urlquery - report: 110dcdown.0098118.com/apk/cc298a81436c19c203471ab3f10de005/2301/13/3337237.apk

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	Sent bytes	Received bytes	IP
110dcdown.0098118.com (1)	0	2023-01-21T20:17:12Z	2023-03-26T07:18:33Z	409	41316523	120.52.95.247
r3.o.lencr.org (9)	344	2020-12-02T09:52:13Z	2023-03-26T05:09:13Z	3042	7976	23.36.77.32
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-26T05:09:18Z	782	2374	35.241.9.150
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-26T05:11:12Z	413	5881	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-26T05:11:59Z	333	391	34.117.237.239
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-26T05:10:29Z	606	127	52.10.3.114
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-26T05:09:08Z	3246	52027	34.120.237.76

Scan Date	Severity	Indicator	Comment
2023-03-23	medium	110dcdown.0098118.com/apk/cc298a81436c19c203471ab3f10de005/2301/13/3337237.apk	Malware

Date	UQ / IDS / BL	URL	IP
2023-04-28 07:57:29 UTC	0 - 1 - 0	xas9.yosiwp.cn/download/%E6%98%93%E4%BC%81%E7 (...)	120.52.95.246
2023-04-27 09:09:51 UTC	0 - 1 - 1	640k.dxykaf.cn/download/%E4%BD%BF%E5%91%BD%E5 (...)	120.52.95.246
2023-04-27 03:38:16 UTC	0 - 0 - 1	110dcdown.0098118.com/apk/11ab7d7a545c88d7b3f (...)	120.52.95.246
2023-04-27 03:34:55 UTC	0 - 0 - 1	110dcdown.0098118.com/apk/b09207f5c299c42708e (...)	120.52.95.246
2023-04-26 03:01:34 UTC	0 - 0 - 1	110dcdown.0098118.com/apk/cc298a81436c19c2034 (...)	120.52.95.246

Date	UQ / IDS / BL	URL	IP
2023-06-08 01:45:50 UTC	0 - 2 - 0	res.ldmnq.com/ldy/1810/ldinst_ld_1064.exe?t=1 (...)	120.52.95.247
2023-06-07 06:29:45 UTC	0 - 3 - 0	hwupdate.bwhj.cn/bwupdate/zhkp/zhfpqd/qdqh/ZH (...)	120.52.95.247
2023-06-05 11:46:27 UTC	0 - 1 - 0	downloadnew.qfhyyx.com/hdw/HDW_4.0.286.exe	120.52.95.248
2023-06-05 10:01:52 UTC	0 - 3 - 0	hwupdate.bwhj.cn/bwupdate/zhkp/zhfpsk/skqh/ZH (...)	120.52.95.249
2023-06-04 04:30:46 UTC	0 - 3 - 0	cdn1.mydown.yesky.com/55ab56f6/39e731c6fae3a7 (...)	120.52.95.249

Date	UQ / IDS / BL	URL	IP
2023-05-28 03:50:00 UTC	0 - 0 - 1	516pangame.0098118.com/txs6/Ruined.King.ALrFl (...)	118.180.40.35
2023-05-28 00:26:20 UTC	0 - 0 - 1	516ttl7.0098118.com/yg/kdygxgq.zip	113.219.239.58
2023-05-27 02:56:45 UTC	0 - 0 - 1	516acj5.0098118.com/pc6_soure/2020-4-2/bec1c3 (...)	113.219.239.49
2023-05-25 01:26:59 UTC	0 - 0 - 1	5163dx.0098118.com/xy3/hygxckq.zip	113.219.239.58
2023-05-22 02:11:54 UTC	0 - 0 - 1	516ttl7.0098118.com/wgd/dwjlmh.zip	113.219.239.58

Date	UQ / IDS / BL	URL	IP
2023-04-04 20:53:03 UTC	0 - 1 - 0	install.avcdn.net/avg/iavs9x/avg_internet_sec (...)	23.38.201.24
2023-04-04 14:04:53 UTC	0 - 0 - 1	files.cnblogs.com/files/testware/automatedqa. (...)	47.110.20.149
2023-04-04 01:15:48 UTC	0 - 1 - 0	static-res.playit2019.com/playit/pc/exe/playi (...)	104.18.12.35
2023-04-04 00:14:33 UTC	0 - 1 - 0	findhow.org/wp-content/themes/trestoo/parsed_ (...)	94.247.135.94
2023-04-04 00:08:48 UTC	0 - 2 - 0	cndl.synology.cn/download/Utility/iSCSIVssPlu (...)	116.129.226.24

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "59553A312D3FB34F1F0AEA469F7E7CC810FF9993481DDBD73EA5D461CF97ED51" Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12317 Expires: Thu, 23 Mar 2023 07:35:48 GMT Date: Thu, 23 Mar 2023 04:10:31 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 210a2a42cfc4f4aced144f5de9babcc6 Sha1: ece6ecfb2db8d036c3bfc7f02f8ea387e3f965db Sha256: 59553a312d3fb34f1f0aea469f7e7cc810ff9993481ddbd73ea5d461cf97ed51
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "469B97BF9F57401B3C9571039483589F2815F4794212B75C7C85CFEFE0AE71E9" Last-Modified: Wed, 22 Mar 2023 14:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2656 Expires: Thu, 23 Mar 2023 04:54:47 GMT Date: Thu, 23 Mar 2023 04:10:31 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: bea3185dd820a31c1981317f37c3456d Sha1: 1a548a5d27270fc11df9011837a7149571cedd78 Sha256: 469b97bf9f57401b3c9571039483589f2815f4794212b75c7c85cfefe0ae71e9
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Content-Length, Content-Type, Alert, Retry-After, Backoff content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Thu, 23 Mar 2023 03:27:30 GMT age: 2581 cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: 84db75194692d4afe13196bda6f22da8 Sha1: 4c1f49bc973a4917f146d93c8d598344edc021f6 Sha256: a3bec66f95b3bdf1d310c726e8ed05f7b06c1901c62381a94582d581844d2c23
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "8794223D5E8D4D276C35E2FDCC24BF99694240634DD749CD9B5BF874DEC055CF" Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15162 Expires: Thu, 23 Mar 2023 08:23:13 GMT Date: Thu, 23 Mar 2023 04:10:31 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 51a5d4696a6090c295850554508b51ce Sha1: c44e143c2223546e64b19f543b8101aaf3b11e97 Sha256: 8794223d5e8d4d276c35e2fdcc24bf99694240634dd749cd9b5bf874dec055cf
GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: wJFUEDZS4EduDQJ/ie+xrUOUZVWZ99uHI5tQF2XaHZl/DEAuwV8eUa6cSpRl/78XVFraUnnFzT0= x-amz-request-id: WJ1GTPJQXSYRVMRD x-amz-server-side-encryption: AES256 content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Thu, 23 Mar 2023 03:59:47 GMT age: 644 last-modified: Sat, 11 Mar 2023 16:53:15 GMT etag: "e7bace7c1e04d44012e37ddffe36e5d5" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: e7bace7c1e04d44012e37ddffe36e5d5 Sha1: 3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2 Sha256: 6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Thu, 23 Mar 2023 04:10:31 GMT content-length: 12 access-control-allow-credentials: true access-control-expose-headers: content-type vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	35.241.9.150 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Content-Length, ETag, Content-Type, Cache-Control, Pragma, Alert, Last-Modified, Retry-After, Backoff, Expires content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Thu, 23 Mar 2023 03:17:23 GMT age: 3188 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" cache-control: max-age=3600,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "7001D3EF847C7002AC15155F0DFCC0A369F19860E85C8E90530F1E7B2DD88F09" Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3269 Expires: Thu, 23 Mar 2023 05:05:01 GMT Date: Thu, 23 Mar 2023 04:10:32 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 18b877ebbad1529e4bd91e12220d91c4 Sha1: a3d64fb3d9cc1fe3a29b261c4ec9acfe134dfedc Sha256: 7001d3ef847c7002ac15155f0dfcc0a369f19860e85c8e90530f1e7b2dd88f09
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: XXHB5wH0ysJPrPd9LPA+Dw== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	52.10.3.114 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: hb7apmQMRB+rBGC0uORJHGGaV/I= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA" Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6386 Expires: Thu, 23 Mar 2023 05:56:59 GMT Date: Thu, 23 Mar 2023 04:10:33 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: a0d3d7099bbc5fed74a6e78e1a3096bf Sha1: 96afaf8b3ac053577c56aca5f4a20d8655ecb771 Sha256: c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA" Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6386 Expires: Thu, 23 Mar 2023 05:56:59 GMT Date: Thu, 23 Mar 2023 04:10:33 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: a0d3d7099bbc5fed74a6e78e1a3096bf Sha1: 96afaf8b3ac053577c56aca5f4a20d8655ecb771 Sha256: c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA" Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6386 Expires: Thu, 23 Mar 2023 05:56:59 GMT Date: Thu, 23 Mar 2023 04:10:33 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: a0d3d7099bbc5fed74a6e78e1a3096bf Sha1: 96afaf8b3ac053577c56aca5f4a20d8655ecb771 Sha256: c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA" Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6386 Expires: Thu, 23 Mar 2023 05:56:59 GMT Date: Thu, 23 Mar 2023 04:10:33 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: a0d3d7099bbc5fed74a6e78e1a3096bf Sha1: 96afaf8b3ac053577c56aca5f4a20d8655ecb771 Sha256: c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA" Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6386 Expires: Thu, 23 Mar 2023 05:56:59 GMT Date: Thu, 23 Mar 2023 04:10:33 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: a0d3d7099bbc5fed74a6e78e1a3096bf Sha1: 96afaf8b3ac053577c56aca5f4a20d8655ecb771 Sha256: c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F93c300c4-e707-428c-9ae5-d4699c20a7ef.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5950 x-amzn-requestid: ce85112e-428d-4ca1-9dac-1d6c8c6dc74a x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: CKyF9EI3oAMFtyQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-641a96f2-05c5948d6f74948b1c67d68c;Sampled=0 x-amzn-remapped-date: Wed, 22 Mar 2023 05:49:38 GMT x-amz-cf-pop: HIO52-P1, SEA19-C1 x-cache: Hit from cloudfront x-amz-cf-id: lnMR6Lh4T37cFhMwb1qXIxjoPBghVFOGUz7HTt65DegMaxlElZxfjQ== via: 1.1 59456abf79b201034ab5c9cfef7355e2.cloudfront.net (CloudFront), 1.1 599f04a365a179d553682d476509c388.cloudfront.net (CloudFront), 1.1 google date: Wed, 22 Mar 2023 21:43:32 GMT age: 56796 etag: "0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5950 Md5: 800c2662fd6ab8829a02b7d63084c38d Sha1: 0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239 Sha256: 76545e9f75dc558fdb7b54550934c7775318fb4150a9309f60e65d982d2e576e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffed036ca-a43b-426f-a0f3-fb8f2e221171.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 6430 x-amzn-requestid: abbe5dc0-5218-46ef-b264-30aa5d0a87b3 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: BzanbGRCIAMF96g= x-content-type-options: nosniff x-amzn-trace-id: Root=1-64113e2f-3c198b4a31aaa8f263ec8db5;Sampled=0 x-amzn-remapped-date: Wed, 15 Mar 2023 03:40:31 GMT x-amz-cf-pop: SEA19-C3 x-cache: Hit from cloudfront x-amz-cf-id: WxDQn6RNw2UUL4QLlZA13MahPDBJokKWw298G97UFmp_HT5DfYrJ8Q== via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 bb763d35677c62f9f5d9728bba884662.cloudfront.net (CloudFront), 1.1 google date: Wed, 22 Mar 2023 11:36:44 GMT age: 59629 etag: "4860b7e75775fe187a9253a4d38222e36552f529" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 6430 Md5: 27bd1bd539c3711ff340f243098cab93 Sha1: 4860b7e75775fe187a9253a4d38222e36552f529 Sha256: 34278c150d0686e999228226d0d92e3e7ed1116978ab94fd21b3047c44a69972
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00ac1765-db6c-42e3-99bf-d857d27a34b9.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5556 x-amzn-requestid: dd5a8417-ddd5-469d-aa84-e880f4b84464 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: CHqKFGRsoAMFTGQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6419570d-3f28a7502b56eda47dd82ba7;Sampled=0 x-amzn-remapped-date: Tue, 21 Mar 2023 07:04:45 GMT x-amz-cf-pop: HIO52-P1, SEA19-C3 x-cache: Miss from cloudfront x-amz-cf-id: FQwexS3AfCYYOg7T9MYj2AbSoYTII1t-c-aX4SzlwEsj0LgBWv5Now== via: 1.1 ee6ea1e4552345de209d26f9ffb35d4a.cloudfront.net (CloudFront), 1.1 8cb7de37a1655236518810d0aabb8656.cloudfront.net (CloudFront), 1.1 google date: Wed, 22 Mar 2023 06:23:16 GMT age: 78437 etag: "0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5556 Md5: c831201ad81f55c63c1b101ce854a810 Sha1: 0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5 Sha256: c854489720d2ca4a95eef00addda0fcdaf481402d044df7725282654a97eb54a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fae396653-384e-48e4-9824-4bf9d53f211b.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 10959 x-amzn-requestid: bd05c562-c0e1-4e24-979e-a6d491a3b146 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: CGRq0HOBIAMF_pQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6418c978-0fc58a245c33de28765f2778;Sampled=0 x-amzn-remapped-date: Mon, 20 Mar 2023 21:00:40 GMT x-amz-cf-pop: HIO50-C1, SEA19-C3 x-cache: Miss from cloudfront x-amz-cf-id: dlFpac3yPwCDpgx2UdrOeNK5H1b3Rrn5Ri05py3WY-Z0-wsPBneBMg== via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 f958a3846d80a3925f664b320dfad9c8.cloudfront.net (CloudFront), 1.1 google date: Wed, 22 Mar 2023 13:45:26 GMT etag: "55bd99cc5490b60e7a653ffa5f2a8c288ef66e87" age: 51907 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 10959 Md5: 90be67fd11de3a169f4de942f6418f3f Sha1: 55bd99cc5490b60e7a653ffa5f2a8c288ef66e87 Sha256: b07e34257bbaa41c941650a839adad82d4999d92ee62402dbec969d9464c89b0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fea5d4e17-e42c-49fb-a54b-d7d97ad50ba4.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 7083 x-amzn-requestid: 352ae6e5-476d-430b-adf0-84d4a739967b x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: B6fGcE1foAMFbRQ= x-content-type-options: nosniff x-amzn-trace-id: Root=1-64141228-7dc6c3cb72cd40965006ab76;Sampled=0 x-amzn-remapped-date: Fri, 17 Mar 2023 07:09:28 GMT x-amz-cf-pop: SEA19-C3 x-cache: Hit from cloudfront x-amz-cf-id: bgeeN4oUpN5wPo6UnQKqKTGDiuLWu-ioS9UtrO5a6m5SI7WyiRNLcA== via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 6bdc2963c9ed59b475ec36c35e5932a4.cloudfront.net (CloudFront), 1.1 google date: Wed, 22 Mar 2023 10:04:25 GMT age: 65168 etag: "76213c7d5c759471ed3823888860f918ac7e8f13" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 7083 Md5: 40d24dfcd9f0afe0e4077384f16cc494 Sha1: 76213c7d5c759471ed3823888860f918ac7e8f13 Sha256: fbbbef0498ddf14bc9b204273a3cd416c357dceed20339c3e8c64a16b0be3caf
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F340c6dd8-fc2f-45fc-9318-44a28c249325.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9687 x-amzn-requestid: b7c8cd8c-6103-4aa4-9016-f02cf368908d x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: CM8JGHyEoAMFzJw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-641b73d3-2fb1fd1b5be3289047f8aed4;Sampled=0 x-amzn-remapped-date: Wed, 22 Mar 2023 21:32:03 GMT x-amz-cf-pop: HIO52-P1, SEA19-C1 x-cache: Miss from cloudfront x-amz-cf-id: LJr_FUB0Pp-5jqhn6kXCUxPYlRZCXlZtzEx8aYqeKhkl8Hhx5Ef9ZQ== via: 1.1 773bf3616e85ce2b187fa78710a6beb2.cloudfront.net (CloudFront), 1.1 4c48e9fb20d53d40e9fe273dbdae1098.cloudfront.net (CloudFront), 1.1 google date: Wed, 22 Mar 2023 21:43:22 GMT etag: "d81a4852f956999fa28a5f667ed73506843d0731" age: 23231 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9687 Md5: 6de676f6856031e5c1baebe9166a8269 Sha1: d81a4852f956999fa28a5f667ed73506843d0731 Sha256: 71f282ba594e454a2abf1c3700ade4d9461d6d48ac2726f746f3da5a63e29c38
GET /apk/cc298a81436c19c203471ab3f10de005/2301/13/3337237.apk HTTP/1.1 Host: 110dcdown.0098118.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	120.52.95.247 HTTP/1.1 200 OK Content-Type: application/octet-stream Date: Thu, 23 Mar 2023 04:10:31 GMT Content-Length: 41315864 Connection: keep-alive Server: openresty Last-Modified: Thu, 12 Jan 2023 20:01:07 GMT ETag: "63c06703-2766e18" Timing-Allow-Origin: * Ohc-Global-Saved-Time: Sun, 19 Feb 2023 15:43:37 GMT Ohc-Cache-HIT: jnctcache58 [1], qdix96 [3] Ohc-File-Size: 41315864 via: CHN-HElangfang-AREACUCC1-CACHE5[3],CHN-HElangfang-AREACUCC1-CACHE56[0,TCP_HIT,0],CHN-TJ-GLOBAL1-CACHE54[72],CHN-TJ-GLOBAL1-CACHE79[60,TCP_MISS,70] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 31536000 nginx-hit: 1 Age: 1493060 X-CCDN-Expires: 31535964 Accept-Ranges: bytes --- Additional Info --- Magic: Zip archive data, at least v0.0 to extract, compression method=store\012- data Size: 41315864 Md5: 9d9958b89c4dc5a7725ba302c9b3f289 Sha1: 417dc74ae1c8ed5ea0c02c66f7413d1e7fb5aecc Sha256: 9eaaf746e0a31e9d5b104f831e96986614eaa966f617411516a2f824b983cf29 Blocklists: - fortinet: Malware

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.77.32

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "59553A312D3FB34F1F0AEA469F7E7CC810FF9993481DDBD73EA5D461CF97ED51" 

                                            
                                                
Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=12317 

                                            
                                                
Expires: Thu, 23 Mar 2023 07:35:48 GMT 

                                            
                                                
Date: Thu, 23 Mar 2023 04:10:31 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    210a2a42cfc4f4aced144f5de9babcc6

                                                Sha1:   ece6ecfb2db8d036c3bfc7f02f8ea387e3f965db

                                                Sha256: 59553a312d3fb34f1f0aea469f7e7cc810ff9993481ddbd73ea5d461cf97ed51

                                        
                                            GET /v1/ HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: application/json

                                            

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
access-control-expose-headers: Content-Length, Content-Type, Alert, Retry-After, Backoff 

                                            
                                                
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                            
                                                
strict-transport-security: max-age=31536000 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
content-length: 939 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Thu, 23 Mar 2023 03:27:30 GMT 

                                            
                                                
age: 2581 

                                            
                                                
cache-control: max-age=3600,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators

                                                Size:   939

                                                Md5:    84db75194692d4afe13196bda6f22da8

                                                Sha1:   4c1f49bc973a4917f146d93c8d598344edc021f6

                                                Sha256: a3bec66f95b3bdf1d310c726e8ed05f7b06c1901c62381a94582d581844d2c23

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1 

                                        
                                            
Host: content-signature-2.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: binary/octet-stream

                                            

                                            
                                                
x-amz-id-2: wJFUEDZS4EduDQJ/ie+xrUOUZVWZ99uHI5tQF2XaHZl/DEAuwV8eUa6cSpRl/78XVFraUnnFzT0= 

                                            
                                                
x-amz-request-id: WJ1GTPJQXSYRVMRD 

                                            
                                                
x-amz-server-side-encryption: AES256 

                                            
                                                
content-disposition: attachment 

                                            
                                                
accept-ranges: bytes 

                                            
                                                
server: AmazonS3 

                                            
                                                
content-length: 5348 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Thu, 23 Mar 2023 03:59:47 GMT 

                                            
                                                
age: 644 

                                            
                                                
last-modified: Sat, 11 Mar 2023 16:53:15 GMT 

                                            
                                                
etag: "e7bace7c1e04d44012e37ddffe36e5d5" 

                                            
                                                
cache-control: public,max-age=3600 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  PEM certificate\012- , ASCII text

                                                Size:   5348

                                                Md5:    e7bace7c1e04d44012e37ddffe36e5d5

                                                Sha1:   3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2

                                                Sha256: 6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 

                                        
                                            
Host: firefox.settings.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: application/json 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/json 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: application/json

                                            

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
access-control-expose-headers: Content-Length, ETag, Content-Type, Cache-Control, Pragma, Alert, Last-Modified, Retry-After, Backoff, Expires 

                                            
                                                
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; 

                                            
                                                
strict-transport-security: max-age=31536000 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
content-length: 329 

                                            
                                                
via: 1.1 google 

                                            
                                                
date: Thu, 23 Mar 2023 03:17:23 GMT 

                                            
                                                
age: 3188 

                                            
                                                
last-modified: Fri, 25 Mar 2022 17:45:46 GMT 

                                            
                                                
etag: "1648230346554" 

                                            
                                                
cache-control: max-age=3600,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators

                                                Size:   329

                                                Md5:    0333b0655111aa68de771adfcc4db243

                                                Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb

                                                Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

                                        
                                            GET / HTTP/1.1 

                                        
                                            
Host: push.services.mozilla.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Sec-WebSocket-Version: 13 

                                        
                                            
Origin: wss://push.services.mozilla.com/ 

                                        
                                            
Sec-WebSocket-Protocol: push-notification 

                                        
                                            
Sec-WebSocket-Extensions: permessage-deflate 

                                        
                                            
Sec-WebSocket-Key: XXHB5wH0ysJPrPd9LPA+Dw== 

                                        
                                            
Connection: keep-alive, Upgrade 

                                        
                                            
Sec-Fetch-Dest: websocket 

                                        
                                            
Sec-Fetch-Mode: websocket 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
Upgrade: websocket

                                        
                                             52.10.3.114

                                            
                                                HTTP/1.1 101 Switching Protocols

                                            

                                            
                                                
Connection: Upgrade 

                                            
                                                
Upgrade: websocket 

                                            
                                                
Sec-WebSocket-Accept: hb7apmQMRB+rBGC0uORJHGGaV/I= 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.77.32

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA" 

                                            
                                                
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=6386 

                                            
                                                
Expires: Thu, 23 Mar 2023 05:56:59 GMT 

                                            
                                                
Date: Thu, 23 Mar 2023 04:10:33 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    a0d3d7099bbc5fed74a6e78e1a3096bf

                                                Sha1:   96afaf8b3ac053577c56aca5f4a20d8655ecb771

                                                Sha256: c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                        
                                             23.36.77.32

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/ocsp-response

                                            

                                            
                                                
Server: nginx 

                                            
                                                
Content-Length: 503 

                                            
                                                
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA" 

                                            
                                                
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC 

                                            
                                                
Cache-Control: public, no-transform, must-revalidate, max-age=6386 

                                            
                                                
Expires: Thu, 23 Mar 2023 05:56:59 GMT 

                                            
                                                
Date: Thu, 23 Mar 2023 04:10:33 GMT 

                                            
                                                
Connection: keep-alive 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  data

                                                Size:   503

                                                Md5:    a0d3d7099bbc5fed74a6e78e1a3096bf

                                                Sha1:   96afaf8b3ac053577c56aca5f4a20d8655ecb771

                                                Sha256: c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F93c300c4-e707-428c-9ae5-d4699c20a7ef.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 5950 

                                            
                                                
x-amzn-requestid: ce85112e-428d-4ca1-9dac-1d6c8c6dc74a 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: CKyF9EI3oAMFtyQ= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-641a96f2-05c5948d6f74948b1c67d68c;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Wed, 22 Mar 2023 05:49:38 GMT 

                                            
                                                
x-amz-cf-pop: HIO52-P1, SEA19-C1 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: lnMR6Lh4T37cFhMwb1qXIxjoPBghVFOGUz7HTt65DegMaxlElZxfjQ== 

                                            
                                                
via: 1.1 59456abf79b201034ab5c9cfef7355e2.cloudfront.net (CloudFront), 1.1 599f04a365a179d553682d476509c388.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Wed, 22 Mar 2023 21:43:32 GMT 

                                            
                                                
age: 56796 

                                            
                                                
etag: "0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   5950

                                                Md5:    800c2662fd6ab8829a02b7d63084c38d

                                                Sha1:   0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239

                                                Sha256: 76545e9f75dc558fdb7b54550934c7775318fb4150a9309f60e65d982d2e576e

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F00ac1765-db6c-42e3-99bf-d857d27a34b9.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 5556 

                                            
                                                
x-amzn-requestid: dd5a8417-ddd5-469d-aa84-e880f4b84464 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: CHqKFGRsoAMFTGQ= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-6419570d-3f28a7502b56eda47dd82ba7;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Tue, 21 Mar 2023 07:04:45 GMT 

                                            
                                                
x-amz-cf-pop: HIO52-P1, SEA19-C3 

                                            
                                                
x-cache: Miss from cloudfront 

                                            
                                                
x-amz-cf-id: FQwexS3AfCYYOg7T9MYj2AbSoYTII1t-c-aX4SzlwEsj0LgBWv5Now== 

                                            
                                                
via: 1.1 ee6ea1e4552345de209d26f9ffb35d4a.cloudfront.net (CloudFront), 1.1 8cb7de37a1655236518810d0aabb8656.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Wed, 22 Mar 2023 06:23:16 GMT 

                                            
                                                
age: 78437 

                                            
                                                
etag: "0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   5556

                                                Md5:    c831201ad81f55c63c1b101ce854a810

                                                Sha1:   0e9b952f6489f0a5f4862d3bea2fbe0ecdd379e5

                                                Sha256: c854489720d2ca4a95eef00addda0fcdaf481402d044df7725282654a97eb54a

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fea5d4e17-e42c-49fb-a54b-d7d97ad50ba4.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76

                                            
                                                HTTP/2 200 OK 

                                            
                                                
content-type: image/jpeg

                                            

                                            
                                                
server: nginx 

                                            
                                                
content-length: 7083 

                                            
                                                
x-amzn-requestid: 352ae6e5-476d-430b-adf0-84d4a739967b 

                                            
                                                
x-xss-protection: 1; mode=block 

                                            
                                                
access-control-allow-origin: * 

                                            
                                                
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                            
                                                
x-frame-options: DENY 

                                            
                                                
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                            
                                                
x-amz-apigw-id: B6fGcE1foAMFbRQ= 

                                            
                                                
x-content-type-options: nosniff 

                                            
                                                
x-amzn-trace-id: Root=1-64141228-7dc6c3cb72cd40965006ab76;Sampled=0 

                                            
                                                
x-amzn-remapped-date: Fri, 17 Mar 2023 07:09:28 GMT 

                                            
                                                
x-amz-cf-pop: SEA19-C3 

                                            
                                                
x-cache: Hit from cloudfront 

                                            
                                                
x-amz-cf-id: bgeeN4oUpN5wPo6UnQKqKTGDiuLWu-ioS9UtrO5a6m5SI7WyiRNLcA== 

                                            
                                                
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 6bdc2963c9ed59b475ec36c35e5932a4.cloudfront.net (CloudFront), 1.1 google 

                                            
                                                
date: Wed, 22 Mar 2023 10:04:25 GMT 

                                            
                                                
age: 65168 

                                            
                                                
etag: "76213c7d5c759471ed3823888860f918ac7e8f13" 

                                            
                                                
cache-control: max-age=3600,public,public 

                                            
                                                
alt-svc: clear 

                                            
                                                
X-Firefox-Spdy: h2 

                                            
                                                
 

                                            
                                            
                                                

                                                --- Additional Info ---

                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   7083

                                                Md5:    40d24dfcd9f0afe0e4077384f16cc494

                                                Sha1:   76213c7d5c759471ed3823888860f918ac7e8f13

                                                Sha256: fbbbef0498ddf14bc9b204273a3cd416c357dceed20339c3e8c64a16b0be3caf

URL	110dcdown.0098118.com/apk/cc298a81436c19c203471ab3f10de005/2301/13/3337237.apk
IP	120.52.95.246 (China)
ASN	#133119 China Unicom IP network
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access	public
Report completed	2023-03-23 04:10:44 UTC
Status	Loading report..
IDS alerts	0
Blocklist alert	1
urlquery alerts	No alerts detected
Tags	None

Overview

Domain Summary (7)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 120.52.95.246

Last 5 reports on ASN: China Unicom IP network

Last 5 reports on domain: 0098118.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (21)

Overview

Domain Summary (7)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

Files

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 120.52.95.246

Last 5 reports on ASN: China Unicom IP network

Last 5 reports on domain: 0098118.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (21)

Network Intrusion Detection Systems