lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
200 OK 17 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1663)
Hash 046ca3e04c2cd3f23d08628d1efa9b9d
825f6758da1c5d46acb13f267df7f06f74af73aa
8ed848d80a9af96e3bdecfbf77b6faf4d2e89b962a787466fbbafc70999948ee
GET /n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339 HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 15d199af49035dc206cb81292fd87de2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 2LHwR-fKBfinLEtjcwB_KY0Kcc60pTM1JBDSRgDJgrsbFjhE8vzIkA==
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5c6a87f6d6b5c54dcb1b630ae6001c73
e0315c9936d6f2f58ff7d078e74a8ec7802265a8
d88ef07b9fcfb42d27a490cb57df4adaf3261efc7d0b38246db387da3ca32a8d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D88EF07B9FCFB42D27A490CB57DF4ADAF3261EFC7D0B38246DB387DA3CA32A8D"
Last-Modified: Fri, 30 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6096
Expires: Sat, 31 Dec 2022 17:29:31 GMT
Date: Sat, 31 Dec 2022 15:47:55 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0e93d32de9bcebd3483b40a8fed30718
7e1fe5db1f08b75a079780717e4f18ad76767212
4f0aaacfefd27c89225a1a0d2fbe778ec4f3369b5e4e1599255bf12866196cd4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4F0AAACFEFD27C89225A1A0D2FBE778EC4F3369B5E4E1599255BF12866196CD4"
Last-Modified: Fri, 30 Dec 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7564
Expires: Sat, 31 Dec 2022 17:53:59 GMT
Date: Sat, 31 Dec 2022 15:47:55 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Type, Content-Length, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 31 Dec 2022 15:35:41 GMT
content-type: application/json
age: 734
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6d6d99cd1201f65eeb7d437b62bad1f3
6d5e41d7a2786ccaad7c7276ecdd9411f8cbd6ba
db2b42007fc4ad126c8af8d7cce27af88947231d09ded56da33cfee3d2594e23
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DB2B42007FC4AD126C8AF8D7CCE27AF88947231D09DED56DA33CFEE3D2594E23"
Last-Modified: Fri, 30 Dec 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10459
Expires: Sat, 31 Dec 2022 18:42:14 GMT
Date: Sat, 31 Dec 2022 15:47:55 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain
IP
File type PEM certificate\012- , ASCII text
Hash b1fcd419a4245617397846e8d17233f6
2a037ce244587640b27ead9a0ec2af4f862d91b2
e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: /Rd3A4FlaxHAqHXUJbBCASvHSnQhzyeM/xyRKCB0sKxb711fLNsMHXSlxzNHDuN0HgE+rnLzLao=
x-amz-request-id: 22SG4RTQB4VD2YRX
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 31 Dec 2022 14:57:28 GMT
age: 3027
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 31 Dec 2022 15:47:55 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/animate.css
200 OK 718 B URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/animate.css
IP
Hash a077535ff115bc707f8dd3bca95f630d
97503fe4f2315e1cc3a94aca636143e28c5cdce3
0a562152abdd82d5fcc344c134adf48c7f514082242331bba09885d1cbb99dd5
GET /n/31/1/nz/chnel_chrsms/css/animate.css HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: W/"63aac188-139a"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: HI_i5i6wW-Nw2skG-7MzBqdBw3zcQh1ANlrhrbyZaHLUJ6EKtWZ4-A==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/js/script.js
200 OK 187 B URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/js/script.js
IP
Hash b7100508c178d80014eddf5b1c576b49
298ed48125b175346a416b3415e825faf2a6153e
5528abaaa2e2a92e72cc25526e2e6951fc5bca890ee4778dd4f70c5c7a0e48e1
Analyzer Verdict Alert fortinet Phishing
GET /n/31/1/nz/chnel_chrsms/js/script.js HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf8
Content-Length: 187
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-bb"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: MlfVpbJ4d3X-Pb8GOrv-2mLomS5kJEofKkmCuB3SGBYOi7dlzYBgPg==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/js/stepsCounter.js
200 OK 326 B URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/js/stepsCounter.js
IP
Hash e2aa153acd625555cfc4599155744693
f175b28bfc312a95d882c47978331f83d7794a04
3fdb14e85a70ce94d60cc66d85698e6097a21b11cf157455ec522a082d4d8326
Analyzer Verdict Alert fortinet Phishing
GET /n/31/1/nz/chnel_chrsms/js/stepsCounter.js HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf8
Content-Length: 326
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-146"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: b5mD8aDez4dQmrjHf5jD0WQlRfzQ8dOftWhDWzabCaqsSlN82hQLeQ==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/style.min.css
200 OK 3.3 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/style.min.css
IP
Hash 7a90c84879fe8be9fe06eea0cac49018
5c70332f0cd7d3da8671678a3badd2a9ea7890a2
dfa0f287ca7e1ae79b4c1f9e5b6eb6467e9f97647d9f329d6a38f6850f4ded34
GET /n/31/1/nz/chnel_chrsms/css/style.min.css HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: W/"63aac188-351a"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: h8SLL3P1gQHdz91q6opjTvlIbp6J0Kl5LgMEnwRib3B7qxu2Dk-H2g==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/main.css
200 OK 6.4 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/main.css
IP
File type ASCII text, with very long lines (540)
Hash 1f21616ad21cc33ff53fec8e45e448ba
e410006515ac9a252473f95eece65aba9be123ac
5c48ff15f137f5343f2ea468e2738acab3f04fc2f045b7f4678c852c9daa970a
GET /n/31/1/nz/chnel_chrsms/css/main.css HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: W/"63aac188-7c88"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 15d199af49035dc206cb81292fd87de2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: GpPBDLIOQaePK7nEEpbVg_5Mg5l0bHqO3MK9GMMlqT7yRHMEbz2qqQ==
code.jquery.com/jquery-1.12.4.min.js
200 OK 34 kB URL HTTP/2 code.jquery.com/jquery-1.12.4.min.js
IP
File type ASCII text, with very long lines (32077)
Hash fc7624613c4e25843694cdb7fa956f05
7765bb4016ae929e22be579ccde505b94c2a63c1
49c97d70ef48bfdc1d7b96271b5613bb099b2c040ebdf5624962aea92ff428ae
GET /jquery-1.12.4.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 31 Dec 2022 15:47:55 GMT
content-encoding: gzip
content-length: 33738
content-type: application/javascript; charset=utf-8
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
accept-ranges: bytes
server: nginx
etag: W/"620cd6ff-17b8b"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-sp-metadata: HS256.CLvPwZ0GEoYBCiRjMmFmOTg0ZC1mY2RlLTQyZDQtOTI4My1mMjEwZDViMTcwMGMQ+OiCoKvU+wIaBgirs8GdBiIMOTEuOTAuNDIuMTU0KLhAMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogYzdkMmI0YzQ4NGE0MTNlMTkxZGU2YWNmZjJkYjIwMDkaLAgBEiRlZDRhOWJlNC1lOTBlLTQ1YTItOTQ5OS1mNjExMGYxMjJkNmQYyocCIhgIAhIUY2RzMjUxLnNrMS5od2Nkbi5uZXQ=.cjAmwN993isr8fb7KRXoiiKSmPi+tUdx6QzceuTmCRI=
x-hw: 1672501675.dop219.sk1.t,1672501675.cds251.sk1.hn,1672501675.cds251.sk1.c
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 069c09a74c8f7ae8409e60844b2cf07d
6ce866430b7e0b579378a7f10c1dbbd45ec95cdf
12bfafd537a26be5b4fe158a347c0e59477be02a9440c0e67b66fc81fe9b96a9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 069c09a74c8f7ae8409e60844b2cf07d
6ce866430b7e0b579378a7f10c1dbbd45ec95cdf
12bfafd537a26be5b4fe158a347c0e59477be02a9440c0e67b66fc81fe9b96a9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/normalize.css
200 OK 897 B URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/normalize.css
IP
File type ASCII text, with very long lines (1880)
Hash 8ca792972dc5202bd0a1ffd73769645f
d24a12992541a21bd6552ef17184ff6951c6e9cf
e7507a2706c28513cc4fc8a05c85ae7eea9e2a5937c2fcfd7a2e75b59390d605
GET /n/31/1/nz/chnel_chrsms/css/normalize.css HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/style.min.css
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: W/"63aac188-75b"
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: winq6QDzqi-R3qqhnphj1MRzJqC5GgJ3VPoi2jQ1FMixQdKsdzr7lQ==
lp.clientoffer.site/n/assets/images/row_logos/footer2_nz.png
200 OK 2.3 kB URL HTTP/1.1 lp.clientoffer.site/n/assets/images/row_logos/footer2_nz.png
IP
File type PNG image data, 220 x 72, 8-bit colormap, non-interlaced\012- data
Hash 3d004a0e32d29085c0302caf420fff84
65e7db5a7f07598b4e1ea1bc8a51b904d6071162
d1866f64c9ffc344d4ffc58b44931c0b80e60818148a26f7aec2d974ce3ea31f
GET /n/assets/images/row_logos/footer2_nz.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2285
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:29 GMT
ETag: "63aac189-8ed"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: JTv7j_bSRx06RoPHiFzPQXkNTPRUf64JRx_Cl0FvMoqnw386j0qBAA==
lp.clientoffer.site/assets/img/logo/qzt_white.png
200 OK 5.2 kB URL HTTP/1.1 lp.clientoffer.site/assets/img/logo/qzt_white.png
IP
File type PNG image data, 132 x 24, 8-bit/color RGBA, non-interlaced\012- data
Hash bb16bbfca8cdaa042353a79845eeba47
d9bd97b057f4434ecf041129ab978ecf2bec51ce
1639d12a6a23397077fe402a82cad1f71e15e811d621bc235f60a65960d38869
GET /assets/img/logo/qzt_white.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 5187
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:55:42 GMT
ETag: "63aac11e-1443"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: bjtVNdoGLq6iiyf-0mvxMBdZLUisDLgS_Wa7fP0MSclTXBl2H3fG6g==
lp.clientoffer.site/n/assets/images/row_logos/footer3_nz.png
200 OK 4.5 kB URL HTTP/1.1 lp.clientoffer.site/n/assets/images/row_logos/footer3_nz.png
IP
File type PNG image data, 220 x 72, 8-bit colormap, non-interlaced\012- data
Hash 514dab34eb59695f2332197b14570bf8
57138b592d78a273794c817948901525a24ff74e
fe41c791acd93aa5ff5401593ea3bd3e8fb7e96d83d801f9afdcf22d0495e212
GET /n/assets/images/row_logos/footer3_nz.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 4518
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:29 GMT
ETag: "63aac189-11a6"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 15d199af49035dc206cb81292fd87de2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Mq19fpn27TjBs-ZCactUjLk3d7utYrXGdxLjURgNaN8x7MsriZzZdQ==
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash fd709882d6200273f7b7891e681693ec
d008208872781332d7b05fc818caae50eda6f6a5
8cd1958e7f32cce8cfd0533371d7a97cbd4e51b9906fe347a4e2cc879ec2b647
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=118481
Date: Sat, 31 Dec 2022 15:47:55 GMT
Etag: "63af7793-1d7"
Expires: Mon, 02 Jan 2023 00:42:36 GMT
Last-Modified: Fri, 30 Dec 2022 23:43:15 GMT
Server: ECS (bsa/EB1F)
X-Cache: Miss from cloudfront
Via: 1.1 66be79bde9fd204b1a11f560cee8fff4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN1-C1
X-Amz-Cf-Id: HkO2tTbryBw9YD2fIoNVR8A3A0PyOHhkQ7CQDnkhjX5EXN8Do-_e1Q==
Age: 3561
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/prize-wap.png
200 OK 36 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/prize-wap.png
IP
File type PNG image data, 550 x 201, 8-bit colormap, non-interlaced\012- data
Hash 7b4d06654f183df2c0be9d95b1443fd0
1161750f545aa8a190e8f591d1c9fbe8330aa42d
8d3c33a3a914691d2004355dbaa7db3ffb68e35202e4fcec317838f887a3eed9
GET /n/31/1/nz/chnel_chrsms/img/prize-wap.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 35599
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-8b0f"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: hLahPrd1GAY2joaN4-wF8hd2m1RGaLHC1hEb08SD2M_YTHJA-h5a2Q==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/bottom.png
200 OK 379 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/bottom.png
IP
File type PNG image data, 2869 x 480, 8-bit colormap, non-interlaced\012- data
Size 379 kB (378863 bytes)
Hash 803c796d4e9d87ed3764ebad1c2d0573
d480250c9aa08b62f6ef67467c90b943dc7f531c
39695cf63cd8409e35334032fd9e05477d48e700d67c1e39ffa6e98a00acb50e
GET /n/31/1/nz/chnel_chrsms/img/bottom.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 378863
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-5c7ef"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: Rfup5QHRWNhWM-xS_g68F_wRqtYIWjupHCZkYSW8NugBACsXoAHvcA==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/title_image.gif
200 OK 173 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/title_image.gif
IP
File type GIF image data, version 89a, 180 x 167\012- data
Size 173 kB (173075 bytes)
Hash 0e77615b5a87c2d6e702cfbcafe3a8e8
f622439ab4bf8acff072d844fb122804984fd2fa
00d0a698dfab693ede9007638cdbf23cf51520b036e02e9b16d1d5c41ca96f71
GET /n/31/1/nz/chnel_chrsms/img/title_image.gif HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 173075
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:55 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-2a413"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 8ac66e1d6983a0f44cf391b1ec3b1cce.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: bgvqJuzuuM8WLVQ198xjqgSULtEGOOQ1j34SDx_NEhHe0cyJcZfopw==
st.formulead.com/assets/img/spinner/wait.gif
200 OK 7.3 kB URL HTTP/2 st.formulead.com/assets/img/spinner/wait.gif
IP
File type GIF image data, version 89a, 251 x 251\012- data
Hash aa3e0a4deade091fda5ee9c7271f01dd
1d2ece50cb5e3955f8fe0f917cc93315fb4044c1
d3ce5a72144a43c210ccb40dfcac8794ca3541be66e9b81b12468ab334c5b183
GET /assets/img/spinner/wait.gif HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/gif
content-length: 7331
server: nginx/1.19.0
date: Sat, 31 Dec 2022 07:53:15 GMT
last-modified: Fri, 23 Dec 2022 10:41:43 GMT
etag: "63a585e7-1ca3"
accept-ranges: bytes
access-control-allow-origin: *
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: g_Em5f4tR8xhEsInDOxoKa6MdLd38SCfcy2i0M6V_IKoznLlyaAwdw==
age: 28480
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 756c77d7d577e0260b6e1ffc3522e77a
2b7e2dd5b3df6768d0d7d20d67988ac60dc28234
1d1598a7f732980f6376fbadd56d71b4497454939a7b9e784adaa9c3f91883d4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash 756c77d7d577e0260b6e1ffc3522e77a
2b7e2dd5b3df6768d0d7d20d67988ac60dc28234
1d1598a7f732980f6376fbadd56d71b4497454939a7b9e784adaa9c3f91883d4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
200 OK 31 kB URL HTTP/2 fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 30928, version 1.0\012- data
Hash ac0d2859ea5f8fd6bcb3c305c08ec184
7f6c17e3e592cd8bd346b9cc261d8dd961b8aef7
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
GET /s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 30928
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 30 Dec 2022 07:08:09 GMT
expires: Sat, 30 Dec 2023 07:08:09 GMT
cache-control: public, max-age=31536000
age: 117586
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash fd709882d6200273f7b7891e681693ec
d008208872781332d7b05fc818caae50eda6f6a5
8cd1958e7f32cce8cfd0533371d7a97cbd4e51b9906fe347a4e2cc879ec2b647
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=114920
Date: Sat, 31 Dec 2022 15:47:55 GMT
Etag: "63af7793-1d7"
Expires: Sun, 01 Jan 2023 23:43:15 GMT
Last-Modified: Fri, 30 Dec 2022 23:43:15 GMT
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 fc6bcc0c05113295fc38d1c274344ae4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN1-C1
X-Amz-Cf-Id: ZzxEhiqkhFeYGuTJvFYJoo6S4tMbW6bql5j2aeCy9VBfXjlYeoOZbA==
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b8166fe0679d6ccf83bc7f27cb76f6a5
7c76f9e3b7cd828fd0bd9ddb3603e0f1c8fc6f23
d0799689c53c389718f8818863c88447440e69b8837264dbe7a24e62a746e1e2
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash fd709882d6200273f7b7891e681693ec
d008208872781332d7b05fc818caae50eda6f6a5
8cd1958e7f32cce8cfd0533371d7a97cbd4e51b9906fe347a4e2cc879ec2b647
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: 'max-age=158059'
Date: Sat, 31 Dec 2022 15:47:55 GMT
Etag: "63ae261c-1d7"
Server: ECS (dcb/7FA7)
X-Cache: Miss from cloudfront
Via: 1.1 66be79bde9fd204b1a11f560cee8fff4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN1-C1
X-Amz-Cf-Id: uo_dPTN-JwR_4wTAiDDWseC1L7tWYvBKmGBxeXi85rTP-ZwrJ0uRNg==
st.formulead.com/assets/img/recent_winners/image-8.png
200 OK 4.2 kB URL HTTP/2 st.formulead.com/assets/img/recent_winners/image-8.png
IP
File type PNG image data, 60 x 60, 8-bit colormap, non-interlaced\012- data
Hash b202b1398e6cc205e936c9fd002ef2fb
cb861ccbedab49db23ff63147da8ea452c20e47d
720ce8069fcfde7b31363457c468b21debd81cf49d31932069316f08a16da2be
GET /assets/img/recent_winners/image-8.png HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/png
content-length: 4186
server: nginx/1.19.0
last-modified: Fri, 23 Dec 2022 10:41:43 GMT
accept-ranges: bytes
access-control-allow-origin: *
date: Sat, 31 Dec 2022 14:25:40 GMT
etag: "63a585e7-105a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: dcbw8FDLrDtD20Cg-b25bi-dQJ6uvPg3m1kufyqBrYcAS86OraHabw==
age: 4935
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1bd023dafcf5b2d4d22f7efa367bcbdd
073efa44ab34f9ea62412e97b893348e51cff15f
4c4de1d5ae9fcee96984094b8d643c18deebeec366b24eb4dc194a7b253dd21d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4C4DE1D5AE9FCEE96984094B8D643C18DEEBEEC366B24EB4DC194A7B253DD21D"
Last-Modified: Fri, 30 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14265
Expires: Sat, 31 Dec 2022 19:45:40 GMT
Date: Sat, 31 Dec 2022 15:47:55 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1bd023dafcf5b2d4d22f7efa367bcbdd
073efa44ab34f9ea62412e97b893348e51cff15f
4c4de1d5ae9fcee96984094b8d643c18deebeec366b24eb4dc194a7b253dd21d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4C4DE1D5AE9FCEE96984094B8D643C18DEEBEEC366B24EB4DC194A7B253DD21D"
Last-Modified: Fri, 30 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18096
Expires: Sat, 31 Dec 2022 20:49:31 GMT
Date: Sat, 31 Dec 2022 15:47:55 GMT
Connection: keep-alive
st.formulead.com/assets/js/recent_winners.js
200 OK 5.1 kB URL HTTP/2 st.formulead.com/assets/js/recent_winners.js
IP
Hash 3a4265e56db4c23cfe7074ae0af38a8c
c7c294fee4db8641ba17392b76b3fd85c0fe74a2
463f30236a9d9b7b4d5feb5143f26f9d654ae58868893514353540822acb4137
GET /assets/js/recent_winners.js HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=utf8
server: nginx/1.19.0
last-modified: Fri, 23 Dec 2022 10:41:43 GMT
access-control-allow-origin: *
content-encoding: gzip
date: Sat, 31 Dec 2022 12:39:45 GMT
etag: W/"63a585e7-6d6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: LbycNBp0To27eqLJfl6_23MjOihILlAuEXCbAjUEWtyL4Jxa2TqP0Q==
age: 11290
X-Firefox-Spdy: h2
st.formulead.com/assets/img/recent_winners/image-38.png
500 Internal Server Error 522 B URL HTTP/2 st.formulead.com/assets/img/recent_winners/image-38.png
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (329), with CRLF line terminators
Hash 97d203efeeeff5102399ee7c48570914
15716370751a9f40a6bcfe56763a906e0b32951b
a7f1e040376f85232c54d6b349a8ed62fc58b71ff61642d23007c7f6284597f3
GET /assets/img/recent_winners/image-38.png HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 500 Internal Server Error
content-type: text/html; charset=utf8
server: nginx/1.19.0
date: Sat, 31 Dec 2022 15:47:55 GMT
access-control-allow-origin: *
x-cache: Error from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: wwTOWQQRofelSCmkyA0wQidlOWssOzl4qOLDb72XWF1Q4uDSrePZDA==
X-Firefox-Spdy: h2
cdn.formulead.com/v/country
200 OK 51 B URL HTTP/1.1 cdn.formulead.com/v/country
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 91440c116c92d75cfc02cd72bd060a82
591d3adc1d1d80e012b0dd0214df1f0438ae37f5
1b35c679adcfb2f8fbf92afcaf9f7a741f3c6273503a54b6c55448e1b2807c80
GET /v/country HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 51
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"33-WR063B0dgOASsN0CFN8fBDiuN/U"
set-cookie: qst.sid=s%3ATXm5p7h7haB-OCNtA5PF66xue0DZTh0G.mqhOf%2BKY7pckWRnBy8oBnFJINSetFBtaOsaMHVnA3e0; Path=/; HttpOnly
Vary: Accept-Encoding
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/p.js
200 OK 427 kB URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/p.js
IP
File type ASCII text, with very long lines (65536), with no line terminators
Size 427 kB (427033 bytes)
Hash 14a27bb82448d5d4c37c68482b18ab77
9e32016e8e584832a0782ec40da31554d8473c81
03380cef01d2b65c2fac4b9a3cd530130fbf5fae79d6d6a7b09e3f0f5ae8a673
GET /p/5bbb0ba263dcf80100a2e07f/p.js HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
set-cookie: lid=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
plc=5bbb0ba263dcf80100a2e07f; Path=/; Expires=Mon, 30 Dec 2024 15:47:56 GMT; Secure; SameSite=None
qst.sid=s%3ASLsV-MeOAeOhWWbGkrslfjCI0jyHN95v.u49DjNulUXLGlGxIjC7Pbcpupwh%2FFKEKrNib3adK0Lc; Path=/; HttpOnly
Vary: Accept-Encoding
Content-Encoding: gzip
cdn.formulead.com/css/main.min.css
200 OK 94 kB URL HTTP/1.1 cdn.formulead.com/css/main.min.css
IP
File type ASCII text, with very long lines (65518)
Hash 86544848beaffa1f00df85a64a709e4d
2f8ac448380daa4cf75c577c7717d7181a69dcee
d6793c514450f63e0eb467c41092148fac198e507f2d9b0e6768cfa41220aea5
GET /css/main.min.css HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Content-Type: text/css; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Accept-Ranges: bytes
Cache-Control: public, max-age=2678400
Last-Modified: Wed, 14 Dec 2022 14:06:03 GMT
ETag: W/"b267e-18510f4e4f8"
Vary: Accept-Encoding
Content-Encoding: gzip
lp.clientoffer.site/n/assets/fonts/myriad-pro/MyriadPro-Bold.woff
200 OK 53 kB URL HTTP/1.1 lp.clientoffer.site/n/assets/fonts/myriad-pro/MyriadPro-Bold.woff
IP
File type Web Open Font Format, CFF, length 52644, version 0.0\012- data
Hash c905542735ebc800162133d4d1b287f0
310e41e75eae30b80a96d8c9b8e6b46e5b798fcd
801f07cd82df4b98655a2aafd3c8fbb9f6fd1008c933e3ab491aef86e344bb82
Analyzer Verdict Alert fortinet Phishing
GET /n/assets/fonts/myriad-pro/MyriadPro-Bold.woff HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/style.min.css
HTTP/1.1 200 OK
Content-Type: application/font-woff
Content-Length: 52644
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 07:02:40 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:29 GMT
ETag: "63aac189-cda4"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 3HxHylV-V7DKYsUlxCJiNN0R6NL_f1mvE4DWvRzrsclqJ04VsFD0dA==
Age: 31516
lp.clientoffer.site/n/assets/images/row_logos/footer1_nz.png
200 OK 3.2 kB URL HTTP/1.1 lp.clientoffer.site/n/assets/images/row_logos/footer1_nz.png
IP
File type PNG image data, 220 x 72, 8-bit colormap, non-interlaced\012- data
Hash 39162ee3ea2d39ddad7e0ccaaec2fef0
19865467af4506403e4d9d06c582af983f8e459d
1d99768c06fc282fcb7093d897a77cb91e06807943c1159d67d0bcd97b80af13
GET /n/assets/images/row_logos/footer1_nz.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 3160
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:29 GMT
ETag: "63aac189-c58"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ibC6nAjFlu4rIJsfLk7xnM7VW_i4VJHEXZEl1HqOpqYTjFGGegQP_w==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/ribbon.png
200 OK 9.4 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/ribbon.png
IP
File type PNG image data, 207 x 169, 8-bit colormap, non-interlaced\012- data
Hash 87948d75e64f41e8692338975a2517dc
656bb3529fe78cee56503a2c90ae52bdbfafb598
6b11b397f711c81aaa035bf13b16b88437cc602767acc823e689c6c0cff03a44
GET /n/31/1/nz/chnel_chrsms/img/ribbon.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 9437
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-24dd"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 fc5e625db631bc657fc73f189d53fa14.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ZPdU40xH6RipMEOVhdRIUoWwJ5hIQSZI0qDFJiwSVpQmd6FQImMSxA==
lp.clientoffer.site/n/assets/fonts/myriad-pro/MyriadPro-Regular.woff
200 OK 52 kB URL HTTP/1.1 lp.clientoffer.site/n/assets/fonts/myriad-pro/MyriadPro-Regular.woff
IP
File type Web Open Font Format, CFF, length 51572, version 0.0\012- data
Hash 6a324f29ef3efabd2176f8b697ad71ed
dd696f0c713eb491c6e16bec9fda63f3f23999ba
6d64c461708b8f11e06451c96779d22fc2b8de582214c77493ecc57c32ede06e
Analyzer Verdict Alert fortinet Phishing
GET /n/assets/fonts/myriad-pro/MyriadPro-Regular.woff HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/style.min.css
HTTP/1.1 200 OK
Content-Type: application/font-woff
Content-Length: 51572
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 07:02:40 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:29 GMT
ETag: "63aac189-c974"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Via: 1.1 8ac66e1d6983a0f44cf391b1ec3b1cce.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 1zEgNk_EZLfDwWVBRK-xzJjQB9sBpeng9vye-KB69A4l2IFocxvo9w==
Age: 31516
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/background.jpg
200 OK 26 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/background.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2000x1125, components 3\012- data
Hash 7f802a34365848d376fd3e744ba852d6
9bb9fa4ce7f8778f9f16a7351dd5dd73df67abc6
547cce006112e8a42b99a9997ff3da108cbb15a9840b9eb09e3a3f20dc25a798
GET /n/31/1/nz/chnel_chrsms/img/background.jpg HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/css/main.css
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 26318
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-66ce"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 c26775cc34c23943f6f5cfc9a3da9b4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: kTn_DJZpiFcgP-q2IIIYTy7kw84x81mFSqVZO2csLmGtKHxFRvqpTg==
lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/prize.png
200 OK 83 kB URL HTTP/1.1 lp.clientoffer.site/n/31/1/nz/chnel_chrsms/img/prize.png
IP
File type PNG image data, 708 x 480, 8-bit colormap, non-interlaced\012- data
Hash c78c51d6c8d5412ccdc75bedca05e1ec
4efb0af5cb0bfce22b533f091fcdc2c5ff07c3d3
3b567286a528d14e2d445dba8a5f89666521d84fe82408bbbb7c60731b7993e4
GET /n/31/1/nz/chnel_chrsms/img/prize.png HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 82737
Connection: keep-alive
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Last-Modified: Tue, 27 Dec 2022 09:57:28 GMT
ETag: "63aac188-14331"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Via: 1.1 15d199af49035dc206cb81292fd87de2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: sxfPq_QCfxnDra6n3D7wZKlJYUGhK1m4KPG8q6WXOykkbLORSiNWKA==
lp.clientoffer.site/favicon.ico
200 OK 1.2 kB URL HTTP/1.1 lp.clientoffer.site/favicon.ico
IP
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 2b41416e68dcc31606e749cc9da0e7e4
7801b077f31134407e429aa5d3cfd65ed2197e59
934e627d59f1a7b1d98df885aa0d09603b4027b25d29e5ddeaadd15fdd318c6b
GET /favicon.ico HTTP/1.1
Host: lp.clientoffer.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://lp.clientoffer.site/n/31/1/nz/chnel_chrsms/no_teaser.html?p_id=5bbb0ba263dcf80100a2e07f&_c_id=aff_code:LDA;request_id:90544e0d548a12d62692e73ab606cbaf;aff_tid:;aff_goal_id:5671;aff_goal_id2:5672;aff_id:1339;aff_version:no_teaser;aff_adv_id:2;aff_offer_id:1180;aff_inc:chanel&_c_user=ld_first_name:;ld_last_name:;ld_email:;ld_phone_cell:&_c_loc=ld_zip_code:;ld_city:&_c_dob=ld_dob:&aff_click_id=&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=&aff_fbp=&aff_tt=dp&aff_ttp=&ch=&request_id=90544e0d548a12d62692e73ab606cbaf&aff_id=1339
HTTP/1.1 200 OK
Content-Type: image/x-icon
Content-Length: 1150
Connection: keep-alive
Server: nginx/1.19.0
Last-Modified: Tue, 27 Dec 2022 09:56:46 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Date: Sat, 31 Dec 2022 07:02:40 GMT
ETag: "63aac15e-47e"
X-Cache: Hit from cloudfront
Via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 8cIDmKUODT1ccg1GjhQHbERjRxViRAi-ivjgMrwFtkOmuaUM6T7gqw==
Age: 31516
st.formulead.com/assets/css/recent_winners.css
200 OK 509 B URL HTTP/2 st.formulead.com/assets/css/recent_winners.css
IP
Hash 634a0269bed8e02aab96a9009cfae89c
a3889b8a65e285833ae712c54d40cb543c4b1762
75268f05690280d2fb669232afd7051811f2021b89e77eee10044e1bd6c766ca
GET /assets/css/recent_winners.css HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: text/css
server: nginx/1.19.0
last-modified: Fri, 23 Dec 2022 10:41:43 GMT
access-control-allow-origin: *
content-encoding: gzip
date: Sat, 31 Dec 2022 14:50:46 GMT
etag: W/"63a585e7-461"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 92umssDoJVgo1SPA3t06Kv_PskgTfOdcVUQmrxC1tgiWO8ySzBvcFg==
age: 5635
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash ee3578369e7f711b440d7bfcb6f612ef
53b4e4113472c355154f1be36918952a8ae56f14
a5784782a853d49a26231d16b5254c9641cbd5c324265e4ec6019c1ba1c856da
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:56 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/recaptcha/api.js?render=6Le28S4hAAAAAA_HM_1PgW6fsQqLb2dZORF4Hbu-
200 OK 583 B URL HTTP/2 www.google.com/recaptcha/api.js?render=6Le28S4hAAAAAA_HM_1PgW6fsQqLb2dZORF4Hbu-
IP
File type ASCII text, with very long lines (884), with no line terminators
Hash 59f85f8f3f028d6a2adc2c336a1d4553
3d2f551f341a4376d62ee2725f4e0c626d1d4d27
69cb4b2d20c57dc80b36d623d7912977db11c4d806c8d8bcb17696db30f93927
GET /recaptcha/api.js?render=6Le28S4hAAAAAA_HM_1PgW6fsQqLb2dZORF4Hbu- HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Sat, 31 Dec 2022 15:47:56 GMT
date: Sat, 31 Dec 2022 15:47:56 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 583
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 3e81af3903c1ab8d3ca86e884ed4911f
8f6603230b3a178c101515a7d9c26c60c59085bb
b35d6540fc5a01ad99b53d222ee3977a6cf544d481f162431a9dd28f590c66bd
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:56 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.formulead.com/v/reverse-dns-lookup
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/v/reverse-dns-lookup
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /v/reverse-dns-lookup HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-lead-id
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=lp.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v&p_id=5bbb0ba263dcf80100a2e07f&aff_code=LDA&request_id=90544e0d548a12d62692e73ab606cbaf&aff_goal_id=5671&aff_goal_id2=5672&aff_id=1339&aff_version=no_teaser&aff_adv_id=2&aff_offer_id=1180&aff_inc=chanel&aff_tt=dp&sc_url=http%3A%2F%2Flp.clientoffer.site%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&sc_campaign_page=no_teaser.html&sc_campaign_path=%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2F&sc_campaign_domain=http%3A%2F%2Flp.clientoffer.site&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&stp=1&feed_type=initial
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=lp.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v&p_id=5bbb0ba263dcf80100a2e07f&aff_code=LDA&request_id=90544e0d548a12d62692e73ab606cbaf&aff_goal_id=5671&aff_goal_id2=5672&aff_id=1339&aff_version=no_teaser&aff_adv_id=2&aff_offer_id=1180&aff_inc=chanel&aff_tt=dp&sc_url=http%3A%2F%2Flp.clientoffer.site%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&sc_campaign_page=no_teaser.html&sc_campaign_path=%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2F&sc_campaign_domain=http%3A%2F%2Flp.clientoffer.site&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&stp=1&feed_type=initial
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=lp.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v&p_id=5bbb0ba263dcf80100a2e07f&aff_code=LDA&request_id=90544e0d548a12d62692e73ab606cbaf&aff_goal_id=5671&aff_goal_id2=5672&aff_id=1339&aff_version=no_teaser&aff_adv_id=2&aff_offer_id=1180&aff_inc=chanel&aff_tt=dp&sc_url=http%3A%2F%2Flp.clientoffer.site%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&sc_campaign_page=no_teaser.html&sc_campaign_path=%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2F&sc_campaign_domain=http%3A%2F%2Flp.clientoffer.site&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&stp=1&feed_type=initial HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-iivmxswc,x-request-id,x-session-id
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=lp.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v&p_id=5bbb0ba263dcf80100a2e07f&aff_code=LDA&request_id=90544e0d548a12d62692e73ab606cbaf&aff_goal_id=5671&aff_goal_id2=5672&aff_id=1339&aff_version=no_teaser&aff_adv_id=2&aff_offer_id=1180&aff_inc=chanel&aff_tt=dp&sc_url=http%3A%2F%2Flp.clientoffer.site%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&sc_campaign_page=no_teaser.html&sc_campaign_path=%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2F&sc_campaign_domain=http%3A%2F%2Flp.clientoffer.site&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&stp=1&feed_type=initial
200 OK 4.4 kB URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=lp.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v&p_id=5bbb0ba263dcf80100a2e07f&aff_code=LDA&request_id=90544e0d548a12d62692e73ab606cbaf&aff_goal_id=5671&aff_goal_id2=5672&aff_id=1339&aff_version=no_teaser&aff_adv_id=2&aff_offer_id=1180&aff_inc=chanel&aff_tt=dp&sc_url=http%3A%2F%2Flp.clientoffer.site%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&sc_campaign_page=no_teaser.html&sc_campaign_path=%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2F&sc_campaign_domain=http%3A%2F%2Flp.clientoffer.site&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&stp=1&feed_type=initial
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (18466), with no line terminators
Hash 550990604fae32d78186a98354f84fd6
7a1d639e9f63591a39e30fd10caaa665868ac11b
512e9a4976e2c54600113f92f6832af8426873a40fcd6933cf421c35192bfc7a
GET /p/5bbb0ba263dcf80100a2e07f/feed?sc_domain=lp.clientoffer.site&cl_ip=91.90.42.154&qb_placement_id=5bbb0ba263dcf80100a2e07f&qb_offer_id=5e1f1fd6db04380100ede242&qb_flow_id=5e1f1fd6db04380100ede242&qb_vendor_id=570e5c924ce290010026cc24&qb_country=NZ&ql_session_id=SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v&p_id=5bbb0ba263dcf80100a2e07f&aff_code=LDA&request_id=90544e0d548a12d62692e73ab606cbaf&aff_goal_id=5671&aff_goal_id2=5672&aff_id=1339&aff_version=no_teaser&aff_adv_id=2&aff_offer_id=1180&aff_inc=chanel&aff_tt=dp&sc_url=http%3A%2F%2Flp.clientoffer.site%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&sc_campaign_page=no_teaser.html&sc_campaign_path=%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2F&sc_campaign_domain=http%3A%2F%2Flp.clientoffer.site&sc_url_wl=https%3A%2F%2Flp.nectarjunkie.com%2Fn%2F31%2F1%2Fnz%2Fchnel_chrsms%2Fno_teaser.html&stp=1&feed_type=initial HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v.u49DjNulUXLGlGxIjC7Pbcpupwh/FKEKrNib3adK0Lc
X-Request-Id: 26bdf98b86966ce22743d8c5
X-iivmxswc: ee824528516d51fc429a8cd7bb66bbf9bf99b324ee33ad03327a4bcfaaeb9ad8
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Set-Cookie: stp=1; Path=/; Expires=Mon, 30 Dec 2024 15:47:56 GMT; Secure; SameSite=None
ck_tsp=2022-12-31T15%3A47%3A56.818Z; Path=/; Expires=Mon, 30 Dec 2024 15:47:56 GMT; Secure; SameSite=None
sip=91.90.42.154; Path=/; Expires=Mon, 30 Dec 2024 15:47:56 GMT; Secure; SameSite=None
ETag: W/"48ea-9veXdl+sfdO1XP8usKsF5MhhyJ8"
Vary: Accept-Encoding
Content-Encoding: gzip
cdn.formulead.com/v/reverse-dns-lookup
200 OK 16 B URL HTTP/1.1 cdn.formulead.com/v/reverse-dns-lookup
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
GET /v/reverse-dns-lookup HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Lead-Id: 26bdf98b86966ce22743d8c5
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:56 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
set-cookie: qst.sid=s%3A3FPsFifHQd-53iClGwhHlEBOpLLy2S0J.CNoUS14YhLYTMa0on2mDXMJYuObgeZ9eUxl8DVzt%2F74; Path=/; HttpOnly
Vary: Accept-Encoding
www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
200 OK 165 kB URL HTTP/2 www.gstatic.com/recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js
IP
File type ASCII text, with very long lines (658)
Size 165 kB (164706 bytes)
Hash 0b7fccb24ee065a01fdde10928c03c3f
9b198014f81844820588c202cc24bf5e03bf3dd7
68756de8f0d6742525ddaca56ab350e34d822777e86939fea27eb704ae013280
GET /recaptcha/releases/5qcenVbrhOy8zihcc2aHOWD4/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 164706
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 31 Dec 2022 02:17:53 GMT
expires: Sun, 31 Dec 2023 02:17:53 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 15 Dec 2022 05:24:10 GMT
content-type: text/javascript
age: 48603
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.formulead.com/fonts/Roboto-Regular.ttf
200 OK 171 kB URL HTTP/1.1 cdn.formulead.com/fonts/Roboto-Regular.ttf
IP
File type TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob\012- data
Size 171 kB (171272 bytes)
Hash 11eabca2251325cfc5589c9c6fb57b46
096c9245b6a192d1403a82848e104a65f578a8ec
017c0be9aaa6d0359737e1fa762ad304c0e0107927faff5a6c1f415c7f5244ed
GET /fonts/Roboto-Regular.ttf HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: https://cdn.formulead.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:57 GMT
Content-Type: font/ttf
Content-Length: 171272
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Accept-Ranges: bytes
Cache-Control: public, max-age=2678400
Last-Modified: Wed, 14 Dec 2022 14:06:03 GMT
ETag: W/"29d08-18510f4e4f8"
ocsp.digicert.com/
200 OK 279 B IP
Hash daa0e65bb240205bbc3eff4effac4481
3be89758ce96587749aada1a0bedbd43a7fb4884
f1ded74d9da65d31ee225168dd8da8658fe3adc5a082fa2339b995129406ebee
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=92931
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:57 GMT
Etag: "63af21b0-117"
Expires: Sun, 01 Jan 2023 17:36:48 GMT
Last-Modified: Fri, 30 Dec 2022 17:36:48 GMT
Server: nginx
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash daa0e65bb240205bbc3eff4effac4481
3be89758ce96587749aada1a0bedbd43a7fb4884
f1ded74d9da65d31ee225168dd8da8658fe3adc5a082fa2339b995129406ebee
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 0
Cache-Control: max-age=92931
Content-Type: application/ocsp-response
Date: Sat, 31 Dec 2022 15:47:57 GMT
Etag: "63af21b0-117"
Expires: Sun, 01 Jan 2023 17:36:48 GMT
Last-Modified: Fri, 30 Dec 2022 17:36:48 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 279
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?stp=1&feed_type=full
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?stp=1&feed_type=full
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /p/5bbb0ba263dcf80100a2e07f/feed?stp=1&feed_type=full HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-iivmxswc,x-request-id,x-session-id
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:57 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/t/errors
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/t/errors
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /t/errors HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-session-id
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:57 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/t/errors
200 OK 16 B URL HTTP/1.1 cdn.formulead.com/t/errors
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
POST /t/errors HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v.u49DjNulUXLGlGxIjC7Pbcpupwh/FKEKrNib3adK0Lc
Content-Type: application/json
Content-Length: 149
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:57 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
Vary: Accept-Encoding
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 2156f5045eb474b5c02d0c6f64f02c4e
5cc884658ca6b9b357478137cb431f694e773bd8
3e7eb661f6a47c44f20915b8384799874b0f0a69fcedd1d90caaed93f8fce4bb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3E7EB661F6A47C44F20915B8384799874B0F0A69FCEDD1D90CAAED93F8FCE4BB"
Last-Modified: Fri, 30 Dec 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9854
Expires: Sat, 31 Dec 2022 18:32:11 GMT
Date: Sat, 31 Dec 2022 15:47:57 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 2156f5045eb474b5c02d0c6f64f02c4e
5cc884658ca6b9b357478137cb431f694e773bd8
3e7eb661f6a47c44f20915b8384799874b0f0a69fcedd1d90caaed93f8fce4bb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3E7EB661F6A47C44F20915B8384799874B0F0A69FCEDD1D90CAAED93F8FCE4BB"
Last-Modified: Fri, 30 Dec 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9854
Expires: Sat, 31 Dec 2022 18:32:11 GMT
Date: Sat, 31 Dec 2022 15:47:57 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 2156f5045eb474b5c02d0c6f64f02c4e
5cc884658ca6b9b357478137cb431f694e773bd8
3e7eb661f6a47c44f20915b8384799874b0f0a69fcedd1d90caaed93f8fce4bb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3E7EB661F6A47C44F20915B8384799874B0F0A69FCEDD1D90CAAED93F8FCE4BB"
Last-Modified: Fri, 30 Dec 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9854
Expires: Sat, 31 Dec 2022 18:32:11 GMT
Date: Sat, 31 Dec 2022 15:47:57 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 2156f5045eb474b5c02d0c6f64f02c4e
5cc884658ca6b9b357478137cb431f694e773bd8
3e7eb661f6a47c44f20915b8384799874b0f0a69fcedd1d90caaed93f8fce4bb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3E7EB661F6A47C44F20915B8384799874B0F0A69FCEDD1D90CAAED93F8FCE4BB"
Last-Modified: Fri, 30 Dec 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9854
Expires: Sat, 31 Dec 2022 18:32:11 GMT
Date: Sat, 31 Dec 2022 15:47:57 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5a47c045-1085-41e2-ba44-5e8915e43f22.jpeg
200 OK 9.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5a47c045-1085-41e2-ba44-5e8915e43f22.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 880b9fddb758d9768872f16161c3f6e2
5c720512b75495a2f492d8b659a4623f117fd3fa
3d8df7cc6dba9573d9778aa200252266013ba6301e3083dc0ff8d6eb8e7cf73d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5a47c045-1085-41e2-ba44-5e8915e43f22.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9715
x-amzn-requestid: fef575f6-de9e-4ff0-ae9d-3f9b62c38875
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dnVpKHJIIAMFjBA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a60307-2f95164407ad2b51141e428c;Sampled=0
x-amzn-remapped-date: Fri, 23 Dec 2022 19:35:35 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: uVD2IH73Q_ex4WK9usDMFIZcwp4POPoPtS8hUKRvlE0Ll-tDHwCzXw==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Fri, 30 Dec 2022 21:54:16 GMT
age: 64421
etag: "5c720512b75495a2f492d8b659a4623f117fd3fa"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb1874564-89d0-4e8a-96f1-26aa13ef8307.jpeg
200 OK 7.1 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb1874564-89d0-4e8a-96f1-26aa13ef8307.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash aeb8f265207dab756973b9dacac29d05
bcc455a8e604fb95085b5a2feda165452240fe5b
80fcb11a40c9127d6452762b0ff859eefab572a0a804ddeef3fae04651f9a4da
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb1874564-89d0-4e8a-96f1-26aa13ef8307.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7149
x-amzn-requestid: 830ef706-5466-4589-951d-f0bb04059b33
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d42OPEOroAMFRwg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63ad03f4-1c7c3dab40e6732e7f647c48;Sampled=0
x-amzn-remapped-date: Thu, 29 Dec 2022 03:05:24 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: JWVDBfhKBp4LWHO4CUMZNd0J2kVCmXUdRvbPWml2v6A6sfiJ5L00Rg==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 31 Dec 2022 04:15:02 GMT
age: 41575
etag: "bcc455a8e604fb95085b5a2feda165452240fe5b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3e6c2763-3047-4d8a-adab-82148ff57727.jpeg
200 OK 7.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3e6c2763-3047-4d8a-adab-82148ff57727.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dc62c3ca8bc387a91c7d4711b5bc2409
7a984b459227e11984faa2539569a90875a58d29
e14a0e22b58fc1f3f392b842573e3abff7b24eb66db6b351046a186acc3b2954
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3e6c2763-3047-4d8a-adab-82148ff57727.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7660
x-amzn-requestid: 9338abf2-1191-47da-95ff-0a201604fbc2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d-sKCEDhoAMFZ4Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63af5a40-433f4ba9780dbc7a485ccbe9;Sampled=0
x-amzn-remapped-date: Fri, 30 Dec 2022 21:38:08 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: yR6kZT7use-SXKKXM3rRmo56EFDJN9VUcRSlzb0cG7nn_pblH0uL6g==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Fri, 30 Dec 2022 21:47:12 GMT
etag: "7a984b459227e11984faa2539569a90875a58d29"
content-type: image/jpeg
age: 64845
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F90ce2d9e-60b4-4010-9026-a4f7c9573dfa.jpeg
200 OK 9.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F90ce2d9e-60b4-4010-9026-a4f7c9573dfa.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1a747e4ba9f713788d8d9c13ba12d253
58726a734bd0c049ed38b760c8f235c918ac1dc4
8be489aafe2c6e61bdd234a28d9d9e0de96e9d04549e2c6638a6343112c29f55
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F90ce2d9e-60b4-4010-9026-a4f7c9573dfa.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9173
x-amzn-requestid: 36af4d98-e328-44ac-abdc-58f8bb3dec9e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: d-sLQEh0IAMF5wQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63af5a47-6ea74b1133d81bf312e5bdb2;Sampled=0
x-amzn-remapped-date: Fri, 30 Dec 2022 21:38:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 0dYlGS4Z1EAJ9y9W6pepgty5vl1f_GWzXaSSta1EXwdGex-yjjkxiw==
via: 1.1 56c69262ecfa7873b40572ba8a323242.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 30 Dec 2022 21:47:12 GMT
etag: "58726a734bd0c049ed38b760c8f235c918ac1dc4"
content-type: image/jpeg
age: 64845
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F25f9647b-a062-474a-96b2-0b04f5e0328c.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F25f9647b-a062-474a-96b2-0b04f5e0328c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c931888a790ebf9a456e6096ab46bd34
971c55aff0dbb01ac93a2c9649be6633880e09ac
ba3d85fe6776c7f329d5fdb1febdbd6f3c09317029851940e3c99aeaee8d2400
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F25f9647b-a062-474a-96b2-0b04f5e0328c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13299
x-amzn-requestid: f45ce04a-b0b1-4445-b6de-0f027bfc4264
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: duqbtEQ3oAMFnEA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a8f117-6bc757e462070f3670bd962e;Sampled=0
x-amzn-remapped-date: Mon, 26 Dec 2022 00:55:51 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 2YpfBFkjXKdQwei66w0MuxmmsFDk2CQuR84hiugyeAItYdg22rpQjQ==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Fri, 30 Dec 2022 16:16:32 GMT
age: 84685
etag: "971c55aff0dbb01ac93a2c9649be6633880e09ac"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4bc8a7ce-e487-4001-9bab-2d25955322df.jpeg
200 OK 5.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4bc8a7ce-e487-4001-9bab-2d25955322df.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2a353c18ba212595aecc2545eab8d351
f7bc83ddda7d7bae7f9668808f8a93c0403b7f37
c8cb7049ad48bf1dd92f6554b8b7dbaf0ed9be42ca8ef8502b99fd3b30eec913
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4bc8a7ce-e487-4001-9bab-2d25955322df.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5660
x-amzn-requestid: 37bd2994-2984-423f-8508-8e58646805b0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dlnrxH9ToAMF6CQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63a55317-7cce5fd0618ba2c56e80fc04;Sampled=0
x-amzn-remapped-date: Fri, 23 Dec 2022 07:04:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1SdkV5FiDgl2HgdRABoM-wUWzQGHpBYQ4NboKegb1BL0F11ROJELFA==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Sat, 31 Dec 2022 10:04:26 GMT
age: 20611
etag: "f7bc83ddda7d7bae7f9668808f8a93c0403b7f37"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
cdn.formulead.com/v/fingerprint-cache?vl_fp=391e872fcb1ac8f165404c80dff63646&vl_fp_cljs=803716228
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/v/fingerprint-cache?vl_fp=391e872fcb1ac8f165404c80dff63646&vl_fp_cljs=803716228
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /v/fingerprint-cache?vl_fp=391e872fcb1ac8f165404c80dff63646&vl_fp_cljs=803716228 HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-lead-id
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:57 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
event.trk-consulatu.com/register/event_log/zqd2ojv4ek
200 OK 0 B URL HTTP/2 event.trk-consulatu.com/register/event_log/zqd2ojv4ek
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /register/event_log/zqd2ojv4ek HTTP/1.1
Host: event.trk-consulatu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 31 Dec 2022 15:47:57 GMT
content-length: 0
access-control-allow-headers: content-type
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: http://lp.clientoffer.site
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-allow-methods: POST
access-control-max-age: 1800
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bcl0bHVz8Wmk0caiDjrWeoneRxwyxygP7T7YYlfEy2w1tbh0j%2BhJanAH%2Bsd%2BPVu9Q24grplsOFDIH3z5aeXyMgVvn5g9bsZ5Gpav%2BTaHBEo6JY8qD7pMbS6eWcPA2UMWa6LjldgrvXyfig%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7824281e5e2f7474-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.formulead.com/v/fingerprint-cache?vl_fp=391e872fcb1ac8f165404c80dff63646&vl_fp_cljs=803716228
200 OK 16 B URL HTTP/1.1 cdn.formulead.com/v/fingerprint-cache?vl_fp=391e872fcb1ac8f165404c80dff63646&vl_fp_cljs=803716228
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
GET /v/fingerprint-cache?vl_fp=391e872fcb1ac8f165404c80dff63646&vl_fp_cljs=803716228 HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Lead-Id: 26bdf98b86966ce22743d8c5
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f; stp=1; ck_tsp=2022-12-31T15%3A47%3A56.818Z; sip=91.90.42.154
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:57 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
set-cookie: qst.sid=s%3AdwIt1XwBcxi2uu1zzzXrNSgcpKMHkOP5.kuzF1gV%2BPX8suSpqD%2Fn2lKFl1JDZAcIBl12f7mwqC%2BM; Path=/; HttpOnly
Vary: Accept-Encoding
cdn.formulead.com/t/page
200 OK 2 B IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /t/page HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-session-id
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:58 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
event.trk-consulatu.com/register/event_log/zqd2ojv4ek
200 OK 0 B URL HTTP/2 event.trk-consulatu.com/register/event_log/zqd2ojv4ek
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /register/event_log/zqd2ojv4ek HTTP/1.1
Host: event.trk-consulatu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://lp.clientoffer.site/
Content-type: application/json
Origin: http://lp.clientoffer.site
Content-Length: 103
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sat, 31 Dec 2022 15:47:58 GMT
content-length: 0
expires: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
x-pushplatformapp-params:
content-security-policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-pushplatformapp-alert: pushPlatformApp.pushSubscription.deleted
x-frame-options: DENY
access-control-expose-headers: Authorization, Link, X-Total-Count
access-control-allow-origin: http://lp.clientoffer.site
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials: true
x-content-type-options: nosniff
feature-policy: geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d6lbqLDeLHytXvY84U%2F%2ForcDUWx6uxgxJhiiamL5qhH5S5dqQn6WM4najf5oDA%2BAy7bCQxxuwLCiaugQ0StIQfG5zPTN1U%2Fjyp4MCyXhgLf2vRFYUaVvWNSDvGXbP97JT7TXLI68lJF4Kg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7824281f2ef47474-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 29 Dec 2022 21:48:03 GMT
expires: Fri, 29 Dec 2023 21:48:03 GMT
cache-control: public, max-age=31536000
age: 151195
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Hash 285467176f7fe6bb6a9c6873b3dad2cc
ea04e4ff5142ddd69307c183def721a160e0a64e
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 29 Dec 2022 16:40:43 GMT
expires: Fri, 29 Dec 2023 16:40:43 GMT
cache-control: public, max-age=31536000
age: 169635
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdn.formulead.com/v/recaptcha3?token=03AD1IbLAI0dlXTzAyeQLCEsG7QfvB7UE-Ro4hJbDdsXPJgAJGmBuu2JQ5C1v29zyxWtGt8CkUK-U9dknJvHsPpCm8GDoYPJeVii5v8OXKzJMhemVIOJX98DHrUH8jtKd6tgUk6HoBeDeecM_yv5OkwP-bBpBIiRYsXa_c9Rpjqaed1aA74-gEmZvqmP0bCSUVPMBj9H96cQUte-cKn5ElbVZJIPPaBLo0YInL1NLlPotAZf1N-wY2G0hhz7DjPMkJqFzj9Izxn5x-WEeFyElMKbAt7zC0qcsVlXbzB1U73V-M5FYy4bmWu-J3HOXU6wR-9fU_44JjOskSyrwrGgjj6w7EkbgJpUPFsqgErQTEP4ruzJJxH5rjC6H3EnuSV6MLt62rbBLINwJe-nclxlbHc7Tyuy3lpz0w3dpuxrbWFZ-AX-29ncEyb7LoVZyUUzEdL1nqJ4-NYeQRCH1kGX3cvevR6aup20CuohpK0j70eOcoeHEINApm6XRlTHQjVYNrUQxTbAjFKdD52ehpEPSKXRIJxAzu_GG1vw&step=1
200 OK 2 B URL HTTP/1.1 cdn.formulead.com/v/recaptcha3?token=03AD1IbLAI0dlXTzAyeQLCEsG7QfvB7UE-Ro4hJbDdsXPJgAJGmBuu2JQ5C1v29zyxWtGt8CkUK-U9dknJvHsPpCm8GDoYPJeVii5v8OXKzJMhemVIOJX98DHrUH8jtKd6tgUk6HoBeDeecM_yv5OkwP-bBpBIiRYsXa_c9Rpjqaed1aA74-gEmZvqmP0bCSUVPMBj9H96cQUte-cKn5ElbVZJIPPaBLo0YInL1NLlPotAZf1N-wY2G0hhz7DjPMkJqFzj9Izxn5x-WEeFyElMKbAt7zC0qcsVlXbzB1U73V-M5FYy4bmWu-J3HOXU6wR-9fU_44JjOskSyrwrGgjj6w7EkbgJpUPFsqgErQTEP4ruzJJxH5rjC6H3EnuSV6MLt62rbBLINwJe-nclxlbHc7Tyuy3lpz0w3dpuxrbWFZ-AX-29ncEyb7LoVZyUUzEdL1nqJ4-NYeQRCH1kGX3cvevR6aup20CuohpK0j70eOcoeHEINApm6XRlTHQjVYNrUQxTbAjFKdD52ehpEPSKXRIJxAzu_GG1vw&step=1
IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /v/recaptcha3?token=03AD1IbLAI0dlXTzAyeQLCEsG7QfvB7UE-Ro4hJbDdsXPJgAJGmBuu2JQ5C1v29zyxWtGt8CkUK-U9dknJvHsPpCm8GDoYPJeVii5v8OXKzJMhemVIOJX98DHrUH8jtKd6tgUk6HoBeDeecM_yv5OkwP-bBpBIiRYsXa_c9Rpjqaed1aA74-gEmZvqmP0bCSUVPMBj9H96cQUte-cKn5ElbVZJIPPaBLo0YInL1NLlPotAZf1N-wY2G0hhz7DjPMkJqFzj9Izxn5x-WEeFyElMKbAt7zC0qcsVlXbzB1U73V-M5FYy4bmWu-J3HOXU6wR-9fU_44JjOskSyrwrGgjj6w7EkbgJpUPFsqgErQTEP4ruzJJxH5rjC6H3EnuSV6MLt62rbBLINwJe-nclxlbHc7Tyuy3lpz0w3dpuxrbWFZ-AX-29ncEyb7LoVZyUUzEdL1nqJ4-NYeQRCH1kGX3cvevR6aup20CuohpK0j70eOcoeHEINApm6XRlTHQjVYNrUQxTbAjFKdD52ehpEPSKXRIJxAzu_GG1vw&step=1 HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-lead-id
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:58 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/v/recaptcha3?token=03AD1IbLAI0dlXTzAyeQLCEsG7QfvB7UE-Ro4hJbDdsXPJgAJGmBuu2JQ5C1v29zyxWtGt8CkUK-U9dknJvHsPpCm8GDoYPJeVii5v8OXKzJMhemVIOJX98DHrUH8jtKd6tgUk6HoBeDeecM_yv5OkwP-bBpBIiRYsXa_c9Rpjqaed1aA74-gEmZvqmP0bCSUVPMBj9H96cQUte-cKn5ElbVZJIPPaBLo0YInL1NLlPotAZf1N-wY2G0hhz7DjPMkJqFzj9Izxn5x-WEeFyElMKbAt7zC0qcsVlXbzB1U73V-M5FYy4bmWu-J3HOXU6wR-9fU_44JjOskSyrwrGgjj6w7EkbgJpUPFsqgErQTEP4ruzJJxH5rjC6H3EnuSV6MLt62rbBLINwJe-nclxlbHc7Tyuy3lpz0w3dpuxrbWFZ-AX-29ncEyb7LoVZyUUzEdL1nqJ4-NYeQRCH1kGX3cvevR6aup20CuohpK0j70eOcoeHEINApm6XRlTHQjVYNrUQxTbAjFKdD52ehpEPSKXRIJxAzu_GG1vw&step=1
200 OK 166 B URL HTTP/1.1 cdn.formulead.com/v/recaptcha3?token=03AD1IbLAI0dlXTzAyeQLCEsG7QfvB7UE-Ro4hJbDdsXPJgAJGmBuu2JQ5C1v29zyxWtGt8CkUK-U9dknJvHsPpCm8GDoYPJeVii5v8OXKzJMhemVIOJX98DHrUH8jtKd6tgUk6HoBeDeecM_yv5OkwP-bBpBIiRYsXa_c9Rpjqaed1aA74-gEmZvqmP0bCSUVPMBj9H96cQUte-cKn5ElbVZJIPPaBLo0YInL1NLlPotAZf1N-wY2G0hhz7DjPMkJqFzj9Izxn5x-WEeFyElMKbAt7zC0qcsVlXbzB1U73V-M5FYy4bmWu-J3HOXU6wR-9fU_44JjOskSyrwrGgjj6w7EkbgJpUPFsqgErQTEP4ruzJJxH5rjC6H3EnuSV6MLt62rbBLINwJe-nclxlbHc7Tyuy3lpz0w3dpuxrbWFZ-AX-29ncEyb7LoVZyUUzEdL1nqJ4-NYeQRCH1kGX3cvevR6aup20CuohpK0j70eOcoeHEINApm6XRlTHQjVYNrUQxTbAjFKdD52ehpEPSKXRIJxAzu_GG1vw&step=1
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 8e172950a164f9f9d5065e00dae9ad49
ee23168759f5875061b45b42fb876f7002a80dec
9520ff33284faca4ae151c57f03e08714ed9c794d253e747ad8613abd1d4d253
GET /v/recaptcha3?token=03AD1IbLAI0dlXTzAyeQLCEsG7QfvB7UE-Ro4hJbDdsXPJgAJGmBuu2JQ5C1v29zyxWtGt8CkUK-U9dknJvHsPpCm8GDoYPJeVii5v8OXKzJMhemVIOJX98DHrUH8jtKd6tgUk6HoBeDeecM_yv5OkwP-bBpBIiRYsXa_c9Rpjqaed1aA74-gEmZvqmP0bCSUVPMBj9H96cQUte-cKn5ElbVZJIPPaBLo0YInL1NLlPotAZf1N-wY2G0hhz7DjPMkJqFzj9Izxn5x-WEeFyElMKbAt7zC0qcsVlXbzB1U73V-M5FYy4bmWu-J3HOXU6wR-9fU_44JjOskSyrwrGgjj6w7EkbgJpUPFsqgErQTEP4ruzJJxH5rjC6H3EnuSV6MLt62rbBLINwJe-nclxlbHc7Tyuy3lpz0w3dpuxrbWFZ-AX-29ncEyb7LoVZyUUzEdL1nqJ4-NYeQRCH1kGX3cvevR6aup20CuohpK0j70eOcoeHEINApm6XRlTHQjVYNrUQxTbAjFKdD52ehpEPSKXRIJxAzu_GG1vw&step=1 HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Lead-Id: 26bdf98b86966ce22743d8c5
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f; stp=1; ck_tsp=2022-12-31T15%3A47%3A56.818Z; sip=91.90.42.154
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:58 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 166
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"a6-7iMWh1n1h1BhtFtC+4dvcAKoDew"
set-cookie: qst.sid=s%3Ah_Kit7sBGOc9VsM-Sp3ehhmmLa5gMvZ9.r5UT%2B7NR%2FMCeMnaLb%2FLo4iHNacoZz99bE2CraXI7Otk; Path=/; HttpOnly
Vary: Accept-Encoding
cdn.formulead.com/t/vdt
200 OK 2 B IP
File type ASCII text, with no line terminators
Hash e0aa021e21dddbd6d8cecec71e9cf564
9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
OPTIONS /t/vdt HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-ofvuinwk,x-session-id,x-zqhkygow
Referer: http://lp.clientoffer.site/
Origin: http://lp.clientoffer.site
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:58 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
Vary: Accept-Encoding
cdn.formulead.com/t/vdt
200 OK 16 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
POST /t/vdt HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v.u49DjNulUXLGlGxIjC7Pbcpupwh/FKEKrNib3adK0Lc
Content-Type: application/json
x-zqhkygow: aea095746b412c304b1e8a6705197b520a6c7e7252cffb4fdf171bc20ff2b2b5
x-ofvuinwk: dc077a8f657448755c7df95e2303e9b1a31965639f2be07c6d4622def88aaa34
Content-Length: 1855
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:47:58 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
Vary: Accept-Encoding
cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?stp=1&feed_type=full
200 OK 21 kB URL HTTP/1.1 cdn.formulead.com/p/5bbb0ba263dcf80100a2e07f/feed?stp=1&feed_type=full
IP
File type Unicode text, UTF-8 text, with very long lines (65316), with no line terminators
Hash 740a93747251fbda8e3c3c62c3661c9b
304221e9ca3a73e6b4cb072877fda0f78dc71e69
6dd57cffd8fa62ea694c56be3361e13a375586a2afeb23391059678094fea4b4
GET /p/5bbb0ba263dcf80100a2e07f/feed?stp=1&feed_type=full HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v.u49DjNulUXLGlGxIjC7Pbcpupwh/FKEKrNib3adK0Lc
X-Request-Id: 26bdf98b86966ce22743d8c5
X-iivmxswc: ee824528516d51fc429a8cd7bb66bbf9bf99b324ee33ad03327a4bcfaaeb9ad8
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Cookie: plc=5bbb0ba263dcf80100a2e07f; stp=1; ck_tsp=2022-12-31T15%3A47%3A56.818Z; sip=91.90.42.154
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:48:01 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
ETag: W/"188d0-WX4P+cMgfnkYgkcBczUzaLcr7/0"
Vary: Accept-Encoding
Content-Encoding: gzip
cdn.formulead.com/t/page
200 OK 16 B IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
POST /t/page HTTP/1.1
Host: cdn.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Session-Id: s:SLsV-MeOAeOhWWbGkrslfjCI0jyHN95v.u49DjNulUXLGlGxIjC7Pbcpupwh/FKEKrNib3adK0Lc
Content-Type: application/json
Content-Length: 143
Origin: http://lp.clientoffer.site
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 31 Dec 2022 15:48:02 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: http://lp.clientoffer.site
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type, X-CSRF-Token, X-Session-Id, X-Offer-Id, X-Flow-Id, X-Flow_Id, X-Placement-Id, X-Placement_Id, X-Lead-Id, X-Sig, X-iivmxswc, X-Request-id, X-zqhkygow, X-ofvuinwk
Pragma: no-cache
Cache-Control: no-cache
ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
Vary: Accept-Encoding
st.formulead.com/assets/js/helpers.js
200 OK 0 B URL HTTP/2 st.formulead.com/assets/js/helpers.js
IP
GET /assets/js/helpers.js HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=utf8
server: nginx/1.19.0
last-modified: Fri, 23 Dec 2022 10:41:43 GMT
access-control-allow-origin: *
content-encoding: gzip
date: Sat, 31 Dec 2022 00:54:22 GMT
etag: W/"63a585e7-11fa2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: JEDCzbc94W-xK8Bcjm9kx55a_6oFkNz_dvm0cU73CzteRe-qYinKIw==
age: 53613
X-Firefox-Spdy: h2
st.formulead.com/assets/js/bioep.min.js
200 OK 0 B URL HTTP/2 st.formulead.com/assets/js/bioep.min.js
IP
GET /assets/js/bioep.min.js HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=utf8
server: nginx/1.19.0
last-modified: Fri, 23 Dec 2022 10:41:43 GMT
access-control-allow-origin: *
content-encoding: gzip
date: Sat, 31 Dec 2022 14:50:46 GMT
etag: W/"63a585e7-14c4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 3wnLS2U-FmsTnvbxSZV5Yw4pMi-omUdZXmnrH-CiJNULDpvBX60Bdw==
age: 5672
X-Firefox-Spdy: h2
st.formulead.com/assets/img/recent_winners/image-24.png
500 Internal Server Error 0 B URL HTTP/2 st.formulead.com/assets/img/recent_winners/image-24.png
IP
GET /assets/img/recent_winners/image-24.png HTTP/1.1
Host: st.formulead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 500 Internal Server Error
content-type: text/html; charset=utf8
server: nginx/1.19.0
date: Sat, 31 Dec 2022 15:47:55 GMT
access-control-allow-origin: *
x-cache: Error from cloudfront
via: 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: jOHrIC8tV2mMK0MCw7-I44akUgtbgOF3xvwEWmUTyot3u4Zi9ewNpA==
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Montserrat:400,700
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Montserrat:400,700
IP
GET /css?family=Montserrat:400,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 31 Dec 2022 15:47:55 GMT
date: Sat, 31 Dec 2022 15:47:55 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
trk-consulatu.com/scripts/push/script/z75dnkdk4q?url=lp.clientoffer.site
200 OK 0 B URL HTTP/2 trk-consulatu.com/scripts/push/script/z75dnkdk4q?url=lp.clientoffer.site
IP
GET /scripts/push/script/z75dnkdk4q?url=lp.clientoffer.site HTTP/1.1
Host: trk-consulatu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://lp.clientoffer.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 31 Dec 2022 15:47:57 GMT
content-type: application/javascript;charset=UTF-8
expires: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-xss-protection: 1; mode=block
pragma: no-cache
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
content-security-policy: default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-content-type-options: nosniff
feature-policy: geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6UfxrrkD6nJQLCk2EVrFTUnV3z%2FFpzFqThKl0J4LpusrfUJEvh1tSpr%2FjIR4lGNUyn8DwyY3p99si8xDJcOfWdoF6e%2FNN9L1brCofmFHNcVxL%2BZCA%2FJIds%2FvEuOHgogjiaLZPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7824281b0b7a748c-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
54.230.111.111
93.184.220.29
34.78.252.25
23.33.119.27
0.0.0.0