Report - cddtsecure.com/?a=43588&c=318080&co=91932&mt=18&s2=QJJobHyh1BiJ8q1CXxpB2g

Report Overview

Submitted URL
cddtsecure.com/?a=43588&c=318080&co=91932&mt=18&s2=QJJobHyh1BiJ8q1CXxpB2g
IP
63.33.9.29
ASN
#16509 AMAZON-02
Submitted
2023-02-08 20:26:10
Access
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	1.7 kB	3.5 kB	142.250.74.131
cddtsecure.com	unknown	2021-12-09T12:53:46Z	2023-03-13T06:56:01Z	404 B	4.4 kB	52.31.164.125
ujn.nowsubmission.com	unknown	2022-06-14T03:33:32Z	2023-03-13T05:50:29Z	11 kB	444 kB	179.61.143.121
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.8 kB	34.160.144.191
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	54.189.35.180
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	55 kB	34.120.237.76
pushrev.neptuneadspush.com	160570	2019-02-14T12:19:32Z	2023-03-13T05:50:36Z	891 B	26 kB	172.64.129.25
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3.0 kB	8.0 kB	23.33.119.27
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
fonts.googleapis.com	8877	2013-06-10T22:14:26Z	2023-03-13T08:14:31Z	423 B	1.9 kB	142.250.74.106
ajax.googleapis.com	12905	2013-08-16T11:51:31Z	2023-03-13T08:37:09Z	398 B	94 kB	142.250.74.74
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-13T06:00:13Z	341 B	569 B	93.184.220.29
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
code.jquery.com	634	2012-05-21T19:28:02Z	2023-03-13T05:09:57Z	377 B	34 kB	69.16.175.10

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-08	medium	ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e	Phishing
2023-02-08	medium	ujn.nowsubmission.com/o/2XXQ6DLP/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/?push=true	Phishing
2023-02-08	medium	ujn.nowsubmission.com/_common/js/service-workers/neptuneads/service-worker.js	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (9)

	URL	Size	First Seen	Last Seen
	ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e	1.5 kB	2023-03-07	2023-11-03
Pretty URL ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e IP 179.61.143.121 ASN #61317 Ipxo Uk Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:25:53 Last Seen2023-11-03 08:13:07 Times Seen205 Hash f9bee39f8fab5c1968a8ee1eea700a07 8db4440fbd23c8ffe925f93a635ae9326e128400 42037e26c90e9b6e7063479a94f42419107c785b42cb2982968f91bf2170b394 Loading...

	ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e	585 B	2023-03-07	2023-11-03
Pretty URL ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e IP 179.61.143.121 ASN #61317 Ipxo Uk Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:25:53 Last Seen2023-11-03 08:13:07 Times Seen205 Hash d403e2ac626e1fd36cddfbba4fe79bae 49e2f56fc6e17b6ed6070544fea1dab2e51e796d 82da2e2b85e9faaab54c4930face8afffed23e92b25b4ad9bf4d87514274e499 Loading...

	ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e	4.0 kB	2023-03-13	2023-03-13
Pretty URL ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e IP 179.61.143.121 ASN #61317 Ipxo Uk Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 19:52:18 Last Seen2023-03-13 19:52:18 Times Seen1 Hash f125cbbe78f37dd790404ece0708c3f1 b4e5762166e9886487155971fa797178b91b6ec9 b44148c16fc1fa674327275d7204e47e1b222f1bd0aaebc6c8673fb30a5ab966 Loading...

	pushrev.neptuneadspush.com/javascripts/trackpush-v2-vapid.js?v=1&custom=true	31 kB	2023-03-07	2024-02-06
Pretty URL pushrev.neptuneadspush.com/javascripts/trackpush-v2-vapid.js?v=1&custom=true IP 172.64.129.25 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:15:05 Last Seen2024-02-06 20:59:50 Times Seen125 Hash 082008cf87ed5081440e78698f3fea4b aba52d0908b5fc28f2e222a601783170505ef688 29372b162335dd10e58c65543b10b6955373688fd2033523ec067616bd335ad4 Loading...

	code.jquery.com/jquery-1.11.3.min.js	96 kB	2023-03-07	2024-04-24
Pretty URL code.jquery.com/jquery-1.11.3.min.js IP 69.16.175.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:25 Last Seen2024-04-24 22:59:07 Times Seen10370 Hash 895323ed2f7258af4fae2c738c8aea49 276c87ff3e1e3155679c318938e74e5c1b76d809 ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8 Loading...

	ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js	93 kB	2023-03-07	2024-04-24
Pretty URL ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js IP 142.250.74.74 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-24 15:54:13 Times Seen16792 Hash e0e0559014b222245deb26b6ae8bd940 e2f3603e23711f6446f278a411d905623d65201e 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e Loading...

	ujn.nowsubmission.com/o/2XXQ6DLP/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/?push=true	1.1 kB	2023-03-13	2023-03-13
Pretty URL ujn.nowsubmission.com/o/2XXQ6DLP/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/?push=true IP 179.61.143.121 ASN #61317 Ipxo Uk Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 19:52:18 Last Seen2023-03-13 19:52:18 Times Seen1 Hash d40f53065f4171f5e792b87faca09a25 ee7f53452eb528ec52fea1e47c47633a24788de7 632ebd806f5d7dd398f2ccefa43b6358f8cc0008ede75fbe09fbfcbd6f011b62 Loading...

	ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e	559 B	2023-03-07	2024-02-20
Pretty URL ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e IP 179.61.143.121 ASN #61317 Ipxo Uk Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:25:53 Last Seen2024-02-20 08:43:07 Times Seen225 Hash facb6be6d205d591a961eeb6ae6a6032 cf931260828e3287c5ee540dad6865358f10382d e24c922fce3c989c61a36a1b378d9a0443b441d7bbf2ded71b7d7aa8c0b13dfb Loading...

	ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e	379 B	2023-03-13	2023-03-13
Pretty URL ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e IP 179.61.143.121 ASN #61317 Ipxo Uk Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 19:52:18 Last Seen2023-03-13 19:52:18 Times Seen1 Hash f6ed36c643178e439cf4839231ee8b66 99158f5e10ebace8e803da10873679a84749ba0c d89d2dcd311211dc7d41c87aa0e73ffd1fe4239ce66fa8ec95ce9957cf7de2bd Loading...

HTTP Transactions (45)

URL IP Response Size

cddtsecure.com/?a=43588&c=318080&co=91932&mt=18&s2=QJJobHyh1BiJ8q1CXxpB2g

52.31.164.125

302 Found

243 B

URL HTTP/1.1
cddtsecure.com/?a=43588&c=318080&co=91932&mt=18&s2=QJJobHyh1BiJ8q1CXxpB2g
IP
52.31.164.125:0
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
243 B (243 bytes)
Hash
ecedb3cc744d6c0fa47f6ba00fa3fdf7
07ce8a4477d184c91e4ba78c3ad1ede9e54d6c5c
efbd998aa58e77f9c03353242ea8cbe8b6e56e066295568551e15e458bff3054

HTTP Headers

GET /?a=43588&c=318080&co=91932&mt=18&s2=QJJobHyh1BiJ8q1CXxpB2g HTTP/1.1
Host: cddtsecure.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Found
Date: Wed, 08 Feb 2023 20:25:59 GMT
Content-Type: text/html;charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Set-Cookie: gdm_sid_v2_3_001=O4Dqz/2Wwz8CQ3G4+WlIepS7i+tmgudF0BguTl8890mN8F5I4e2uXm3DJ2LZGZAAEiZmgqVVmBW0NMc6l7WTIvNcgoNUYs1akRjSF1h1miA044ga8Kg2VLWRxUFDjrCz4eC5et2DI7xFsD6ODGoZ3thdQBTbKJXqnB2CXnCY4LTHl6NLmgwoH6Xk1HFopOUl9rgy7MgDiocc2cXlvNBDVas4Kwv/XdQuAlY48SCqO0E3jjsL7C0sOEEGRzsF0zzof2F/vK18Z/PnAm4PFc7jAd4zT4fCJO4EJ4aLfhvTtdDa1FaWEY+k7nNHPLk6eXPmoVNe6jlJfXV76UJl8PNkdDj5HMI57p+nETCAzDPIV4pJWmiIAAxleZ+glMrHRH7GqsrHk4lD8GnUgDGS3fBRT6x7tcw3mDSNNVMW0nWS5vfoxjA/NTYxZDZt4nZxeThkCzFlNYKaclYFHUNC9KAlOwdvJhcQVRqaKiIoyDyfQHVkRvTVb0j4XK305ezoAfo4ul3ZTLgv1R9Mom4Js2I0KpYZnFlpxP1l+MAeFi8pkJpTiTka6BpoJrsc4ioYXlH4yB6Ipm2LMUOO9o1n/HpHqxtTKl/E7pC8YP919d0I4/SBLt80EvfHz25FFCcjwqRaOmVaoM/etJRB/PUIeSSKHgCiKov0HCB7JLgIq4+qn1lOIOOkQtYU6Fau0KGU+uuchOestSAbtBB6isba30bEpnOEqbq2aOGYOV7FiMIubDef/1Q+h3thKa5LYy6frfIlWRA7arT/IIGcNKibJ2OxdvHwEABKpE1ixiMoUzSFhBybJr0hFgoo/hyC+XdW6thfU7umDvXoO18hW6eNhUdwqWCH40R22QZA39dgmB5SVl1toxkmf2XR7rSAcRuuZH6VI8R4tpY04kLy9Uc3EwVi1iTR3emwfT51QVj/kocUjoQ/D1OczcyE5X2pfOYLz7SaePWRE3q/s7ySr7B2iSdz2xVoH/Dq25O0o9314ttp5qBWh/TnxgLMVt38/BLMIQ6Ay4XkM601b4NWbu53BXC6Vg==; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/; Secure; SameSite=None
gdm_sid_v1_3_001=O4Dqz/2Wwz8CQ3G4+WlIepS7i+tmgudF0BguTl8890mN8F5I4e2uXm3DJ2LZGZAAEiZmgqVVmBW0NMc6l7WTIvNcgoNUYs1akRjSF1h1miA044ga8Kg2VLWRxUFDjrCz4eC5et2DI7xFsD6ODGoZ3thdQBTbKJXqnB2CXnCY4LTHl6NLmgwoH6Xk1HFopOUl9rgy7MgDiocc2cXlvNBDVas4Kwv/XdQuAlY48SCqO0E3jjsL7C0sOEEGRzsF0zzof2F/vK18Z/PnAm4PFc7jAd4zT4fCJO4EJ4aLfhvTtdDa1FaWEY+k7nNHPLk6eXPmoVNe6jlJfXV76UJl8PNkdDj5HMI57p+nETCAzDPIV4pJWmiIAAxleZ+glMrHRH7GqsrHk4lD8GnUgDGS3fBRT6x7tcw3mDSNNVMW0nWS5vfoxjA/NTYxZDZt4nZxeThkCzFlNYKaclYFHUNC9KAlOwdvJhcQVRqaKiIoyDyfQHVkRvTVb0j4XK305ezoAfo4ul3ZTLgv1R9Mom4Js2I0KpYZnFlpxP1l+MAeFi8pkJpTiTka6BpoJrsc4ioYXlH4yB6Ipm2LMUOO9o1n/HpHqxtTKl/E7pC8YP919d0I4/SBLt80EvfHz25FFCcjwqRaOmVaoM/etJRB/PUIeSSKHgCiKov0HCB7JLgIq4+qn1lOIOOkQtYU6Fau0KGU+uuchOestSAbtBB6isba30bEpnOEqbq2aOGYOV7FiMIubDef/1Q+h3thKa5LYy6frfIlWRA7arT/IIGcNKibJ2OxdvHwEABKpE1ixiMoUzSFhBybJr0hFgoo/hyC+XdW6thfU7umDvXoO18hW6eNhUdwqWCH40R22QZA39dgmB5SVl1toxkmf2XR7rSAcRuuZH6VI8R4tpY04kLy9Uc3EwVi1iTR3emwfT51QVj/kocUjoQ/D1OczcyE5X2pfOYLz7SaePWRE3q/s7ySr7B2iSdz2xVoH/Dq25O0o9314ttp5qBWh/TnxgLMVt38/BLMIQ6Ay4XkM601b4NWbu53BXC6Vg==; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/
gdm_uid_v2_1_001=32+nBjUqhaGxnB/wqlfM/F0GcfVLxulh56w5D62mdlv/uKZuCIzFiEYBkKKrt/3Z; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/; Secure; SameSite=None
gdm_click_adv_freq_v2_1_001=B6XtSNf0/Fok3GcB4BTdMvyymuwR+mhD2ihClBxEUOmnJrtnyao4O4LQnlNdRZP6; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/; Secure; SameSite=None
gdm_click_freq_v1_1_001=bfK8z5UDo04kDjzc8YCbxnSULai5P5GEh4KDg6cQXpKEAYSmRu9b4b43pZJgtWps; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/
gdm_suid_v1_1_001=HPfHs3OFxkaNOwO68jCjbQ==; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/
gdm_suid_v2_1_001=HPfHs3OFxkaNOwO68jCjbQ==; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/; Secure; SameSite=None
gdm_click_adv_freq_v1_1_001=B6XtSNf0/Fok3GcB4BTdMvyymuwR+mhD2ihClBxEUOmnJrtnyao4O4LQnlNdRZP6; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/
gdm_uid_v1_1_001=32+nBjUqhaGxnB/wqlfM/F0GcfVLxulh56w5D62mdlv/uKZuCIzFiEYBkKKrt/3Z; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/
gdm_click_freq_v2_1_001=bfK8z5UDo04kDjzc8YCbxnSULai5P5GEh4KDg6cQXpKEAYSmRu9b4b43pZJgtWps; Domain=.cddtsecure.com; Expires=Tue, 09-May-2023 20:25:59 GMT; Path=/; Secure; SameSite=None
Location: https://ujn.nowsubmission.com//?kw=43588&s1=3c8ec2a6cba445d784e011302b23a3e21e1bf&s2=
Content-Language: en-US
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b7407cc102d62a5acd5e61f8a79bed36
c2f4890a62454e514962b55b7fc14228339c8e90
be282de92da261128a7c8471f3067466aa9930fd0ab2a2cdda8cd2d6ce2bbd74

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE282DE92DA261128A7C8471F3067466AA9930FD0AB2A2CDDA8CD2D6CE2BBD74"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5481
Expires: Wed, 08 Feb 2023 21:57:20 GMT
Date: Wed, 08 Feb 2023 20:25:59 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
565c1bbc5c1c40be1988b3bf6fd9dc1a
cfdba5bc597130461dd67bf6cda53183be592493
60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12914
Expires: Thu, 09 Feb 2023 00:01:13 GMT
Date: Wed, 08 Feb 2023 20:25:59 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
cc14b0d2f7c451f6431dc87ba54d1d60
bab8bfda6fa3e2f17125353f5147211787dc25d0
b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD"
Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14623
Expires: Thu, 09 Feb 2023 00:29:42 GMT
Date: Wed, 08 Feb 2023 20:25:59 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Backoff, Alert, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 08 Feb 2023 19:36:42 GMT
content-type: application/json
age: 2957
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: yaeuARnrA+kSyBijEVttA+4SLprfV/Ajt3Tu3xRb/yWnaQNyZtLLuXclbuSkmu5vsR0b+oBLe5s=
x-amz-request-id: 5JGNXDB5KEDR73QZ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 08 Feb 2023 19:46:05 GMT
age: 2394
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 08 Feb 2023 20:25:59 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Content-Type, Expires, Pragma, Retry-After, Last-Modified, ETag, Cache-Control, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 08 Feb 2023 20:14:52 GMT
age: 667
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9b88bae61bca33aba8aa99f6128db8d9
a07b61fb2458917699613fcae68710941b595416
54915c2f79822732e06a592d027da421ad1e7a6458c545f98333db25612b3dea

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "54915C2F79822732E06A592D027DA421AD1E7A6458C545F98333DB25612B3DEA"
Last-Modified: Mon, 06 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3603
Expires: Wed, 08 Feb 2023 21:26:03 GMT
Date: Wed, 08 Feb 2023 20:26:00 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
eb149b87d14be419f78458891d4154c4
682b002cfeba08617ede1b8e0e967ccf758cc4a3
e7991c456f7ee54a55efab81f902c36026b320a34086ad1b41a3594cd3dd914e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E7991C456F7EE54A55EFAB81F902C36026B320A34086AD1B41A3594CD3DD914E"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7049
Expires: Wed, 08 Feb 2023 22:23:29 GMT
Date: Wed, 08 Feb 2023 20:26:00 GMT
Connection: keep-alive

push.services.mozilla.com/

54.189.35.180

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.189.35.180:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: zOEn0NVu5cYZzgL9OyvcXA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: uTYGvkdOnI2KGsIne5PFQprtP5Q=

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12844
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 20:26:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12844
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 20:26:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12844
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 20:26:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.33.119.27

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
1d885cfc22a04f1216c98dd64df5338a
589916a844b81fac40af88a772865b8e28dfb64e
40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12844
Expires: Thu, 09 Feb 2023 00:00:05 GMT
Date: Wed, 08 Feb 2023 20:26:01 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F99e021e8-f66e-44fd-94ca-b30d25a8f5b4.jpeg

34.120.237.76

200 OK

5.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F99e021e8-f66e-44fd-94ca-b30d25a8f5b4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.0 kB (4961 bytes)
Hash
544181f4aba24fc687a14522dd20f720
2b117270563b8c466ec774acce55271c38f6135b
607c45cc5b4726b92c8507988bbb90ac6a44a3cf22b290030d440266350099a1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F99e021e8-f66e-44fd-94ca-b30d25a8f5b4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4961
x-amzn-requestid: c3b9db99-726f-4473-a6b6-9cff0dceb949
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fswe1GeRoAMFiAA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63db612b-17b52fcd74e374f1104af709;Sampled=0
x-amzn-remapped-date: Thu, 02 Feb 2023 07:07:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: dSxTM3mmYK8cLOy5_x4o-lew1goEgwT4fBHi0pM-HSK_qBC6rDAlzg==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 15:13:11 GMT
age: 18770
etag: "2b117270563b8c466ec774acce55271c38f6135b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3ed9aa0-a88e-4b92-a2bb-567735d813b6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.2 kB (8170 bytes)
Hash
fbe359ce6fb136add75c8f3d3cc06330
e6584afcf39b6fad21eccbcce95c6645b8e1b3b8
29478bf1b8168dc457bb7d298448a78e1040bd3aa80cbf11cfa37475568590d8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3ed9aa0-a88e-4b92-a2bb-567735d813b6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8170
x-amzn-requestid: d1ddb47f-3472-4015-8d55-72f435671f03
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f5aSPHiroAMFpSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e070da-114975440d70915472cdba2f;Sampled=0
x-amzn-remapped-date: Mon, 06 Feb 2023 03:15:38 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0w6JgtsKSRHLPJ3LyY6YUI8N7PS-gVlLuivQUq9jdyeYYm3STiJJIQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 04:13:34 GMT
age: 58347
etag: "e6584afcf39b6fad21eccbcce95c6645b8e1b3b8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdcf61053-67f6-4767-ad44-fa802c5ef5b4.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10058 bytes)
Hash
a9c2a9eee923b84d4e06438a8b2acaff
520b122e3ce52220af153fee26bb7067283f9075
9ff4236fdcd05210a9c8bb48ea68179e142b1b05c8b19dd66282590dff69fa22

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdcf61053-67f6-4767-ad44-fa802c5ef5b4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10058
x-amzn-requestid: 94374454-1e89-4c43-895b-0a90f39b851d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_O5vEgcoAMFctg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c50a-0bf11cad4b0818c36188ba91;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:39:22 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1R4SRNvqhRHbrDZsGB06NJbBXf8WRgJEHmXTbop8pqf8etTJSlmQwQ==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 22:06:05 GMT
age: 80396
etag: "520b122e3ce52220af153fee26bb7067283f9075"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa8532aa1-7280-445c-9c4c-b562d09929d0.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10328 bytes)
Hash
1d2eccb9280b851aa1725df5681f6bbd
b4e2b14ee5bc9ee6c9c05666c34b2d1b6ec425b5
c64ece16f4c550feb05db1bccbf74b49d839e77fea31893d48a3f0c267939c92

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa8532aa1-7280-445c-9c4c-b562d09929d0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10328
x-amzn-requestid: 0b0b3fcd-416c-47ac-afa0-51be0ab85665
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_PPlGGqoAMFxYg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c596-219ee5023d71e4ce17d49233;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:41:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 1uPNh-FvA8oI5ZuruNle0ATMPSsyl-_ZjLrUnPQJrogPVREc8wrHMQ==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 22:12:09 GMT
etag: "b4e2b14ee5bc9ee6c9c05666c34b2d1b6ec425b5"
content-type: image/jpeg
age: 80032
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbcb27041-48b2-474f-b9d5-f88e9e662723.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6342 bytes)
Hash
d8a3fa4f1ec82d501942f9db3de2cb7d
b91c2aea7f2fb26131c8929b254c5596a1bb25ff
9d246eeab8ba04c775a03fd960c8859934a0accb737e845e89aba40bc573fdaa

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbcb27041-48b2-474f-b9d5-f88e9e662723.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6342
x-amzn-requestid: b2b61a71-5326-4fc6-baba-7baad29cf7c5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_OkbHfDIAMF5AQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c482-5cc4028d01d05305637af317;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:37:06 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: xc32O6lBfn7jYg9I3VlZ5FnR9YpJtU3DbYD_ozsf_-R_Ih1-2e1-CQ==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:42:10 GMT
age: 81831
etag: "b91c2aea7f2fb26131c8929b254c5596a1bb25ff"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf4a5986-35e6-4c6b-9dba-c981908d9ec1.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.6 kB (8644 bytes)
Hash
726928e5de19ef978faebbe933c34008
bdaba3ed0c7efb65de88af96063d830683c8499b
c6d208fcee052da80de1bf2dcccbbc48853511b8888c4777799ee676abba51b5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf4a5986-35e6-4c6b-9dba-c981908d9ec1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8644
x-amzn-requestid: d6d71f42-f887-4ad0-a2b7-9073d3857b03
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f_OjRHBFoAMF4_Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e2c47b-57490f255d8d30a561fdcd3a;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 21:36:59 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: xU_uVO78ZQRKon3Cz-fVcHJuPEMMgzDsVuY8BXoKL6ntJwkl-SLeQA==
via: 1.1 a4fe306096165bb1e86e69365dc8fac2.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Tue, 07 Feb 2023 21:42:03 GMT
age: 81838
etag: "bdaba3ed0c7efb65de88af96063d830683c8499b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ujn.nowsubmission.com//?kw=43588&s1=3c8ec2a6cba445d784e011302b23a3e21e1bf&s2=

179.61.143.121

302 Found

718 B

URL HTTP/1.1
ujn.nowsubmission.com//?kw=43588&s1=3c8ec2a6cba445d784e011302b23a3e21e1bf&s2=
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
718 B (718 bytes)
Hash
6735107bd44f78d5619e19416990c491
56002199c8ac1a6b6e9055668f33478cb26684aa
9530b96bfb35be54597e24587c647856f345352c111c608c935b09db06c3317f

HTTP Headers

GET //?kw=43588&s1=3c8ec2a6cba445d784e011302b23a3e21e1bf&s2= HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 302 Found
date: Wed, 08 Feb 2023 20:26:02 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
cache-control: no-cache, private
location: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
x-redir: true
set-cookie: yredir_session=eyJpdiI6InVUbHY1Vm9MNy9tSW82RFFHV3NMZkE9PSIsInZhbHVlIjoibmhOOXNDOHNWeEx5OEVnS3p2S1VrNzdydU9IQldIQWFkTXk2bEZVUVNLcExBL2JqVlVGWlgwb0hZNzNFWjNjcGhRcWpjc1NsNEtBbFB6ZWhOUXVUVFppcFJobGdKQWcveWxhMVJWalNPY3o2RHlKNHEvd2lKMTBnM1IwRmpYZUkiLCJtYWMiOiIyYzBkNmE2ZWZmOWVkZjI3OTdhODc5MjNkOWEwOGUwZWVkMDA4YmE5YjA0ZWRmZmEyMDFmYmM0YzFkNTcyNDZmIiwidGFnIjoiIn0%3D; expires=Wed, 08 Feb 2023 22:26:02 GMT; Max-Age=7200; path=/; httponly; samesite=lax
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e

179.61.143.121

200 OK

3.5 kB

URL HTTP/1.1
ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
3.5 kB (3519 bytes)
Hash
6b7635809754e9189dcb0f7aa887c984
bdd7c504b66f6d6e63aa5119bc8dd4ead13a15ca
b084235f5e91a5ac0412873a41866f32125c8eb69b5e88c355f4fe97f6c94318

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: yredir_session=eyJpdiI6InVUbHY1Vm9MNy9tSW82RFFHV3NMZkE9PSIsInZhbHVlIjoibmhOOXNDOHNWeEx5OEVnS3p2S1VrNzdydU9IQldIQWFkTXk2bEZVUVNLcExBL2JqVlVGWlgwb0hZNzNFWjNjcGhRcWpjc1NsNEtBbFB6ZWhOUXVUVFppcFJobGdKQWcveWxhMVJWalNPY3o2RHlKNHEvd2lKMTBnM1IwRmpYZUkiLCJtYWMiOiIyYzBkNmE2ZWZmOWVkZjI3OTdhODc5MjNkOWEwOGUwZWVkMDA4YmE5YjA0ZWRmZmEyMDFmYmM0YzFkNTcyNDZmIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 20:26:02 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
service-worker-allowed: /
cache-control: no-cache, private
x-redir: true
set-cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D; expires=Wed, 08 Feb 2023 22:26:02 GMT; Max-Age=7200; path=/; httponly; samesite=lax
content-encoding: gzip
strict-transport-security: max-age=15768000

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
0333fa3e34f17f01e9829bd8ee662c23
be4c7a8599038facc49c73d6d14451023bc919e7
8b4ad992549334395b268f43cf73150ed0dfe58801cf9595c3e245ea92dea7d9

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 20:26:02 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
0333fa3e34f17f01e9829bd8ee662c23
be4c7a8599038facc49c73d6d14451023bc919e7
8b4ad992549334395b268f43cf73150ed0dfe58801cf9595c3e245ea92dea7d9

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 20:26:02 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

code.jquery.com/jquery-1.11.3.min.js

69.16.175.10

200 OK

33 kB

URL HTTP/2
code.jquery.com/jquery-1.11.3.min.js
IP
69.16.175.10:0
ASN
#20446 STACKPATH-CDN

File type
ASCII text, with very long lines (32038)
Size
33 kB (33261 bytes)
Hash
1c8acbf5f411ace3b76578a1fd1a603e
b1bbee9db24d885c25afd2e5a7720e4f79b6b991
e37464521b5447580a641b775ddb258a76f3bc7a3ca5a34eb452b12908b350a9

HTTP Headers

GET /jquery-1.11.3.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Wed, 08 Feb 2023 20:26:02 GMT
content-encoding: gzip
content-length: 33261
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-176d5"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1675887962.dop017.sk1.t,1675887962.cds238.sk1.hn,1675887962.cds216.sk1.c
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

142.250.74.74

200 OK

93 kB

URL HTTP/2
ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
IP
142.250.74.74:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (32072)
Size
93 kB (93100 bytes)
Hash
e0e0559014b222245deb26b6ae8bd940
e2f3603e23711f6446f278a411d905623d65201e
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

HTTP Headers

GET /ajax/libs/jquery/1.10.2/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 93100
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 07 Feb 2023 14:19:37 GMT
expires: Wed, 07 Feb 2024 14:19:37 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
age: 108385
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Roboto+Condensed%7COpen+Sans:400,700

142.250.74.106

200 OK

1.2 kB

URL HTTP/2
fonts.googleapis.com/css?family=Roboto+Condensed%7COpen+Sans:400,700
IP
142.250.74.106:0
ASN
#15169 GOOGLE

File type
data
Size
1.2 kB (1229 bytes)
Hash
cb7b19e5a2149e1000572df424cfce12
296c056bcd7b94835f82f580a514c0eee6ce1906
430bd854e4eaa7630b0b7907fc295b26817504ab55e9d8dee34334db996ef04d

HTTP Headers

GET /css?family=Roboto+Condensed%7COpen+Sans:400,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 08 Feb 2023 20:26:02 GMT
date: Wed, 08 Feb 2023 20:26:02 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
0333fa3e34f17f01e9829bd8ee662c23
be4c7a8599038facc49c73d6d14451023bc919e7
8b4ad992549334395b268f43cf73150ed0dfe58801cf9595c3e245ea92dea7d9

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 20:26:02 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/css/style.css

179.61.143.121

200 OK

25 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/css/style.css
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
ASCII text
Size
25 kB (25401 bytes)
Hash
bc84bd3caee9a7b227a5054179477e02
bc1b53ceedb9b91f4d4bec2037126b4d05c20912
d86b239f3ad7fc29593df1655848824493b2299a203c9be2f67adae10f94309e

HTTP Headers

GET /templates/templates/spin-casino_MASTER/css/style.css HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:33:49 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "bc84bd3caee9a7b227a5054179477e02"
content-type: text/css
content-length: 25401
x-varnish: 184558 65570
age: 28334
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/o/2XXQ6DLP/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/?push=true

179.61.143.121

302 Found

818 B

URL HTTP/1.1
ujn.nowsubmission.com/o/2XXQ6DLP/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/?push=true
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (325)
Size
818 B (818 bytes)
Hash
501a4dc88609ad27d57b24f145b851b4
36ab5af254eacc63327e65ec37c2e911c6c4e67e
95c446976d8898f6dc526b3f2bb05ff8b5aa54eed9970433cee8a41df0fb75b7

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /o/2XXQ6DLP/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/?push=true HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 302 Found
date: Wed, 08 Feb 2023 20:26:02 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
cache-control: no-cache, private
location: https://pushrev.neptuneadspush.com/tracker-v2-vapid.js?aff_id=1163&custom=v2&s2=cea9ac3c-a7ee-11ed-be3d-75848f6869bb&&push=true
x-redir: true
set-cookie: yredir_session=eyJpdiI6InN4R3RyT3pSeUhvL2Z2Nng2dmNPREE9PSIsInZhbHVlIjoiQU14RWhTN1ZRTFZBSTFmUWRwL2g3UDNabHJia2xHdk53QlVqcUJYK2tNdjNzaUh5cXZkb3FQVWRIZ1MwWW9zSENLT0w4Tk1DZ0JxTGxsVHY2Z0ZZdHpSanZsR1V5L1hJZGY3cld6dzZGNGhmZFVaYVQyWndnNUIraGFWMFlGeGEiLCJtYWMiOiI4ZWIxZDM4ZWY0ODYxZDhmOGYwYTMwYzgyZTI5NTJjNDgyNGJlYjdjMDYzNGM1ZTYyNjE4OTM2ZjU2ZmY1ZDc4IiwidGFnIjoiIn0%3D; expires=Wed, 08 Feb 2023 22:26:02 GMT; Max-Age=7200; path=/; httponly; samesite=lax
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/loader.gif

179.61.143.121

200 OK

2.9 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/loader.gif
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
GIF image data, version 89a, 128 x 15\012- data
Size
2.9 kB (2892 bytes)
Hash
35de537ece3bfee3ab3f7af4c19e2151
9139201df5d36e1b2b9a8a6566683c95a49e0006
2a020670608060e8f05776815edaa0696f1dd553545ee49946e24be7741433f5

HTTP Headers

GET /templates/templates/spin-casino_MASTER/images/loader.gif HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:34:02 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "35de537ece3bfee3ab3f7af4c19e2151"
content-type: image/gif
content-length: 2892
x-varnish: 450122 163907
age: 28321
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/overlay2.png

179.61.143.121

200 OK

19 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/overlay2.png
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
PNG image data, 300 x 325, 8-bit/color RGBA, non-interlaced\012- data
Size
19 kB (18646 bytes)
Hash
90f8155b00c6e9ec624a12e8a67bd264
fbf3b21af8cc2c2d44879f19f5893dbe696113f1
677aebad5741b57c1a3a51f8a65cd295a7aae1d656958313a882ef199f046418

HTTP Headers

GET /templates/templates/spin-casino_MASTER/images/overlay2.png HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:34:01 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "90f8155b00c6e9ec624a12e8a67bd264"
content-type: image/png
content-length: 18646
x-varnish: 218219 163904
age: 28322
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ocsp.digicert.com/

93.184.220.29

200 OK

278 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
278 B (278 bytes)
Hash
ec82e521a8dd105a8325e8984f7e200d
653e163c07c72bcf12d1aadc4fabf9ed8271939f
e79fc3f07d7634551a2eb71bd481ecde0737d55fa1062ac798d92cceb8a7ae76

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=96789
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 20:26:03 GMT
Etag: "63e2dc70-116"
Expires: Thu, 09 Feb 2023 23:19:12 GMT
Last-Modified: Tue, 07 Feb 2023 23:19:12 GMT
Server: nginx
Content-Length: 278

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/spin1.png

179.61.143.121

200 OK

85 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/spin1.png
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
PNG image data, 639 x 479, 8-bit/color RGBA, non-interlaced\012- data
Size
85 kB (85123 bytes)
Hash
827076646858c6cc499ec675c45b147d
4b6bf3459af50ba8db76d31f9dc3876b50a4c5fe
bc50750cd41cbabc77efc8143fb1b210c983a23e5c954b65b02562958b922e63

HTTP Headers

GET /templates/templates/spin-casino_MASTER/images/spin1.png HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:34:02 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "827076646858c6cc499ec675c45b147d"
content-type: image/png
content-length: 85123
x-varnish: 111912 229379
age: 28321
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/kr_reel.fs8.png

179.61.143.121

200 OK

171 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/kr_reel.fs8.png
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
PNG image data, 142 x 7733, 8-bit colormap, non-interlaced\012- data
Size
171 kB (171408 bytes)
Hash
276c26514be610b5c6fa413756b33671
43c532ff2dc2ce6ed8360fc5d05116b222036e4b
453150bf90ff9debe217f3734a4d3cf4bf6ed9017635d4f2d867096132ad4e28

HTTP Headers

GET /templates/templates/spin-casino_MASTER/images/kr_reel.fs8.png HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:40:40 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "276c26514be610b5c6fa413756b33671"
content-type: image/png
content-length: 171408
x-varnish: 409048 295323
age: 27923
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/spin2.png

179.61.143.121

200 OK

88 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/spin2.png
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
PNG image data, 639 x 479, 8-bit/color RGBA, non-interlaced\012- data
Size
88 kB (88130 bytes)
Hash
f12f850a9ec2daa0b2dbb07e11252122
012a03ac053a0367ef9cdb76685a77d61f3d8a22
ada8eb4421bf605c058c123aa95bd5e4590b4507c68809f563c921e4db31ea8a

HTTP Headers

GET /templates/templates/spin-casino_MASTER/images/spin2.png HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:34:02 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "f12f850a9ec2daa0b2dbb07e11252122"
content-type: image/png
content-length: 88130
x-varnish: 184562 262146
age: 28321
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/overlay.png

179.61.143.121

200 OK

19 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/overlay.png
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
PNG image data, 300 x 325, 8-bit/color RGBA, non-interlaced\012- data
Size
19 kB (18661 bytes)
Hash
a3f2c95451c2201b26033d755a0164c9
f150487dacf8607e49c31abebaf034e34ef8e8aa
bd03836c50a13a9d0c5868a5656f4112f69909cc52c50ca21de772da164e13a2

HTTP Headers

GET /templates/templates/spin-casino_MASTER/images/overlay.png HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InA4K2l5cUdYZWJIL2ZNeVVPRy9Zdmc9PSIsInZhbHVlIjoiUjl5OUlGWnl4UVhlMTU0WndZRkh5VUhkMk1ramU2dWhGRHBvZVZBTFlHZWtsVk1MU1ZkWWozY1JQYlhrbXBRSDBSQjlKNklQNmZ6eHBVT05pRWdiZzhET1ordjBJVGVIQXEzZ1hhMGVQTGRZd21MNVhMUUlTalZaM3lRam9MUkciLCJtYWMiOiJkNWQzY2ExMWQzYjZiNTczMDJhMmIzZmFiZWVmOTM3Njc3MjdhZThhNmM4MzE2YzA5NzVmMzEwYTZkYWQxNDFkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:34:01 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "a3f2c95451c2201b26033d755a0164c9"
content-type: image/png
content-length: 18661
x-varnish: 503787 23
age: 28322
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

pushrev.neptuneadspush.com/tracker-v2-vapid.js?aff_id=1163&custom=v2&s2=cea9ac3c-a7ee-11ed-be3d-75848f6869bb&&push=true

172.64.129.25

200 OK

778 B

URL HTTP/2
pushrev.neptuneadspush.com/tracker-v2-vapid.js?aff_id=1163&custom=v2&s2=cea9ac3c-a7ee-11ed-be3d-75848f6869bb&&push=true
IP
172.64.129.25:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with CRLF line terminators
Size
778 B (778 bytes)
Hash
ec29eec7d3750a1ed210f27f1b968b29
8a2b1937b1cdbf4a4dea77f78447c03431357c2d
43bca0f5583505f537776e8405a0f9ae12c5a3157ea397a1709933843a60e5ec

HTTP Headers

GET /tracker-v2-vapid.js?aff_id=1163&custom=v2&s2=cea9ac3c-a7ee-11ed-be3d-75848f6869bb&&push=true HTTP/1.1
Host: pushrev.neptuneadspush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ujn.nowsubmission.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Wed, 08 Feb 2023 20:26:03 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=2678400
cf-cache-status: MISS
last-modified: Wed, 08 Feb 2023 20:26:03 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZmVghjEbI%2BANlw1bTfrd9K18UZxcjZCOI1MadZ76MGOq3%2B0qRPCVk0NGZoevKKACdvJrZvvBhtxMIEFH9oPz%2BhMDWYkz9UVd7xqM2OPVLlWnjCPd%2B1VykJkZAkzBKdP0gy3koe0q06bsWvP3ZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7967191aa82b75b9-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
3f3962ef574ee0069c41f7cbcabd1ef3
c4b6aefa8563432c5e5901488c38ae7da3c83fd7
9518b917cc6f0b1724d687d6aac4d8c1851d46949eeb4926acdb26a84728fdc0

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 20:26:03 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

pushrev.neptuneadspush.com/javascripts/trackpush-v2-vapid.js?v=1&custom=true

172.64.129.25

200 OK

24 kB

URL HTTP/2
pushrev.neptuneadspush.com/javascripts/trackpush-v2-vapid.js?v=1&custom=true
IP
172.64.129.25:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (1977), with CRLF line terminators
Size
24 kB (23599 bytes)
Hash
3f60036d3df634b5cc65154a30f1abbf
948d82aa6639c440137fab83d93d019b78b53a13
7ddedc5b02d3e76e90c833a56e413f08ac36d57789f6888b3d1ab41aade8151a

HTTP Headers

GET /javascripts/trackpush-v2-vapid.js?v=1&custom=true HTTP/1.1
Host: pushrev.neptuneadspush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Wed, 08 Feb 2023 20:26:03 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=2678400
cf-cache-status: HIT
age: 728
last-modified: Wed, 08 Feb 2023 20:13:55 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cMA9iZCEwKKmWyvHY4Su%2F%2FOFM2gPI5xuEJuTDsfngmPf5XpDRxaWLidRS07eObkeDCyFsa884VMvl4HadRVQC8XCvstJRVNFdMEoDZtqdECcBGo35xnGH3bCc4OcGjmPtllDlMpuufO81efRLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7967191c7a6075b9-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/gratorama-progjackpot-v3.gif

179.61.143.121

200 OK

23 kB

URL HTTP/1.1
ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/images/gratorama-progjackpot-v3.gif
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
GIF image data, version 89a, 500 x 150\012- data
Size
23 kB (23095 bytes)
Hash
f79f189bde401dfac7723f7c963d0ef8
83530e9d6248767d661c4996c14414621c857ed6
bdc936e847facab60f4b4a9153dc8145ebccdeca49becc4cd684e007cd0459ca

HTTP Headers

GET /templates/templates/spin-casino_MASTER/images/gratorama-progjackpot-v3.gif HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/templates/templates/spin-casino_MASTER/css/style.css
Cookie: yredir_session=eyJpdiI6InN4R3RyT3pSeUhvL2Z2Nng2dmNPREE9PSIsInZhbHVlIjoiQU14RWhTN1ZRTFZBSTFmUWRwL2g3UDNabHJia2xHdk53QlVqcUJYK2tNdjNzaUh5cXZkb3FQVWRIZ1MwWW9zSENLT0w4Tk1DZ0JxTGxsVHY2Z0ZZdHpSanZsR1V5L1hJZGY3cld6dzZGNGhmZFVaYVQyWndnNUIraGFWMFlGeGEiLCJtYWMiOiI4ZWIxZDM4ZWY0ODYxZDhmOGYwYTMwYzgyZTI5NTJjNDgyNGJlYjdjMDYzNGM1ZTYyNjE4OTM2ZjU2ZmY1ZDc4IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:34:02 GMT
last-modified: Tue, 07 Feb 2023 12:00:07 GMT
etag: "f79f189bde401dfac7723f7c963d0ef8"
content-type: image/gif
content-length: 23095
x-varnish: 503788 98333
age: 28322
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
986afab4bad851da3c4a2b8db670c876
c58b7142ce3bebda918b77649973715dbd71b4d2
24e4025e6576d86e781fd0861a0a87338b7b5d52b9e559ae76ca52755cc3a865

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 Feb 2023 20:26:03 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ujn.nowsubmission.com/_common/js/service-workers/neptuneads/service-worker.js

179.61.143.121

200 OK

90 B

URL HTTP/1.1
ujn.nowsubmission.com/_common/js/service-workers/neptuneads/service-worker.js
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
ASCII text, with no line terminators
Size
90 B (90 bytes)
Hash
1060884cf64d39c3fb28309d83ead97c
6c370dffa201da316e7dc11ff7ac7fec556a1273
d299b7fe0f0da619c1a2c016f631cf004b8a7f92fdb0104dfb6fc0ab03105123

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /_common/js/service-workers/neptuneads/service-worker.js HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: yredir_session=eyJpdiI6InN4R3RyT3pSeUhvL2Z2Nng2dmNPREE9PSIsInZhbHVlIjoiQU14RWhTN1ZRTFZBSTFmUWRwL2g3UDNabHJia2xHdk53QlVqcUJYK2tNdjNzaUh5cXZkb3FQVWRIZ1MwWW9zSENLT0w4Tk1DZ0JxTGxsVHY2Z0ZZdHpSanZsR1V5L1hJZGY3cld6dzZGNGhmZFVaYVQyWndnNUIraGFWMFlGeGEiLCJtYWMiOiI4ZWIxZDM4ZWY0ODYxZDhmOGYwYTMwYzgyZTI5NTJjNDgyNGJlYjdjMDYzNGM1ZTYyNjE4OTM2ZjU2ZmY1ZDc4IiwidGFnIjoiIn0%3D; _NeptuneAdsPushSubscriberID=4f25e42e-faa0-0f53-c687-c1b09e576092
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Wed, 08 Feb 2023 12:33:35 GMT
last-modified: Fri, 20 May 2022 14:50:35 GMT
etag: "1060884cf64d39c3fb28309d83ead97c"
content-type: application/javascript
content-length: 90
service-worker-allowed: /
x-varnish: 111913 65539
age: 28348
via: 1.1 varnish (Varnish/7.0)
accept-ranges: bytes
strict-transport-security: max-age=15768000

ujn.nowsubmission.com/favicon.ico

179.61.143.121

403 Forbidden

243 B

URL HTTP/1.1
ujn.nowsubmission.com/favicon.ico
IP
179.61.143.121:0
ASN
#61317 Ipxo Uk Limited

File type
XML 1.0 document text\012- XML document, ASCII text
Size
243 B (243 bytes)
Hash
ea8de93d06c6a354449d0f337a427519
a4d5a1f2c1a9a8d30c58a772f44dba703b419a18
3395d18c1da2859d4ab45ad2d7f5fe2ba080dab5a73bc5b667315d7d7c5c571e

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: ujn.nowsubmission.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://ujn.nowsubmission.com/t/8f0d93c8664e/ce317fd2-a7ee-11ed-9a36-e792abeca9ef/ce357a2e-a7ee-11ed-bebf-d1ecfded140e
Cookie: yredir_session=eyJpdiI6InN4R3RyT3pSeUhvL2Z2Nng2dmNPREE9PSIsInZhbHVlIjoiQU14RWhTN1ZRTFZBSTFmUWRwL2g3UDNabHJia2xHdk53QlVqcUJYK2tNdjNzaUh5cXZkb3FQVWRIZ1MwWW9zSENLT0w4Tk1DZ0JxTGxsVHY2Z0ZZdHpSanZsR1V5L1hJZGY3cld6dzZGNGhmZFVaYVQyWndnNUIraGFWMFlGeGEiLCJtYWMiOiI4ZWIxZDM4ZWY0ODYxZDhmOGYwYTMwYzgyZTI5NTJjNDgyNGJlYjdjMDYzNGM1ZTYyNjE4OTM2ZjU2ZmY1ZDc4IiwidGFnIjoiIn0%3D; _NeptuneAdsPushSubscriberID=4f25e42e-faa0-0f53-c687-c1b09e576092
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 403 Forbidden
content-type: application/xml
date: Wed, 08 Feb 2023 12:33:34 GMT
x-varnish: 503789 6
age: 28348
via: 1.1 varnish (Varnish/7.0)
content-length: 243
strict-transport-security: max-age=15768000

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML