c3f29fccb01e6
29722f06f96b61baf13f33f548e4db990b817862
b3596a6d2c77e61155a5fd1de76b900cb4f33d8718b7f0462a53d3ecc99b8d68
GET /s/andadapro/v12/HhyEU5Qi9-SuOEhPe4LtKoVCuWGURPcg3DPJBb8bHr0.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://cqrnpddwvs.duckdns.org
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17272
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 31 Oct 2022 19:52:04 GMT
expires: Tue, 31 Oct 2023 19:52:04 GMT
cache-control: public, max-age=31536000
age: 187550
last-modified: Fri, 24 Jun 2022 19:48:19 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.35200 OK 472 B IP 142.250.74.35:0
Hash 4873b91ff9e1327d57e6ad100a152cec
4e5c092b944615affe4ecd481c2a33fa6dbb2bb6
05467c141fbcdf4af9b8b7e1153e60509f51ce729a4dcad88f9e0d2d4debfd34
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2022 23:57:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cqrnpddwvs.duckdns.org/jquery.js
45.12.138.13200 OK 96 kB URL HTTP/1.1 cqrnpddwvs.duckdns.org/jquery.js
IP 45.12.138.13:0
File type ASCII text, with very long lines (32086)
Hash d4a20d75db01a33e2d65e303ce5c34f3
b14a228c3632ebfe3d20e5ea830ceea313523353
4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /jquery.js HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
Service-Worker-Allowed: /
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 01 Nov 2022 18:47:23 GMT
ETag: W/"1764d-184348502a3"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 95821
Date: Wed, 02 Nov 2022 23:57:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5
cqrnpddwvs.duckdns.org/home.jpeg
45.12.138.13200 OK 30 kB URL HTTP/1.1 cqrnpddwvs.duckdns.org/home.jpeg
IP 45.12.138.13:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 297x396, components 3\012- data
Hash 61a9ebd7cb0e894003bbf30fc83847a2
fc929a05c32f7d6e511dc450c6b563297c3bfa0e
a64307b34983b6f7dd9ebb2eca5a20eb2da25280ab861d11f7ca79d146d2e1cf
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /home.jpeg HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
Service-Worker-Allowed: /
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 01 Nov 2022 18:47:23 GMT
ETag: W/"743c-184348502a2"
Content-Type: image/jpeg
Content-Length: 29756
Date: Wed, 02 Nov 2022 23:57:54 GMT
Connection: keep-alive
Keep-Alive: timeout=5
cqrnpddwvs.duckdns.org/favicon.ico
45.12.138.13200 OK 154 kB URL HTTP/1.1 cqrnpddwvs.duckdns.org/favicon.ico
IP 45.12.138.13:0
File type PNG image data, 1024 x 1030, 8-bit/color RGBA, interlaced\012- data
Size 154 kB (153746 bytes)
Hash fc6601bcea1256514db6938b5e55d5ad
ed18f2d86ff219dcace5f49fb18e7e23e1405ef0
d835fc25e82dee2a822bc903a1ec92cc33cb22c41710e6bbd42313851ba50d8b
Analyzer Verdict Alert urlquery DynDNS domain detected
openphish National Tax Agency JAPAN
quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: cqrnpddwvs.duckdns.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
HTTP/1.1 200 OK
X-Powered-By: Express
Service-Worker-Allowed: /
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 01 Nov 2022 18:47:23 GMT
ETag: W/"25892-184348502a2"
Content-Type: image/x-icon
Content-Length: 153746
Date: Wed, 02 Nov 2022 23:57:54 GMT
Connection: keep-alive
Keep-Alive: timeout=5
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash fd65439b27a0101cd831309f178fbb45
4daa9343dda0f37ba734e2b5500caf2728cf89db
37e6d155f598b5154e3ce96105c39798716b5d35e12a98b9aec172c160de5f6a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5771
Cache-Control: max-age=121505
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2022 23:57:54 GMT
Etag: "63622518-1d7"
Expires: Fri, 04 Nov 2022 09:42:59 GMT
Last-Modified: Wed, 02 Nov 2022 08:06:48 GMT
Server: ECS (ska/F70D)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
35.162.110.205101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.162.110.205:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: R6rx9x+ufO2CCL3yp/d4sA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: cRdpyYRgjtrWWom78MmygbWtydw=
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash f286e64f8de8d0158fe2a83cea74da23
b0e9fd228565aaf58ec455d743e39559a548fdbb
21c7fb0f3d2486d6655b5d6817dd90faafa18836c820a684215f9a29f1a4451c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "21C7FB0F3D2486D6655B5D6817DD90FAAFA18836C820A684215F9A29F1A4451C"
Last-Modified: Mon, 31 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8115
Expires: Thu, 03 Nov 2022 02:13:10 GMT
Date: Wed, 02 Nov 2022 23:57:55 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash f286e64f8de8d0158fe2a83cea74da23
b0e9fd228565aaf58ec455d743e39559a548fdbb
21c7fb0f3d2486d6655b5d6817dd90faafa18836c820a684215f9a29f1a4451c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "21C7FB0F3D2486D6655B5D6817DD90FAAFA18836C820A684215F9A29F1A4451C"
Last-Modified: Mon, 31 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8115
Expires: Thu, 03 Nov 2022 02:13:10 GMT
Date: Wed, 02 Nov 2022 23:57:55 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.76.226200 OK 503 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash f286e64f8de8d0158fe2a83cea74da23
b0e9fd228565aaf58ec455d743e39559a548fdbb
21c7fb0f3d2486d6655b5d6817dd90faafa18836c820a684215f9a29f1a4451c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "21C7FB0F3D2486D6655B5D6817DD90FAAFA18836C820A684215F9A29F1A4451C"
Last-Modified: Mon, 31 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8115
Expires: Thu, 03 Nov 2022 02:13:10 GMT
Date: Wed, 02 Nov 2022 23:57:55 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F623cd169-7ed9-42a3-aa0b-e5d3053dad6c.jpeg
34.120.237.76200 OK 9.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F623cd169-7ed9-42a3-aa0b-e5d3053dad6c.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f22f82690184549a27cacc59906590bd
f387ae7704ac36d6a3e20da098cb9f75829d1e0f
a9804db6a2263ed8d70634921ac39079c2a803f180a3347eeb92d7bbede66b67
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F623cd169-7ed9-42a3-aa0b-e5d3053dad6c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9464
x-amzn-requestid: 63126894-cf2b-4b97-9115-4782d4418e52
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: a2ZVpFtqoAMFZdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635f3c23-766a430e679848b74e1f7d06;Sampled=0
x-amzn-remapped-date: Mon, 31 Oct 2022 03:08:19 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: JTGuMhMakZRq-O_UQRPJ4cE5pjk-hu36b1S8miRUpsnwXM9GPLtk2A==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Wed, 02 Nov 2022 04:33:38 GMT
age: 69857
etag: "f387ae7704ac36d6a3e20da098cb9f75829d1e0f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46c1f0aa-9ef9-468e-9e11-7a02b7969f7f.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46c1f0aa-9ef9-468e-9e11-7a02b7969f7f.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f6a0b42162a59f85f6ddb149bbb09517
107817da1e00f629351ebbeb62caf795a6a8393b
0e6094306076439f0aaa893d8a4f4188a9ded69f4dca19b47d4762a19b5fc8fa
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46c1f0aa-9ef9-468e-9e11-7a02b7969f7f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10411
x-amzn-requestid: 21836619-61da-4d22-811c-f605f5d41170
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: avzazF_zoAMFgOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635c9911-4678c6272cf91c3d0f4827b8;Sampled=0
x-amzn-remapped-date: Sat, 29 Oct 2022 03:08:01 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: ryG7GxtXQArs5_FPS9qnofnflm9PE427b3AkPGbmhiq_rPU2LxLiZg==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google
date: Wed, 02 Nov 2022 19:23:26 GMT
age: 16469
etag: "107817da1e00f629351ebbeb62caf795a6a8393b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4e2853cc6ec6223160471401e6871f4b
f052e1f8b2bf4a8eeecfa5b82e27ada1b7719a0c
bf4b9145ea043d87a30fd3aeeae21a1a0aa27004cd2467e7aa843bc894ae1f60
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc6fadd94-b1a4-4bdc-bcf4-b6bade4840a0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10462
x-amzn-requestid: 43480a38-fd89-4c47-b8c4-e6ba90b1321c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aMF6oEz_oAMF8Hg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634e5043-6617fd2e59cab00135301cdd;Sampled=0
x-amzn-remapped-date: Tue, 18 Oct 2022 07:05:39 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: z6Lnru_eeTvRGdsz-q37-HGFgFfIT6fLSFcJBvT3oPjAPilszTWkDw==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google
date: Wed, 02 Nov 2022 11:00:57 GMT
age: 46618
etag: "f052e1f8b2bf4a8eeecfa5b82e27ada1b7719a0c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F116416c7-b158-4c98-af55-3027f9bfbd6c.jpeg
34.120.237.76200 OK 7.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F116416c7-b158-4c98-af55-3027f9bfbd6c.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cc615bd01e1ac97fec7bf47b18f0e999
ee2c892adba5d3e12ac8443065c38317752f3e4a
ca41974691496f2629f45cba9bb21b84e7dbb9cefbf7e8e3348c98b101002269
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F116416c7-b158-4c98-af55-3027f9bfbd6c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7044
x-amzn-requestid: 6ed2687f-f478-4206-a9b7-fc63428966bb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: a5sd1GcvIAMFYew=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63608df1-79ada3087098484923a3b64d;Sampled=0
x-amzn-remapped-date: Tue, 01 Nov 2022 03:09:38 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: HsnvvNU6huvFGVXW-AypNd0J5_Hwv-bQbpJ0g6JVrjUt6a_cy3vAUA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Wed, 02 Nov 2022 04:23:25 GMT
age: 70470
etag: "ee2c892adba5d3e12ac8443065c38317752f3e4a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2985da2d-c17e-4258-b3e5-f70ccec94347.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2985da2d-c17e-4258-b3e5-f70ccec94347.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 04b435cec384cb5293ba193dc47dd65e
1c527195f3ddd4b1d73c2e2246b6bbdc2721d7b9
128afdd19f7dd88aa1788728ecda7191fb28e4e482b7e6fd508c58218c862f1b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2985da2d-c17e-4258-b3e5-f70ccec94347.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10101
x-amzn-requestid: 8761b5b7-19ac-4096-bb98-8194894648a1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: a_iCZEzxIAMFgFg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6362e3a8-4b01c9d20865821c0394cb5b;Sampled=0
x-amzn-remapped-date: Wed, 02 Nov 2022 21:39:52 GMT
x-amz-cf-pop: SEA73-P2, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: gDH2G2ttY2kyvo4mH3UQpk2eR6qNk63GpS9OSTP2JquVNjD5EIXAYg==
via: 1.1 7d01bcfcfe27ce0b8979cf621dd081de.cloudfront.net (CloudFront), 1.1 ebe4011a81a36e2bf678f69ce1711330.cloudfront.net (CloudFront), 1.1 google
date: Wed, 02 Nov 2022 21:40:08 GMT
etag: "1c527195f3ddd4b1d73c2e2246b6bbdc2721d7b9"
content-type: image/jpeg
age: 8267
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd29dc073-c468-4a6d-911c-661817b2bf58.jpeg
34.120.237.76200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd29dc073-c468-4a6d-911c-661817b2bf58.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash be7fc1a565f4f85af041099ba5b0bdc9
e91ab27aeb682908cdd1a6203e4e6b57b2256f41
97b2ccd84247cdcfe0ab439b12c541a7fec589bf0810e8377d6cd27dd5bdfc38
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd29dc073-c468-4a6d-911c-661817b2bf58.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11467
x-amzn-requestid: 39f4af84-a979-496d-b0d9-7c697f7fff66
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: azpklFiuIAMFqTw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-635e22e9-58d417626a967b7625bf83ce;Sampled=0
x-amzn-remapped-date: Sun, 30 Oct 2022 07:08:25 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: hhXcKOdiea0HChS_SkQRtLAGXQqGktoWNDQ43L-6YzyAMNODGwbrMA==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 02 Nov 2022 08:03:39 GMT
age: 57256
etag: "e91ab27aeb682908cdd1a6203e4e6b57b2256f41"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
fonts.googleapis.com/css2?family=Andada+Pro&display=swap
142.250.74.10200 OK 0 B URL HTTP/2 fonts.googleapis.com/css2?family=Andada+Pro&display=swap
IP 142.250.74.10:0
GET /css2?family=Andada+Pro&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 02 Nov 2022 23:57:53 GMT
date: Wed, 02 Nov 2022 23:57:53 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.googleapis.com/css2?family=Roboto+Mono&display=swap
142.250.74.10200 OK 0 B URL HTTP/2 fonts.googleapis.com/css2?family=Roboto+Mono&display=swap
IP 142.250.74.10:0
GET /css2?family=Roboto+Mono&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://cqrnpddwvs.duckdns.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 02 Nov 2022 23:57:53 GMT
date: Wed, 02 Nov 2022 23:57:53 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2