Overview

URLwebmail.wt-msn.at/
IP 194.208.76.15 (Austria)
ASN#5385 Russmedia IT GmbH
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-11-24 14:09:24 UTC
StatusLoading report..
IDS alerts0
Blocklist alert0
urlquery alerts
15
Phishing - Webmail
Phishing - Webmail
Tags None

Domain Summary (8)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-11-24 05:36:55 UTC 34.102.187.140
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-11-24 05:30:55 UTC 34.117.237.239
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2020-05-03 10:09:39 UTC 44.228.207.167
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-21 23:36:00 UTC 2020-02-19 04:43:25 UTC 34.120.237.76
webmail.wt-msn.at (14) 0 2017-02-09 23:01:09 UTC 2022-11-24 04:08:39 UTC 194.208.76.15 Unknown ranking
r3.o.lencr.org (7) 344 No data No data 23.36.77.32
ocsp.digicert.com (2) 86 2012-05-21 07:02:23 UTC 2020-05-02 20:58:10 UTC 93.184.220.29

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 194.208.76.15
Date UQ / IDS / BL URL IP
2023-02-03 20:15:49 +0000 0 - 0 - 1 grenzenloskochen.erne.com/ 194.208.76.15
2023-02-03 14:19:41 +0000 0 - 1 - 0 adler-bregenz.at/ 194.208.76.15
2023-02-03 12:15:53 +0000 0 - 0 - 1 grenzenloskochen.erne.com/ 194.208.76.15
2023-01-31 06:14:48 +0000 0 - 0 - 1 kirchenchor.erne.com/ 194.208.76.15
2023-01-31 04:14:22 +0000 0 - 0 - 1 erne.com/ 194.208.76.15


Last 5 reports on ASN: Russmedia IT GmbH
Date UQ / IDS / BL URL IP
2023-02-03 20:15:49 +0000 0 - 0 - 1 grenzenloskochen.erne.com/ 194.208.76.15
2023-02-03 14:19:41 +0000 0 - 1 - 0 adler-bregenz.at/ 194.208.76.15
2023-02-03 12:15:53 +0000 0 - 0 - 1 grenzenloskochen.erne.com/ 194.208.76.15
2023-02-02 12:14:23 +0000 0 - 0 - 1 webmail.aat-biogas.at/ 194.208.76.38
2023-01-31 13:08:43 +0000 0 - 1 - 0 newweb.eko-lifestyle.at/ 194.208.76.18


Last 5 reports on domain: wt-msn.at
Date UQ / IDS / BL URL IP
2022-11-27 16:09:37 +0000 15 - 0 - 0 webmail.wt-msn.at/ 194.208.76.15
2022-11-27 04:12:32 +0000 16 - 0 - 0 webmail.wt-msn.at/ 194.208.76.15
2022-11-24 22:09:36 +0000 16 - 0 - 0 webmail.wt-msn.at/ 194.208.76.15
2022-11-24 20:09:36 +0000 16 - 0 - 0 webmail.wt-msn.at/ 194.208.76.15
2022-11-24 14:09:24 +0000 15 - 0 - 0 webmail.wt-msn.at/ 194.208.76.15


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-02-02 05:23:42 +0000 0 - 0 - 14 brajmail.com/ 89.22.114.29
2023-02-01 05:11:12 +0000 0 - 1 - 0 rc.itnw.cloud/ 89.58.38.54
2023-01-30 14:11:16 +0000 0 - 1 - 0 rc.itnw.cloud/ 89.58.38.54
2023-01-30 04:11:11 +0000 0 - 1 - 0 rc.itnw.cloud/ 89.58.38.54
2023-01-21 03:23:45 +0000 0 - 0 - 14 brajmail.com/ 89.22.114.29

JavaScript

Executed Scripts (9)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (34)


Request Response
                                        
                                            GET / HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 2068
Connection: keep-alive
X-Powered-By: PHP/7.4.32
Expires: Thu, 24 Nov 2022 14:09:09 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Frame-Options: sameorigin
Content-Language: en
Set-Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8; path=/; HttpOnly
Last-Modified: Thu, 24 Nov 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (730)
Size:   2068
Md5:    a401ae56db7946493bef145b1dcbd077
Sha1:   b9afb7f8d2aacd21c3bb7ed9c6b47c89d8b62400
Sha256: dedf78f7b4c4146fbfc8342a76e8f30b6bf8d1477a415821d0b6eefa48d9a240
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F3EBA265EE64870B2F822F1511B36C747D763C382557789CDAD8BE1D3B52D1F5"
Last-Modified: Mon, 21 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2337
Expires: Thu, 24 Nov 2022 14:48:10 GMT
Date: Thu, 24 Nov 2022 14:09:13 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5030
Cache-Control: max-age=164748
Date: Thu, 24 Nov 2022 14:09:13 GMT
Etag: "637f47ef-1d7"
Expires: Sat, 26 Nov 2022 11:55:01 GMT
Last-Modified: Thu, 24 Nov 2022 10:31:11 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 24 Nov 2022 13:18:58 GMT
cache-control: public,max-age=3600
age: 3015
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    d130218d0e2841f39c99610fe1a2ab90
Sha1:   29fbe1e177ee55c7a61ae0a206afff271cf5f945
Sha256: 6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C9951A909F354174F0075A01C01C3C3AA6960983040E328BFBBBEA81AEB405C2"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13757
Expires: Thu, 24 Nov 2022 17:58:30 GMT
Date: Thu, 24 Nov 2022 14:09:13 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: IYoWZZTOUChqsU59mqKI9YNC3Jl+AU1opjbUJW26beTc1pk5RYwkAjlLXQ7w+Ndm8Wy3WWiiIyk=
x-amz-request-id: MSCJ1W6TR2V9M481
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 24 Nov 2022 13:43:25 GMT
age: 1548
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Thu, 24 Nov 2022 14:09:13 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /plugins/jqueryui/themes/elastic/jquery-ui.css?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 8157
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "858e-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (2515)
Size:   8157
Md5:    2578a139909b8e29f484063dfdff0849
Sha1:   562ffaba1086c8476688e7cd95158633d620b762
Sha256: 7fe9f75dc0f86fe8cafded604971841f0d9de601f27d60e0049ef328730174a5

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /program/js/common.min.js?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 4890
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "3382-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (1379)
Size:   4890
Md5:    9905fa6efc7fc8fabf3e209fabc6972c
Sha1:   d30148fa19ea2995ad617b3b694aeaf1d5b7af5e
Sha256: dc92d0b197dfeb7185cf48a776c3a8365c51686a76921d2fb8d4b71976dea9d9

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /skins/elastic/deps/bootstrap.min.css?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 23198
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "26041-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (65324)
Size:   23198
Md5:    0e11ff574389c64214c25204b6cad7e5
Sha1:   c250a9edd8accbe6a959106b47ca067c8bc9cb95
Sha256: 15cc0d2bad562b04e656abace6b377837d6fc2bee1610de3d5fb06677a714480

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /program/js/jstz.min.js?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 5013
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "360b-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (12309)
Size:   5013
Md5:    2277fd7ddbe4f8d201e86092dfa83689
Sha1:   373e7f0301757faa67c61359d2a960e0d7ada67a
Sha256: 18c0b823e2c571a167139687515ebfd10212906abeeed1f5002743c76c467862

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /skins/elastic/styles/styles.css?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 19621
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "19560-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   19621
Md5:    7e4391d7a6b4e8f1f5a4ee30c99aa881
Sha1:   325c20f8bc68022938e3b9b9a0498e21bcdf44e4
Sha256: 9653c82e6dcf252d0c6209e66326e77e029e0f71f5b62cb9cf1a4370ad47490e

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /program/js/jquery.min.js?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 31474
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "15dfb-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (64001)
Size:   31474
Md5:    0295c222219c217d7a245bc34a5252c4
Sha1:   3e9cf2f204a0c09e6e169e09430c73c0fb05970e
Sha256: d57b36b62dd37158fc6089c56eec1c7d00c8e24c676d4eeffc501b69299fb0d7

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /skins/elastic/deps/bootstrap.bundle.min.js?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 22259
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "132fb-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (65297)
Size:   22259
Md5:    9c823ccfb496d6be1dc44d15ef41ad0b
Sha1:   29fc28a39110d044c7e9aae8334f986d887126c8
Sha256: 21921d66ae9470181b447547007e7a3550000f5428e9ea47ca1830f8244bcc27

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /skins/elastic/ui.min.js?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 19428
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "ebb1-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (629)
Size:   19428
Md5:    c58fb353c5bc2bef853dfe5f16322fc5
Sha1:   b4f542ebf510010726b6bc6822a49c8d30f7724e
Sha256: e2a4b339846365bb5e4cdefe30daaf0b640035ced607628f1a0b9ad84d791d0c

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /program/js/app.min.js?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 49229
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "2a123-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  ASCII text, with very long lines (690)
Size:   49229
Md5:    a667a740e47ce3dd74f7f6b6117a1401
Sha1:   f417247861b596070cc9af26636e04731dc2eb84
Sha256: 5d3261ec3aef3538c0d244fedc7ac26037f972d7738430e8758d3eac901a1690

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /skins/elastic/images/logo.svg?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 395
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "378-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document, ASCII text
Size:   395
Md5:    ceea723c944a3b28684277063830be99
Sha1:   88fdb3804cbcab6df3e9058d8a34281548ae41f3
Sha256: 11bd6d377d6315e926d18e70a547f463d80a77a2cff12a0ff3d965abe541ed5f

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Cache-Control, ETag, Pragma, Expires, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 24 Nov 2022 14:08:53 GMT
cache-control: public,max-age=3600
age: 21
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /skins/elastic/fonts/roboto-v19-regular.woff2 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://webmail.wt-msn.at/skins/elastic/styles/styles.css?s=1665649994
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 51116
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "c7ac-5eae65c366680"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 51116, version 1.0\012- data
Size:   51116
Md5:    9549360090baf2eb8b25d3a9708fc19d
Sha1:   3229ae839d33696d39c89dc0d3e193fe985f1da4
Sha256: a7bf1f115e60e0c8f3b335df66d4d77baaae4eb11d2cea2cf7c5b4693403a46f

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET /skins/elastic/fonts/fa-solid-900.woff2 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://webmail.wt-msn.at/skins/elastic/styles/styles.css?s=1665649994
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:09 GMT
Content-Length: 75440
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "126b0-5eae65c366680"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:09 GMT
Vary: Accept-Encoding
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 75440, version 329.-1049\012- data
Size:   75440
Md5:    b5cf8ae26748570d8fb95a47f46b69e1
Sha1:   07bed153d47f9129a944ee54dd72952deed074c8
Sha256: cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5644
Cache-Control: max-age=160299
Date: Thu, 24 Nov 2022 14:09:14 GMT
Etag: "637f3429-1d7"
Expires: Sat, 26 Nov 2022 10:40:53 GMT
Last-Modified: Thu, 24 Nov 2022 09:06:49 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /skins/elastic/images/favicon.ico?s=1665649994 HTTP/1.1 
Host: webmail.wt-msn.at
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://webmail.wt-msn.at/
Cookie: roundcube_sessid=k2sdcm91tvtlfoiu8afeo081n8

search
                                         194.208.76.15
HTTP/1.1 200 OK
Content-Type: image/vnd.microsoft.icon
                                        
Server: nginx
Date: Thu, 24 Nov 2022 14:09:10 GMT
Content-Length: 573
Connection: keep-alive
Last-Modified: Thu, 13 Oct 2022 08:33:14 GMT
ETag: "8f6-5eae65c366680-gzip"
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Expires: Sat, 24 Dec 2022 14:09:10 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Robots-Tag: noindex, nofollow


--- Additional Info ---
Magic:  MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 16x16, 32 bits/pixel\012- data
Size:   573
Md5:    b9b72ea513cc996ee29f388aac38b5d5
Sha1:   523ee86effdbdefd3494bcea2282129fb4b827ef
Sha256: c5ac240e4524b0ec0e2c3649769685025c881ee9684973915c772b87b8955213

Alerts:
  urlquery:
    - Phishing - Webmail
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: SowEttlPq+BSJH4N49dR6w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         44.228.207.167
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: c2AbpgqytNzo1D3gZjFMLvMWiw0=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17058
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:09:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17058
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:09:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17058
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:09:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17058
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:09:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E4EF6DDEF97EC03D43DF4C0BADA61D792B9F030E4D9FAB5BD3CF904AEAA3BC9"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17058
Expires: Thu, 24 Nov 2022 18:53:33 GMT
Date: Thu, 24 Nov 2022 14:09:15 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F50d7d834-f80d-4fd9-a728-24643ed00c45.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6789
x-amzn-requestid: 4d94ce1b-d18f-43b8-bb4d-e7093f9bea42
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cCvd2G9UIAMFrEg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637dc5f2-64a570135be59b83031811da;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 07:04:18 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: JygkDI7XSvlgurUTot874ZAXlOIqnv4cntMQ55IvHVqw93JBcksZjQ==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 07:10:24 GMT
age: 25131
etag: "303c571b13b05fcf27ee1159d8fdf6369aaef0a2"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6789
Md5:    d9d93b2a6875d446c3467eb49767eef5
Sha1:   303c571b13b05fcf27ee1159d8fdf6369aaef0a2
Sha256: 2a2345a925e0187979930a7f2de8548957ad9f2baae77364dcb157286e2b3fcf
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fca5cb469-21a0-420a-875c-a81635b33f53.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7993
x-amzn-requestid: 9f0ff853-4819-47cd-959d-658401ea5748
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvCsG5mIAMFqAQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9211-1c48b9223684f2942f8dd42d;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:35:13 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YJuHCuUgkLuFFiQUlrPWgv9grHznufMTU08hi4ZMpQTBmou6BGWrhQ==
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 7e87179efaa9e3c316bd3d3a74cfded8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:47:52 GMT
age: 58883
etag: "43d1dec7fc06879988c9c3cadd800cc8145df988"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7993
Md5:    92c78302bcce1568eb6a5563100b932c
Sha1:   43d1dec7fc06879988c9c3cadd800cc8145df988
Sha256: 0dda9914306c8e3a7ea75eade8e762652d93907dd6c5a8cc81707d6d8098b60a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F433fbaf5-7c54-485b-af70-542e1e788832.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5070
x-amzn-requestid: d86d95ad-9b78-4047-82e7-04e83a97e330
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEwViF1GIAMF_PQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9423-10809ba1634776171cf79cb8;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:44:03 GMT
x-amz-cf-pop: SFO5-P2, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: rrs7G6Wto6iY0rT6KsKwKAOPJjehXqD0jHZrR_eaiqpepQILFr7Dtw==
via: 1.1 0dc4feb22bb4657ce2bb95fd05ec7122.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:49:07 GMT
age: 58808
etag: "89accd230fba95fe0049678070817b36ead015fa"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5070
Md5:    0856fdb55f19f03a1bec38b3d6e0ac77
Sha1:   89accd230fba95fe0049678070817b36ead015fa
Sha256: 17c6e6f9bb8f4261fff2dc2a43ed994986418761624b8afead768e89927594f2
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3d85d03d-8fcf-42f4-bada-e7f488f04307.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7462
x-amzn-requestid: 1f6fb14d-83e0-43d3-9dab-5bc83af1a7c4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEwV3HV9oAMFs9w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9425-634d43db6308e0be596aa5a0;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:44:05 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GW5UTfY7-TwPWTno9z1e21a2cA9fmU7GfHFYWdL-zQvMLxeq-S9Trg==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 22:08:16 GMT
age: 57659
etag: "a7d9135f9d01ba13c3cdaf8b038c70212f159297"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7462
Md5:    b4157f2c5c3c77ce699324ecb08f47c7
Sha1:   a7d9135f9d01ba13c3cdaf8b038c70212f159297
Sha256: 2305f7afee95bb34d9e8dbff571c6b146ba7b694be96e9e925c32d1f41785916
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F81517ad5-7c1b-49aa-9ba9-dbfa36fbb071.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13882
x-amzn-requestid: 9022b0b3-31d5-4149-a969-02514f11b95a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cEvzNHjMoAMFWMg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637e9347-0e8354a02bef623644714e31;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: DYBcunpyI0FBJsJGh1kKpFI3X8kzCkO3mCxzUtWnaMKBT-Bv-zkq3Q==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 23 Nov 2022 21:59:18 GMT
age: 58197
etag: "1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13882
Md5:    64d79191f005c9876b952c5f948aa0f7
Sha1:   1102dbdcbcabf5c25d17840f8f00d5b55b9b8f0a
Sha256: 00fb36c3d322e8302c5ce202d6d4119d637510cd6f3b63e1347781ec3bb9d7fc
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4309
x-amzn-requestid: 47c2739d-73c5-4d91-914c-fe635cb09772
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b1U8xGxgIAMF-qQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63786851-6fbe19dc5c4c20dd657604e3;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 05:23:29 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: j_8oVo464QMWMnmkxQJIDRhaIVmwhzCTHe4A57OdmaUr9HcyTtBUjg==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 2750b94b402c92287d764b5fa115a042.cloudfront.net (CloudFront), 1.1 google
date: Thu, 24 Nov 2022 05:04:28 GMT
age: 32687
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    841a4b110022a99ddea6f7bf66df0fa1
Sha1:   126771b86638108050cf57c0d12faa27f80f0edb
Sha256: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db