go.lnkpth.com/aff_c?offer_id=10000&aff_id=70711&url_id=0&aff_sub5=tiktok&click_id=16ilceo2fsvj/rd.html?go=queitho.com/client?camp=s9&aff_id=2&aff_sub=70711&source=70711&aff_sub2=tiktok&click_id=31_70711_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_f061284a4aa438445f4519c5f8304ecd/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_f061284a4aa438445f4519c5f8304ecd/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425
302 Found 394 B URL User Request GET HTTP/1.1 go.lnkpth.com/aff_c?offer_id=10000&aff_id=70711&url_id=0&aff_sub5=tiktok&click_id=16ilceo2fsvj/rd.html?go=queitho.com/client?camp=s9&aff_id=2&aff_sub=70711&source=70711&aff_sub2=tiktok&click_id=31_70711_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_f061284a4aa438445f4519c5f8304ecd/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_f061284a4aa438445f4519c5f8304ecd/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425
IP
Certificate IssuerLet's Encrypt
Subjecttrack.cpamatica.com
Fingerprint55:95:28:6A:EC:1D:DC:9B:AA:33:46:53:FF:B5:17:A0:D5:5F:2F:B4
ValidityTue, 23 Apr 2024 12:38:03 GMT - Mon, 22 Jul 2024 12:38:02 GMT
File type HTML document, ASCII text, with very long lines (394), with no line terminators
Hash 56a1309b7070af1253857de22f58a9bd
dc666be3d3f482beb4f591a70b301be6b374b06a
86af0d07a50bd4f3b42d6737c2bad6988605227b63cb9e6e8a5ae34becf3c809
GET /aff_c?offer_id=10000&aff_id=70711&url_id=0&aff_sub5=tiktok&click_id=16ilceo2fsvj/rd.html?go=queitho.com/client?camp=s9&aff_id=2&aff_sub=70711&source=70711&aff_sub2=tiktok&click_id=31_70711_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_3b9c78f68584271e3839c4aaa9793059/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_f061284a4aa438445f4519c5f8304ecd/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_f061284a4aa438445f4519c5f8304ecd/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425/rd.html?go=https://queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=31_2_10000_e9bb910de4d2fbd7a28cff606d05c425 HTTP/1.1
Host: go.lnkpth.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 10 May 2024 21:45:17 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 394
Connection: keep-alive
Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: no-referrer
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 0
Set-Cookie: language=en; Domain=go.lnkpth.com; Path=/; Expires=Sun, 09 Jun 2024 21:45:17 GMT
test=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
10000=32_2_10000_6cd026425b0498b3e5002630e0bbc098; Domain=go.lnkpth.com; Path=/; Expires=Sun, 09 Jun 2024 21:45:17 GMT; Secure; SameSite=None
op_10000=0; Domain=go.lnkpth.com; Path=/; Expires=Sun, 09 Jun 2024 21:45:17 GMT
user_id=adc186af-78a7-480c-a221-46f9e3581aeb_0a485ca22ae208653e1a5e326ef857e1; Domain=go.lnkpth.com; Path=/; Expires=Wed, 09 May 2029 21:45:17 GMT; Secure; SameSite=None
Location: /rd.html?go=https%3A%2F%2Fqueitho.com%2Fclient%3Fcamp%3Ds9%26aff_id%3D2%26aff_sub%3D2%26source%3D2%26aff_sub2%3Dtiktok%26click_id%3D32_2_10000_6cd026425b0498b3e5002630e0bbc098
Vary: Accept
Cache-Control: no-store, no-cache
go.lnkpth.com/rd.html?go=https%3A%2F%2Fqueitho.com%2Fclient%3Fcamp%3Ds9%26aff_id%3D2%26aff_sub%3D2%26source%3D2%26aff_sub2%3Dtiktok%26click_id%3D32_2_10000_6cd026425b0498b3e5002630e0bbc098
200 OK 255 B URL User Request GET HTTP/1.1 go.lnkpth.com/rd.html?go=https%3A%2F%2Fqueitho.com%2Fclient%3Fcamp%3Ds9%26aff_id%3D2%26aff_sub%3D2%26source%3D2%26aff_sub2%3Dtiktok%26click_id%3D32_2_10000_6cd026425b0498b3e5002630e0bbc098
IP
Certificate IssuerLet's Encrypt
Subjecttrack.cpamatica.com
Fingerprint55:95:28:6A:EC:1D:DC:9B:AA:33:46:53:FF:B5:17:A0:D5:5F:2F:B4
ValidityTue, 23 Apr 2024 12:38:03 GMT - Mon, 22 Jul 2024 12:38:02 GMT
File type HTML document, ASCII text
Hash d032811d8a01caff2a5ce141a657ca0e
7cfb5ac640b5496f18939ee73dc89cccf77125cc
e2efe220662dd9a54582aa6ab3f6d9fcaf0341710d0b01aa051fc09258ff9e6e
GET /rd.html?go=https%3A%2F%2Fqueitho.com%2Fclient%3Fcamp%3Ds9%26aff_id%3D2%26aff_sub%3D2%26source%3D2%26aff_sub2%3Dtiktok%26click_id%3D32_2_10000_6cd026425b0498b3e5002630e0bbc098 HTTP/1.1
Host: go.lnkpth.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: language=en; 10000=32_2_10000_6cd026425b0498b3e5002630e0bbc098; op_10000=0; user_id=adc186af-78a7-480c-a221-46f9e3581aeb_0a485ca22ae208653e1a5e326ef857e1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 10 May 2024 21:45:17 GMT
Content-Type: text/html
Last-Modified: Fri, 13 Aug 2021 14:56:49 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"61168831-149"
Cache-Control: no-store, no-cache
Content-Encoding: gzip
oacenom.com/ckset
117 B IP
Hash 523b71ff008b83c5fff9364b8cdb6eea
086d8ad2eef468375e87e7d166fe715c8a075450
bc989c615bd2b8c49b058eb308a3f5376946d1b9423824dd82ebea48a0d19035
POST /ckset HTTP/1.1
Host: oacenom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://queitho.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
HTTP/2 201 Created
date: Fri, 10 May 2024 21:45:18 GMT
content-type: application/json; charset=utf-8
content-length: 117
content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
set-cookie: mastidencook=bf571b2c-ec9c-4c73-a4e9-6d8d251d9bac_2d4fbf0c15cef77bc63f1f66a9cfef4e; Domain=oacenom.com; Path=/; Expires=Wed, 09 May 2029 21:45:18 GMT; Secure; SameSite=None
etag: W/"75-CG2K0u70aDdeh+fRZv5xXIoHVFA"
access-control-allow-origin: https://queitho.com
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4uJ8ZC4CcSlNeu%2FckqHm1C0%2BbrNrrFneMghdHoEFwdKCIgwzKW4DHxR%2FxChDKAOsJcm%2FafnocMd1M4BUT7UvdsnafrtP8vhgWaJMM64B3VmX6OVCVLfayZtR32qS1A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881d1d93093b0b65-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
queitho.com/visit?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=s9&p_camp=&bstep=&sid=&efcn=custom-unknown&cntp=custom-unknown&sch=&scw=&vph=&vpw=<=
789 B URL queitho.com/visit?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=s9&p_camp=&bstep=&sid=&efcn=custom-unknown&cntp=custom-unknown&sch=&scw=&vph=&vpw=<=
IP
Hash 8a6f943d743e36dfafc725acd7c437fc
eea064e1dac3d63ac715b5af7120f190b62b157e
8ac8daaadac36bf5613a922dde503cfeb2c2af41cbd320001555609c42600f2a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /visit?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=s9&p_camp=&bstep=&sid=&efcn=custom-unknown&cntp=custom-unknown&sch=&scw=&vph=&vpw=<= HTTP/1.1
Host: queitho.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 392
Origin: https://queitho.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 201 Created
date: Fri, 10 May 2024 21:45:18 GMT
content-type: application/json; charset=utf-8
content-length: 789
content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
set-cookie: browserLanguage=en; Domain=queitho.com; Path=/; Expires=Sun, 09 Jun 2024 21:45:18 GMT
userId=998d72e0-70b6-4f4c-995d-145ec7e74147_96f807b6bfb32498b94c5d2a8e05f912; Domain=queitho.com; Path=/; Expires=Wed, 09 May 2029 21:45:18 GMT; Secure; SameSite=None
cache-control: no-store, no-store, no-cache
etag: W/"315-7qBk4drD1jrHFbWvcSDxkLYrFX4"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W609R3O4Ehh9esikEGsmjbfOLCJjWd1jxcwSih6cstqWrl82TBDUCuqZJPpJtaTCkjRZUfWcrbvhxm9qnL21QdfAwemNWpJmflkGcpEtDBs3c4N4Ojj50a%2BDZKN%2Fiw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881d1d937f4756af-OSL
alt-svc: h3=":443"; ma=86400
queitho.com/fl?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=f14&sl_cid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6_34641551ef0cf548d95b846e64461430&p_camp=&bstep=&sid=s9&efcn=custom-unknown&cntp=custom-unknown&sch=1024&scw=1280&vph=1024&vpw=1280&ref=https%3A%2F%2Fgo.lnkpth.com%2F<=
1.3 kB URL queitho.com/fl?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=f14&sl_cid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6_34641551ef0cf548d95b846e64461430&p_camp=&bstep=&sid=s9&efcn=custom-unknown&cntp=custom-unknown&sch=1024&scw=1280&vph=1024&vpw=1280&ref=https%3A%2F%2Fgo.lnkpth.com%2F<=
IP
Hash 40c78d752f93bdcf7ec1ab4ad902fc56
3eb3232d23964cf6ecac104b2c83a30cf0486f04
6a32255b5c590e59f681a84c808e3bc9f0c2f134203b004ed861e6cdacaff6da
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /fl?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=f14&sl_cid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6_34641551ef0cf548d95b846e64461430&p_camp=&bstep=&sid=s9&efcn=custom-unknown&cntp=custom-unknown&sch=1024&scw=1280&vph=1024&vpw=1280&ref=https%3A%2F%2Fgo.lnkpth.com%2F<= HTTP/1.1
Host: queitho.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 398
Origin: https://queitho.com
DNT: 1
Connection: keep-alive
Cookie: browserLanguage=en; userId=998d72e0-70b6-4f4c-995d-145ec7e74147_96f807b6bfb32498b94c5d2a8e05f912
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 201 Created
date: Fri, 10 May 2024 21:45:18 GMT
content-type: application/json; charset=utf-8
content-length: 1274
content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
set-cookie: browserLanguage=en; Domain=queitho.com; Path=/; Expires=Sun, 09 Jun 2024 21:45:18 GMT
cache-control: no-store, no-store, no-cache
etag: W/"4fa-PrMjLSOWTPbsrBBLLIOjDPBIbwQ"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KfdVb8neBoYkvWL7IMQjc%2BO0HyxAWNjC%2Bh%2FkufElQdu5pK74R2llRaLTs%2BkaAmPEVo8kICaMtLqLwYWio%2FRKrUQ2EkIXnLj%2Fr2E6y4N8d0D5yFXmVVVhjQk2RVzBdg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881d1d93dfae56af-OSL
alt-svc: h3=":443"; ma=86400
queitho.com/ofp?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=f14&sl_cid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6_34641551ef0cf548d95b846e64461430&p_camp=&bstep=0&sid=s9&ofp_id=111&efcn=custom-unknown&cntp=custom-unknown&sch=1024&scw=1280&vph=1024&vpw=1280&ref=https%3A%2F%2Fgo.lnkpth.com%2F<=0
223 B URL queitho.com/ofp?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=f14&sl_cid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6_34641551ef0cf548d95b846e64461430&p_camp=&bstep=0&sid=s9&ofp_id=111&efcn=custom-unknown&cntp=custom-unknown&sch=1024&scw=1280&vph=1024&vpw=1280&ref=https%3A%2F%2Fgo.lnkpth.com%2F<=0
IP
Hash 634b0e322b8349f098efcaefeba65b8c
e7fefbcdc7cc12ac4b32bdbb45985f3029ad7360
448f323261019a799191fd71eeeccb92e9063d4415c5560d5313e6209eb6072f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /ofp?aff_id=2&aff_sub=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098&source=2&ttype=direct&camp=f14&sl_cid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6_34641551ef0cf548d95b846e64461430&p_camp=&bstep=0&sid=s9&ofp_id=111&efcn=custom-unknown&cntp=custom-unknown&sch=1024&scw=1280&vph=1024&vpw=1280&ref=https%3A%2F%2Fgo.lnkpth.com%2F<=0 HTTP/1.1
Host: queitho.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 405
Origin: https://queitho.com
DNT: 1
Connection: keep-alive
Cookie: browserLanguage=en; userId=998d72e0-70b6-4f4c-995d-145ec7e74147_96f807b6bfb32498b94c5d2a8e05f912
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 201 Created
date: Fri, 10 May 2024 21:45:18 GMT
content-type: application/json; charset=utf-8
content-length: 223
content-security-policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
set-cookie: browserLanguage=en; Domain=queitho.com; Path=/; Expires=Sun, 09 Jun 2024 21:45:18 GMT
cache-control: no-store, no-store, no-cache
etag: W/"df-5/77zcfMEqxLMr27RZhfMCmtc2A"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FtuKpGx%2Bes0OQSrZw%2BQp0FMRMhvydkPmFo0sQ%2FW6E25uQlms77hqnDIitmysE0iIChzm4d%2BkALkj5h4JOMPswQT1mf4lXD66Gri46TADlNiyfSpAHbCUm1fzhv32Kg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881d1d94885a56af-OSL
alt-svc: h3=":443"; ma=86400
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash 915cf4bba700f0e34e638a793cc07417
8344e62c7ed9aa222f4ff7e8725dafd1ea37a28c
a4d3ce63eaabbc4c5e29fbb974697afcb8ac582515ca788260c5fde5869a134a
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 10 May 2024 21:45:18 GMT
Last-Modified: Fri, 10 May 2024 20:37:28 GMT
Server: ECAcc (ska/F7A5)
X-Cache: Miss from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: HBdH-iuueEgNt3delV0uA4X0k3su0vh1pkJCRkdAiTdpipHBxo46ww==
Age: 4070
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash c2c5d1ecf386e2c193ae721fb30ecd85
7d58b6b826a23336343b4cdb7b1fb3883e822439
cae5d7336cfbe8f8faf1a59808e90bc2eab6ca32839a26d506a7470a62bb3b57
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 10 May 2024 21:45:19 GMT
Last-Modified: Fri, 10 May 2024 20:51:52 GMT
Server: ECAcc (ska/F6E1)
X-Cache: Miss from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: qaDAU11tf_tDgJA9ZNtZZuEvdxsRvIVm11WZOXp2O3Altmn3TDHVUQ==
Age: 3208
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash 915cf4bba700f0e34e638a793cc07417
8344e62c7ed9aa222f4ff7e8725dafd1ea37a28c
a4d3ce63eaabbc4c5e29fbb974697afcb8ac582515ca788260c5fde5869a134a
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 10 May 2024 21:45:19 GMT
Last-Modified: Fri, 10 May 2024 20:37:28 GMT
Server: ECAcc (ska/F7A5)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: -1fslRmM-1l0hS2gSjNDzXWLbZYBAkuskzilFc6wFGjpRsuNIdDjLg==
Age: 4071
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash c2c5d1ecf386e2c193ae721fb30ecd85
7d58b6b826a23336343b4cdb7b1fb3883e822439
cae5d7336cfbe8f8faf1a59808e90bc2eab6ca32839a26d506a7470a62bb3b57
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 10 May 2024 21:45:19 GMT
Last-Modified: Fri, 10 May 2024 21:44:41 GMT
Server: ECAcc (ska/F6D2)
X-Cache: Miss from cloudfront
Via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 8AITbWyvAHggeLdiCdkmZWAYB_X-dstXkORqMlhfVN2SjpLzlswMmQ==
Age: 39
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash 915cf4bba700f0e34e638a793cc07417
8344e62c7ed9aa222f4ff7e8725dafd1ea37a28c
a4d3ce63eaabbc4c5e29fbb974697afcb8ac582515ca788260c5fde5869a134a
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 10 May 2024 21:45:19 GMT
Last-Modified: Fri, 10 May 2024 21:44:59 GMT
Server: ECAcc (ska/F77E)
X-Cache: Miss from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: WQxBTxE_fI--6peTrZKXRd24lwNuySUEvGCvCvRMxSLWVZ16Iw9OJw==
Age: 20
cdn-dimi.akamaized.net/landings/285828/1704989181/css/popup.css?1704989181
200 OK 589 B URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/css/popup.css?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type assembler source, ASCII text
Hash fb984c4fc6f9603c755e271685dcf17b
c51ce8be5fc93f8079f1c58edb9bd9f71ed3b564
abc470a646b5352f0a0372edf3f2ce2c62d64148682ff73c98799daabded1e96
GET /landings/285828/1704989181/css/popup.css?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: u276NTe/sCmuRfsuN/gguGn/xUgiZrd6zRB5UzFWDK1gtA3bfmrp0vykPOBlaIIVY+b35E63jK4=
x-amz-request-id: 885XRHEERTKHHPHZ
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "fb984c4fc6f9603c755e271685dcf17b"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/css
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 589
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
200 OK 2.7 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
Hash e6d646e8547e3961d2ebf527b18bbf13
7302490aa895cb313625cad1ca902f270d35246e
4e8f270058992bd6af75e4242d0bd3778478f48fbe0a9d8d7ea3d0fcd9490e5f
GET /landings/285828/1704989181/css/style.css?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: HlwgEM/5Q7GXORFqe7NoSkHzr19kCE+OXRKT2CqjyaTKp1X1m+UcavUTqajAG9Xv2YWusANHcrM=
x-amz-request-id: H8K29JFTWDMZ5G9D
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "e6d646e8547e3961d2ebf527b18bbf13"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/css
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 2702
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/css/timer.css?1704989181
200 OK 667 B URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/css/timer.css?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
Hash 5eaf241d81e3c64a39eba770ed834bb3
743084a68436d58ad9c602dcf22947aa713867c7
7d4adb96762d6e54b20618631f9d8a215d89af5d4e411227a71a2ec907a5c17d
GET /landings/285828/1704989181/css/timer.css?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 8d9zT0Y20/x2bJ85vxMFXD0i5U5r0jnZ3hUVlHyGqAlo1WkbkU4kchbsIiqbcIHekOQAEel0RiE=
x-amz-request-id: 65F072RHVWM0XBXT
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "5eaf241d81e3c64a39eba770ed834bb3"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/css
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 667
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/css/reviews.css?1704989181
200 OK 1.0 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/css/reviews.css?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
Hash ab7655b7e0870e539ab60ed308b94176
6d2528a94402def11fcfab529ad51b98e8b6ec88
2e9c81b9fd7c0be920940728b172ecaf0e0652e147f345caa8ef36bf6ade8180
GET /landings/285828/1704989181/css/reviews.css?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 1EEptWOROEaGG5mO7Xd0pCVIx0s3pAnYMWBLbB7/UpyGfdG/4Rz96gqvh6vGsJNrUp+zJCVicEc=
x-amz-request-id: EYADXEX0N0MD5DZD
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "ab7655b7e0870e539ab60ed308b94176"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/css
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 1029
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/js/title_tanslate.js?1704989181
200 OK 1.3 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/js/title_tanslate.js?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 5f373fa5bf21c44b9ad23b70ef96e73d
068ef5b63ab18924a286f2c0c3ec46545e08c678
7f40bc2c95ee280de5320ae7d33f2e57eeeb0cda5b5820f2c456a0c9ba50ed77
GET /landings/285828/1704989181/js/title_tanslate.js?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: XPMu2/CkNG7d3Qsp9XjAlNjL0eO6DHbZnZh4rF3cZuYbUngu9TsYTtkh4Jgc+tfTh9eVK36AmaU=
x-amz-request-id: 65F0JYBF9RH7ZMBR
Last-Modified: Fri, 12 Jan 2024 08:41:19 GMT
ETag: "5f373fa5bf21c44b9ad23b70ef96e73d"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 1298
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/js/translates-review.js?1704989181
200 OK 14 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/js/translates-review.js?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
Hash 9061bd0c6ff627d3a43a9e6c125350a7
ddd7b182a17fed4e7f13250599fe9fe3eb63b907
2898923c357cf44fb75bfeb3236d1e237d16bc112466176f0be582d156ee9b04
GET /landings/285828/1704989181/js/translates-review.js?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: G3Int/dytdYQZrhomaYn42X7EB5m8daORezFcc/NLQ6eWWsvZSWnTkfl+ijEzGyjAKKj5MDrWAs=
x-amz-request-id: 65F9RYW11AZNSRFP
Last-Modified: Fri, 12 Jan 2024 08:41:19 GMT
ETag: "9061bd0c6ff627d3a43a9e6c125350a7"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 14059
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/js/timer.js?1704989181
200 OK 906 B URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/js/timer.js?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 text
Hash a5e8bb74efe1c2b6fa13d0ef8d71c926
80855d0f0976667f260d513f90168e0e08736553
d1c19e3721d62556d0f5f65b160121ade1b0b07eaeb8e85d644a5ecb024fdebe
GET /landings/285828/1704989181/js/timer.js?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: Baf2d3adVaccgohxkfRC6UKIZZzvv+3bojfGkg5NC7hBdxJjOj1WkkoHWKUPXG6hCEykS0yT2V8=
x-amz-request-id: 885MEJ5JV929J54V
Last-Modified: Fri, 12 Jan 2024 08:41:19 GMT
ETag: "a5e8bb74efe1c2b6fa13d0ef8d71c926"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 906
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/js/translates.js?1704989181
200 OK 30 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/js/translates.js?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
Hash 768bd7d069903883d0d73244b9757368
11da78f1d8f9ff98741b963cdbeacfd8d026f325
f4bed9686a64594af1beaff7bc8242212ae19f6d3eaa5ef083e939037d5a2c53
GET /landings/285828/1704989181/js/translates.js?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: bPA8k4trwjt5amV0QNuR0WbJW1QCfN+heiDfaw/g0+fX9dfwdmPSIupFfkOuziROpNrNY5nNd5Y=
x-amz-request-id: 885Y5RXRYM1PB8GB
Last-Modified: Fri, 12 Jan 2024 08:41:19 GMT
ETag: "768bd7d069903883d0d73244b9757368"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 30207
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/js/translate-popup-timer.js?1704989181
200 OK 1.1 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/js/translate-popup-timer.js?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash e87a84612ebce6b2a84f41ef7f6d40b0
fa22c93e2d9672f9d3d7e52304ffbb9425d49186
6ab40ce148d5bd7e60bcfb447765c7f54394e318da80970c8b636d2d5fe122ec
GET /landings/285828/1704989181/js/translate-popup-timer.js?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 5hURoXwOUGkodHE2eXF0Tfyy3X8CfLEKebtiywBG7SurRU2jEhMpJsPm6iMwxPbLjqefYVJ8BIg=
x-amz-request-id: RG88AE00W4CH5MJZ
Last-Modified: Fri, 12 Jan 2024 08:41:19 GMT
ETag: "e87a84612ebce6b2a84f41ef7f6d40b0"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 1080
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/js/jquery.validate.min.js?1704989181
200 OK 7.8 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/js/jquery.validate.min.js?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (24228)
Hash 23d73c6bd6cbea8f06d0cc227896a827
3815cf11e1020ac70cc86789ba2adaf07d3db434
6eefc13f4d9832e74173dea423bca495ceb7f4cbb888a19434d71a9bc0f69cb7
GET /landings/285828/1704989181/js/jquery.validate.min.js?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: Cv8uQDGPImAYdjl6m7FUP8SRbDj4iJIEVb3GzfilYZNFFDZ6HwDiMCzuEL/tvbdOB+fabfHwNcQ=
x-amz-request-id: 7SHXX1AJ0VAYD78D
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "23d73c6bd6cbea8f06d0cc227896a827"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 7815
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/js/jquery-2.2.4.min.js?1704989181
200 OK 30 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/js/jquery-2.2.4.min.js?1704989181
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (32065)
Hash 2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
GET /landings/285828/1704989181/js/jquery-2.2.4.min.js?1704989181 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 81QT8/lisLnyMpy8vDJulPX3cH0n4dHjZBFqVkU/epYjVr0ulzgaUgxa41uS5oUN/tWUULXWPEY=
x-amz-request-id: H8K8W066H9DDJ48M
Last-Modified: Fri, 12 Jan 2024 08:41:19 GMT
ETag: "2f6b11a7e914718e0290410e85366fe9"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Fri, 10 May 2024 21:45:19 GMT
Content-Length: 29855
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/logo_inst3.svg
200 OK 7.0 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/logo_inst3.svg
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash 0025657d9d2274a15aed06a9eadd2ab2
2838a36bfaa63abfe8b9f4bca8f8fe1a7ab7405d
d7b396cbae8aa719a1a277fa8fcf7df40f61b50e59b5937fcb347c679c6e990c
GET /landings/285828/1704989181/images/logo_inst3.svg HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: vFiNC8ufz/VmRNSLtdXtsCF+kag/0q8XcYoSZAVDiBmM69U2uffCfgiPgq/awxcgBWqZn+vrTeo=
x-amz-request-id: 2K2E44X2W5V2XG1Y
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "0025657d9d2274a15aed06a9eadd2ab2"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/svg+xml
Server: AmazonS3
Content-Length: 7042
Date: Fri, 10 May 2024 21:45:19 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/blocked-icon.png
200 OK 502 B URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/blocked-icon.png
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type PNG image data, 23 x 32, 8-bit/color RGBA, non-interlaced
Hash 87487ad255dde0624f59abb85602defc
caafad17df41875bed690353ead6cc495a9bf8c2
f7a4b3fb74b9e06f243f23ede51a801a0aa3fa2c0040bc44a49a97444780923d
GET /landings/285828/1704989181/images/blocked-icon.png HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: iMo1vpVXCjZds9lfI8NQxx6FutfDdywZvJ0tVdbdZa13rGyQjllSeKziqc6cFZTz3Rk2G3K2Skw=
x-amz-request-id: 2G921JM493W4HW51
Last-Modified: Fri, 12 Jan 2024 08:41:17 GMT
ETag: "87487ad255dde0624f59abb85602defc"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 502
Date: Fri, 10 May 2024 21:45:19 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/110010_4.jpg
200 OK 55 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/110010_4.jpg
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 682x388, components 3
Hash daf4cb58fb756b1ed20036941b7a6b72
f59a45cb83366de64071b3a35dfcb54aabbdcd9a
42b2fe5d347c3c56725d0addd7129d13ce335df871730534ecee42d2df3a637b
GET /landings/285828/1704989181/images/110010_4.jpg HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: PpnQUgl6j3o5gIUebiOS1qL7E6kKlWEfVaPGPE9OPquABSSuYyrvclCtKQeYXts3QT2jbdt+yC4=
x-amz-request-id: 03TQKEPC68Z0TPEQ
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "daf4cb58fb756b1ed20036941b7a6b72"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/jpeg
Server: AmazonS3
Content-Length: 55243
Date: Fri, 10 May 2024 21:45:19 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/49.png
200 OK 4.5 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/49.png
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type PNG image data, 336 x 336, 8-bit/color RGB, non-interlaced
Hash 372e58a66b7d92e1dd903f32fb308d1e
40be5d7067b822dfed07e173acd11cfceaa9e329
82408edfa51c2d831b86658b6637a6950986c342195aa08fd1467ea1d71b9793
GET /landings/285828/1704989181/images/49.png HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: TvfZYk+pm5Zz325xPfObg2es/GmEVzAIzRuIVmx3nKuAv/O9ZvwCM3nOFYhcb4ziipfsmhOCb0k=
x-amz-request-id: PT5XEDG2GF4ENSAK
Last-Modified: Fri, 12 Jan 2024 08:41:17 GMT
ETag: "372e58a66b7d92e1dd903f32fb308d1e"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 4510
Date: Fri, 10 May 2024 21:45:20 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap
200 OK 1.1 kB URL GET HTTP/2 fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap
IP
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT
File type gzip compressed data, max compression
Hash 72e39cf4415126af62032eb147bccd53
e53ad2bc5eca6486d96586e1bc76aa9681a6d267
608b04063c72d0565888fb1da9799b58a4aa9318dfae4fc5557e46be706ce750
GET /css2?family=Inter:wght@400;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn-dimi.akamaized.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 10 May 2024 21:45:20 GMT
date: Fri, 10 May 2024 21:45:20 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-home.svg
200 OK 889 B URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-home.svg
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash 02866968d59a649b76df83c300d2d8f6
8293027c754094ab05cb7d6daa7f7cdb1be5c98e
ce26e303b33d69ca20eb3079b4c37ed364eacb8c633260c56315d6db74414b74
GET /landings/285828/1704989181/images/icon-home.svg HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: J2j15DxUM5rlXT7Nxc3X0Y34YFEmdyaOsazkHX/ikypVKg62NIs40smGzAENdDYJk1inK7Vfddg=
x-amz-request-id: PT5GE7X8D0WQFEVR
Last-Modified: Fri, 12 Jan 2024 08:41:17 GMT
ETag: "02866968d59a649b76df83c300d2d8f6"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/svg+xml
Server: AmazonS3
Content-Length: 889
Date: Fri, 10 May 2024 21:45:20 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-search.svg
200 OK 1.2 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-search.svg
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash aa6ea58a389a3ebe541d5f9d622dedd7
9fb684b6f6cd982396bd8c8e745997c3a01dd6be
4aa4713ccd74ad24299b1558cb49061c90076e841b3b1177fb3b056a8448b4c5
GET /landings/285828/1704989181/images/icon-search.svg HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 5MWWFv/pV4zyNDNiGlQmQ3qKNUv3e5Uju/4iFQUl1MXYGvp5+/2wVbhAuFaUPfa3CXlziFJiacI=
x-amz-request-id: AGX82PAPYWSTTABX
Last-Modified: Fri, 12 Jan 2024 08:41:17 GMT
ETag: "aa6ea58a389a3ebe541d5f9d622dedd7"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/svg+xml
Server: AmazonS3
Content-Length: 1189
Date: Fri, 10 May 2024 21:45:20 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-plus.svg
200 OK 1.1 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-plus.svg
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash f89e15ef5cf4b32ca987f73bd4a2ef9d
0f55d36995906b78bd98f23c7fdc67778212b7fc
7b023c50adbfe6554e1bf1986a12de8ba9e47c5d14a3e57318d117004ea6a641
GET /landings/285828/1704989181/images/icon-plus.svg HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: R8ISDoAk6yapIVUfIwscUBW6bTK3JKja3s/XdLdKBIi9H30IQ7+z5JdfhoffN+oMj7P/7M3mCSE=
x-amz-request-id: PT5P4086S3D4K9Q5
Last-Modified: Fri, 12 Jan 2024 08:41:17 GMT
ETag: "f89e15ef5cf4b32ca987f73bd4a2ef9d"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/svg+xml
Server: AmazonS3
Content-Length: 1117
Date: Fri, 10 May 2024 21:45:20 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-like.svg
200 OK 914 B URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-like.svg
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash 2457f6954df5056e25151bcdd05a2718
41ab46311796f9ade12cae960687a422ee8ff0a0
c1a26e7a024fd0e566423b10e91c63854979ce89f3fe2625043dc52dfe20891b
GET /landings/285828/1704989181/images/icon-like.svg HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: ZUbXCJxGwKXqwMDezh47FNzo2IdI9tQ3EVMUeb7WOoM9SR3kJWllIXaTlo8GNQ1JVuBYXsHbwGA=
x-amz-request-id: PT5J41Y0V1HKXFRB
Last-Modified: Fri, 12 Jan 2024 08:41:17 GMT
ETag: "2457f6954df5056e25151bcdd05a2718"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/svg+xml
Server: AmazonS3
Content-Length: 914
Date: Fri, 10 May 2024 21:45:20 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-user.svg
200 OK 844 B URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/icon-user.svg
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash 00aa56c530f0df6ddbb8805f25376920
2331bb67d5538e5fb2c010ef41541ce8dc8acfc1
ed65348e7b16bbe9b436282214590814692d0fb779fc2155c82ca0d94fe5a94e
GET /landings/285828/1704989181/images/icon-user.svg HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn-dimi.akamaized.net/landings/285828/1704989181/css/style.css?1704989181
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: ZVWyB5ozfQueRX3ARgZwgS6byU5YmYd5sDJaULfMKtPGzGVQTFNuThivp4ySbhpjF6j48BLDZ6I=
x-amz-request-id: PT5RVY9G7TN79JAK
Last-Modified: Fri, 12 Jan 2024 08:41:17 GMT
ETag: "00aa56c530f0df6ddbb8805f25376920"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/svg+xml
Server: AmazonS3
Content-Length: 844
Date: Fri, 10 May 2024 21:45:20 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/4.mp4
206 Partial Content 692 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/4.mp4
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Size 692 kB (691794 bytes)
Hash 254c97fbac9f92203f7871bea8ef1eb7
b5d254d711ff98206ee3b103de601415eadc883a
104dc2eb9fffa01bdbcff72b2ee0544ed1e09dfb03ff11cee8012366f9dfaae8
GET /landings/285828/1704989181/images/4.mp4 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
x-amz-id-2: 4AhltQXYj8gQQLSEHCUY9AGuSxwbPlvGmuC+ICWk/rhF5LL2NhqpA99ZkCkkgnF8m/7qVthktdo=
x-amz-request-id: PT5YP3NSC0YYKG8S
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "254c97fbac9f92203f7871bea8ef1eb7"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: video/mp4
Server: AmazonS3
Date: Fri, 10 May 2024 21:45:20 GMT
Content-Range: bytes 0-691793/691794
Content-Length: 691794
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
200 OK 47 kB URL GET HTTP/2 fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
IP
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 46704, version 1.0
Hash 30a274cd01b6eeb0b082c918b0697f1e
393311bde26b99a4ad935fa55bad1dce7994388b
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
GET /s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://rgqval.awaitingdream.net
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 46704
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 10:54:17 GMT
expires: Tue, 06 May 2025 10:54:17 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
content-type: font/woff2
age: 384663
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
200 OK 47 kB URL GET HTTP/2 fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
IP
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 46704, version 1.0
Hash 30a274cd01b6eeb0b082c918b0697f1e
393311bde26b99a4ad935fa55bad1dce7994388b
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
GET /s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://rgqval.awaitingdream.net
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 46704
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 10:54:17 GMT
expires: Tue, 06 May 2025 10:54:17 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
content-type: font/woff2
age: 384664
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn-dimi.akamaized.net/landings/285828/1704989181/images/favicon.png?t=20240510214519
200 OK 4.1 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/favicon.png?t=20240510214519
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced
Hash 40a54c3ecf143b64096b063ff793fdbb
017eafffc5e55226a2aec0dd3c03f1b6130a6bab
39b439471019cb16f819e05166d23492593310fd55cce8471062d8f2dc5de423
GET /landings/285828/1704989181/images/favicon.png?t=20240510214519 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: T0JZ6ljKqoyJAOGUBnRd/n9ODLnR50iFEq+fJRLINQJn55lOEdrrfBXy6+lDLMp0mzqks0/j+yQ=
x-amz-request-id: V3PHYWQQ69S9VSBZ
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "40a54c3ecf143b64096b063ff793fdbb"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 4093
Date: Fri, 10 May 2024 21:45:21 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
cdn-dimi.akamaized.net/landings/285828/1704989181/images/favicon.png?t=20240510214519
200 OK 4.1 kB URL GET HTTP/1.1 cdn-dimi.akamaized.net/landings/285828/1704989181/images/favicon.png?t=20240510214519
IP
ASN #20940 Akamai International B.V.
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerDigiCert Inc
Subjecta248.e.akamai.net
Fingerprint28:39:AF:63:7D:02:E8:F7:17:23:A0:EE:E0:C9:2F:9C:64:17:68:0A
ValidityThu, 18 Apr 2024 00:00:00 GMT - Sat, 19 Apr 2025 23:59:59 GMT
File type PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced
Hash 40a54c3ecf143b64096b063ff793fdbb
017eafffc5e55226a2aec0dd3c03f1b6130a6bab
39b439471019cb16f819e05166d23492593310fd55cce8471062d8f2dc5de423
GET /landings/285828/1704989181/images/favicon.png?t=20240510214519 HTTP/1.1
Host: cdn-dimi.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: T0JZ6ljKqoyJAOGUBnRd/n9ODLnR50iFEq+fJRLINQJn55lOEdrrfBXy6+lDLMp0mzqks0/j+yQ=
x-amz-request-id: V3PHYWQQ69S9VSBZ
Last-Modified: Fri, 12 Jan 2024 08:41:18 GMT
ETag: "40a54c3ecf143b64096b063ff793fdbb"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 4093
Date: Fri, 10 May 2024 21:45:21 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js
200 OK 10 kB URL GET HTTP/2 www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js
IP
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File type JavaScript source, ASCII text, with very long lines (35547)
Hash 0cb7a0eb328ea70ab360f861314c8820
e3e20eb50dae36f4cbcef1890b1cc7878acb537a
4569845f7c550a55311814032e88541bd3b4a055ec3894e9cf58c4fff1be91d9
GET /firebasejs/5.0.2/firebase-messaging.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 10017
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 23:33:31 GMT
expires: Fri, 09 May 2025 23:33:31 GMT
cache-control: public, max-age=31536000
age: 79910
last-modified: Thu, 10 May 2018 20:35:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.gstatic.com/firebasejs/5.0.2/firebase-app.js
200 OK 8.6 kB URL GET HTTP/2 www.gstatic.com/firebasejs/5.0.2/firebase-app.js
IP
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File type JavaScript source, ASCII text, with very long lines (25088)
Hash 9164d0e8a317eceb870cca88c9683127
4617c910005f7100b4ff26a458a8b4463e33cdc6
15c9bd66992ef54979c981763cae280f28b6845520020ed38b5ab5f3f70f7931
GET /firebasejs/5.0.2/firebase-app.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 8604
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 20:42:54 GMT
expires: Fri, 09 May 2025 20:42:54 GMT
cache-control: public, max-age=31536000
age: 90147
last-modified: Thu, 10 May 2018 20:35:51 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
queitho.com/favicon.ico
7.5 kB IP
File type HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: queitho.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 10 May 2024 21:45:18 GMT
content-type: text/html
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: HIT
age: 38
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7wL896lxkq5IPG33WujeQMkPj6vAyWmhNy%2B2WktXHYhrV88mkueM9MJWUHISySq2Db%2B1We3gO65JQKuDYEbu713d7%2FPJvkbaY%2FWRCjDcBkEi1c46itF977aLGvQ7eg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881d1d936f4456af-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
rgqval.awaitingdream.net/?s1=134504&s2=2005070&s3=sml_e1f18e7f&s5=backuser&click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&iexpp=1&j1=1&j9=1&ban=other&utm_source=e2905f55ec3a568b&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7
136 B URL rgqval.awaitingdream.net/?s1=134504&s2=2005070&s3=sml_e1f18e7f&s5=backuser&click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&iexpp=1&j1=1&j9=1&ban=other&utm_source=e2905f55ec3a568b&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7
IP
File type HTML document, ASCII text
Hash 2d9f9e36d799a591f5c5f7c43f3d8bf0
7caecbe009eacced17d7833cc231174f5ad0b40f
664f67f790c643594fed72403192eef927b0bbc1784dc85b81d59f9d9c3d88e3
GET /?s1=134504&s2=2005070&s3=sml_e1f18e7f&s5=backuser&click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&iexpp=1&j1=1&j9=1&ban=other&utm_source=e2905f55ec3a568b&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7 HTTP/1.1
Host: rgqval.awaitingdream.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Fri, 10 May 2024 21:45:41 GMT
content-type: text/html; charset=utf-8
content-length: 136
location: https://cy.trck-capt-prv2.com/click?o=4691&a=198&sub_id1=yprps663e9585000c8acc&sub_id3=134504_2005070
set-cookie: unique_id=663e858900033b48; Path=/; Expires=Tue, 09 Jul 2024 21:45:41 GMT; Secure; SameSite=None
unique_id2=663e758f00077420; Path=/; Expires=Thu, 08 Aug 2024 21:45:41 GMT; Secure; SameSite=None
663e758f00077420_c=1; Path=/; Expires=Thu, 08 Aug 2024 21:45:41 GMT; Secure; SameSite=None
ref_token=134504; Path=/; Expires=Sun, 09 Jun 2024 21:45:41 GMT; Secure; SameSite=None
impression=; Path=/; Expires=Fri, 10 May 2024 21:45:41 GMT; Secure; SameSite=None
tid=yprps663e9585000c8acc; Path=/; Expires=Sat, 14 Apr 2029 21:45:41 GMT; Secure; SameSite=None
X-Firefox-Spdy: h2
luvwhisper.com/tds/ae?tdsId=s5428sto_r&tds_campaign=s5428sto&s1=ps&utm_source=int&utm_sub=opnfnl&affid=e1f18e7f&subid=dit1120&subid2=Ml9kaXQxMTIw&clickid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6
302 Found 1.2 kB URL User Request GET HTTP/2 luvwhisper.com/tds/ae?tdsId=s5428sto_r&tds_campaign=s5428sto&s1=ps&utm_source=int&utm_sub=opnfnl&affid=e1f18e7f&subid=dit1120&subid2=Ml9kaXQxMTIw&clickid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6
IP
Certificate IssuerAmazon
Subjectluvwhisper.com
Fingerprint4D:EC:81:10:9E:C3:DA:0D:65:B1:D0:C2:7A:5E:0F:BE:3E:14:88:E3
ValidityTue, 09 Jan 2024 00:00:00 GMT - Thu, 06 Feb 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tds/ae?tdsId=s5428sto_r&tds_campaign=s5428sto&s1=ps&utm_source=int&utm_sub=opnfnl&affid=e1f18e7f&subid=dit1120&subid2=Ml9kaXQxMTIw&clickid=1bd159d5-77e5-407b-b5f3-08e93ac6e8e6 HTTP/1.1
Host: luvwhisper.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
location: https://empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
date: Fri, 10 May 2024 21:45:19 GMT
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Platform, Sec-CH-UA-Wow64, Sec-CH-UA
set-cookie: dci=f8d83707ad619154cf0a249b35aaed00278ba40a; Max-Age=31536000; Domain=.luvwhisper.com; Path=/; Expires=Sat, 10 May 2025 21:45:19 GMT; Secure; SameSite=None
dm=fe450dd0d1dadc615429144d33241f42; Max-Age=432000; Path=/; Expires=Wed, 15 May 2024 21:45:19 GMT
x-cache: Miss from cloudfront
via: 1.1 3bff78035f818b6a3185b0f5f4586410.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: B_I_MjEs-GxDGTP8VrLh_fbcXLeg-ClTs1k5ul6sohAjQM94SWnqIQ==
X-Firefox-Spdy: h2
luvwhisper.com/lp-external/index.js
200 OK 2.2 kB URL GET HTTP/2 luvwhisper.com/lp-external/index.js
IP
Requested by https://empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
Certificate IssuerAmazon
Subjectluvwhisper.com
Fingerprint4D:EC:81:10:9E:C3:DA:0D:65:B1:D0:C2:7A:5E:0F:BE:3E:14:88:E3
ValidityTue, 09 Jan 2024 00:00:00 GMT - Thu, 06 Feb 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (2304), with no line terminators
Hash 6581cb890b9497166c13fa1122c88947
4632208a24f59f3b44a68ca77b130f4b6a661ded
19f631eaad330a3adac93c919803b30bc262991bb7db396bc9a4fbbae6cd5d3b
GET /lp-external/index.js HTTP/1.1
Host: luvwhisper.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://empirelayer.club/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
date: Fri, 10 May 2024 21:45:19 GMT
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
x-robots-tag: noindex
accept-ranges: bytes
cache-control: public, max-age=3600
last-modified: Thu, 09 May 2024 13:15:55 GMT
etag: W/"8b7-18f5d7efef8"
vary: Accept-Encoding
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 94eee494c19905cb6933ec8a32a577a0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 2C0ziGQe6e5x9x14ygpj4HIbtTEYQf-8fFI1940AsCJbmCSXlG_zJQ==
X-Firefox-Spdy: h2
empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
200 OK 1.2 kB URL User Request GET HTTP/2 empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
IP
Certificate IssuerAmazon
Subjectempirelayer.club
FingerprintD0:9A:6A:E3:BC:1C:59:10:F7:F8:FD:8F:63:D3:56:1C:43:2C:75:EF
ValidityThu, 02 Nov 2023 00:00:00 GMT - Sat, 30 Nov 2024 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (1236), with no line terminators
Hash 884e3c865f685837812d0f5e8534aaab
88ff54424b0e6a22c5c1cf4e58003d393433f991
2472b78f4aa644c140af306bde1c813aea6008fe47f15a58018406aa6ed9b15a
GET /tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u= HTTP/1.1
Host: empirelayer.club
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
date: Fri, 10 May 2024 21:45:19 GMT
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Platform, Sec-CH-UA-Wow64, Sec-CH-UA
vary: Accept-Encoding
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: ASuCp3A2aI1WEDZ_JHnVqgxgkrdVgfHzmoxjXXY-eq1Gb9Zw-I9jcA==
X-Firefox-Spdy: h2
empirelayer.club/tds/interlayer?handler=ExternalBackofferEvent&urlIn=https%3A%2F%2Fempirelayer.club%2Ftds%2Finterlayer%2Feb%2Fs%2Fdafa4842e98c2955459f06e2e61b3297%3F__t%3D1715377519166%26__l%3D3600%26__c%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26__u%3D&urlOut=https%3A%2F%2Frgqval.awaitingdream.net%2F%3Fclick_id%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26ban%3Dother%26s2%3D2005070%26s5%3Ddit1120%26utm_source%3De2905f55ec3a568b%26s3%3Dsml_e1f18e7f%26tds_cid%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26j9%3D1%26s1%3D134504%26j1%3D1&altQs=utm_campaign%3De1f18e7f%26utm_source%3Dint%26utm_content%3Ddit1120%26data2%3D1bd159d5-77e5-407b-b5f3-08e93ac6e8e6%26s1%3Dps%26s3%3DMl9kaXQxMTIw%26tds_campaign%3Db7637pos%26tds_id%3Db7637pos_lp_a_1575477620507_smartlink%26tds_oid%3D83b8f3ff%26tds_cid%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26tds_ac_id%3Ds5428sto%26p_tds_cid%3D35e7d5c2d30bf9c7376533b3eff3644833de6fd7%26tds_host%3Dluvwhisper.com%26tds_path%3D%252Ftds%252Fae%26dci%3Df8d83707ad619154cf0a249b35aaed00278ba40a%26tds_ps%3Da&tdsCid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&reason=beacon&visitsCount=1&ts=1715377519534
200 OK 0 B URL POST HTTP/3 empirelayer.club/tds/interlayer?handler=ExternalBackofferEvent&urlIn=https%3A%2F%2Fempirelayer.club%2Ftds%2Finterlayer%2Feb%2Fs%2Fdafa4842e98c2955459f06e2e61b3297%3F__t%3D1715377519166%26__l%3D3600%26__c%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26__u%3D&urlOut=https%3A%2F%2Frgqval.awaitingdream.net%2F%3Fclick_id%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26ban%3Dother%26s2%3D2005070%26s5%3Ddit1120%26utm_source%3De2905f55ec3a568b%26s3%3Dsml_e1f18e7f%26tds_cid%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26j9%3D1%26s1%3D134504%26j1%3D1&altQs=utm_campaign%3De1f18e7f%26utm_source%3Dint%26utm_content%3Ddit1120%26data2%3D1bd159d5-77e5-407b-b5f3-08e93ac6e8e6%26s1%3Dps%26s3%3DMl9kaXQxMTIw%26tds_campaign%3Db7637pos%26tds_id%3Db7637pos_lp_a_1575477620507_smartlink%26tds_oid%3D83b8f3ff%26tds_cid%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26tds_ac_id%3Ds5428sto%26p_tds_cid%3D35e7d5c2d30bf9c7376533b3eff3644833de6fd7%26tds_host%3Dluvwhisper.com%26tds_path%3D%252Ftds%252Fae%26dci%3Df8d83707ad619154cf0a249b35aaed00278ba40a%26tds_ps%3Da&tdsCid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&reason=beacon&visitsCount=1&ts=1715377519534
IP
Requested by https://empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
Certificate IssuerAmazon
Subjectempirelayer.club
FingerprintD0:9A:6A:E3:BC:1C:59:10:F7:F8:FD:8F:63:D3:56:1C:43:2C:75:EF
ValidityThu, 02 Nov 2023 00:00:00 GMT - Sat, 30 Nov 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /tds/interlayer?handler=ExternalBackofferEvent&urlIn=https%3A%2F%2Fempirelayer.club%2Ftds%2Finterlayer%2Feb%2Fs%2Fdafa4842e98c2955459f06e2e61b3297%3F__t%3D1715377519166%26__l%3D3600%26__c%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26__u%3D&urlOut=https%3A%2F%2Frgqval.awaitingdream.net%2F%3Fclick_id%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26ban%3Dother%26s2%3D2005070%26s5%3Ddit1120%26utm_source%3De2905f55ec3a568b%26s3%3Dsml_e1f18e7f%26tds_cid%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26j9%3D1%26s1%3D134504%26j1%3D1&altQs=utm_campaign%3De1f18e7f%26utm_source%3Dint%26utm_content%3Ddit1120%26data2%3D1bd159d5-77e5-407b-b5f3-08e93ac6e8e6%26s1%3Dps%26s3%3DMl9kaXQxMTIw%26tds_campaign%3Db7637pos%26tds_id%3Db7637pos_lp_a_1575477620507_smartlink%26tds_oid%3D83b8f3ff%26tds_cid%3D87b684c6e3f715e7effcec963fae4ce8eae60ed7%26tds_ac_id%3Ds5428sto%26p_tds_cid%3D35e7d5c2d30bf9c7376533b3eff3644833de6fd7%26tds_host%3Dluvwhisper.com%26tds_path%3D%252Ftds%252Fae%26dci%3Df8d83707ad619154cf0a249b35aaed00278ba40a%26tds_ps%3Da&tdsCid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&reason=beacon&visitsCount=1&ts=1715377519534 HTTP/1.1
Host: empirelayer.club
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://empirelayer.club
DNT: 1
Connection: keep-alive
Referer: https://empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
HTTP/3 200 OK
alt-svc: h3=":443"; ma=86400
x-amz-cf-pop: OSL50-C1
date: Fri, 10 May 2024 21:45:19 GMT
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Platform, Sec-CH-UA-Wow64, Sec-CH-UA
x-cache: Miss from cloudfront
via: 1.1 71c98156ae29b36a903974f9dd2568f8.cloudfront.net (CloudFront)
x-amz-cf-id: c1qMxSboNeiuP55q-K9Me0LEvPLIS1bcuHQrZtC4fyq92tnuuuCb2w==
queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098
200 OK 6.1 kB URL User Request GET HTTP/2 queitho.com/client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098
IP
Certificate IssuerLet's Encrypt
Subjectqueitho.com
FingerprintF1:05:3E:9D:7A:6D:B6:57:58:D4:D8:E8:6E:81:69:2A:D3:2B:5C:D9
ValidityTue, 12 Mar 2024 19:42:25 GMT - Mon, 10 Jun 2024 19:42:24 GMT
File type JavaScript source, ASCII text, with very long lines (6152), with no line terminators
Hash f3e3601f706fbe80a014728138b7af62
ee10561739b0b04a6e4d39b83bf85a023261aa1a
63aeb4950bfba505ac1cfdd117f47f2f1ce7c03ce090f71cc5624cf74ed36ce6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /client?camp=s9&aff_id=2&aff_sub=2&source=2&aff_sub2=tiktok&click_id=32_2_10000_6cd026425b0498b3e5002630e0bbc098 HTTP/1.1
Host: queitho.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://go.lnkpth.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 21:45:18 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: default-src 'self' https://oacenom.com https://openfpcdn.io/fingerprintjs/v4; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://oacenom.com https://openfpcdn.io/fingerprintjs/v4
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
accept-ch: Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: no-store, no-store, no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d0T%2F3DABYPr3ixXp1E%2F3CYhFyeDpq7KHCE20lUj%2F%2BIdrBPB%2FkIk3za1DWVMjizK%2B6AJLqo%2FVn%2FPkr%2Foy9uM88HdaZPmLLMGvPJyf9TV62Mkrk5FwhpPW3nHv3gmSHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881d1d915ff45694-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
rgqval.awaitingdream.net/js/pushjs/1.0.0/subscriber.js
200 OK 9.4 kB URL GET HTTP/2 rgqval.awaitingdream.net/js/pushjs/1.0.0/subscriber.js
IP
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerLet's Encrypt
Subject*.awaitingdream.net
Fingerprint80:13:71:FD:9C:9C:0B:BF:1A:E0:B5:EA:6C:C4:ED:77:5A:CA:B4:02
ValidityTue, 19 Mar 2024 09:01:07 GMT - Mon, 17 Jun 2024 09:01:06 GMT
File type JavaScript source, ASCII text, with very long lines (9661), with no line terminators
Hash 698668c880e3133ee2cffc2eee6aad4d
cadcabaeb8a3da90317682ead381b76c11319464
1963c90f965a52259d5b8fd47cb33ef3df24733a994ad99ce7f0cfa525d9b163
GET /js/pushjs/1.0.0/subscriber.js HTTP/1.1
Host: rgqval.awaitingdream.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/?s1=134504&s2=2005070&s3=sml_e1f18e7f&s5=backuser&click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&iexpp=1&j1=1&j9=1&ban=other&utm_source=e2905f55ec3a568b&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7
Cookie: unique_id=663e858900033b48; unique_id2=663e758f00077420; 663e758f00077420_c=1; ref_token=134504; 663e758f00077420_sl=[285828]
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 21:45:20 GMT
content-type: application/javascript
expires: Fri, 17 May 2024 21:45:20 GMT
cache-control: max-age=604800
content-encoding: gzip
X-Firefox-Spdy: h2
rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
200 OK 40 kB URL User Request GET HTTP/2 rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
IP
Certificate IssuerLet's Encrypt
Subject*.awaitingdream.net
Fingerprint80:13:71:FD:9C:9C:0B:BF:1A:E0:B5:EA:6C:C4:ED:77:5A:CA:B4:02
ValidityTue, 19 Mar 2024 09:01:07 GMT - Mon, 17 Jun 2024 09:01:06 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1 HTTP/1.1
Host: rgqval.awaitingdream.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://empirelayer.club/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 21:45:19 GMT
content-type: text/html; charset=utf-8
set-cookie: unique_id=663e858900033b48; Path=/; Expires=Tue, 09 Jul 2024 21:45:19 GMT; Secure; SameSite=None
unique_id2=663e758f00077420; Path=/; Expires=Thu, 08 Aug 2024 21:45:19 GMT; Secure; SameSite=None
663e758f00077420_c=1; Path=/; Expires=Thu, 08 Aug 2024 21:45:19 GMT; Secure; SameSite=None
ref_token=134504; Path=/; Expires=Sun, 09 Jun 2024 21:45:19 GMT; Secure; SameSite=None
impression=; Path=/; Expires=Fri, 10 May 2024 21:45:19 GMT; Secure; SameSite=None
663e758f00077420_sl=[285828]; Path=/; Expires=Fri, 24 May 2024 21:45:19 GMT; Secure; SameSite=None
content-encoding: gzip
X-Firefox-Spdy: h2
empirelayer.club/favicon.ico
0 B URL GET empirelayer.club/favicon.ico
IP
Requested by https://empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
Certificate IssuerAmazon
Subjectempirelayer.club
FingerprintD0:9A:6A:E3:BC:1C:59:10:F7:F8:FD:8F:63:D3:56:1C:43:2C:75:EF
ValidityThu, 02 Nov 2023 00:00:00 GMT - Sat, 30 Nov 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: empirelayer.club
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://empirelayer.club/tds/interlayer/eb/s/dafa4842e98c2955459f06e2e61b3297?__t=1715377519166&__l=3600&__c=87b684c6e3f715e7effcec963fae4ce8eae60ed7&__u=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
rgqval.awaitingdream.net/js/pushjs/1.0.0/utils.js
200 OK 7.1 kB URL GET HTTP/2 rgqval.awaitingdream.net/js/pushjs/1.0.0/utils.js
IP
Requested by https://rgqval.awaitingdream.net/?click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&ban=other&s2=2005070&s5=dit1120&utm_source=e2905f55ec3a568b&s3=sml_e1f18e7f&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7&j9=1&s1=134504&j1=1
Certificate IssuerLet's Encrypt
Subject*.awaitingdream.net
Fingerprint80:13:71:FD:9C:9C:0B:BF:1A:E0:B5:EA:6C:C4:ED:77:5A:CA:B4:02
ValidityTue, 19 Mar 2024 09:01:07 GMT - Mon, 17 Jun 2024 09:01:06 GMT
File type JavaScript source, ASCII text, with very long lines (7334), with no line terminators
Hash 7df62062a027cd25d5a179c520f38668
0ddaa8cd9090908d987e0299cef74fbf7f118738
cdf93aff990bae251f609ef00d7d2bdbb56a35f003c7184ba067b5948629faa3
GET /js/pushjs/1.0.0/utils.js HTTP/1.1
Host: rgqval.awaitingdream.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rgqval.awaitingdream.net/?s1=134504&s2=2005070&s3=sml_e1f18e7f&s5=backuser&click_id=87b684c6e3f715e7effcec963fae4ce8eae60ed7&iexpp=1&j1=1&j9=1&ban=other&utm_source=e2905f55ec3a568b&tds_cid=87b684c6e3f715e7effcec963fae4ce8eae60ed7
Cookie: unique_id=663e858900033b48; unique_id2=663e758f00077420; 663e758f00077420_c=1; ref_token=134504; 663e758f00077420_sl=[285828]
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 21:45:20 GMT
content-type: application/javascript
expires: Fri, 17 May 2024 21:45:20 GMT
cache-control: max-age=604800
content-encoding: gzip
X-Firefox-Spdy: h2
172.255.248.119
172.67.176.78
104.21.79.101
95.101.11.40
52.19.138.177
0.0.0.0