urlquery - report: static.updatestar.net/dl/picpick/picpick

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	Sent bytes	Received bytes	IP
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	62417	34.120.237.76
r3.o.lencr.org (8)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2704	7090	95.101.11.115
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782	2374	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5844	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	54.213.114.144
static.updatestar.net (1)	0	2012-09-30T19:33:51Z	2023-03-11T01:31:41Z	380	13132066	91.250.81.8

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-13 16:15:15 UTC	high	91.250.81.8	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP

Scan Date	Severity	Indicator	Comment
2023-02-13	medium	static.updatestar.net/dl/picpick/picpick_inst.exe	Malware

Date	UQ / IDS / BL	URL	IP
2023-06-02 16:25:34 UTC	0 - 1 - 0	static.updatestar.net/dl/frostwire/frostwire- (...)	5.35.253.150
2023-06-02 09:14:18 UTC	0 - 1 - 0	static.updatestar.net/dl/intel/idcc.exe	5.35.253.150
2023-05-29 14:40:04 UTC	0 - 1 - 1	static.updatestar.net/dl/epson/epson326328eu.exe	5.35.253.150
2023-05-27 20:14:39 UTC	0 - 1 - 1	static.updatestar.net/dl/easeus/mover_free_In (...)	5.35.253.150
2023-05-26 05:32:12 UTC	0 - 0 - 1	static.updatestar.net/dl/netsurveillance/NetS (...)	5.35.253.150

Date	UQ / IDS / BL	URL	IP
2023-06-09 04:39:02 UTC	0 - 1 - 0	ww.kuechenplanung-danz.de/	91.250.114.206
2023-06-09 02:04:07 UTC	0 - 0 - 6	gsmobile.es/images/outlock/imp.png	92.204.40.123
2023-06-09 00:41:31 UTC	0 - 5 - 0	inspectomation.biz/	83.169.22.79
2023-06-09 00:31:04 UTC	0 - 17 - 0	medial.cc/	5.175.16.107
2023-06-08 20:40:14 UTC	0 - 0 - 95	hb-buchhaltung.de/	91.250.114.206

Date	UQ / IDS / BL	URL	IP
2023-06-02 16:25:34 UTC	0 - 1 - 0	static.updatestar.net/dl/frostwire/frostwire- (...)	5.35.253.150
2023-06-02 09:14:18 UTC	0 - 1 - 0	static.updatestar.net/dl/intel/idcc.exe	5.35.253.150
2023-05-29 14:40:04 UTC	0 - 1 - 1	static.updatestar.net/dl/epson/epson326328eu.exe	5.35.253.150
2023-05-27 20:14:39 UTC	0 - 1 - 1	static.updatestar.net/dl/easeus/mover_free_In (...)	5.35.253.150
2023-05-26 05:32:12 UTC	0 - 0 - 1	static.updatestar.net/dl/netsurveillance/NetS (...)	5.35.253.150

Date	UQ / IDS / BL	URL	IP
2023-04-04 20:11:51 UTC	0 - 0 - 2	cdn.discordapp.com/attachments/86164670981773 (...)	162.159.134.233
2023-04-04 19:51:03 UTC	0 - 1 - 0	cdn.discordapp.com/attachments/93929061122220 (...)	162.159.133.233
2023-04-04 19:37:42 UTC	0 - 1 - 0	www.nch.com.au/components/switchsetup.exe	66.39.105.214
2023-04-04 19:35:36 UTC	0 - 1 - 0	www.nch.com.au/switch/switchsetup.exe	66.39.105.214
2023-04-04 18:46:27 UTC	0 - 1 - 0	cdn.discordapp.com/attachments/10601106250675 (...)	162.159.129.233

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "1F48C58BC1624F3EDF7C67A677F453210524DC536D6E71ABE77E5B6F0B437FE5" Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10910 Expires: Mon, 13 Feb 2023 19:15:45 GMT Date: Mon, 13 Feb 2023 16:13:55 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 3b7089c645ddc074539d8e19b80cef98 Sha1: 34d2a12ab22405ce01c150dd13e46a781387b00d Sha256: 1f48c58bc1624f3edf7c67a677f453210524dc536d6e71abe77e5b6f0b437fe5
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "469D18130CA960FF8EFB710D09F4498BFC21DF7339A2E7B79AD1F73A8CE3299A" Last-Modified: Sat, 11 Feb 2023 23:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=4408 Expires: Mon, 13 Feb 2023 17:27:23 GMT Date: Mon, 13 Feb 2023 16:13:55 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 254178cc40b1a92de9d879bd731aeb9a Sha1: bfab58d211f1f823deed8f91de96ddf778b393a3 Sha256: 469d18130ca960ff8efb710d09f4498bfc21df7339a2e7b79ad1f73a8ce3299a
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Mon, 13 Feb 2023 15:34:43 GMT age: 2352 cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: ff250d3ef3fa45322bf05039a0122a9f Sha1: b3e7a2c383bce1bab807dbe1a03c375258b51f1d Sha256: d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "A129CF843807FEFF42F74C16F73D3E770B143B8F501969694FC4F158BC3E8BA4" Last-Modified: Sat, 11 Feb 2023 20:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=11239 Expires: Mon, 13 Feb 2023 19:21:14 GMT Date: Mon, 13 Feb 2023 16:13:55 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: b95b930615e89adacbb0cba6ac43288b Sha1: 257c13545fd3903ece587963bae0c90935ea9bf9 Sha256: a129cf843807feff42f74c16f73d3e770b143b8f501969694fc4f158bc3e8ba4
GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: l1iG+qnBtuWxsDHiM77Pea/R5Ul7EkMPWzg6Js8iY8w9IsWABRazvXb5E6Nk8dfXd3GrzZmroFA= x-amz-request-id: SKF3V6CDVXX2TC4R content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Mon, 13 Feb 2023 15:38:08 GMT age: 2148 last-modified: Sun, 29 Jan 2023 18:44:47 GMT etag: "e76071a28ee566dababb3834f46d68ed" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: e76071a28ee566dababb3834f46d68ed Sha1: aebb4e68c1ba2de0f90025283e8ed8470944fde0 Sha256: 78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Mon, 13 Feb 2023 16:13:56 GMT content-length: 12 access-control-allow-credentials: true vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-expose-headers: content-type strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Content-Length, Alert, Content-Type, Expires, Pragma, Retry-After, Last-Modified, ETag, Cache-Control, Backoff content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Mon, 13 Feb 2023 15:14:53 GMT age: 3543 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "CF9DF8A54E2DD5BA508CE4C27BD2EBC3524AD381FCE0EC7B3BEC1338E4569790" Last-Modified: Sat, 11 Feb 2023 08:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2190 Expires: Mon, 13 Feb 2023 16:50:26 GMT Date: Mon, 13 Feb 2023 16:13:56 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8fb35800c2b4b14aa5a43cb1eec27200 Sha1: c05fbacf454cda0cf3f3f62b94b0a00311d492d6 Sha256: cf9df8a54e2dd5ba508ce4c27bd2ebc3524ad381fce0ec7b3bec1338e4569790
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: gqliYkUkpETKZPRWiWJfbA== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	54.213.114.144 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: FRJzxbBWlvRLC1wLNFGcafqp/gk= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /dl/picpick/picpick_inst.exe HTTP/1.1 Host: static.updatestar.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	91.250.81.8 HTTP/1.1 200 OK Content-Type: application/octet-stream Cache-Control: public,max-age=31536000 Last-Modified: Tue, 07 Feb 2017 10:53:42 GMT Accept-Ranges: bytes ETag: "5ef778723081d21:0" Server: Microsoft-IIS/7.5 Date: Mon, 13 Feb 2023 15:13:52 GMT Content-Length: 13131784 --- Additional Info --- Magic: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive\012- data Size: 13131784 Md5: a55eab4f9b3ff2e07f1e4d2e27a9af0c Sha1: 108f5e37b2c5430a8d5c1c8afc7103e7a4bcf06c Sha256: 07e6894ece3bdc5878f27760a4218d61b8c26139e5ceed3408f9df751484a5ee Blocklists: - fortinet: Malware IDS: - ET POLICY PE EXE or DLL Windows file download HTTP
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243" Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=9120 Expires: Mon, 13 Feb 2023 18:45:58 GMT Date: Mon, 13 Feb 2023 16:13:58 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 0de0354ee620551182e2bf1fbc6b2194 Sha1: b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c Sha256: c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243" Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=9120 Expires: Mon, 13 Feb 2023 18:45:58 GMT Date: Mon, 13 Feb 2023 16:13:58 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 0de0354ee620551182e2bf1fbc6b2194 Sha1: b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c Sha256: c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243" Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=9120 Expires: Mon, 13 Feb 2023 18:45:58 GMT Date: Mon, 13 Feb 2023 16:13:58 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 0de0354ee620551182e2bf1fbc6b2194 Sha1: b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c Sha256: c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	95.101.11.115 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243" Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=9120 Expires: Mon, 13 Feb 2023 18:45:58 GMT Date: Mon, 13 Feb 2023 16:13:58 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 0de0354ee620551182e2bf1fbc6b2194 Sha1: b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c Sha256: c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa19cc035-f1f4-49fe-b677-6257cdc564bf.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 13204 x-amzn-requestid: b5956fb1-3d69-4e3f-a525-5677d9c28c48 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ADu2_H5hIAMF-RQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63e491c6-4753a2f443623db323713b59;Sampled=0 x-amzn-remapped-date: Thu, 09 Feb 2023 06:25:10 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: w_Nf7kQseMlJmm8ou4Aaqp-sZr4LQ_BQdCJedv4-hwFYI4GNOFpriw== via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google date: Mon, 13 Feb 2023 03:42:52 GMT age: 45066 etag: "e5854817d4411f5eb66114ab895a701a9a9fcd94" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 13204 Md5: b8f758759a7de044863863bca0fa0e74 Sha1: e5854817d4411f5eb66114ab895a701a9a9fcd94 Sha256: 43a4f950a198daf4e4a6e70af830d2529e9470edf158dd7b814d2a0b0d295151
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b06ab0c-1143-4629-8724-280dec7cb11e.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 8371 x-amzn-requestid: 89e90142-77ec-4e69-b65b-8bfe11117bbb x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: AMa4zGMKoAMFTLQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63e80b6b-030bc7d4355c82024f6276d6;Sampled=0 x-amzn-remapped-date: Sat, 11 Feb 2023 21:40:59 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: kIt9BMi7w6c1C_ObtddhENVN-rsjk0CYgfRh42CiCsq7NvpCuIbZ7g== via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Feb 2023 22:19:05 GMT age: 64493 etag: "eb9181e65afd6b72ae163f32b168ba77052a4b77" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 8371 Md5: 774b10b5d2cf23ba6bdcaa44c08aa802 Sha1: eb9181e65afd6b72ae163f32b168ba77052a4b77 Sha256: 56df134435aa26f41e4c85761d37c81c94a4edc145395805b593f7d62a25a7d0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4db4e5da-b298-4ec6-81f2-87abfcaa0e88.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7158 x-amzn-requestid: 6763d8b5-d93a-42f5-b14d-0d74c2c88ce4 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ANwQcFnGoAMFk_g= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63e89402-6ee9df2f212ca9a07cea2c3f;Sampled=0 x-amzn-remapped-date: Sun, 12 Feb 2023 07:23:46 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: vuptgjtpAG6i9ZWtvQzm_WNKeMt-O5QXILV8n8CfBB6-z7hVo8qldA== via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google date: Mon, 13 Feb 2023 08:22:50 GMT age: 28268 etag: "4ee12b26dedee6c2ea3dee6f3fe43eca25a428b8" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7158 Md5: 5a63f48369111521d5d405850dbcf673 Sha1: 4ee12b26dedee6c2ea3dee6f3fe43eca25a428b8 Sha256: b720c79c0e7df1fbdbc31be559f501334634a32f701522ab27f80d501b0ec816
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff1328b38-4c26-4346-9364-04b00f9e8ef0.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7534 x-amzn-requestid: 8275cb6e-b051-402c-b956-d8ca055d8fe4 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: AMbCEHPhIAMFlXQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63e80ba6-250d3b22764cbdcb501c7cf1;Sampled=0 x-amzn-remapped-date: Sat, 11 Feb 2023 21:41:58 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: mmknagBm543-Xj7N2EJv-WzXp0ylIOfe0PcWGPEtW0QX7IzVHIz-WQ== via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Feb 2023 22:20:57 GMT age: 64381 etag: "9dc8676f615747a2b3ab0f74b4d3007cb93df83a" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7534 Md5: ac85f9dc31c092b34bd59c9f4a2bf52f Sha1: 9dc8676f615747a2b3ab0f74b4d3007cb93df83a Sha256: c1a4485461d295bcf5f83a656d059778401a2835afcac9e103181f99ab3ea7fe
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45d2a39d-e35d-41a8-88ce-a7ee383e8c20.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 12647 x-amzn-requestid: acc44bca-e984-412a-9288-b08d5a9040c6 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: AMameF-_IAMFWWw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63e80af5-4c794c7f5eddf2184b7742c0;Sampled=0 x-amzn-remapped-date: Sat, 11 Feb 2023 21:39:01 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: -PMIH58XbZgQOh3WE-l4-ld4T8J4FyOeIFVMq9q5FxnduNf0slNHug== via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Feb 2023 22:22:20 GMT age: 64298 etag: "2fe085ba8b4da8ea339f9385a735478cf1cf4094" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 12647 Md5: 8202f178017b3843997cacf84663762d Sha1: 2fe085ba8b4da8ea339f9385a735478cf1cf4094 Sha256: f780c52f56a2f3dfaf000bc1d009417335fdf7269edfc1b2dcacce005c308a9c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8d541e83-a28d-41ae-96ee-c714e1779f72.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7180 x-amzn-requestid: 05383e16-b613-4d6d-abe1-041b686dedd8 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: AMaAiHvPIAMFagw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63e80a03-68c551686b4c75dc4be8a27b;Sampled=0 x-amzn-remapped-date: Sat, 11 Feb 2023 21:34:59 GMT x-amz-cf-pop: SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: PS012Gqundlj1W_alPa1W9p94dBT_8OQeh4a-x09Jth_mBww-Pkp-g== via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google date: Sun, 12 Feb 2023 22:20:57 GMT age: 64381 etag: "3e0893c2de220659cfcbb7b3a10e7b61b5a793d5" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7180 Md5: 0ebfff39e38a072acb90da1ca6a70818 Sha1: 3e0893c2de220659cfcbb7b3a10e7b61b5a793d5 Sha256: 7c474a70863661059b127c3d811a7d339a8ed85d0e807fcd993282e098589491

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             95.101.11.115

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "1F48C58BC1624F3EDF7C67A677F453210524DC536D6E71ABE77E5B6F0B437FE5" 

                                            
                                                
Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=10910 

                                            
                                                
Expires: Mon, 13 Feb 2023 19:15:45 GMT 

                                            
                                                
Date: Mon, 13 Feb 2023 16:13:55 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    3b7089c645ddc074539d8e19b80cef98

                                                Sha1:   34d2a12ab22405ce01c150dd13e46a781387b00d

                                                Sha256: 1f48c58bc1624f3edf7c67a677f453210524dc536d6e71abe77e5b6f0b437fe5

                                        
                                            GET /v1/ HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: application/json

                                            

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff 

                                            
                                                
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                            
                                                
strict-transport-security: max-age=31536000 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
content-length: 939 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Mon, 13 Feb 2023 15:34:43 GMT 

                                            
                                                
age: 2352 

                                            
                                                
cache-control: max-age=3600,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators

                                                Size:   939

                                                Md5:    ff250d3ef3fa45322bf05039a0122a9f

                                                Sha1:   b3e7a2c383bce1bab807dbe1a03c375258b51f1d

                                                Sha256: d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1 

                                        
                                            
Host: content-signature-2.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: binary/octet-stream

                                            

                                            
                                                
x-amz-id-2: l1iG+qnBtuWxsDHiM77Pea/R5Ul7EkMPWzg6Js8iY8w9IsWABRazvXb5E6Nk8dfXd3GrzZmroFA= 

                                            
                                                
x-amz-request-id: SKF3V6CDVXX2TC4R 

                                            
                                                
content-disposition: attachment 

                                            
                                                
accept-ranges: bytes 

                                            
                                                
server: AmazonS3 

                                            
                                                
content-length: 5348 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Mon, 13 Feb 2023 15:38:08 GMT 

                                            
                                                
age: 2148 

                                            
                                                
last-modified: Sun, 29 Jan 2023 18:44:47 GMT 

                                            
                                                
etag: "e76071a28ee566dababb3834f46d68ed" 

                                            
                                                
cache-control: public,max-age=3600 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  PEM certificate\012- , ASCII text

                                                Size:   5348

                                                Md5:    e76071a28ee566dababb3834f46d68ed

                                                Sha1:   aebb4e68c1ba2de0f90025283e8ed8470944fde0

                                                Sha256: 78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: application/json 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/json 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: application/json

                                            

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
access-control-expose-headers: Content-Length, Alert, Content-Type, Expires, Pragma, Retry-After, Last-Modified, ETag, Cache-Control, Backoff 

                                            
                                                
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                            
                                                
strict-transport-security: max-age=31536000 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
content-length: 329 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Mon, 13 Feb 2023 15:14:53 GMT 

                                            
                                                
age: 3543 

                                            
                                                
last-modified: Fri, 25 Mar 2022 17:45:46 GMT 

                                            
                                                
etag: "1648230346554" 

                                            
                                                
cache-control: max-age=3600,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators

                                                Size:   329

                                                Md5:    0333b0655111aa68de771adfcc4db243

                                                Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb

                                                Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

                                        
                                            GET / HTTP/1.1 

                                        
                                            
Host: push.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Sec-WebSocket-Version: 13 

                                        
                                            
Origin: wss://push.services.mozilla.com/ 

                                        
                                            
Sec-WebSocket-Protocol: push-notification 

                                        
                                            
Sec-WebSocket-Extensions: permessage-deflate 

                                        
                                            
Sec-WebSocket-Key: gqliYkUkpETKZPRWiWJfbA== 

                                        
                                            
Connection: keep-alive, Upgrade 

                                        
                                            
Sec-Fetch-Dest: websocket 

                                        
                                            
Sec-Fetch-Mode: websocket 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
Upgrade: websocket

                                        
                                             54.213.114.144

                                            
                                                HTTP/1.1 101 Switching Protocols

                                            

                                            
                                                
Connection: Upgrade 

                                            
                                                
Upgrade: websocket 

                                            
                                                
Sec-WebSocket-Accept: FRJzxbBWlvRLC1wLNFGcafqp/gk= 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             95.101.11.115

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243" 

                                            
                                                
Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=9120 

                                            
                                                
Expires: Mon, 13 Feb 2023 18:45:58 GMT 

                                            
                                                
Date: Mon, 13 Feb 2023 16:13:58 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    0de0354ee620551182e2bf1fbc6b2194

                                                Sha1:   b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c

                                                Sha256: c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             95.101.11.115

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243" 

                                            
                                                
Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=9120 

                                            
                                                
Expires: Mon, 13 Feb 2023 18:45:58 GMT 

                                            
                                                
Date: Mon, 13 Feb 2023 16:13:58 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    0de0354ee620551182e2bf1fbc6b2194

                                                Sha1:   b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c

                                                Sha256: c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa19cc035-f1f4-49fe-b677-6257cdc564bf.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 13204 

                                            
                                                
x-amzn-requestid: b5956fb1-3d69-4e3f-a525-5677d9c28c48 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: ADu2_H5hIAMF-RQ= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-63e491c6-4753a2f443623db323713b59;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Thu, 09 Feb 2023 06:25:10 GMT 

                                            
                                                
x-amz-cf-pop: SEA19-C2 

                                            
                                                
x-cache: Miss from cloudfront 

                                            
                                                
x-amz-cf-id: w_Nf7kQseMlJmm8ou4Aaqp-sZr4LQ_BQdCJedv4-hwFYI4GNOFpriw== 

                                            
                                                
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Mon, 13 Feb 2023 03:42:52 GMT 

                                            
                                                
age: 45066 

                                            
                                                
etag: "e5854817d4411f5eb66114ab895a701a9a9fcd94" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   13204

                                                Md5:    b8f758759a7de044863863bca0fa0e74

                                                Sha1:   e5854817d4411f5eb66114ab895a701a9a9fcd94

                                                Sha256: 43a4f950a198daf4e4a6e70af830d2529e9470edf158dd7b814d2a0b0d295151

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4db4e5da-b298-4ec6-81f2-87abfcaa0e88.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 7158 

                                            
                                                
x-amzn-requestid: 6763d8b5-d93a-42f5-b14d-0d74c2c88ce4 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: ANwQcFnGoAMFk_g= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-63e89402-6ee9df2f212ca9a07cea2c3f;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Sun, 12 Feb 2023 07:23:46 GMT 

                                            
                                                
x-amz-cf-pop: SEA19-C2 

                                            
                                                
x-cache: Miss from cloudfront 

                                            
                                                
x-amz-cf-id: vuptgjtpAG6i9ZWtvQzm_WNKeMt-O5QXILV8n8CfBB6-z7hVo8qldA== 

                                            
                                                
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Mon, 13 Feb 2023 08:22:50 GMT 

                                            
                                                
age: 28268 

                                            
                                                
etag: "4ee12b26dedee6c2ea3dee6f3fe43eca25a428b8" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   7158

                                                Md5:    5a63f48369111521d5d405850dbcf673

                                                Sha1:   4ee12b26dedee6c2ea3dee6f3fe43eca25a428b8

                                                Sha256: b720c79c0e7df1fbdbc31be559f501334634a32f701522ab27f80d501b0ec816

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F45d2a39d-e35d-41a8-88ce-a7ee383e8c20.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 12647 

                                            
                                                
x-amzn-requestid: acc44bca-e984-412a-9288-b08d5a9040c6 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: AMameF-_IAMFWWw= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-63e80af5-4c794c7f5eddf2184b7742c0;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Sat, 11 Feb 2023 21:39:01 GMT 

                                            
                                                
x-amz-cf-pop: SEA19-C2 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: -PMIH58XbZgQOh3WE-l4-ld4T8J4FyOeIFVMq9q5FxnduNf0slNHug== 

                                            
                                                
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Sun, 12 Feb 2023 22:22:20 GMT 

                                            
                                                
age: 64298 

                                            
                                                
etag: "2fe085ba8b4da8ea339f9385a735478cf1cf4094" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   12647

                                                Md5:    8202f178017b3843997cacf84663762d

                                                Sha1:   2fe085ba8b4da8ea339f9385a735478cf1cf4094

                                                Sha256: f780c52f56a2f3dfaf000bc1d009417335fdf7269edfc1b2dcacce005c308a9c

URL	static.updatestar.net/dl/picpick/picpick_inst.exe
IP	5.35.253.150 (France)
ASN	#8972 Host Europe GmbH
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access
Report completed	2023-02-13 16:14:08 UTC
Status	Loading report..
IDS alerts	1
Blocklist alert	1
urlquery alerts	No alerts detected
Tags	None

Overview

Domain Summary (7)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 5.35.253.150

Last 5 reports on ASN: Host Europe GmbH

Last 5 reports on domain: updatestar.net

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (20)

Overview

Domain Summary (7)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 5.35.253.150

Last 5 reports on ASN: Host Europe GmbH

Last 5 reports on domain: updatestar.net

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (20)

Network Intrusion Detection Systems