Report - ojoteyes.cf/d40b108b2a.html

Report Overview

URL

ojoteyes.cf/d40b108b2a.html
IP

195.20.48.158

ASN

#31624 Verotel International B.V.
Submitted

2023-02-23T12:22:43Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

4
Threat Detection Systems

1

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
ocsp.digicert.com (1)	86	2012-05-21T09:02:23Z	2023-03-14T08:09:39Z	341	737	93.184.220.29
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-14T05:09:38Z	606	127	52.41.18.18
ajax.googleapis.com (1)	12905	2013-08-16T11:51:31Z	2023-03-14T07:59:56Z	391	30424	142.250.74.106
register.freenom.com (1)	unknown	2014-10-06T20:18:42Z	2023-03-14T05:20:32Z	366	1206	104.155.8.167
r3.o.lencr.org (11)	344	2020-12-02T09:52:13Z	2023-03-14T05:09:04Z	3718	9750	95.101.11.115
getpocket.cdn.mozilla.net (1)	1369	2018-08-28T15:15:36Z	2023-03-14T05:09:37Z	435	47912	34.120.5.221
firefox.settings.services.mozilla.com (17)	867	2020-06-04T22:08:41Z	2023-03-13T18:13:28Z	8063	276410	35.241.9.150
domain.dot.tk (1)	166571	2012-05-22T19:00:16Z	2023-03-14T05:20:32Z	444	253	109.235.49.197
ocsp.sectigo.com (3)	487	2019-11-29T12:50:24Z	2023-03-14T03:07:50Z	1020	2892	172.64.155.188
www.freenom.com (8)	unknown	2014-05-27T04:45:17Z	2023-03-14T05:20:32Z	3592	147192	35.186.227.193
detectportal.firefox.com (2)	1601	2018-08-30T11:52:03Z	2023-03-13T05:09:11Z	606	428	34.107.221.82
ojoteyes.cf (1)	unknown	2022-06-04T09:53:31Z	2023-03-03T15:31:05Z	358	976	195.20.48.158
ocsp.pki.goog (4)	175	2018-07-01T08:43:07Z	2023-03-13T18:12:07Z	1372	2796	142.250.74.131
firefox-settings-attachments.cdn.mozilla.net (1)	11509	2019-11-30T10:32:57Z	2023-03-13T08:38:30Z	412	807704	34.111.73.144
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-14T05:09:37Z	333	391	34.117.237.239
content-signature-2.cdn.mozilla.net (3)	1152	2020-11-03T13:26:46Z	2023-03-14T05:09:37Z	1267	17607	34.160.144.191
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	56087	34.120.237.76
www.google-analytics.com (2)	40	2012-10-03T03:04:21Z	2023-03-14T08:17:33Z	1217	21135	142.250.74.46
shavar.services.mozilla.com (1)	3602	2015-09-28T08:30:01Z	2023-03-13T05:09:14Z	453	204	44.225.87.128

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-23T12:22:38Z	low	Client IP	Internal IP	ET INFO DNS Query for Suspicious .cf Domain
2023-02-23T12:22:39Z	medium	Client IP	Internal IP	ET DNS Query to a .tk domain - Likely Hostile
2023-02-23T12:22:39Z	medium	Client IP	Internal IP	ET DNS Query to a .tk domain - Likely Hostile
2023-02-23T12:22:39Z	medium	Client IP	109.235.49.197	ET POLICY HTTP Request to a *.tk domain

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-23	medium	ojoteyes.cf/d40b108b2a.html	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

HTTP Transactions (66)

URL IP Response Size

detectportal.firefox.com/success.txt?ipv4

34.107.221.82

200 OK

URL HTTP/1.1

detectportal.firefox.com/success.txt?ipv4
IP

34.107.221.82:0
ASN

#15169 GOOGLE

Magic

ASCII text

Size

8
Hash

ae780585f49b94ce1444eb7d28906123

7d5ca8c0c03e883c56c4eb1ef6f6bb9bccad4d86

81b2bd4ea98c8db66554fbc8d7637a1a69a130f331feb732b75caab4c4868fd5

HTTP Headers

                                        GET /success.txt?ipv4 HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Length: 8
Via: 1.1 google
Date: Wed, 22 Feb 2023 15:24:39 GMT
Age: 75465
Content-Type: text/plain
Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600

ojoteyes.cf/d40b108b2a.html

195.20.48.158

203

639

URL HTTP/1.1

ojoteyes.cf/d40b108b2a.html
IP

195.20.48.158:0
ASN

#31624 Verotel International B.V.

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text

Size

639
Hash

bd939001521b12ce059877b2380546cb

6355a5722eb96a145cf1246efccc75f94d5d3e97

fd832d038d5303ef5346f9ae289c873ccdda37bdaed09947eee06ad83cf2153f

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /d40b108b2a.html HTTP/1.1
Host: ojoteyes.cf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 203 
Server: nginx
Date: Thu, 23 Feb 2023 12:22:26 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 639
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-Server: ip-172-31-36-223
Set-Cookie: JSESSIONID=268526F2C964E2262D4C66C366E4F42B; Path=/; HttpOnly

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

bbe5e8dc913bdcab76f9fe8851ea2e77

9215fadd003873382ed2a4ace79ba337adadd692

e6094932dd4de52ea6360bdfbe8bb15951ebd76255766eee627c5de6f83fcea8

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E6094932DD4DE52EA6360BDFBE8BB15951EBD76255766EEE627C5DE6F83FCEA8"
Last-Modified: Wed, 22 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5260
Expires: Thu, 23 Feb 2023 13:50:04 GMT
Date: Thu, 23 Feb 2023 12:22:24 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

3bf2985444924fcb7c28583d95fe3e07

95b5b25c5e28758f16327475be944d68ba858b4d

1e1b4f9fd2e5b5c38916cea3f07edc4abe897defb9db47123d374bc979cad933

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1E1B4F9FD2E5B5C38916CEA3F07EDC4ABE897DEFB9DB47123D374BC979CAD933"
Last-Modified: Wed, 22 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20612
Expires: Thu, 23 Feb 2023 18:05:56 GMT
Date: Thu, 23 Feb 2023 12:22:24 GMT
Connection: keep-alive

getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=NO&count=30

34.120.5.221

200 OK

47225

URL HTTP/2

getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=NO&count=30
IP

34.120.5.221:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (65536), with no line terminators

Size

47225
Hash

e2716d2bd20f5b92515425f54bd33762

8029081bb313e1cbd10f2f163e5035a36abfe570

8d3c78b480e2d2f0538d1165271e698253a338b269e073fc4025439f3b7a6541

HTTP Headers

                                        GET /v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=NO&count=30 HTTP/1.1
Host: getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-location: global-recs.php
tcn: choice
x-frame-options: SAMEORIGIN
status: 200 OK
x-source: Pocket
pragma: cache
p3p: policyref="/w3c/p3p.xml", CP="ALL CURa ADMa DEVa OUR IND UNI COM NAV INT STA PRE"
x-cache: Miss from cloudfront
x-amz-cf-pop: SEA73-P2
x-amz-cf-id: di_fHjT47a3Nq1FmHzA2-JTORBOsk7aY4iNhLq_EIxvyjuAVfDtkHA==
content-encoding: gzip
via: 1.1 25b9a991f871f75614e7f92f97b136a4.cloudfront.net (CloudFront), 1.1 google
date: Thu, 23 Feb 2023 12:17:38 GMT
content-type: application/json
vary: Accept-Encoding
content-length: 47225
age: 286
cache-control: s-maxage=900,public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

d4569ebd95f766b8f22ed69d69334c37

a7fcd3f640877885077a4126708968d7e1e0d252

e485343a8251f50009506dfc6a42c82ca6b09b434d1e0984ea7c2dfea7dcd28d

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E485343A8251F50009506DFC6A42C82CA6B09B434D1E0984EA7C2DFEA7DCD28D"
Last-Modified: Wed, 22 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3295
Expires: Thu, 23 Feb 2023 13:17:20 GMT
Date: Thu, 23 Feb 2023 12:22:25 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

6eb0a77aa4a20639a06d9621742007c2

d2d03beeb111049117b70d5f3dff3698a671ef8a

62c2da0800bf8efb6bb985b2eb046fa863e0b394681fb2ab187a9c4836fbd320

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "62C2DA0800BF8EFB6BB985B2EB046FA863E0B394681FB2AB187A9C4836FBD320"
Last-Modified: Wed, 22 Feb 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15333
Expires: Thu, 23 Feb 2023 16:37:58 GMT
Date: Thu, 23 Feb 2023 12:22:25 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

67d5a988edcda47bc3b3b3f65d32b4b6

d4f0e0da8b3690cc7da925026d3414b68c7d954f

55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: HmHhQdCCHnyvqlDEBgNUqHWYpYCdUbxd/NkaeLVbEuOJGItKAH8Knw0+I7IfzRRLZBT5/k4/AdI=
x-amz-request-id: B8V455YKRQ04EEEP
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 23 Feb 2023 12:16:54 GMT
age: 331
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

bf0c602d32b3c14606f22a86183b5e3c

6eabd8d83475eba731968abe1a05a8bfd272f160

6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Content-Length, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 23 Feb 2023 11:38:20 GMT
content-type: application/json
age: 2645
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

domain.dot.tk/p/?d=OJOTEYES.CF&i=91.90.42.154&c=47&ro=0&ref=unknown&_=1677154944888

109.235.49.197

301 Moved Permanently

URL HTTP/1.0

domain.dot.tk/p/?d=OJOTEYES.CF&i=91.90.42.154&c=47&ro=0&ref=unknown&_=1677154944888
IP

109.235.49.197:0
ASN

#47869 Netrouting

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to a *.tk domain

HTTP Headers

                                        GET /p/?d=OJOTEYES.CF&i=91.90.42.154&c=47&ro=0&ref=unknown&_=1677154944888 HTTP/1.1
Host: domain.dot.tk
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ojoteyes.cf/
Upgrade-Insecure-Requests: 1

                                        HTTP/1.0 301 Moved Permanently
Date: Thu, 23 Feb 2023 12:23:54 GMT
Server: nginx/1.18.0
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 0
Location: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Connection: close

detectportal.firefox.com/success.txt?ipv4

34.107.221.82

200 OK

URL HTTP/1.1

detectportal.firefox.com/success.txt?ipv4
IP

34.107.221.82:0
ASN

#15169 GOOGLE

Magic

ASCII text

Size

8
Hash

ae780585f49b94ce1444eb7d28906123

7d5ca8c0c03e883c56c4eb1ef6f6bb9bccad4d86

81b2bd4ea98c8db66554fbc8d7637a1a69a130f331feb732b75caab4c4868fd5

HTTP Headers

                                        GET /success.txt?ipv4 HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Length: 8
Via: 1.1 google
Date: Wed, 22 Feb 2023 15:24:39 GMT
Age: 75466
Content-Type: text/plain
Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600

ocsp.sectigo.com/

172.64.155.188

200 OK

472

URL HTTP/1.1

ocsp.sectigo.com/
IP

172.64.155.188:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

472
Hash

d3ec69b570cd6a59adb2c64e28994c84

34cf1690a2d78d0b8df017b5140eb69efb8a46ab

8e2758a260df9eac0db4fa916a02d87b7a73647742b27a0e81c630dd9b288ecb

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Thu, 23 Feb 2023 12:22:25 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 22 Feb 2023 04:15:44 GMT
Expires: Wed, 01 Mar 2023 04:15:43 GMT
Etag: "34cf1690a2d78d0b8df017b5140eb69efb8a46ab"
Cache-Control: max-age=488597,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 79dfed48bd8ffac4-OSL

www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267

35.186.227.193

200 OK

2928

URL HTTP/2

www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators

Size

2928
Hash

7f2a2d857762c4124e2220d7702056e6

6cb83718fea1ccc8ed46cae7d90285de58734033

1678ca6933c124b44fe8e816ffb134a299cf551412c46732e0f9994c2de9652e

HTTP Headers

                                        GET /en/pagenotfound.html?_urlfwd=1&_=1677154267 HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ojoteyes.cf/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: text/html
content-length: 2928
x-guploader-uploadid: ADPycdsI-Sd99COFgr-JVFnmKw4c6-Rgyyf7dEc_fD7pw-sYWrI9rY9casAc1e6IWUmlW6OY-jAuFWaNbd-6lPIG3ao8Lg
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Tue, 07 Aug 2018 08:18:30 GMT
etag: "7f2a2d857762c4124e2220d7702056e6"
x-goog-generation: 1533629910554398
x-goog-metageneration: 43
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 2928
x-goog-meta-goog-reserved-file-mtime: 1533629651
content-language: en
x-goog-hash: crc32c=L9bXEQ==, md5=fyothXdixBJOIiDXcCBW5g==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.freenom.com/css/reset.css

35.186.227.193

200 OK

795

URL HTTP/2

www.freenom.com/css/reset.css
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (738), with CRLF line terminators

Size

795
Hash

182a9e59cb2d502fa68a9bb9e30e5ad8

f6a54c21086d495f2687e4a5fff3f1f59a8be8ad

ec34f5f4278bcc95f8e963777380ce5a20697dc357ae00c7f4f4c77468b5dba5

HTTP Headers

                                        GET /css/reset.css HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: text/css
content-length: 795
x-guploader-uploadid: ADPycdtfKiNmAeYzZXfzS-_UjyA5m4O5mUOU6R1N7ueRsZb4OXKxxDj_Z_I0Swx8g1jzvSOBmhOHRdXofV_16hQzt7d7sQ
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Thu, 22 Sep 2016 11:56:14 GMT
etag: "182a9e59cb2d502fa68a9bb9e30e5ad8"
x-goog-generation: 1474545374458000
x-goog-metageneration: 58
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 795
x-goog-meta-goog-reserved-file-mtime: 1474545367
content-language: en
x-goog-hash: crc32c=n0/UNQ==, md5=GCqeWcstUC+mipu54w5a2A==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.freenom.com/css/font-awesome.min.css

35.186.227.193

200 OK

26689

URL HTTP/2

www.freenom.com/css/font-awesome.min.css
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (26524), with CRLF line terminators

Size

26689
Hash

895edde9f15b1bb00acd7f3e7a6e25ee

8407f9aa4d39f3edda9f54b0e30225385d2f8b20

8ce35e7c8f6fb1f1a1cd07dbe5a7edc19d858ebfe8dbe6a04013236d5176c58a

HTTP Headers

                                        GET /css/font-awesome.min.css HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: text/css
content-length: 26689
x-guploader-uploadid: ADPycduyFe7l9-7YhVPsxC1TUro5nb5hD3BOMlwudQb_h9nzX90ivmqo1QNcLuG3LnTpv1ULQqu43DE_tI7ocvrpLhoH7A
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Thu, 24 Mar 2016 21:03:51 GMT
etag: "895edde9f15b1bb00acd7f3e7a6e25ee"
x-goog-generation: 1458853431597000
x-goog-metageneration: 68
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 26689
x-goog-meta-goog-reserved-file-mtime: 1467283521
x-goog-hash: crc32c=KEIgNw==, md5=iV7d6fFbG7AKzX8+em4l7g==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.freenom.com/js/jquery.easing.min.js

35.186.227.193

200 OK

7046

URL HTTP/2

www.freenom.com/js/jquery.easing.min.js
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

ISO-8859 text, with very long lines (3601)

Size

7046
Hash

ec64dc8377266f617caf00ebc5067a14

fb6ebf42d2da04eee38b8fabc0c09dd9e433a9e4

a7c016be6c9693535e2a8abce5814c71290f76bb8259e907dfa092f3c3633447

HTTP Headers

                                        GET /js/jquery.easing.min.js HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: application/javascript
content-length: 7046
x-guploader-uploadid: ADPycdvwGRCkIQpjgv3H5k4fK1lwOfxizGB60NVciV26n85fkaFeRiGBw2vKo9OW4y-M9oQ9fqWxfHzgIqkF4JffNPZGyw
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Thu, 24 Mar 2016 21:04:33 GMT
etag: "ec64dc8377266f617caf00ebc5067a14"
x-goog-generation: 1458853473712000
x-goog-metageneration: 76
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7046
x-goog-meta-goog-reserved-file-mtime: 1467283509
x-goog-hash: crc32c=924SHw==, md5=7GTcg3cmb2F8rwDrxQZ6FA==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.freenom.com/css/freenom.min.css

35.186.227.193

200 OK

52912

URL HTTP/2

www.freenom.com/css/freenom.min.css
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

Unicode text, UTF-8 text, with very long lines (396), with CRLF line terminators

Size

52912
Hash

12e8524e0e1cd523b89348f06dc07b09

ce46989028dd0a2759ad511229d470664cccd264

c390bac6e59b3fb9cb4b9ac6141fb422c5c31a0afcf04fc0185d22be344aa4b8

HTTP Headers

                                        GET /css/freenom.min.css HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: text/css
content-length: 52912
x-guploader-uploadid: ADPycdtcXiLwiebpobUfPJdW_lQbpqzQObRzJ0VzTBZNY1sauSdQvf8y_SdIcTKr8YFGw9knKqnL8pFeZ4HW29lQ3b5Qjw
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Thu, 22 Sep 2016 11:56:14 GMT
etag: "12e8524e0e1cd523b89348f06dc07b09"
x-goog-generation: 1474545375012000
x-goog-metageneration: 58
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 52912
x-goog-meta-goog-reserved-file-mtime: 1474545367
content-language: en
x-goog-hash: crc32c=CfVXUA==, md5=EuhSTg4c1SO4k0jwbcB7CQ==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.freenom.com/css/style-2015.css

35.186.227.193

200 OK

36772

URL HTTP/2

www.freenom.com/css/style-2015.css
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

assembler source, ASCII text, with CRLF line terminators

Size

36772
Hash

7f167f69f709956a16a4dbde38036b9b

d1a60a8bd0f3a005ad9d616cc3a2d5fb064a8eec

b96fdf74eddef1994a12a884d6aaa2a80d7f0f2111e30aa6d303681463bd8cad

HTTP Headers

                                        GET /css/style-2015.css HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: text/css
content-length: 36772
x-guploader-uploadid: ADPycdtYoBUV9JejkF-qRX7unBuW_hGGUMCzFye-JvJwFkqyWYCu9fYg5IFh4oKRxjsExg0IrBORBAfPMynQdQYyUrOIhg
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Thu, 01 Sep 2016 13:39:19 GMT
etag: "7f167f69f709956a16a4dbde38036b9b"
x-goog-generation: 1472737159446000
x-goog-metageneration: 67
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 36772
x-goog-meta-goog-reserved-file-mtime: 1472737150
content-language: en
x-goog-hash: crc32c=zyW2Rg==, md5=fxZ/afcJlWoWpNveOANrmw==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

295ecb42da084d2556789eada5291422

24c3605ff6984776ca77a2aa3b3b4bba4267f76f

f787cdc01fe5b6c0889f133cdf9cd0e38973f4cb8515014e8a14418521af04bf

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 23 Feb 2023 12:22:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.freenom.com/images.v2/logo.png

35.186.227.193

200 OK

12407

URL HTTP/2

www.freenom.com/images.v2/logo.png
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

PNG image data, 344 x 84, 8-bit/color RGBA, non-interlaced\012- data

Size

12407
Hash

0d15ea0d66606463554b67000d2bf00b

1a2982d69bf466bf506cf6e3958aeb116c5380e8

8f5f28a19f79671426814c76e3b17cbc3d1b1e6346dbdf7905b1a516d314d5ad

HTTP Headers

                                        GET /images.v2/logo.png HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: image/png
content-length: 12407
x-guploader-uploadid: ADPycdtwILpE8XsuQnEh6CbWoSdKV8VuYEwbjjit-8kUoMF4dZllDiUFxW-IRXDFLyAPzHaxXTFZxXeClDI_dplXJFQQqQ
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Thu, 24 Mar 2016 21:04:18 GMT
etag: "0d15ea0d66606463554b67000d2bf00b"
x-goog-generation: 1458853458625000
x-goog-metageneration: 68
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 12407
x-goog-meta-goog-reserved-file-mtime: 1467283538
x-goog-hash: crc32c=qci8jQ==, md5=DRXqDWZgZGNVS2cADSvwCw==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.freenom.com/js/jquery.rotating.backgrounds.js

35.186.227.193

200 OK

979

URL HTTP/2

www.freenom.com/js/jquery.rotating.backgrounds.js
IP

35.186.227.193:0
ASN

#15169 GOOGLE

Magic

ASCII text, with CRLF line terminators

Size

979
Hash

8d685417c25ae3822c63b489b79575ab

dbfd3c26dc80d96c96c0b8fd97c176cf839631e3

b057931915715d603c8d72986402da1ff6e77c669b46326400cc32de8a6f1a28

HTTP Headers

                                        GET /js/jquery.rotating.backgrounds.js HTTP/1.1
Host: www.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/en/pagenotfound.html?_urlfwd=1&_=1677154267
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx/1.17.8
date: Thu, 23 Feb 2023 12:22:25 GMT
content-type: application/javascript
content-length: 979
x-guploader-uploadid: ADPycdt53VAs1IEr6VftwhEfwfX7HWSOAIw4KiSMvnKwdzelHAeqKSJMRL602qoxlolZSa4eKoeWJKQVp7jjsYvQWtfGkA
cache-control: private, max-age=0, no-transform
expires: Thu, 23 Feb 2023 12:22:25 GMT
last-modified: Thu, 22 Sep 2016 11:56:18 GMT
etag: "8d685417c25ae3822c63b489b79575ab"
x-goog-generation: 1474545378683000
x-goog-metageneration: 66
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 979
x-goog-meta-goog-reserved-file-mtime: 1474545366
content-language: en
x-goog-hash: crc32c=r2XZGA==, md5=jWhUF8Ja44IsY7SJt5V1qw==
x-goog-storage-class: STANDARD
accept-ranges: bytes
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js

142.250.74.106

200 OK

29440

URL HTTP/2

ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js
IP

142.250.74.106:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (32023)

Size

29440
Hash

8b4eef92298453e0536f38127ed3dd35

e778ceb9964d0035f688bb1d8c3c30b36e90e261

2f6d9e04250c84e0541a29cb66bc978dc128edc99e187d4a2642fc64fb1050e4

HTTP Headers

                                        GET /ajax/libs/jquery/2.0.3/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 29440
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 17 Feb 2023 07:16:47 GMT
expires: Sat, 17 Feb 2024 07:16:47 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 536738
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.sectigo.com/

172.64.155.188

200 OK

472

URL HTTP/1.1

ocsp.sectigo.com/
IP

172.64.155.188:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

472
Hash

dda238280312d37ec9d7e95cef0098ae

ed9259a47868c8088566ff4f3250bb99b5f54b7d

76180bec86efa177c1fba555e793a7a963bb68f4af46b1f8e0fa8369d8fb5bcb

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Thu, 23 Feb 2023 12:22:25 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Thu, 23 Feb 2023 00:00:56 GMT
Expires: Thu, 02 Mar 2023 00:00:55 GMT
Etag: "ed9259a47868c8088566ff4f3250bb99b5f54b7d"
Cache-Control: max-age=559709,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 79dfed4a99d00b51-OSL

ocsp.sectigo.com/

172.64.155.188

200 OK

472

URL HTTP/1.1

ocsp.sectigo.com/
IP

172.64.155.188:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

472
Hash

d3ec69b570cd6a59adb2c64e28994c84

34cf1690a2d78d0b8df017b5140eb69efb8a46ab

8e2758a260df9eac0db4fa916a02d87b7a73647742b27a0e81c630dd9b288ecb

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Thu, 23 Feb 2023 12:22:25 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 22 Feb 2023 04:15:44 GMT
Expires: Wed, 01 Mar 2023 04:15:43 GMT
Etag: "34cf1690a2d78d0b8df017b5140eb69efb8a46ab"
Cache-Control: max-age=488597,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 79dfed49be44fac4-OSL

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

a8530fcefb585de4930c998e366124cc

290ef080fe5bddca89a1a92e505268f9c38a308c

e2369003249fb3ebcc2f3ced2f2cd685376be22d7201cdc52b73751834c5c7fc

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 23 Feb 2023 12:22:25 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

104.155.8.167

200 OK

948

URL HTTP/1.1

register.freenom.com/js/login.js
IP

104.155.8.167:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (948), with no line terminators

Size

948
Hash

98236fa777091f2ca39919f59bc0b637

e212fc0877d911b499d1937d2d4e4c47898d1884

1de89c9d7f8cfadcf197686751cbe5ee65c4d75762447f9999b1b003a45e8b6d

HTTP Headers

                                        GET /js/login.js HTTP/1.1
Host: register.freenom.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site

                                        HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 23 Feb 2023 12:22:25 GMT
Content-Type: application/x-javascript
Content-Length: 948
Connection: keep-alive
Last-Modified: Tue, 02 Sep 2014 09:21:44 GMT
ETag: "bd5029-3b4-54058c28"
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

56cd85a02d031d2f7b794f1f2cfda4eb

878162e77393da15f0a1c8bf8a83a777a6caf317

15bc2ef238d6cf940adc4a29a31bd3fa0ee1712529d89c1a2fd74fb32d5ffe5e

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 23 Feb 2023 12:22:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

5aa46280b9f4ef8602f5e1b6864d898f

f1b8d2278116c2873ec0683122818fc186c74392

bb61e1178bc48dc26984f63f54d2621706fe49faa6f9a5651b06befa53cea9a0

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1837
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 23 Feb 2023 12:22:26 GMT
Last-Modified: Thu, 23 Feb 2023 11:51:49 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Content-Type, Alert, Content-Length, Backoff, ETag, Cache-Control, Retry-After, Last-Modified, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 23 Feb 2023 11:51:26 GMT
age: 1860
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

www.google-analytics.com/analytics.js

142.250.74.46

200 OK

20085

URL HTTP/2

www.google-analytics.com/analytics.js
IP

142.250.74.46:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (1490)

Size

20085
Hash

ca7fbbfd120e3e329633044190bbf134

d17f81e03dd827554ddd207ea081fb46b3415445

847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db

HTTP Headers

                                        GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.freenom.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20085
date: Thu, 23 Feb 2023 11:45:20 GMT
expires: Thu, 23 Feb 2023 13:45:20 GMT
cache-control: public, max-age=7200
age: 2226
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
content-type: text/javascript
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

5fa728a339ca32e616d483e61d0aebcd

6a63966de94d16390c8f1e47e5b67fe5bb67f7cd

7e83729d554404e59f1f1ff809ac776d3596487e2b062a1e38af8e29f33c0686

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7E83729D554404E59F1F1FF809AC776D3596487E2B062A1E38AF8E29F33C0686"
Last-Modified: Wed, 22 Feb 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16165
Expires: Thu, 23 Feb 2023 16:51:51 GMT
Date: Thu, 23 Feb 2023 12:22:26 GMT
Connection: keep-alive

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

67d0353e59411ba1f85c492efa548d94

2bb48dd2638abb14217de43ca03d2485a31eb7e7

c50c81dc979238b0bfea29f69cc5b4e6277e06c407025412430c190acf1e8d29

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 23 Feb 2023 12:22:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google-analytics.com/j/collect?v=1&_v=j99&a=1221169006&t=pageview&_s=1&dl=https%3A%2F%2Fwww.freenom.com%2Fen%2Fpagenotfound.html%3F_urlfwd%3D1%26_%3D1677154267&dr=http%3A%2F%2Fojoteyes.cf%2F&ul=en-us&de=UTF-8&dt=Page%20not%20found&sd=24-bit&sr=1280x1024&vp=1280x939&je=0&_u=IEBAAEABAAAAACAAI~&jid=677111528&gjid=125689953&cid=1169423044.1677154960&tid=UA-13022573-13&_gid=465210166.1677154960&_r=1&_slc=1&z=1364377098

142.250.74.46

200 OK

URL HTTP/2

www.google-analytics.com/j/collect?v=1&_v=j99&a=1221169006&t=pageview&_s=1&dl=https%3A%2F%2Fwww.freenom.com%2Fen%2Fpagenotfound.html%3F_urlfwd%3D1%26_%3D1677154267&dr=http%3A%2F%2Fojoteyes.cf%2F&ul=en-us&de=UTF-8&dt=Page%20not%20found&sd=24-bit&sr=1280x1024&vp=1280x939&je=0&_u=IEBAAEABAAAAACAAI~&jid=677111528&gjid=125689953&cid=1169423044.1677154960&tid=UA-13022573-13&_gid=465210166.1677154960&_r=1&_slc=1&z=1364377098
IP

142.250.74.46:0
ASN

#15169 GOOGLE

Magic

ASCII text, with no line terminators

Size

3
Hash

dec002daa3f9abe33f5ab1a61ba58e91

b286614a767c86a75059fb1d4557be706e7c3812

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

HTTP Headers

                                        POST /j/collect?v=1&_v=j99&a=1221169006&t=pageview&_s=1&dl=https%3A%2F%2Fwww.freenom.com%2Fen%2Fpagenotfound.html%3F_urlfwd%3D1%26_%3D1677154267&dr=http%3A%2F%2Fojoteyes.cf%2F&ul=en-us&de=UTF-8&dt=Page%20not%20found&sd=24-bit&sr=1280x1024&vp=1280x939&je=0&_u=IEBAAEABAAAAACAAI~&jid=677111528&gjid=125689953&cid=1169423044.1677154960&tid=UA-13022573-13&_gid=465210166.1677154960&_r=1&_slc=1&z=1364377098 HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://www.freenom.com
Connection: keep-alive
Referer: https://www.freenom.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-origin: https://www.freenom.com
date: Thu, 23 Feb 2023 12:22:26 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

shavar.services.mozilla.com/downloads?client=Firefox&appver=96.0a&pver=2.2

44.225.87.128

200 OK

URL HTTP/1.1

shavar.services.mozilla.com/downloads?client=Firefox&appver=96.0a&pver=2.2
IP

44.225.87.128:0
ASN

#16509 AMAZON-02

Magic

ASCII text

Size

8
Hash

29fc57841962e407cb50c1be60284bf7

ce968a77e2996da5eee8925182318f171ccdce47

ae7e7075247dcfad763f1e131aeac3d2e756bb03d48b0d315a50c69636e5dc8b

HTTP Headers

                                        POST /downloads?client=Firefox&appver=96.0a&pver=2.2 HTTP/1.1
Host: shavar.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 773
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/octet-stream
Date: Thu, 23 Feb 2023 12:22:26 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 8
Connection: Close

push.services.mozilla.com/

52.41.18.18

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

52.41.18.18:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: G8Dlndr5oedNB8WOmGgD8Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: psks+QgkOhBmDzmmDMnz5P9qAoo=

firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=%221677142635636%22

35.241.9.150

200 OK

21681

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=%221677142635636%22
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (21681), with no line terminators

Size

21681
Hash

cc2664125b7a46f42e1daa525660ffd4

f4760f712e4c26fbcaef070d507904b9abebfef5

fd1e50a712b8e06f2e6f111d055fe179b334f30cf1bce0ba19c51b0055c62e1c

HTTP Headers

                                        GET /v1/buckets/monitor/collections/changes/changeset?_expected=%221677142635636%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Content-Length, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 21681
via: 1.1 google
date: Thu, 23 Feb 2023 12:02:15 GMT
age: 1211
last-modified: Thu, 23 Feb 2023 08:57:15 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/addons-bloomfilters/changeset?_expected=1677069440866&_since=%221666204638208%22

35.241.9.150

200 OK

32643

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/addons-bloomfilters/changeset?_expected=1677069440866&_since=%221666204638208%22
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (32643), with no line terminators

Size

32643
Hash

111a124bfe0fcca1d00eacc4056304c0

09f7b2abd4d09de09db0e11add552e995346c23c

3dfc4c61e3f4a5d95c359d2914ec2dcf4bfc413116dec9b98bc104ecc9f446bf

HTTP Headers

                                        GET /v1/buckets/blocklists/collections/addons-bloomfilters/changeset?_expected=1677069440866&_since=%221666204638208%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Backoff, Content-Type, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 32643
via: 1.1 google
date: Thu, 23 Feb 2023 12:15:26 GMT
age: 420
last-modified: Wed, 22 Feb 2023 12:37:20 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

b5ba6334e73496995e3e3a9ecd0eb323

ad80d3b7718c28364e8c2004fb38a13a1747e462

aa5abb52515c6383c014aadb63a86c9f798ad64de53c0218616c1fc6d424d2e2

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-04-09-20-28-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
x-amz-id-2: 7KQOvvRPQ/+QrZblhK/Ye5uR17fwDl0Un/4Vg2mVBvIAeX5UOARsOblk8pnb7CfD3AOpjp4hgmc=
x-amz-request-id: 9CJCFKSJJHPMDB6Z
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 23 Feb 2023 11:49:14 GMT
age: 1992
last-modified: Sat, 18 Feb 2023 20:28:27 GMT
etag: "b5ba6334e73496995e3e3a9ecd0eb323"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

bf0c602d32b3c14606f22a86183b5e3c

6eabd8d83475eba731968abe1a05a8bfd272f160

6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Content-Length, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 23 Feb 2023 11:38:20 GMT
content-type: application/json
age: 2646
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

299cfd09608d974f3058fb736224367b

1307c521c6c3854bd0156ba0c8fa8480b3d9b1e5

3fdc46e8fa678463b9446f87190e53740be3e274fcd75e213e9681f845830708

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3FDC46E8FA678463B9446F87190E53740BE3E274FCD75E213E9681F845830708"
Last-Modified: Wed, 22 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15136
Expires: Thu, 23 Feb 2023 16:34:42 GMT
Date: Thu, 23 Feb 2023 12:22:26 GMT
Connection: keep-alive

firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/8038652a-6557-460a-858c-84f19a5a0987.bin

34.111.73.144

200 OK

807180

URL HTTP/2

firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/8038652a-6557-460a-858c-84f19a5a0987.bin
IP

34.111.73.144:0
ASN

#15169 GOOGLE

Magic

data

Size

807180
Hash

914be443bdfbe8a1c3ded61e1c114bd6

4fe7c5ff83f6a29e6699f4cebc17550891504661

41b036d0c889509d547296b238027a063c313261ad52d5f7bb81922011791857

HTTP Headers

                                        GET /staging/addons-bloomfilters/8038652a-6557-460a-858c-84f19a5a0987.bin HTTP/1.1
Host: firefox-settings-attachments.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: W0BOTyhr4twUvOZ5PXzJJypgQYWSdxyiNIVbzii2sCr6bqxjFhob0vSInGW+A8Nz6kahQNDtgAM=
x-amz-request-id: 5VNAE12H3Z1T7YB6
x-amz-version-id: K1ODzappZsD35qeu0OM5zvs_BP1eybj7
accept-ranges: bytes
server: AmazonS3
content-length: 807180
via: 1.1 google
date: Thu, 23 Feb 2023 11:49:07 GMT
age: 1999
last-modified: Tue, 10 Jan 2023 12:38:46 GMT
etag: "914be443bdfbe8a1c3ded61e1c114bd6"
content-type: application/octet-stream
cache-control: public,max-age=604800
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/gfx/changeset?_expected=1676781773899&_since=%221643818378440%22

35.241.9.150

200 OK

5951

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/gfx/changeset?_expected=1676781773899&_since=%221643818378440%22
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (5951), with no line terminators

Size

5951
Hash

84c45909a46631dec23c78a3a547ca95

b511f80ad0abe7a6f0ce8988a0b9275573665c9a

ce6af1c28962645f13129411c11c7f156f0cd9e282f5ef0146d5cbd84a4e2b7e

HTTP Headers

                                        GET /v1/buckets/blocklists/collections/gfx/changeset?_expected=1676781773899&_since=%221643818378440%22 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Content-Length, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 5951
via: 1.1 google
date: Thu, 23 Feb 2023 11:49:28 GMT
age: 1979
last-modified: Sun, 19 Feb 2023 04:42:53 GMT
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/hijack-blocklists?_expected=1605801189258

35.241.9.150

200 OK

681

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/hijack-blocklists?_expected=1605801189258
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (681), with no line terminators

Size

681
Hash

b3c57c4bb39f0c7541d93ba82a5cd4c9

be92fd1cee01b4a8bb4174b0b11e53be649cd1a3

98e848e13f44cb1595f2f1882c734fd25761a0e8facae4e0c3dcff6f322a4000

HTTP Headers

                                        GET /v1/buckets/main/collections/hijack-blocklists?_expected=1605801189258 HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Content-Type, Alert, Content-Length, Backoff, ETag, Cache-Control, Retry-After, Last-Modified, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 681
via: 1.1 google
date: Thu, 23 Feb 2023 11:36:44 GMT
age: 2743
last-modified: Wed, 22 Feb 2023 16:36:55 GMT
etag: "1677083815772"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/query-stripping/changeset?_expected=1667238122278&_since=%221656585893704%22

35.241.9.150

200 OK

1718

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/query-stripping/changeset?_expected=1667238122278&_since=%221656585893704%22
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (1718), with no line terminators

Size

1718
Hash

3cbf51bbaf8bb528a034989257447d86

8dd38651205ecdbf2c5093b3df5de8bd626c9d92

59a47ed5c562bad2d78d22af00951c1fdf4a6eb2066324e966dbe4525e64ec3f

HTTP Headers

```
   
```

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

#1 JS:Script (size: 7048)

#2 JS:Script (size: 83606)

#3 JS:Script (size: 948)

#4 JS:Script (size: 392)

#5 JS:Script (size: 979)

#6 JS:Script (size: 50234)

#7 JS:Script (size: 233)

HTTP Transactions (66)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size