Overview

URL thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=continuetosite.com
IP54.230.111.55
ASNAMAZON-02
Location United States
Report completed2022-09-27 20:07:06 UTC
StatusLoading report..
urlquery Alerts Scam / Brand infringement


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-09-27 2 thefreeclub.xyz/1/prizewheel/cash/iqcash/css/app.css?id=c588c17324f2be0e0ec9 Phishing
2022-09-27 2 thefreeclub.xyz/1/prizewheel/cash/iqcash/js/landers/prizewheel-fb/app.js?id (...) Phishing
2022-09-27 2 thefreeclub.xyz/1/prizewheel/cash/iqcash/img/fb-like.svg Phishing
mnemonic secure dns  No alerts detected
Quad9 DNS
Scan Date Severity Indicator Comment
2022-09-27 2 desekansr.com Sinkholed


Files

No files detected



Passive DNS (9)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS r3.o.lencr.org (7) 344 2020-12-02 08:52:13 UTC 2022-09-27 04:52:25 UTC 23.36.77.32
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-05-28 17:26:30 UTC 2022-09-27 14:55:40 UTC 143.204.55.36
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-09-27 05:14:54 UTC 34.160.144.191
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-09-27 04:52:33 UTC 34.117.237.239
mnemonic passive DNS desekansr.com (1) 0 2022-05-12 08:00:20 UTC 2022-09-27 15:38:00 UTC 139.45.197.250 Unknown ranking
mnemonic passive DNS ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2022-09-27 12:08:14 UTC 93.184.220.29
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-09-27 05:14:54 UTC 35.163.196.193
mnemonic passive DNS thefreeclub.xyz (19) 0 2022-08-15 11:22:15 UTC 2022-09-27 05:01:02 UTC 54.230.111.94 Unknown ranking
mnemonic passive DNS img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-09-27 13:22:33 UTC 34.120.237.76


Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 54.230.111.55

Date UQ / IDS / BL URL IP
2022-11-25 14:43:20 +0000
0 - 0 - 1 www.free-prizes.click/push/iPhone12/ganar.html 54.230.111.55
2022-11-09 22:51:41 +0000
0 - 0 - 1 c8f6c5.jtbgcwpfsv.com/ 54.230.111.55
2022-11-07 16:09:57 +0000
0 - 0 - 25 bmogsp.com/logon 54.230.111.55
2022-11-06 02:18:33 +0000
17 - 0 - 10 www.free-prizes.click/push/iPhoneXS/index.htm (...) 54.230.111.55
2022-11-01 19:03:20 +0000
0 - 0 - 1 makesyourhappy.shop/ps/us/14/fa/tt/index1.html 54.230.111.55

Last 5 reports on ASN: AMAZON-02

Date UQ / IDS / BL URL IP
2022-12-10 06:41:23 +0000
0 - 0 - 2 email.btobtechinsight.com/c/18g5uV2yXk5NpqqWL (...) 54.230.111.9
2022-12-10 06:41:17 +0000
0 - 0 - 2 email.btobtechinsight.com/c/1KykdFUdQnjkQWTmn (...) 54.230.111.72
2022-12-10 06:38:12 +0000
0 - 0 - 1 api4.check-data.xyz/api/get_stat_options/2C6A (...) 44.233.23.32
2022-12-10 06:38:08 +0000
0 - 0 - 1 api5.check-data.xyz/api/get_stat_options/2C6A (...) 52.27.164.166
2022-12-10 06:36:17 +0000
0 - 0 - 4 gemenexchang.godaddysites.com/ 13.248.243.5

Last 5 reports on domain: thefreeclub.xyz

Date UQ / IDS / BL URL IP
2022-11-21 04:57:29 +0000
0 - 0 - 5 thefreeclub.xyz/1/prizewheel/cash/southacash/ (...) 69.175.50.100
2022-11-21 04:52:34 +0000
0 - 0 - 6 thefreeclub.xyz/1/prizewheel/cash/kecash/inde (...) 69.175.50.100
2022-11-01 19:16:04 +0000
0 - 0 - 5 thefreeclub.xyz/1/prizewheel/cash/mycashn/ind (...) 69.175.50.100
2022-10-25 22:39:49 +0000
0 - 0 - 9 thefreeclub.xyz/1/prizewheel/cash/thcashn/ind (...) 69.175.50.100
2022-10-25 17:39:52 +0000
0 - 0 - 11 thefreeclub.xyz/1/prizewheel/cash/uaecash/ind (...) 69.175.50.100

Last 5 reports with similar screenshot

Date UQ / IDS / BL URL IP
2022-12-08 15:49:11 +0000
0 - 0 - 4 officialwinner.xyz/1/prizewheel/cash/iqcash/i (...) 54.230.111.119
2022-12-08 15:46:49 +0000
0 - 0 - 4 officialwinner.xyz/1/prizewheel/cash/iqcash/i (...) 54.230.111.119
2022-12-01 13:49:20 +0000
0 - 0 - 4 officialgifts.xyz/1/prizewheel/cash/iqcash/in (...) 54.230.111.85
2022-11-27 17:08:57 +0000
0 - 0 - 5 continuetosite.com/go/66e190b1-30d3-492f-af42 (...) 3.70.16.242
2022-11-27 04:31:16 +0000
0 - 0 - 6 continuetosite.com/go/6841ff10-cc6d-4c02-b093 (...) 3.70.16.242


JavaScript

Executed Scripts (11)


Executed Evals (1)

#1 JavaScript::Eval (size: 80, repeated: 1) - SHA256: 4e414302c72ef7885383b496dfb592eaca37d5483e8ab47a59ebc8de57f12e70

                                        (() => {
    const a = async
    function name() {};
    window['z4z4fy94p8g'] = true;
})()
                                    

Executed Writes (2)

#1 JavaScript::Write (size: 0, repeated: 1) - SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                    

#2 JavaScript::Write (size: 79, repeated: 1) - SHA256: 5c0f4cc1e7ed997c71e2382e10aaaf35e614105d8549cf1b9591f2dd2f9624cc

                                        < a href = "https://continuetosite.com/click"
class = "step__button" > '7D( ,' & 2 * C < /a>
                                    


HTTP Transactions (39)


Request Response
                                        
                                            GET /1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: text/html
                                        
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 19 Sep 2022 10:56:18 GMT
Server: AmazonS3
Content-Encoding: gzip
Date: Tue, 27 Sep 2022 11:12:48 GMT
ETag: W/"9db191da2a76d77cae8a96be776fa095"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ddM1961VpL3-EUioJLaELQEzQTyjK3kurCvNYsKJmHYWgddyQhSIMQ==
Age: 32048


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (2918)
Size:   4530
Md5:    6de158a2ba14d012d1d3a54f1d08f16d
Sha1:   d781f065592630797748c93d2b55fe5404218182
Sha256: 5f15162388e902b8a9d16c1a5d36bb55ab8f2f0e456c5c6695eb0efeec9503e5
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "4397E6B45B5822FBAB9B83ABE0B96EE70EFBA7CD2160B51936159865EDE5FDB1"
Last-Modified: Sun, 25 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11498
Expires: Tue, 27 Sep 2022 23:18:33 GMT
Date: Tue, 27 Sep 2022 20:06:55 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.36
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Backoff, Content-Type, Retry-After, Alert
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Tue, 27 Sep 2022 19:15:31 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 277d0e3af1ffdcb1ee40b7dc9f040146.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 3QRJ8TALt7LDlGyX6pAfrYvtOVol9eQwhlHFq7zD9Pt6u-VcnDL1vQ==
Age: 3084


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    2d12f67fe57a87e7366b662d153a5582
Sha1:   d7b02d81cc74f24a251d9363e0f4b0a149264ec1
Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "F35BB3A8C877DD8D3C5920F3C917722F12B157AFF398E2EC30FAB51FA6CAA2EF"
Last-Modified: Mon, 26 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7501
Expires: Tue, 27 Sep 2022 22:11:56 GMT
Date: Tue, 27 Sep 2022 20:06:55 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: 9tsep5776C8Ovyi0is9K36moGWN/9rONlLRUdzxDMfpUClocqRWKy9cZx+ib1Y3m+zm0uUT1QLk=
x-amz-request-id: XDJ7HG4WCY2NEA12
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 27 Sep 2022 19:47:02 GMT
age: 1193
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
etag: "6113f8408c59aebe188d6af273b90743"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /1/prizewheel/cash/iqcash/css/app.css?id=c588c17324f2be0e0ec9 HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Content-Length: 33
Connection: keep-alive
Last-Modified: Mon, 19 Sep 2022 10:51:25 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Tue, 27 Sep 2022 08:06:54 GMT
ETag: "c588c17324f2be0e0ec90a18f39e7d7c"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: fKkzY1LOyLNQ8FnhTUX9TGVUwif09audhfv8ve9jBHtJ2PQI5lkBrQ==
Age: 43202


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   33
Md5:    c588c17324f2be0e0ec90a18f39e7d7c
Sha1:   69d360eddd15f527aac7f7e610346517732b7770
Sha256: b83e8830b6b2f1253a78f90191cf1087e8fd7638831fd4c1376a7a6029297240

Alerts:
  urlquery:
    - Scam / Brand infringement
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /1/prizewheel/cash/iqcash/js/landers/prizewheel-fb/app.js?id=c3c399d8b44b50eee3e6 HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 19 Sep 2022 10:32:16 GMT
Server: AmazonS3
Content-Encoding: gzip
Date: Tue, 27 Sep 2022 20:06:55 GMT
ETag: W/"cdf97653c213f02233f50a1ec975633c"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Endzfd9fG2OWTtKMUFLBwOIk7S7lQxpbBvDF2WcQg2F1QeACMcGoSA==
Age: 39548


--- Additional Info ---
Magic:  ASCII text, with very long lines (65475)
Size:   52541
Md5:    644205cd16dee07dca96d81fc6fbde8a
Sha1:   6f9c63d2f589eaad4be4df0ea56ccbce84bdd2ea
Sha256: 7df578baffaa784097299b6336dcc4ddecea34b9877b539357d5294294001384

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /1/prizewheel/cash/iqcash/css/landers/prizewheel-fb/app.css?id=cd41123a11e97e0f2444 HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:48 GMT
Last-Modified: Mon, 19 Sep 2022 10:32:15 GMT
ETag: W/"cd41123a11e97e0f2444b57d180631a0"
Server: AmazonS3
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 7WKY9q3JBP_LIMElXbM93c20lbasnLt4S6aQN7VyD52mvfmcADfAyA==
Age: 39548


--- Additional Info ---
Magic:  ASCII text, with very long lines (3495), with no line terminators
Size:   1122
Md5:    6f0b111c9658146e2042ef7c4344ff2b
Sha1:   2edf66fed1f9e1e4292f3bdc371f830c88c7aa4b
Sha256: 813db1f18fabea8c860b154cc0ac0280326ea36addf4af4b6c91b596c325f383
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Tue, 27 Sep 2022 20:06:55 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /1/prizewheel/cash/iqcash/img/landers/prizewheel-fb/notification.png HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Content-Length: 449
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:48 GMT
Last-Modified: Mon, 19 Sep 2022 10:32:18 GMT
ETag: "bd5203f2cc9e7a9125e4575e029541b0"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: If4I91SAyBs5Fqv5BhnhH4w2G9dra8sFYYLCu6HRopcmI7qVpnASCg==
Age: 39548


--- Additional Info ---
Magic:  PNG image data, 30 x 28, 8-bit colormap, non-interlaced\012- data
Size:   449
Md5:    bd5203f2cc9e7a9125e4575e029541b0
Sha1:   9fa565ab2f4b55da4735b79e529562252b3c9afe
Sha256: db94c8ae725f947f20e12df29e6b6c8ade5ffcd5a7dc9ffd9be0351d963f826f

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/landers/prizewheel-fb/loader.gif HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Content-Length: 5083
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:48 GMT
Last-Modified: Mon, 19 Sep 2022 10:32:18 GMT
ETag: "ed786659a534e0d183c09a90c50abc9d"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: NUTCcsxCNqE-ErQhZjluvlw3-IW-x689wNh9gFIMQI5snIC831vk1g==
Age: 39548


--- Additional Info ---
Magic:  GIF image data, version 89a, 50 x 50\012- data
Size:   5083
Md5:    ed786659a534e0d183c09a90c50abc9d
Sha1:   a6c3d90bfaa86a7cda490bc5d04c8939c31a414e
Sha256: cbaeb154dcb93bff5f6e382cede5d51a11175a2295e56bb2790611910280ba97

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/prizes/iphone-12-pro-max/default@0.5x.png HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Content-Length: 57361
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:49 GMT
Last-Modified: Mon, 19 Sep 2022 10:32:19 GMT
ETag: "067843b7e5fadf09896c23cee6a28d1a"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 3sERG45A4kirfhxQaQJ9uyBj2TMxR_jOAsdjO58PT_MPuAhW_2s_0g==
Age: 39547


--- Additional Info ---
Magic:  PNG image data, 250 x 179, 8-bit/color RGBA, non-interlaced\012- data
Size:   57361
Md5:    067843b7e5fadf09896c23cee6a28d1a
Sha1:   4a7863bc885fbbb8ab0274280ea51f5980413f68
Sha256: 82771bd4f119c328c192827cec6ba9edb36abbad8cf7887898cdecdf462b8258
                                        
                                            GET /1/prizewheel/cash/iqcash/js/app.js?id=15b1bae461854d516179 HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Content-Length: 977
Connection: keep-alive
Last-Modified: Mon, 19 Sep 2022 10:51:26 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Tue, 27 Sep 2022 20:06:55 GMT
ETag: "15b1bae461854d516179a34a8c9b5f08"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 a343e36742f64defd0a2caf1f96ff772.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: voHpe0WzFcHE-XH74sKtVQ7mlD7BqzSwTbdqRRoc4IWS2fGhAqG0lA==
Age: 39548


--- Additional Info ---
Magic:  ASCII text, with very long lines (977), with no line terminators
Size:   977
Md5:    15b1bae461854d516179a34a8c9b5f08
Sha1:   330c1d191253fe07c5fe6b5af37872408f2e5904
Sha256: 1bd25e467ea078265aee433e0cf9732a7e127514304634590a2de17fb2330896

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/landers/prizewheel-fb/prizewheel_static.png HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Content-Length: 3370
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:49 GMT
Last-Modified: Mon, 19 Sep 2022 10:32:17 GMT
ETag: "dc484e0043b5ff6191b1880c8779863c"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: RDvSSTYbcGlP4MTsqxFYOGO4_PzF8Z4m_xVP2tRWCKAprPB8tNjjAA==
Age: 39547


--- Additional Info ---
Magic:  PNG image data, 1002 x 1002, 4-bit colormap, non-interlaced\012- data
Size:   3370
Md5:    dc484e0043b5ff6191b1880c8779863c
Sha1:   a5b67e3dff3dea3940eed090431aecbb36611b1d
Sha256: 30bc059973d84a6e1d22d16747bce062025561f2555cdd9cec012a87866abcb6

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/female/3@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 2506
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:49 GMT
Last-Modified: Mon, 19 Sep 2022 10:14:32 GMT
ETag: "e69e56799051d24a67414a67301ac984"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Fyd0srL1Adgva7Oprg4MpKH2xBkbaUhFVCOAYdX5q38AOhf8UV16fg==
Age: 39547


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   2506
Md5:    e69e56799051d24a67414a67301ac984
Sha1:   7d7db0281213342c25abf9e08937e38c7d1e8449
Sha256: cff50b269e3afdcf620ba9a8f6d3ac55b03a953136f3148d1b3296798bf57210
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/male/3@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 3301
Connection: keep-alive
Last-Modified: Mon, 19 Sep 2022 10:14:31 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Tue, 27 Sep 2022 08:06:56 GMT
ETag: "49f1b40f2ed2ef127cb64293ae8b1524"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ZaCfLeNmxuPkcgL1fhdyiUR0nvLo-mKzEFonv4sh6Miwxk9zVH3bbQ==
Age: 43200


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   3301
Md5:    49f1b40f2ed2ef127cb64293ae8b1524
Sha1:   7939aacf51d0ba9b4358cb17ef40eb91fa31e27b
Sha256: c5e6dbfaac2e982618aa4ea88a1785ca965b57f3149551f194cdaae2d8406a53

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/male/10@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 3175
Connection: keep-alive
Last-Modified: Mon, 19 Sep 2022 10:14:59 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Tue, 27 Sep 2022 08:06:56 GMT
ETag: "f8002e02aac0ac1bb22d2c80f36ebf15"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 a343e36742f64defd0a2caf1f96ff772.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ZOCgPA0P1J2yQjz1Udie6CQtg1QSjcajXu9hiFcylCyMRLSqW5OXZQ==
Age: 43200


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   3175
Md5:    f8002e02aac0ac1bb22d2c80f36ebf15
Sha1:   bf277a8747caf561b91a25860e772cf0f1a834a5
Sha256: 0e98e32d27f59276dc137de153e32c28220a635701413565a4646dc8361fd94c

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/female/6@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 2950
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:50 GMT
Last-Modified: Mon, 19 Sep 2022 10:14:33 GMT
ETag: "5f6bc62e6e66a94b4ce9b971a798ceff"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 a343e36742f64defd0a2caf1f96ff772.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: A_YjXWjh6t9ty_dtiE2TSjxLaLFwW7VqN_rz56_R3Kqs4JuCgD4KRA==
Age: 39546


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   2950
Md5:    5f6bc62e6e66a94b4ce9b971a798ceff
Sha1:   05faaed9dbd1a5462485d4deeed888312a3b4973
Sha256: cfa55f5831710c40e2429ec2528b080fb2e6b11b560abfa8eaa1710b63770af3

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/male/9@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 2224
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:50 GMT
Last-Modified: Mon, 19 Sep 2022 10:14:58 GMT
ETag: "444a95e7661a07d48ae8a2b7d67792be"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: wMMK4yMin9jr4BlOUAahrZnKXeJGMYWcjY7dY7mM-GCLXg6HAXdAmw==
Age: 39546


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   2224
Md5:    444a95e7661a07d48ae8a2b7d67792be
Sha1:   e31aa744a72a17d6a3e04cd0e6f9a9fc59a47b59
Sha256: d815f00761793a93ef88b73ea6451d9300a052ce64f454d30f9446af3bd9ccda

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/prizes/iphone-12-pro-max/proof.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 26967
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:50 GMT
Last-Modified: Mon, 19 Sep 2022 10:32:19 GMT
ETag: "dad6878310f03670794690dd350722d7"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: YfWvcq7BpLqxgy8HLB6oettE7a-TZ7I939ZxaRT1-lqvBKQGFlcYQA==
Age: 39546


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 670x335, components 3\012- data
Size:   26967
Md5:    dad6878310f03670794690dd350722d7
Sha1:   a8c7aabb1bb3109161074051241c9d2ed234b26a
Sha256: a1affbee3313b4b1f31cd57413a5bc937a2cc6cbdafca96fd3bfd3aa881b7c33
                                        
                                            GET /pfe/current/micro.tag.min.js?z=5378963&sw=/sw-check-permissions-f40a4.js HTTP/1.1 
Host: desekansr.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/

                                         
                                         139.45.197.250
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Tue, 27 Sep 2022 20:06:55 GMT
Last-Modified: Tue, 27 Sep 2022 13:19:37 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"6332f869-1a5ed"
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Pragma: no-cache
Content-Encoding: gzip


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   40057
Md5:    f180b770897d6441bb79cb05ef5655b6
Sha1:   0a1ecab3bd50af2c0930f1ebadeb5ae449b52489
Sha256: 35ca5d4fa63b7895631bbe796dc91e83e0a76ba1a6d6b04c4c2962b7c1fb5a4e

Alerts:
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/female/5@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 2787
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:50 GMT
Last-Modified: Mon, 19 Sep 2022 10:14:31 GMT
ETag: "6063e3355d6e928b55810c359ee1d382"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: g2tedDN7vlEtqAXGcQoBwWGiGwN9wv1dAgpXWUhL0-FZXp03dYxcrA==
Age: 39546


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   2787
Md5:    6063e3355d6e928b55810c359ee1d382
Sha1:   a6a19cb61b8a8f9ed538a6467a7a41ed85fc01ad
Sha256: 9db1c16bd8c27942b3d83cff9d81462ced2b7827ab45fe53ff3fcec32ed138d9
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/male/2@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 2258
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:50 GMT
Last-Modified: Mon, 19 Sep 2022 10:14:30 GMT
ETag: "07ee3d87dba4f97110c83432fcc8f3f6"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 a343e36742f64defd0a2caf1f96ff772.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: SMpuVS3EZueRKEFChUUO_tzRuf55l9KP3qms_HRjlJeZ8hK5SsJrjQ==
Age: 39546


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   2258
Md5:    07ee3d87dba4f97110c83432fcc8f3f6
Sha1:   80f21d2258991eaecca028683f58b16019bf9deb
Sha256: 50479fd6ff7c08b64aa01f0a415bba20d8ddd79a43becae604955e9086098cff

Alerts:
  urlquery:
    - Scam / Brand infringement
                                        
                                            GET /1/prizewheel/cash/iqcash/img/fb-like.svg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Transfer-Encoding: chunked
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:49 GMT
Last-Modified: Mon, 19 Sep 2022 10:51:27 GMT
ETag: W/"765203989756e91925e8f947e660b644"
Server: AmazonS3
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 a343e36742f64defd0a2caf1f96ff772.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 18j4C_NTU0Jz_8NyWiOh62BLAc3GxQgE8FbVEsQZSCLbafnKNe7nVQ==
Age: 39547


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (4627), with no line terminators
Size:   2069
Md5:    173f50bebb0aeee6a79a4fc615fe34bf
Sha1:   8baa34a4bfcf904d84cb5e4b3e8eb1ae2eddfa5b
Sha256: 7f402281306c90cf2788c9ae6f4123b828838852a437b017ee412984207946f1

Alerts:
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /1/prizewheel/cash/iqcash/img/profiles/mena/female/1@0.25x.jpg HTTP/1.1 
Host: thefreeclub.xyz
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://thefreeclub.xyz/1/prizewheel/cash/iqcash/index.html?domain=continuetosite.com&brand=&bemobdata=c=504779cb-1084-4d39-aaf4-8d8e4ab4844b..l=a3e92eb0-e8f7-4f22-96a2-8c47687d7161..a=0..b=0..r=http://continuetosite.com

                                         
                                         54.230.111.94
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Content-Length: 2853
Connection: keep-alive
Date: Tue, 27 Sep 2022 09:07:50 GMT
Last-Modified: Mon, 19 Sep 2022 10:14:33 GMT
ETag: "4ccf612375cb7df45e271ecd2983281e"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: yt7_M6CZivTv42akcifAoADp7LA2C-nekab6G0xBK5B__UiqYPKecg==
Age: 39546


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 128x128, components 3\012- data
Size:   2853
Md5:    4ccf612375cb7df45e271ecd2983281e
Sha1:   db4bc5414c30c39531e38c9a3f34b087cd68b4b6
Sha256: 75f237c0722d2dd3ef7d7e4bad43a70ac57bad90c81b9cb8b9c9b445c0a76a1b
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.36
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Tue, 27 Sep 2022 19:10:46 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Tue, 27 Sep 2022 19:51:05 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 057fdebf738f5915bf38a78949190758.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Gc31s1R7xjkYRxSSqa4k2aArsMnWhU80jNJA-Uo_IEWuL4575qKkAw==
Age: 3370


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6363
Cache-Control: 'max-age=158059'
Date: Tue, 27 Sep 2022 20:06:56 GMT
Last-Modified: Tue, 27 Sep 2022 18:20:54 GMT
Server: ECS (ska/F719)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: PRPKIHGDmaz0puZJeWqkew==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         35.163.196.193
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: bzOR2IiDIQFLlKf1Kjcal6SeIE4=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7359
Expires: Tue, 27 Sep 2022 22:09:36 GMT
Date: Tue, 27 Sep 2022 20:06:57 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7359
Expires: Tue, 27 Sep 2022 22:09:36 GMT
Date: Tue, 27 Sep 2022 20:06:57 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7359
Expires: Tue, 27 Sep 2022 22:09:36 GMT
Date: Tue, 27 Sep 2022 20:06:57 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7359
Expires: Tue, 27 Sep 2022 22:09:36 GMT
Date: Tue, 27 Sep 2022 20:06:57 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E47D6E33FE9F6E588D308B62FA059C960A000C56651713E30BAF6CD09B7DE41"
Last-Modified: Sun, 25 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7359
Expires: Tue, 27 Sep 2022 22:09:36 GMT
Date: Tue, 27 Sep 2022 20:06:57 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F63a7aeb3-999a-4e57-9255-c40e0376d08e.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5319
x-amzn-requestid: 74191b02-ebea-48bd-8522-f05bf8080f31
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZFlOKFtsIAMFyGQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63321bf4-1f2daa9d7906bf9812e10953;Sampled=0
x-amzn-remapped-date: Mon, 26 Sep 2022 21:39:00 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Y0gjPs-l9_JD9F-LSH_i1uL2Nz0UcWCG-9PmDmRH8cN_cNAeSchJTA==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Mon, 26 Sep 2022 21:39:00 GMT
etag: "75df3341e30281fcbf78c7074980356fdf0be8e2"
age: 80877
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5319
Md5:    46e31aa06b8e86a9a5f9ba1cc3feca08
Sha1:   75df3341e30281fcbf78c7074980356fdf0be8e2
Sha256: d1fd4f81b7e0f43de960f0ee024d9e87bcb395f032a4ab0360e3829d1ec8a42b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1bfe3adc-1955-4f21-9e44-c0bc53a4edc5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9163
x-amzn-requestid: 8ccd9b1f-bef9-4591-be32-e6dd98f4ee78
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZFlKpEZrIAMFS1Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63321bdd-4a40b9c8281b64c725fec0f1;Sampled=0
x-amzn-remapped-date: Mon, 26 Sep 2022 21:38:37 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: bs6HOUmHOoYKDuzBoVHhcr8d4HP4bBmwUF3EtOmwKXo7ozhfaIYEvw==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Mon, 26 Sep 2022 21:39:07 GMT
age: 80870
etag: "84f5a4c8b38acde814bc790e5b514347718d5bb9"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9163
Md5:    deb8d1e3b6d7fbc8c8ba478269621676
Sha1:   84f5a4c8b38acde814bc790e5b514347718d5bb9
Sha256: ed14fa766f0708b4166e83b61f160db5671af430917b7c67184bf18d9208742b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2517fd65-65c6-43b1-93a6-b1205ba3f0f8.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7455
x-amzn-requestid: 0887cd56-f324-46cf-a086-709e1c66f354
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZGBTdHmhoAMFvIw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633248e2-42391706084f335228fe3994;Sampled=0
x-amzn-remapped-date: Tue, 27 Sep 2022 00:50:42 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: IWzfDNFlgYdqYnbQ9uWfOvqb5zl3I3mgTZrT5pU5P3EvetMRDN5P7w==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 ead78c395f4bede3ec6cd7ea180e3d3a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Sep 2022 01:06:47 GMT
age: 68410
etag: "1a26007f761e439db575fb80fb403031260aecf4"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7455
Md5:    5274e770cb5a704916c8965659709f4a
Sha1:   1a26007f761e439db575fb80fb403031260aecf4
Sha256: e36e8be75c92feb9b416a46c5918356d8f9694894a799b7c10de21034d33d5ef
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F658e1cdd-3e54-47dd-9724-ec65659721ea.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6390
x-amzn-requestid: b2681ff8-ab83-41e6-adef-3e6772c93c3f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZGFJ6Gc_oAMF44g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63324f0c-3dbf9f4e2047567b5abdbe74;Sampled=0
x-amzn-remapped-date: Tue, 27 Sep 2022 01:17:00 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 8JXEBo_L_xKuKdeoOXEJ6FO7ZVsZVQzUmQFe7fYcxaHRQNEq1HWp6w==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Sep 2022 01:37:50 GMT
age: 66547
etag: "61676358cdbb2373bc644e66f8a84fbc8cc5daf6"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6390
Md5:    14218a43c5e5bbce546735a780c8ccce
Sha1:   61676358cdbb2373bc644e66f8a84fbc8cc5daf6
Sha256: 905b1c30a2273aef69904f2eb1451c756fc1fdba02e86ea5c957629dd056aeda
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F79631135-a10c-43bf-85d2-fa2236b96883.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13213
x-amzn-requestid: fe9ec409-2757-4910-8443-5b4d3be7efd3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZFlATEp8oAMFd9Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63321b9b-3230e97a4fe34413285eb578;Sampled=0
x-amzn-remapped-date: Mon, 26 Sep 2022 21:37:31 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: kRSg9NTTAgeAJgIZ_C9_rRodCX4bzGduJEvNPNHUya0Moa2vsmWSoQ==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google
date: Mon, 26 Sep 2022 21:38:57 GMT
age: 80880
etag: "3d4fa8701f17e8818c25584ef5f04bfbee8440cd"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13213
Md5:    62e68c3cd08dd94d910507512a67e85f
Sha1:   3d4fa8701f17e8818c25584ef5f04bfbee8440cd
Sha256: 058d798963f83f5fb88ab728185f755c5353fa981d93e1b6ff869089f501586b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc9985e6-5fe2-4d64-8060-3ea9e7ea528d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10318
x-amzn-requestid: 6a205445-8a9e-4f25-b144-ba6e6934d383
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZCSlhFNAIAMFmBA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6330caef-61ecbf9154cd56131b940ac0;Sampled=0
x-amzn-remapped-date: Sun, 25 Sep 2022 21:41:04 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: qP5-TglQAoTGc78-rIK27mKRTS_WthN0OpiiMqSF-y2rmWxVOyfNVw==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Tue, 27 Sep 2022 19:30:15 GMT
age: 2202
etag: "cde7845f38c4c077f1f1cfda1d1e3b00065d3ac3"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10318
Md5:    a90590f26bae9ad9e95ffdfbfb7dd21d
Sha1:   cde7845f38c4c077f1f1cfda1d1e3b00065d3ac3
Sha256: 33fe3394213e01d11c3e005cb5a678ba74511704d4132fc2bd9f7ad4e1b7dbfc