r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 81dd5c5cc5b3278876cb44dcb520a60f
c0511a59e9eccdcdda98717b87c89c5d59974808
41736c303afdb3d31e48724b107dcb22883cae02f3562308eb52d9164001a2de
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "41736C303AFDB3D31E48724B107DCB22883CAE02F3562308EB52D9164001A2DE"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17023
Expires: Sat, 28 Jan 2023 12:20:56 GMT
Date: Sat, 28 Jan 2023 07:37:13 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash a2104f935c638b4767ca5ae0d738ef23
85c6af15af749be0ceeae6de17c36925b750f166
5d4789a3696bd7faa9916768cb627bbc89bf70a756d80e53860cbac13c2bc8b1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5D4789A3696BD7FAA9916768CB627BBC89BF70A756D80E53860CBAC13C2BC8B1"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13901
Expires: Sat, 28 Jan 2023 11:28:54 GMT
Date: Sat, 28 Jan 2023 07:37:13 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Backoff, Content-Length, Alert, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 28 Jan 2023 07:35:29 GMT
content-type: application/json
age: 104
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 69f73ac59327cd9ad7d99816ccfcc03e
c54844f82dbee0d5ee4c8ce344eb0139373e6c6b
e81c685b2d8f0e31b89e5cfc911a2c5a99a556646830ac5a8468d991b5e871a3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E81C685B2D8F0E31B89E5CFC911A2C5A99A556646830AC5A8468D991B5E871A3"
Last-Modified: Thu, 26 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12255
Expires: Sat, 28 Jan 2023 11:01:28 GMT
Date: Sat, 28 Jan 2023 07:37:13 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 6aYQ61Y9Vvw5aq4lI9jh80ctdnhEXSat5t+9hXdjwJAo7xj5zpbykSLGUhzmB8nQ/T+utQaLzp0=
x-amz-request-id: GTZN8016G6EZ14G2
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 28 Jan 2023 07:20:53 GMT
age: 980
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 28 Jan 2023 07:37:13 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
59.24.233.251/
59.24.233.251200 OK 458 B IP 59.24.233.251:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 86eab012e92bdb1a720c2472acc9e9e9
5ea6d7aaaf5629298bacfbfe87049484b157244d
26dab256a48aefdde53bdd58ee3350e2310fcf5b746e3848935ac135cfc221e2
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET / HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:18 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 458
Last-Modified: Mon, 17 Apr 2017 07:15:56 GMT
Content-Type: text/html
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Last-Modified, ETag, Content-Length, Expires, Cache-Control, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 28 Jan 2023 06:49:03 GMT
age: 2891
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 16a7b6a7128312e2f985d30df18c4487
6017bff79ffb525d9c7f9f32b999b74b5dc69602
663fd12209627f08e759c2ed1c76278a5da79dae1e0b46082dd1bb44775f7a16
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "663FD12209627F08E759C2ED1C76278A5DA79DAE1E0B46082DD1BB44775F7A16"
Last-Modified: Fri, 27 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14752
Expires: Sat, 28 Jan 2023 11:43:06 GMT
Date: Sat, 28 Jan 2023 07:37:14 GMT
Connection: keep-alive
59.24.233.251/index.html?_1674891435356
59.24.233.251200 OK 10 kB URL HTTP/1.1 59.24.233.251/index.html?_1674891435356
IP 59.24.233.251:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash ab5c3ebe0fdc9aa3ab2bba1e8b9282dd
1edd7f890995b0ce7ba1e5eb4916abe9cb8c748f
d948169b9f8f1f8fee91c50936ff9ae003f8e773c72312a8f71207fd70e474a2
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /index.html?_1674891435356 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:19 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 10397
Last-Modified: Tue, 28 Feb 2017 08:15:50 GMT
Content-Type: text/html
push.services.mozilla.com/
35.163.162.54101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.163.162.54:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: +/WFr1tRlkrCx7MkwBvCKw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: wzqORww4tlLJsip4wORGJIfSHOw=
59.24.233.251/js/LAB.min.js
59.24.233.251200 OK 5.5 kB URL HTTP/1.1 59.24.233.251/js/LAB.min.js
IP 59.24.233.251:0
File type ASCII text, with very long lines (5389)
Hash e842152f94c9b774040a36d6912188d9
82bac8881a591d959d78c37edc73bffd3cd9ae74
bf1fce150ff945b16370d23bed230287f97d36a1b0a13f62abeb89c2ca3f61e7
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/LAB.min.js HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:19 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 5490
Last-Modified: Fri, 08 Apr 2016 03:50:20 GMT
Content-Type: application/javascript
59.24.233.251/css/RSUI.css
59.24.233.251200 OK 1.9 kB URL HTTP/1.1 59.24.233.251/css/RSUI.css
IP 59.24.233.251:0
File type ASCII text, with CRLF line terminators
Hash acd558fc6ff464e9f4ff13de44046566
d6c5f46863fe96c92ee524ae1e2f76a4f8f23811
b902499db582243a23c4467ed5546331f4437deab3007deec7fa267a4dbec044
Analyzer Verdict Alert quad9 Sinkholed
GET /css/RSUI.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:19 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 1929
Last-Modified: Wed, 16 Nov 2016 01:49:50 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
59.24.233.251200 OK 278 B URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 8d2799f78a6b6ce3db8217cc45b7a60c
34c439a1627a4a33d5327f879267fcd34f7bd688
f54b597dbc63181d070b07365ec4bd83b99ae7361b1247e918888948c95a5190
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-all.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:19 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 278
Last-Modified: Tue, 07 Jun 2016 05:53:36 GMT
Content-Type: text/css
59.24.233.251/css/main.css
59.24.233.251200 OK 6.5 kB URL HTTP/1.1 59.24.233.251/css/main.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 3bec80586a0da98608960ad4167ce4ee
a13484e93b943fc88f0c8d65e8fb75c86d39940a
69ffb43ae335c063dcef83f8f0cf744061cedb8d5bc0a3a9c369545f957e01b0
Analyzer Verdict Alert quad9 Sinkholed
GET /css/main.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:19 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 6515
Last-Modified: Wed, 18 Jan 2017 15:32:56 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-menu.css
59.24.233.251200 OK 2.0 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-menu.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 4b3800820d6aef7851bd3bd8e675ffc2
9ecdd4344c8221216b36e6b305977670c5302d7b
813777e6a74a386a8bf4b67ee7dae46e5144be07d17d84f8b3c6fbacf99872ac
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-menu.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 2015
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-common.css
59.24.233.251200 OK 6.8 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-common.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (581), with CRLF line terminators
Hash c2f05706c81d4712cbaece0f3e680f92
8126cdfbd2eef2450ac31574d593cdfdd0b0370e
3e505ad314021e63e14f61000510cf250f0cd84f8423123bd43bc64c07e85c5b
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-common.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 6806
Last-Modified: Thu, 13 Oct 2016 01:14:28 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-dialog.css
59.24.233.251200 OK 14 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-dialog.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (305), with CRLF line terminators
Hash 64dbb8e32cacf9ee8f6345a4daa1999b
1cbc4af919c1e64472f37621c4bd78c6a13ddfcd
21d84c284f39abce9419e6b4a0d7dc5cac3056186bd9ff637057ed6e7c4f5abb
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-dialog.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 14374
Last-Modified: Tue, 07 Jun 2016 05:53:36 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-form.css
59.24.233.251200 OK 19 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-form.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (512), with CRLF line terminators
Hash d0cf0faa08dea4e05486897890c68956
8dba9d15cbd2cf21db3fb518190b73cf6ef62ef4
cd75e612c778888531ea6a3b5fa35ee738cf221d85992f6de2467f367695a231
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-form.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 19338
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-grid.css
59.24.233.251200 OK 16 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-grid.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 2fc94e92acb9c378bcabaed91f813978
3a959862f7435b6d1b32ad3e5858717ba4e3b814
2b12768fd498b055904c021312839cc23a6919863101722168f867ece25c8f06
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-grid.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 15484
Last-Modified: Thu, 13 Oct 2016 01:14:28 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-layout.css
59.24.233.251200 OK 7.6 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-layout.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 92cad57b46713293ced75ee551d1a9d0
d18d7639883e4bbace6631cb3e0c30c2ec90350d
384d092cd74c1281b253f9616ba1d033f3ed56668a8d0c4f2d0851c0af40b28f
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-layout.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 7632
Last-Modified: Thu, 11 Aug 2016 08:45:59 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-tree.css
59.24.233.251200 OK 3.0 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-tree.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash d5233c0719a0623a11fb57adc401bfc8
a8a3a0d3ae7b8e22a6b85e0813784d2ef9865a70
d9e96b1eb0847cc615fe4118be6dd96b9761b5102676ccc2f00a231d4162d02f
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-tree.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 3021
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
59.24.233.251/ligerUI/skins/Aqua/css/ligerui-tab.css
59.24.233.251200 OK 6.2 kB URL HTTP/1.1 59.24.233.251/ligerUI/skins/Aqua/css/ligerui-tab.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 0bcb972d3599392d43d3c1ed65645465
9a526455f1952b0546be3d484194ea48f3873eb9
cdefe689cb9d036f86f3470cfc250c5923f1dfd07cb25032427026031e805136
Analyzer Verdict Alert quad9 Sinkholed
GET /ligerUI/skins/Aqua/css/ligerui-tab.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/ligerUI/skins/Aqua/css/ligerui-all.css
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:20 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 6197
Last-Modified: Fri, 12 Aug 2016 07:36:24 GMT
Content-Type: text/css
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10459
Expires: Sat, 28 Jan 2023 10:31:34 GMT
Date: Sat, 28 Jan 2023 07:37:15 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10459
Expires: Sat, 28 Jan 2023 10:31:34 GMT
Date: Sat, 28 Jan 2023 07:37:15 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10459
Expires: Sat, 28 Jan 2023 10:31:34 GMT
Date: Sat, 28 Jan 2023 07:37:15 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash f2a0c2c0f25bdd19baf87cbb3a87dcdb
bc78ca6206ee8cc1cc05ab7778df71c7e6d1182a
c57f26c0c2e439dc2f69181e1b2f6ae371bff9d299af739e0047eabc8bfb5a69
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10459
Expires: Sat, 28 Jan 2023 10:31:34 GMT
Date: Sat, 28 Jan 2023 07:37:15 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg
34.120.237.76200 OK 4.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 4205d8106659e00fff1cbe9262918b8c
ab4f6528594a1725934727dc7d834c028a79c609
31f1a28602a194bd0856495d4d81d5c72cd7ff4e5bad6bdd1a31ec3041f4a2cc
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4475
x-amzn-requestid: b7b272d6-3089-4f33-89b5-5cb388640e10
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_e6HsaIAMF5Lg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445f8-1789f7f4264270916da323db;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:45:28 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hAzO-IMqc1CFpiBAlRl8seIYL9UonyrBMATibovyFq5kEuaweY_VyA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:56:46 GMT
age: 34829
etag: "ab4f6528594a1725934727dc7d834c028a79c609"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb781854-72d1-4a71-a095-0416f886f570.jpeg
34.120.237.76200 OK 7.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb781854-72d1-4a71-a095-0416f886f570.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 131eb343c5abd61939457d69bd371348
ffb2035cf64fc83f01db5c6f26ffa264b6aac95b
8486eb9dc6325018f8721bc6f37408f260b6e652b145280f2d778d860d3ec2d5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb781854-72d1-4a71-a095-0416f886f570.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7538
x-amzn-requestid: 113924cc-a196-4dbd-91d9-68c213265afe
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e3fobF-ZoAMFjjA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c61302-6b24941a642b22cf21e47dc0;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 03:16:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2P09wOtKPDHjxxAuzcLFMQJwmGN1zNJcH9LA6IJpeaGiaPVRF4y-TA==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 22:14:23 GMT
age: 33772
etag: "ffb2035cf64fc83f01db5c6f26ffa264b6aac95b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ce0741-fcf6-4205-8b3a-016953553eaf.jpeg
34.120.237.76200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ce0741-fcf6-4205-8b3a-016953553eaf.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 195316042e7f798eeeb7993fecb3a383
4aeca24ad4702f87feaf9674ea0c1ff6d71826a3
b7e0a61060455241fce844d2c91eca500d409804361063ddb61053cbc9c7b1c1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ce0741-fcf6-4205-8b3a-016953553eaf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13376
x-amzn-requestid: 64d0092e-1f1a-4183-a4a6-805e0bf37d32
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-DvHIyoAMF6fA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443b1-6387770232ddca74531bce91;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 8cRGlncOQ6qYv7qbI1HxTz-qUYJkTVa5V2qJM1C8XM5dmyXFA8qRvA==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:48:58 GMT
age: 35297
etag: "4aeca24ad4702f87feaf9674ea0c1ff6d71826a3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa7df68b7-44d9-4227-aedc-8e03fd23edd9.jpeg
34.120.237.76200 OK 4.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa7df68b7-44d9-4227-aedc-8e03fd23edd9.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 01d78e0bafdf4cbe227afc503124bc55
e2d21a694342773ccbace4742c4b047e7ce92e1c
3e9027f35134d811a50144a9b70c6de2dc97cbade941a5364717b403bcaf3eb1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa7df68b7-44d9-4227-aedc-8e03fd23edd9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4641
x-amzn-requestid: b2e2ba60-21e7-4304-a354-2b49b8162cf2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_T5FJGoAMFwlA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445b2-4b292f801433239340edab33;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:44:18 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: irkZKPRcil7YVMxVJXNkIn18zBSt2JWyxo9ZFMfz6aZer4_lnqG8oA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:56:38 GMT
etag: "e2d21a694342773ccbace4742c4b047e7ce92e1c"
content-type: image/jpeg
age: 34837
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ed7c466-ac98-4e05-89cf-f0abf56e8d98.jpeg
34.120.237.76200 OK 5.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ed7c466-ac98-4e05-89cf-f0abf56e8d98.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c982569d070f24dba1259603091c22e3
0f93acb5bee53670cc4ef486922f7333d96a2f4e
9a5a2d8a181a763ee6f60c27b396a0e3d7b1527e5177b2aff8d511db250753ed
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1ed7c466-ac98-4e05-89cf-f0abf56e8d98.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4975
x-amzn-requestid: 633350b7-4686-40d5-8c9d-3c097f8e2d34
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-EBGuaoAMFbSw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443b3-4201212c1a0eb2a65d3f494c;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: M4VR-I89SGD0-FLzHhZ88PJJJmdWTEi0UrBnAmCBCQAdjRsssqnSzw==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:49:06 GMT
age: 35289
etag: "0f93acb5bee53670cc4ef486922f7333d96a2f4e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg
34.120.237.76200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash ea24bcba583bd8bd139559448a343e68
b9d37c2b14f890d41983a59f352e8f7caa9c94bb
e5ef5975eec964ae1684deb424f00833f2d217bdc7e6c385320ed3adeb6bc1c4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7585
x-amzn-requestid: bfb52acb-e0d7-482d-8be9-be5db1c16cac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_vkE5roAMF0Hw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d44663-2d38d314177e0ac40d4c8240;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:47:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: K9YWM9eaEc1DQ6wtEEuADnG1U-ahRBXDaiHIAm20dkWMOxPWBlJidw==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 22:46:13 GMT
age: 31862
etag: "b9d37c2b14f890d41983a59f352e8f7caa9c94bb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
59.24.233.251/js/pluginVersion.js?version=1674891437137
59.24.233.251200 OK 115 B URL HTTP/1.1 59.24.233.251/js/pluginVersion.js?version=1674891437137
IP 59.24.233.251:0
File type ASCII text, with CRLF line terminators
Hash a728527da69c9df2977fcebcb94e09cf
3f9a2140a37e0459f0646481b116cb95401bf0c3
a740f02720e2994fdba55becc04d61d8aa3fc2482e54ea42763b40a451d3e440
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/pluginVersion.js?version=1674891437137 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:21 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 115
Last-Modified: Mon, 17 Apr 2017 07:16:10 GMT
Content-Type: application/javascript
59.24.233.251/js/json.js?version=1.0.0.85
59.24.233.251200 OK 5.0 kB URL HTTP/1.1 59.24.233.251/js/json.js?version=1.0.0.85
IP 59.24.233.251:0
Hash 34f7231a0a213167e801318716261d1e
f9383563b79b1df26542b6ede395bb8d1213f904
5b7242ed8e6fe3e6afec7c014b7c66fc1bd68a7b2e0d2706ffaab7876ab8f94a
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/json.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:21 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 4955
Last-Modified: Fri, 08 Apr 2016 03:50:19 GMT
Content-Type: application/javascript
59.24.233.251/js/jquery-1.11.1.min.js
59.24.233.251200 OK 96 kB URL HTTP/1.1 59.24.233.251/js/jquery-1.11.1.min.js
IP 59.24.233.251:0
File type ASCII text, with very long lines (32086)
Hash 8101d596b2b8fa35fe3a634ea342d7c3
d6c1f41972de07b09bfa63d2e50f9ab41ec372bd
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/jquery-1.11.1.min.js HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:21 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 95786
Last-Modified: Fri, 08 Apr 2016 03:50:20 GMT
Content-Type: application/javascript
59.24.233.251/js/CProgress.js?version=1.0.0.85
59.24.233.251200 OK 2.4 kB URL HTTP/1.1 59.24.233.251/js/CProgress.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash bc9e0142e6cb186e59bf3fdf275d1aff
237347d2b2a22767dcf513ead052af80c569afa6
208246414a3fc2e2a52885ea002913749ba455038ee019be51f83865045a78da
Analyzer Verdict Alert quad9 Sinkholed
GET /js/CProgress.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 2400
Last-Modified: Fri, 08 Apr 2016 03:50:18 GMT
Content-Type: application/javascript
59.24.233.251/js/jcookie.js?version=1.0.0.85
59.24.233.251200 OK 1.8 kB URL HTTP/1.1 59.24.233.251/js/jcookie.js?version=1.0.0.85
IP 59.24.233.251:0
File type ASCII text, with CRLF line terminators
Hash 5ce74bbdfb5c027a12b22783cbc34824
66c014ee9b0c9d8dbac4c261e6ac28a5262e7a25
20e17c0c5216d9fcd9bc639e7f11a96a2743ccfebd6ca0a490f6428aba025019
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/jcookie.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 1753
Last-Modified: Wed, 06 Jul 2016 00:48:23 GMT
Content-Type: application/javascript
59.24.233.251/js/function.js?version=1.0.0.85
59.24.233.251200 OK 8.0 kB URL HTTP/1.1 59.24.233.251/js/function.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash bc2faa43c45a7622a36084260156fa45
f200ace1c239390dae39a4449d807a83fd0f6961
37691844e7e8ab530111dc9afdd05fe58cf36980344577cde1033260e0052c0f
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/function.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 8025
Last-Modified: Wed, 18 Jan 2017 09:58:58 GMT
Content-Type: application/javascript
59.24.233.251/js/common.js?version=1.0.0.85
59.24.233.251200 OK 38 kB URL HTTP/1.1 59.24.233.251/js/common.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 626bc8a7144a1f8cb65bac1fbb89e1fe
984197625838690034a3b8bb2ed4c4574f07e5b8
5e502055d06bd8ffb733057eb2acfd9416179964bd78e04325404f4479829506
Analyzer Verdict Alert quad9 Sinkholed
GET /js/common.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=999
Content-Length: 38099
Last-Modified: Tue, 28 Feb 2017 08:15:30 GMT
Content-Type: application/javascript
59.24.233.251/js/class.js?version=1.0.0.85
59.24.233.251200 OK 35 kB URL HTTP/1.1 59.24.233.251/js/class.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash 21d201ed8384516f829ae698db90cc8b
97423dfab1e6b06bcf216edce277e0cfce7b6ffb
2cdd96a49ca44d39710f8e51646f629c0917f04d132d0b7a36b7e3eaa741e167
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/class.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 34877
Last-Modified: Mon, 20 Feb 2017 09:25:50 GMT
Content-Type: application/javascript
59.24.233.251/js/RSUI.js?version=1.0.0.85
59.24.233.251200 OK 14 kB URL HTTP/1.1 59.24.233.251/js/RSUI.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 6db0cf8c8657daf9cf89d3923a4f7f2d
76e9f2ac21fb749f7555c5035e38fefc646eb218
a77c9f3937ed50541f2f5e8e2cd62293f6423bf33e5e91f225518b992c802cba
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/RSUI.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 14240
Last-Modified: Wed, 18 Jan 2017 03:48:34 GMT
Content-Type: application/javascript
59.24.233.251/js/divBox.js?version=1.0.0.85
59.24.233.251200 OK 9.9 kB URL HTTP/1.1 59.24.233.251/js/divBox.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash a4c72049873bb8dbb8fc072991f1b332
139df86161adfabb4c1bc3fa024d230da8fda13b
fb3765bbe0070ad4bbab798833f80e7b9eed17d28ecae21e32b501d579c32935
Analyzer Verdict Alert quad9 Sinkholed
GET /js/divBox.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=996
Content-Length: 9905
Last-Modified: Fri, 25 Nov 2016 13:04:49 GMT
Content-Type: application/javascript
59.24.233.251/js/jquery.qrcode.min.js?version=1.0.0.85
59.24.233.251200 OK 14 kB URL HTTP/1.1 59.24.233.251/js/jquery.qrcode.min.js?version=1.0.0.85
IP 59.24.233.251:0
File type ASCII text, with very long lines (544)
Hash 05f0b1d7d4b9b0b4975870606d650e3c
f424bd339870510d1160d1c5da5d698aedbb452e
f4ccf02b69092819ac24575c717a080c3b6c6d6161f1b8d82bf0bb523075032d
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/jquery.qrcode.min.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:23 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=998
Content-Length: 13995
Last-Modified: Fri, 08 Apr 2016 03:50:20 GMT
Content-Type: application/javascript
59.24.233.251/js/language.js?version=1.0.0.85
59.24.233.251200 OK 142 kB URL HTTP/1.1 59.24.233.251/js/language.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size 142 kB (141870 bytes)
Hash 8c7a75052e5e905c72b3815508355114
8cd4cecb35f45e037c5d2a402d870a8903f69c39
60be18762720bdec40defdc4ef6c99f34fcd5a7bcda392b28241a36b6868e94b
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/language.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:22 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=997
Content-Length: 141870
Last-Modified: Wed, 08 Mar 2017 06:08:04 GMT
Content-Type: application/javascript
59.24.233.251/favicon.ico
59.24.233.251404 Not Found 38 kB URL HTTP/1.1 59.24.233.251/favicon.ico
IP 59.24.233.251:0
File type HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators
Hash 13f973bd928ab91c4043f323860e6aee
9dfb9fee625a23ff1a91ec564b95ac041eb15ff5
8c5bc512b2e4619fd2901ccfa298f064aab9ea5b89337965abd353588f3b02c5
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 404 Not Found
Date: Sat, 28 Jan 2023 06:57:21 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=ISO-8859-1
59.24.233.251/js/jquery.base64.js?version=1.0.0.85
59.24.233.251200 OK 4.5 kB URL HTTP/1.1 59.24.233.251/js/jquery.base64.js?version=1.0.0.85
IP 59.24.233.251:0
File type Algol 68 source text\012- Pascal source, ASCII text
Hash 20b1c2c863902e5bda8bab936f3acaf9
1ae88b012c9af18c8b03222810f80d9b324102c2
d38111b8e9d0a7e37b99e00917719eeea05c49c2c0e4da7861ab337e92b61d9b
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/jquery.base64.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:23 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=996
Content-Length: 4498
Last-Modified: Tue, 19 Feb 2013 15:20:18 GMT
Content-Type: application/javascript
59.24.233.251/ligerUI/js/ligerui.min.js?version=1.0.0.85
59.24.233.251200 OK 136 kB URL HTTP/1.1 59.24.233.251/ligerUI/js/ligerui.min.js?version=1.0.0.85
IP 59.24.233.251:0
File type ISO-8859 text, with very long lines (4671), with CRLF line terminators
Size 136 kB (135881 bytes)
Hash 6ff162554a4af4bdfc987ef94e118c5d
3e42873f2466a3359f1daf3adbcb50b2a84bf527
8e10fc96a223aed4ba0e6e51c50bb8a780208423f2fd7a2a3754662e0afeeb1d
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /ligerUI/js/ligerui.min.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:23 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=996
Content-Length: 135881
Last-Modified: Mon, 04 Jul 2016 06:41:19 GMT
Content-Type: application/javascript
59.24.233.251/js/main.js?version=1.0.0.85
59.24.233.251200 OK 89 kB URL HTTP/1.1 59.24.233.251/js/main.js?version=1.0.0.85
IP 59.24.233.251:0
File type Unicode text, UTF-8 (with BOM) text, with very long lines (498), with CRLF line terminators
Hash 7228d3efa86dcc4c1f5fc2c17ad7e095
89308431a63d0076321aaf4594e6daa71a5d836e
68335e1dd2daca5ec57e704cd659306a2494e4f6a09b4b892abf4f67bdfd58bb
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /js/main.js?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:24 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=996
Content-Length: 88848
Last-Modified: Wed, 08 Mar 2017 00:50:52 GMT
Content-Type: application/javascript
59.24.233.251/html/webplugins.html?version=1.0.0.85
59.24.233.251200 OK 615 B URL HTTP/1.1 59.24.233.251/html/webplugins.html?version=1.0.0.85
IP 59.24.233.251:0
File type ASCII text, with CRLF line terminators
Hash b65347996a1cf884160560d97f156e77
5d6a6546760962562c8e781fa15f2ef3ba75fac1
919bf6db949372d06be39882bf2036613a1993998bca596c9a85953d4f594f34
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET /html/webplugins.html?version=1.0.0.85 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:25 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=995
Content-Length: 615
Last-Modified: Fri, 08 Apr 2016 03:50:15 GMT
Content-Type: text/html
59.24.233.251/css/webplugins.css
59.24.233.251200 OK 447 B URL HTTP/1.1 59.24.233.251/css/webplugins.css
IP 59.24.233.251:0
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash ddae9ef6ef799a16583037c8f8a873a5
6bce4fb79909df056ea21ddf747f9b5abbe306fd
687a96b2097d73a6b35a628745fd3658db57e7c0dac65dada6de70b5fdeb6266
Analyzer Verdict Alert quad9 Sinkholed
GET /css/webplugins.css HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:25 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=994
Content-Length: 447
Last-Modified: Fri, 04 Nov 2016 01:46:28 GMT
Content-Type: text/css
59.24.233.251/js/webplugins.js?version=1.0.0.85&_=1674891438606
59.24.233.251200 OK 625 B URL HTTP/1.1 59.24.233.251/js/webplugins.js?version=1.0.0.85&_=1674891438606
IP 59.24.233.251:0
File type ASCII text, with CRLF line terminators
Hash b9da459aeae31a64d4b7792e6e66b36e
00e317e6457d08012968eea0ddf719f600f9d8c5
e822d4ccb5948ac7d25402c3c40349100ca3f0a7813d3c8462f819c2dbddd54b
Analyzer Verdict Alert quad9 Sinkholed
GET /js/webplugins.js?version=1.0.0.85&_=1674891438606 HTTP/1.1
Host: 59.24.233.251
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://59.24.233.251/index.html?_1674891435356
HTTP/1.1 200 OK
Date: Sat, 28 Jan 2023 06:57:25 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=995
Content-Length: 625
Last-Modified: Tue, 28 Feb 2017 08:14:52 GMT
Content-Type: application/javascript