r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5ceaca9fd4ad000cb435820812fc69c8
8168397aaf7b572c89a9c83f46c0b65e4ac509f2
9c4e52e7e17158307d752db0bc3d1fbedae4f305cc301fd73b260f73ab796492
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9C4E52E7E17158307D752DB0BC3D1FBEDAE4F305CC301FD73B260F73AB796492"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4145
Expires: Tue, 06 Dec 2022 19:13:55 GMT
Date: Tue, 06 Dec 2022 18:04:50 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash f83c5e33ba42e312ee398848bbb711f5
caa1fd23b1fbbe883292ded04404c1cfd861eb09
106d08fba45f1e13f85b4b5abc456594878494238933e54b6a06e21ed8a52bc9
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6149
Cache-Control: max-age=151737
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:04:50 GMT
Etag: "638f19f6-1d7"
Expires: Thu, 08 Dec 2022 12:13:47 GMT
Last-Modified: Tue, 06 Dec 2022 10:31:18 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a0abf10fb7e96c1c98dacf2f013a68b4
acdd839bce85eadc78a8e821e32e00a958d5c0c8
b85d98f8df05431777d96c767ce4c152302ec3f653cdf6e61c8c3fa9574f3255
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B85D98F8DF05431777D96C767CE4C152302EC3F653CDF6E61C8C3FA9574F3255"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6586
Expires: Tue, 06 Dec 2022 19:54:36 GMT
Date: Tue, 06 Dec 2022 18:04:50 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 06 Dec 2022 17:18:40 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2770
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: KCSg3tkTrMtUvvlsxNDmT6z5rOLpzj+AIl9PtDWvzRRmwYNFIYy8ArQ/YP/a7rYh2TXvsShZ30Y=
x-amz-request-id: 34CFSYA382DMSPBX
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 06 Dec 2022 17:47:11 GMT
age: 1059
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
mkkuei4kdsz.com/249/834.html
200 OK 329 B URL HTTP/1.1 mkkuei4kdsz.com/249/834.html
IP
ASN #14061 DIGITALOCEAN-ASN
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash ecbcb8bae64098de3e587487b474f8b8
e275409fb40ea27c3826af493f70faf147d0f995
2597a3f2418586d8a9fb0764743a84486ba066c6af3ff194922fb6c65a783688
Analyzer Verdict Alert quad9 Sinkholed
GET /249/834.html HTTP/1.1
Host: mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Tue, 06 Dec 2022 18:04:50 GMT
content-type: text/html
last-modified: Wed, 12 Jan 2022 17:20:45 GMT
etag: W/"61df0ded-1ad"
content-encoding: gzip
transfer-encoding: chunked
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 06 Dec 2022 18:04:50 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash 3f4ef8a54bffe08abfd72fbbe3b259e8
28770087be63936aabfdd9d802739767c8fca454
642f68596c1c285397713d2b1147f77a94a5e2eadcb8b18632133f1f87276639
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 587
Cache-Control: max-age=95400
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:04:50 GMT
Etag: "638e539f-118"
Expires: Wed, 07 Dec 2022 20:34:50 GMT
Last-Modified: Mon, 05 Dec 2022 20:25:03 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 280
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
200 OK 28 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
File type ASCII text, with very long lines (65451)
Hash 4b5f47439b640180cc3450f7de05d0d8
5a0dc9bcab80ddc409dd35fcb00a88fe6846fee2
1f85e8b327f42c17c025d69849914068536d9aa95412fe473ae90ffb2f4ebd82
GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://mkkuei4kdsz.com
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:04:50 GMT
content-type: application/javascript; charset=utf-8
content-length: 27958
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb09ed3-15d84"
last-modified: Mon, 04 May 2020 23:01:39 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 15793594
expires: Sun, 26 Nov 2023 18:04:50 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rbydu8%2F0ySsHjQ8ScKjWPjbJcN1eyFdtRS6FjfXpJDy5Dl14D%2Br%2B%2BCITJJS2xZ9kudPetyvQeXtCqmRbxM5BINjXNerheaVwHnXrfNlnYZutDiYKX%2FjmA2Z1qm5PMVidD0iR%2F5K0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7756f2422b48fab8-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash 3f4ef8a54bffe08abfd72fbbe3b259e8
28770087be63936aabfdd9d802739767c8fca454
642f68596c1c285397713d2b1147f77a94a5e2eadcb8b18632133f1f87276639
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 587
Cache-Control: max-age=95400
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:04:50 GMT
Etag: "638e539f-118"
Expires: Wed, 07 Dec 2022 20:34:50 GMT
Last-Modified: Mon, 05 Dec 2022 20:25:03 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 280
e1.o.lencr.org/
200 OK 345 B IP
ASN #20940 Akamai International B.V.
Hash 4f327dfecc0976673051f54c75f88b81
e64f125e28a2d7f7fb674389b4ab526f0039e938
1cad3f7552acfc2dd19247e10f21faad29352f8f8c0d0f274a480a219f88b1d4
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "1CAD3F7552ACFC2DD19247E10F21FAAD29352F8F8C0D0F274A480A219F88B1D4"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19004
Expires: Tue, 06 Dec 2022 23:21:35 GMT
Date: Tue, 06 Dec 2022 18:04:51 GMT
Connection: keep-alive
mkkuei4kdsz.com/favicon.ico
200 OK 329 B URL HTTP/1.1 mkkuei4kdsz.com/favicon.ico
IP
ASN #14061 DIGITALOCEAN-ASN
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash ecbcb8bae64098de3e587487b474f8b8
e275409fb40ea27c3826af493f70faf147d0f995
2597a3f2418586d8a9fb0764743a84486ba066c6af3ff194922fb6c65a783688
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/249/834.html
HTTP/1.1 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Tue, 06 Dec 2022 18:04:51 GMT
content-type: text/html
last-modified: Wed, 12 Jan 2022 17:20:45 GMT
etag: W/"61df0ded-1ad"
content-encoding: gzip
transfer-encoding: chunked
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 06 Dec 2022 17:08:58 GMT
cache-control: public,max-age=3600
age: 3353
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 0f7dcaa590e32cfd1c075255188d5f06
d4bb4954fefdb3b59560b54adf500e806e252e39
195795c2511b31519134f5eb4442d8708918ecaff72f8e821a5473ad7c97c448
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 157
Cache-Control: max-age=140676
Content-Type: application/ocsp-response
Date: Tue, 06 Dec 2022 18:04:51 GMT
Etag: "638f062a-1d7"
Expires: Thu, 08 Dec 2022 09:09:27 GMT
Last-Modified: Tue, 06 Dec 2022 09:06:50 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471
domaincntrol.com/?orighost=http://mkkuei4kdsz.com/249/834.html
200 OK 28 B URL HTTP/2 domaincntrol.com/?orighost=http://mkkuei4kdsz.com/249/834.html
IP
File type ASCII text, with no line terminators
Hash 7aae16ed70d2e07943585bbb1cd02b55
3209123510c034e6e38ca45edf14307f1375a8f5
51bfb53a70df6adc48f0670be59a16a657ab5a2bafc176973a32d5c36a4fc5d3
GET /?orighost=http://mkkuei4kdsz.com/249/834.html HTTP/1.1
Host: domaincntrol.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://mkkuei4kdsz.com
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Tue, 06 Dec 2022 18:04:51 GMT
content-type: text/javascript;charset=UTF-8
content-length: 28
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gnu6%2BzH0akUF7yz%2FBpA1PXMVXxHwfmbgtxvWI2qAipWoI%2Ff2VcULDq7ImGvWveV%2F1kSn9I3dfi8efvbofcG9aNm9DwG%2FW%2F2U47vbUr4rBXe7S1pEd%2B5XOanrD5oE8HRXMQc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7756f243acbb0b59-OSL
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: NrPL2CWsHZV8BCwEn5LVzg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 8ppbGgRZyFsw5EZJlsAOEqpHJfo=
ww2.mkkuei4kdsz.com/
200 OK 1.4 kB IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (700)
Hash 6754cad7f197985adce534546df351e4
9fa33538d75f497d78b2a67375bb4db2121c384c
d7c3e30e83c8da3701d23eca828466beff1a5a5fb6f521076a26ca9414054b49
Analyzer Verdict Alert fortinet Malware
quad9 Sinkholed
GET / HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mkkuei4kdsz.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
date: Tue, 06 Dec 2022 18:04:52 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_zfi2IAQMFhbeJz7TohoVHVtJWU2hwm7Lrp9mU2CS1tg8fh6Um4KcOzzYJ6LQkNLWAjiGBQP1WU+h5qP7TrTizQ==
last-modified: Tue, 06 Dec 2022 18:04:51 GMT
x-cache-miss-from: parking-d7dbd8c4d-hwmjh
server: NginX
content-encoding: gzip
img.sedoparking.com/images/js_preloader.gif
200 OK 4.3 kB URL HTTP/1.1 img.sedoparking.com/images/js_preloader.gif
IP
File type GIF image data, version 89a, 16 x 16\012- data
Hash 90c93102a88c2ab94bff1575b7a6e86e
56d71bf13de464534643db9d127629a0a3bf677a
5f6ad7031600056b578a6e8c6b34bc718d13125cc8256aa4a9050e549576f81a
GET /images/js_preloader.gif HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww2.mkkuei4kdsz.com/
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:52 GMT
Content-Type: image/gif
Content-Length: 4254
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Expires: Tue, 13 Dec 2022 18:04:52 GMT
X-CFHash: "90c93102a88c2ab94bff1575b7a6e86e"
X-CFF: B
Last-Modified: Fri, 15 Mar 2019 12:24:07 GMT
X-CF3: H
CF4Age: 156700
x-cf-tsc: 1648179742
CF4ttl: 31536000.000
X-CF2: H
Server: CFS 0215
X-CF-ReqID: a435f4ecec8e5172b7dfae8b2e786f54
X-CF1: 11696:fA.arn1:cf:cacheN.arn1-01:H
Accept-Ranges: bytes
ww2.mkkuei4kdsz.com/search/tsc.php?200=MzgzNDQ1ODM3&21=OTEuOTAuNDIuMTU0&681=MTY3MDM0OTg5MmNlZDE3MjQyNTA2MDI4NmRjNTVjYmRmZTUwYWI2MDA0&crc=f47b9c7126283d0501189b0105b5f1a1287abdb9&cv=1
200 OK 0 B URL HTTP/1.1 ww2.mkkuei4kdsz.com/search/tsc.php?200=MzgzNDQ1ODM3&21=OTEuOTAuNDIuMTU0&681=MTY3MDM0OTg5MmNlZDE3MjQyNTA2MDI4NmRjNTVjYmRmZTUwYWI2MDA0&crc=f47b9c7126283d0501189b0105b5f1a1287abdb9&cv=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /search/tsc.php?200=MzgzNDQ1ODM3&21=OTEuOTAuNDIuMTU0&681=MTY3MDM0OTg5MmNlZDE3MjQyNTA2MDI4NmRjNTVjYmRmZTUwYWI2MDA0&crc=f47b9c7126283d0501189b0105b5f1a1287abdb9&cv=1 HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww2.mkkuei4kdsz.com/
HTTP/1.1 200 OK
date: Tue, 06 Dec 2022 18:04:52 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/8.1.9
x-cache-miss-from: parking-d7dbd8c4d-565j6
server: NginX
ww2.mkkuei4kdsz.com/search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D63OZ%2AXMDOls_0&v=ZjM0YWM3NDdhN2VjNTc2MGZhNGMzNWZhYWRiZWIwMWIJMQl3dzIubWtrdWVpNGtkc3ouY29tNjM4Zjg0NDQwMTlkMDguMDAyMDMyNDAJd3cyLm1ra3VlaTRrZHN6LmNvbTYzOGY4NDQ0MDE5ZjUxLjU3OTIxODMxCTE2NzAzNDk4OTIJYWRfNjNfMA==&l=OAlkMjc3YzE4NDJkNTc2NWEyNjhjMjBmNDFiYTkyOTMyZAkwCTM1CTAJNmU1ODhiYWMxYmM1OTFlNTQyN2I1ZTQwMmZiNzUwNTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzAzNDk4OTIJMS4xRS01CU4JMAkxCTgzMAkxMjA1CTE5NDA0MzE0Mgk5MS45MC40Mi4xNTQJMA%3D%3D
302 Found 0 B URL HTTP/1.1 ww2.mkkuei4kdsz.com/search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D63OZ%2AXMDOls_0&v=ZjM0YWM3NDdhN2VjNTc2MGZhNGMzNWZhYWRiZWIwMWIJMQl3dzIubWtrdWVpNGtkc3ouY29tNjM4Zjg0NDQwMTlkMDguMDAyMDMyNDAJd3cyLm1ra3VlaTRrZHN6LmNvbTYzOGY4NDQ0MDE5ZjUxLjU3OTIxODMxCTE2NzAzNDk4OTIJYWRfNjNfMA==&l=OAlkMjc3YzE4NDJkNTc2NWEyNjhjMjBmNDFiYTkyOTMyZAkwCTM1CTAJNmU1ODhiYWMxYmM1OTFlNTQyN2I1ZTQwMmZiNzUwNTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzAzNDk4OTIJMS4xRS01CU4JMAkxCTgzMAkxMjA1CTE5NDA0MzE0Mgk5MS45MC40Mi4xNTQJMA%3D%3D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /search/redirect.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D63OZ%2AXMDOls_0&v=ZjM0YWM3NDdhN2VjNTc2MGZhNGMzNWZhYWRiZWIwMWIJMQl3dzIubWtrdWVpNGtkc3ouY29tNjM4Zjg0NDQwMTlkMDguMDAyMDMyNDAJd3cyLm1ra3VlaTRrZHN6LmNvbTYzOGY4NDQ0MDE5ZjUxLjU3OTIxODMxCTE2NzAzNDk4OTIJYWRfNjNfMA==&l=OAlkMjc3YzE4NDJkNTc2NWEyNjhjMjBmNDFiYTkyOTMyZAkwCTM1CTAJNmU1ODhiYWMxYmM1OTFlNTQyN2I1ZTQwMmZiNzUwNTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzAzNDk4OTIJMS4xRS01CU4JMAkxCTgzMAkxMjA1CTE5NDA0MzE0Mgk5MS45MC40Mi4xNTQJMA%3D%3D HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww2.mkkuei4kdsz.com/
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
date: Tue, 06 Dec 2022 18:04:52 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Tue, 06 Dec 2022 18:04:52 GMT
location: /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D63OZ%2AXMDOls_0&v=ZjM0YWM3NDdhN2VjNTc2MGZhNGMzNWZhYWRiZWIwMWIJMQl3dzIubWtrdWVpNGtkc3ouY29tNjM4Zjg0NDQwMTlkMDguMDAyMDMyNDAJd3cyLm1ra3VlaTRrZHN6LmNvbTYzOGY4NDQ0MDE5ZjUxLjU3OTIxODMxCTE2NzAzNDk4OTIJYWRfNjNfMA==&l=OAlkMjc3YzE4NDJkNTc2NWEyNjhjMjBmNDFiYTkyOTMyZAkwCTM1CTAJNmU1ODhiYWMxYmM1OTFlNTQyN2I1ZTQwMmZiNzUwNTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzAzNDk4OTIJMS4xRS01CU4JMAkxCTgzMAkxMjA1CTE5NDA0MzE0Mgk5MS45MC40Mi4xNTQJMA%3D%3D
x-cache-miss-from: parking-d7dbd8c4d-hwmjh
server: NginX
ww2.mkkuei4kdsz.com/search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D63OZ%2AXMDOls_0&v=ZjM0YWM3NDdhN2VjNTc2MGZhNGMzNWZhYWRiZWIwMWIJMQl3dzIubWtrdWVpNGtkc3ouY29tNjM4Zjg0NDQwMTlkMDguMDAyMDMyNDAJd3cyLm1ra3VlaTRrZHN6LmNvbTYzOGY4NDQ0MDE5ZjUxLjU3OTIxODMxCTE2NzAzNDk4OTIJYWRfNjNfMA==&l=OAlkMjc3YzE4NDJkNTc2NWEyNjhjMjBmNDFiYTkyOTMyZAkwCTM1CTAJNmU1ODhiYWMxYmM1OTFlNTQyN2I1ZTQwMmZiNzUwNTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzAzNDk4OTIJMS4xRS01CU4JMAkxCTgzMAkxMjA1CTE5NDA0MzE0Mgk5MS45MC40Mi4xNTQJMA%3D%3D
302 Found 311 B URL HTTP/1.1 ww2.mkkuei4kdsz.com/search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D63OZ%2AXMDOls_0&v=ZjM0YWM3NDdhN2VjNTc2MGZhNGMzNWZhYWRiZWIwMWIJMQl3dzIubWtrdWVpNGtkc3ouY29tNjM4Zjg0NDQwMTlkMDguMDAyMDMyNDAJd3cyLm1ra3VlaTRrZHN6LmNvbTYzOGY4NDQ0MDE5ZjUxLjU3OTIxODMxCTE2NzAzNDk4OTIJYWRfNjNfMA==&l=OAlkMjc3YzE4NDJkNTc2NWEyNjhjMjBmNDFiYTkyOTMyZAkwCTM1CTAJNmU1ODhiYWMxYmM1OTFlNTQyN2I1ZTQwMmZiNzUwNTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzAzNDk4OTIJMS4xRS01CU4JMAkxCTgzMAkxMjA1CTE5NDA0MzE0Mgk5MS45MC40Mi4xNTQJMA%3D%3D
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash d4e5ab0cd12678c2fcafb0bc5968da19
afeeff43826c0f471f7e03ec6e90cbbc0abc88ce
01f902bab0e4e5d7c084e303404291a833cf0f8951d2edcce0760f224cb5d4be
Analyzer Verdict Alert quad9 Sinkholed
GET /search/tcerider.php?f=http%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3D63OZ%2AXMDOls_0&v=ZjM0YWM3NDdhN2VjNTc2MGZhNGMzNWZhYWRiZWIwMWIJMQl3dzIubWtrdWVpNGtkc3ouY29tNjM4Zjg0NDQwMTlkMDguMDAyMDMyNDAJd3cyLm1ra3VlaTRrZHN6LmNvbTYzOGY4NDQ0MDE5ZjUxLjU3OTIxODMxCTE2NzAzNDk4OTIJYWRfNjNfMA==&l=OAlkMjc3YzE4NDJkNTc2NWEyNjhjMjBmNDFiYTkyOTMyZAkwCTM1CTAJNmU1ODhiYWMxYmM1OTFlNTQyN2I1ZTQwMmZiNzUwNTgJMzgzNDQ1ODM3CW1ra3VlaTRrZHN6CTAJNjMJNgkyCTE2NzAzNDk4OTIJMS4xRS01CU4JMAkxCTgzMAkxMjA1CTE5NDA0MzE0Mgk5MS45MC40Mi4xNTQJMA%3D%3D HTTP/1.1
Host: ww2.mkkuei4kdsz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
date: Tue, 06 Dec 2022 18:04:52 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
x-powered-by: PHP/8.1.9
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
last-modified: Tue, 06 Dec 2022 18:04:52 GMT
location: http://xml.sedodna.com/click?i=63OZ*XMDOls_0
x-cache-miss-from: parking-d7dbd8c4d-4r7pb
server: NginX
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15995
Expires: Tue, 06 Dec 2022 22:31:28 GMT
Date: Tue, 06 Dec 2022 18:04:53 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15995
Expires: Tue, 06 Dec 2022 22:31:28 GMT
Date: Tue, 06 Dec 2022 18:04:53 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15995
Expires: Tue, 06 Dec 2022 22:31:28 GMT
Date: Tue, 06 Dec 2022 18:04:53 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15995
Expires: Tue, 06 Dec 2022 22:31:28 GMT
Date: Tue, 06 Dec 2022 18:04:53 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 1ab1615b2c8cc26b12fc0cf41734ff07
a7d54b3709ce75a20210e20013e6f06b0aa88e2d
22b22118173565879d7c4a2d54a3546aeab6a4a30e69268b294a98019fbd6ba1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "22B22118173565879D7C4A2D54A3546AEAB6A4A30E69268B294A98019FBD6BA1"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15995
Expires: Tue, 06 Dec 2022 22:31:28 GMT
Date: Tue, 06 Dec 2022 18:04:53 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffaf0de04-19bf-4944-9ac5-5178afafb192.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffaf0de04-19bf-4944-9ac5-5178afafb192.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7f2c354a00ab51d4a41221b6bf191c10
01ceb7233fe05ad8dff3a0a43eef879ea2b83ec4
7d3c8417e1db0db41ceb8b4bf3f506864392dd1ad29319a06a8a6055f6f2ed12
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffaf0de04-19bf-4944-9ac5-5178afafb192.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11352
x-amzn-requestid: 7c3fc7bb-eb1f-46ec-8e92-b6ffc6261848
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSwuF1ToAMFiIA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64d1-7c53152a279f00595b9886bd;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:25 GMT
x-amz-cf-pop: SFO5-P2, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: EQorA5VTb0s2BEIWBkdkhDho-bLdLVvu8LnAIQsQqsIjgBLneYqCzg==
via: 1.1 b6d577696b14c86cbfeb5b3459f38c50.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:48:22 GMT
age: 72991
etag: "01ceb7233fe05ad8dff3a0a43eef879ea2b83ec4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faeae6973-c3cb-4597-8dcc-f36e4cd35fda.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faeae6973-c3cb-4597-8dcc-f36e4cd35fda.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5529617b0748f2d8c82ef99c1ac116a8
a862b74508113ae72b56b9b3de0c75ba559b9032
376a82ae4a5b80f59fb746be79bca569b03a74c345845c7bbf15189964b0bb96
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faeae6973-c3cb-4597-8dcc-f36e4cd35fda.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11469
x-amzn-requestid: f60a3f0d-38f7-4f82-bdd5-9e31814ab1d9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSuZGAXIAMFwuA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64c2-5b4b99e779a0aaa71a311a1c;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:10 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: bWcuXixVA50JUynSO7ar3nWfjsTa5iOteSYq88bWPlQvz__1qfv7Uw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:41:49 GMT
age: 73384
etag: "a862b74508113ae72b56b9b3de0c75ba559b9032"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F70fb9d31-10e5-4323-9fbd-ed451a00e6b1.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F70fb9d31-10e5-4323-9fbd-ed451a00e6b1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7e1b54923ba506fde6b21c5bfb51ccc8
366aa3ab0790c496ea51bc08d1f2ff3358530d9e
a993ca6dc9a1f854f4542f9221e4f90060825ea863974b5163a9d3e284dc4663
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F70fb9d31-10e5-4323-9fbd-ed451a00e6b1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10594
x-amzn-requestid: eee9f193-eef5-44bf-997a-877fa206749e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSyIHpGoAMF1fw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64da-0a9190f7698dbf2f73bb1575;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:34 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: T28mItwomGU8iDJ18lUF7ZrFuyh_P3ZTwUtA4AC5qZ5C5FQurDMgmQ==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:54:01 GMT
age: 72652
etag: "366aa3ab0790c496ea51bc08d1f2ff3358530d9e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feff698a5-ffc4-43ea-b7a3-b681cafeb108.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feff698a5-ffc4-43ea-b7a3-b681cafeb108.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5d72fb8d20c29763234c2817b119d11b
d4924ec714f5157bcb2fddcb5f768188a3dd37dc
e9aa59142e0673ed3f58b36beaca48213c678dbe4655f9c4b64581cb0f6f22f6
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Feff698a5-ffc4-43ea-b7a3-b681cafeb108.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12830
x-amzn-requestid: 66f5f2fa-8472-4484-bbea-20ece7e98b1f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cmcsxGDyIAMFX4Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638c0e51-146167697890d9312ce3dbac;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 03:04:49 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: WMeay1i2pxnboCB3Qcwb2ray4tnyEzO89tQrHCfGdI3s9kJsMWvzBw==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 2bedbeaa49b4a77447d30097858cb81a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 06 Dec 2022 03:41:05 GMT
age: 51828
etag: "d4924ec714f5157bcb2fddcb5f768188a3dd37dc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d735c66-8946-4145-a67f-e17dd48087bc.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d735c66-8946-4145-a67f-e17dd48087bc.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 38b97436af942d5eb1111ca7043259a0
0234fe32c84c4711f0619714f3ac6d3db1b717d3
a76a7721355abbaecd5c8cb5218e7e4626dc345eb26e7541c71bf4ceaa7ae5d8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6d735c66-8946-4145-a67f-e17dd48087bc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11175
x-amzn-requestid: 9c93ddca-1247-44af-a364-e617f69ace26
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csSzYEnEoAMFa2A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e64e2-7d38ea383725901524bc2ca0;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:38:42 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: fNsYsKfPUM8QaG7-F1tSBDdsNit1BfYpWddNssXwyFO2HgdA0RpjAQ==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 21:54:21 GMT
age: 72632
etag: "0234fe32c84c4711f0619714f3ac6d3db1b717d3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b15136d60fd0a5e0f657a4f5c75d540f
36082b7329d473829178f280cb71a83b1531e486
79478269b1f5dcfd1e45ccd4264fa44805b37c5c8fec820bcbd2fa1689dfbbd8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F962c65f4-b402-46b4-83ba-50f3159341f2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11224
x-amzn-requestid: 938de0b8-1055-4416-9ad7-162ab5f4db9f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: csUINEwdoAMFuOw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638e6701-38b079ef341bb17e567de773;Sampled=0
x-amzn-remapped-date: Mon, 05 Dec 2022 21:47:45 GMT
x-amz-cf-pop: YVR50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: tGtiCE9C3j0BUruNaFN2j1mKxCSouLmocmTXpmLMBJaLNyVwkXu1gQ==
via: 1.1 f0ac467993db44dbfc36b778dfcaf73c.cloudfront.net (CloudFront), 1.1 760139201585481b26f947c5f776103a.cloudfront.net (CloudFront), 1.1 google
date: Mon, 05 Dec 2022 22:09:28 GMT
age: 71725
etag: "36082b7329d473829178f280cb71a83b1531e486"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
xml.sedodna.com/click?i=63OZ*XMDOls_0
302 Found 0 B URL HTTP/1.1 xml.sedodna.com/click?i=63OZ*XMDOls_0
IP
ASN #27257 WEBAIR-INTERNET
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?i=63OZ*XMDOls_0 HTTP/1.1
Host: xml.sedodna.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Cache-Control: no-store
Content-Length: 0
Age: 0
Connection: keep-alive
Location: https://mybettermb.com/aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5GCJeMqQw6rmfy4DmN7HDEmPzN2c9f2E7_vAN-6p8GpmDZG8TCuTZ6pDoEwlyap2kfRCKBfBvVAEgI2e7QyUKkLtbz86wY80LHWVUL2gXgUyatsBFMaSTc1RQ5RxkQPBqyyTn3ctXNy_ZHKyd1JwjsDSFy7qEqffCfvqAl2vgIpPvwzLekFxFxC-DAyCTfQ4GVfL-kTfu2LjxpY1sAUxE0jOq03hBA5DPNOqJAs1oO87JLmB78bxK4-ct8bpK3AUBydUfKl_wqTPeNAKqVHKFAgkmbiModMcYxHl4RLmryjaMr02VaPXlXcWkqTVTV25DvxTz5J69_Qzb7VTYuPI_tS7uGRxCbZ77pjGJNo-Jgi1J3cZ02W3VGATjUZfAj0SW-7HcFsm4qau7h6ASO29wrz3i7ZbATtaeTDf0BmGJmbxjfA7f6eGuRQNOefYHY2iyVUU02ERcu6p47SO0XMsIbksnhy3P3FqdsFsDdv6quXnQIaIX2cycE86afBb5pZePL2JE2B_goyx_AZMt0XV1geH0tscpbrcUttRvT68Q_zraG9vjZNlzVT1-MTOHQ3uHZe0wayIpS7MvAZtP9v2JXtwJTCFzs8gl_8BrMqUeSdtVa8gs4GdDO4eFyTNAT29PpBuB3TLknumuaxqXyA-q3hG_JL2OEzUUz8bXNJxsuujBsmLUjZKptVv_yej5TCCduKOW_K6Wvr6h6RuGZN1ww_z049fcIhRuHrSkWmqREAhsgLbvnznxoKe7t249I6PbsOn5dE8IBo09teY7ZiQOXF0b_PhWfgb5Bq1z4yP6EiyFn7Xw9bllOEpqo-9mVIR6LXlORyXstG7NTDK5uLjkHJcXz_2oHch6sZDXUQWpbgf87s4-CitIcH3T5sOa1GUhdT6NRR0xrgfvt9zRIBWf-8vY9lS5hPMArJHBfc5HQhDaxJOelS9Qr-NxWRgPP2pmfvYXJqClpzL8Lz7VFKXpDg93frlsHCcHDatLE5DvSMV8KFpc5rQSpMa4aJsk6bV0hrYg7l7HPhY19eq6_Tq3tEi7pymvadn47MCr4C3wqaa2D_6co7LkOkFcj1RgQ8caN68Pf6mMvSvuswhw-R7-rcgfokmvv3rsHDfCG97yUiYYBDweHZXlIQfUgOCVBYoePMNHdtnjCqLlMeml9Y97tSQfXF3ssP6esg6wdbmhceQf5t3rn0cpn3sEGN8jOxfrB1lNXAAHlPzO8Rmo9cfAPqgejVIrehRGC0Wy4qwZ9KUUarbi3qQuL7xluBVUAx_YiZYfI31mcm3-K87U9Qz2e3owR_NiwMuSGHwUzUOiWSZ4MERqc-xHHFxNC1E927HtTVPUJlZQJfjIbJYOSXzm4qIjwxky0eLa_fv58kzvM4lem70uCFpQ4OLpCdykaf-SEJZRj4sC8OPzY9V_k44LoQN8-iDLKN_vYFy7zCzpgZp15I2ABNsl-Kcr0kIIvFC2fb5GfVL7drYCaHdS3LggtskMdZyFDPO2jhUmBjLIFEo-UoJ3rnB989orwr6rVqrIlo_-1ICs2csbkSkLxf2oa98pw-VDmwYu8vhVjJpsLm0BGzP1DfqZP2SZVu5NPqSq-h2rSoksoBqNG2LV3Zkk-L8FPCSjKZr_YsQ0yRxpJ6k8LlotqmtX7ErGSkvN2YlGY4HZ8X7cx-dM1QaxFxK0PHGpJGlCLAoWMnzoVZuce8ueVaQ0F217-cHwFJ-CDJF8T7C2wcJ1dqtoOgN9pzNxgl6S4oChQzOvrPE96Ym7CMGlXRdGMK-TkKMF_XSxG7q5c9lRJWHNr4s5bSTdWcYVZJciO9bgcuS1jIeAEiXnU3V3e-0UrBa8Hlo4g5B5l-WzpyvSQgi8ULZ9poHBVK_-RlV7Gqw1-DxjXT8_-DdPz2caHuvaL72dMI4AIfpS31EWedozOvh8r9L12xBlfBjiCHzE2vhWPSdr
Pragma: no-cache
ocsp.sectigo.com/
200 OK 472 B IP
Hash 8cff693ee9c762244ede97dd8fcd747a
502f6f4bf0484b95b1a1339077d6fd9df5aced9e
99e344ff76e45b61c748a61cd60c67aff303ffc62e6e5a1e679f59d66c0a15da
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:53 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Sun, 04 Dec 2022 19:25:46 GMT
Expires: Sun, 11 Dec 2022 19:25:45 GMT
Etag: "502f6f4bf0484b95b1a1339077d6fd9df5aced9e"
Cache-Control: max-age=436251,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7756f25208a01bfa-OSL
mybettermb.com/aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5GCJeMqQw6rmfy4DmN7HDEmPzN2c9f2E7_vAN-6p8GpmDZG8TCuTZ6pDoEwlyap2kfRCKBfBvVAEgI2e7QyUKkLtbz86wY80LHWVUL2gXgUyatsBFMaSTc1RQ5RxkQPBqyyTn3ctXNy_ZHKyd1JwjsDSFy7qEqffCfvqAl2vgIpPvwzLekFxFxC-DAyCTfQ4GVfL-kTfu2LjxpY1sAUxE0jOq03hBA5DPNOqJAs1oO87JLmB78bxK4-ct8bpK3AUBydUfKl_wqTPeNAKqVHKFAgkmbiModMcYxHl4RLmryjaMr02VaPXlXcWkqTVTV25DvxTz5J69_Qzb7VTYuPI_tS7uGRxCbZ77pjGJNo-Jgi1J3cZ02W3VGATjUZfAj0SW-7HcFsm4qau7h6ASO29wrz3i7ZbATtaeTDf0BmGJmbxjfA7f6eGuRQNOefYHY2iyVUU02ERcu6p47SO0XMsIbksnhy3P3FqdsFsDdv6quXnQIaIX2cycE86afBb5pZePL2JE2B_goyx_AZMt0XV1geH0tscpbrcUttRvT68Q_zraG9vjZNlzVT1-MTOHQ3uHZe0wayIpS7MvAZtP9v2JXtwJTCFzs8gl_8BrMqUeSdtVa8gs4GdDO4eFyTNAT29PpBuB3TLknumuaxqXyA-q3hG_JL2OEzUUz8bXNJxsuujBsmLUjZKptVv_yej5TCCduKOW_K6Wvr6h6RuGZN1ww_z049fcIhRuHrSkWmqREAhsgLbvnznxoKe7t249I6PbsOn5dE8IBo09teY7ZiQOXF0b_PhWfgb5Bq1z4yP6EiyFn7Xw9bllOEpqo-9mVIR6LXlORyXstG7NTDK5uLjkHJcXz_2oHch6sZDXUQWpbgf87s4-CitIcH3T5sOa1GUhdT6NRR0xrgfvt9zRIBWf-8vY9lS5hPMArJHBfc5HQhDaxJOelS9Qr-NxWRgPP2pmfvYXJqClpzL8Lz7VFKXpDg93frlsHCcHDatLE5DvSMV8KFpc5rQSpMa4aJsk6bV0hrYg7l7HPhY19eq6_Tq3tEi7pymvadn47MCr4C3wqaa2D_6co7LkOkFcj1RgQ8caN68Pf6mMvSvuswhw-R7-rcgfokmvv3rsHDfCG97yUiYYBDweHZXlIQfUgOCVBYoePMNHdtnjCqLlMeml9Y97tSQfXF3ssP6esg6wdbmhceQf5t3rn0cpn3sEGN8jOxfrB1lNXAAHlPzO8Rmo9cfAPqgejVIrehRGC0Wy4qwZ9KUUarbi3qQuL7xluBVUAx_YiZYfI31mcm3-K87U9Qz2e3owR_NiwMuSGHwUzUOiWSZ4MERqc-xHHFxNC1E927HtTVPUJlZQJfjIbJYOSXzm4qIjwxky0eLa_fv58kzvM4lem70uCFpQ4OLpCdykaf-SEJZRj4sC8OPzY9V_k44LoQN8-iDLKN_vYFy7zCzpgZp15I2ABNsl-Kcr0kIIvFC2fb5GfVL7drYCaHdS3LggtskMdZyFDPO2jhUmBjLIFEo-UoJ3rnB989orwr6rVqrIlo_-1ICs2csbkSkLxf2oa98pw-VDmwYu8vhVjJpsLm0BGzP1DfqZP2SZVu5NPqSq-h2rSoksoBqNG2LV3Zkk-L8FPCSjKZr_YsQ0yRxpJ6k8LlotqmtX7ErGSkvN2YlGY4HZ8X7cx-dM1QaxFxK0PHGpJGlCLAoWMnzoVZuce8ueVaQ0F217-cHwFJ-CDJF8T7C2wcJ1dqtoOgN9pzNxgl6S4oChQzOvrPE96Ym7CMGlXRdGMK-TkKMF_XSxG7q5c9lRJWHNr4s5bSTdWcYVZJciO9bgcuS1jIeAEiXnU3V3e-0UrBa8Hlo4g5B5l-WzpyvSQgi8ULZ9poHBVK_-RlV7Gqw1-DxjXT8_-DdPz2caHuvaL72dMI4AIfpS31EWedozOvh8r9L12xBlfBjiCHzE2vhWPSdr
302 Found 0 B URL HTTP/2 mybettermb.com/aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5GCJeMqQw6rmfy4DmN7HDEmPzN2c9f2E7_vAN-6p8GpmDZG8TCuTZ6pDoEwlyap2kfRCKBfBvVAEgI2e7QyUKkLtbz86wY80LHWVUL2gXgUyatsBFMaSTc1RQ5RxkQPBqyyTn3ctXNy_ZHKyd1JwjsDSFy7qEqffCfvqAl2vgIpPvwzLekFxFxC-DAyCTfQ4GVfL-kTfu2LjxpY1sAUxE0jOq03hBA5DPNOqJAs1oO87JLmB78bxK4-ct8bpK3AUBydUfKl_wqTPeNAKqVHKFAgkmbiModMcYxHl4RLmryjaMr02VaPXlXcWkqTVTV25DvxTz5J69_Qzb7VTYuPI_tS7uGRxCbZ77pjGJNo-Jgi1J3cZ02W3VGATjUZfAj0SW-7HcFsm4qau7h6ASO29wrz3i7ZbATtaeTDf0BmGJmbxjfA7f6eGuRQNOefYHY2iyVUU02ERcu6p47SO0XMsIbksnhy3P3FqdsFsDdv6quXnQIaIX2cycE86afBb5pZePL2JE2B_goyx_AZMt0XV1geH0tscpbrcUttRvT68Q_zraG9vjZNlzVT1-MTOHQ3uHZe0wayIpS7MvAZtP9v2JXtwJTCFzs8gl_8BrMqUeSdtVa8gs4GdDO4eFyTNAT29PpBuB3TLknumuaxqXyA-q3hG_JL2OEzUUz8bXNJxsuujBsmLUjZKptVv_yej5TCCduKOW_K6Wvr6h6RuGZN1ww_z049fcIhRuHrSkWmqREAhsgLbvnznxoKe7t249I6PbsOn5dE8IBo09teY7ZiQOXF0b_PhWfgb5Bq1z4yP6EiyFn7Xw9bllOEpqo-9mVIR6LXlORyXstG7NTDK5uLjkHJcXz_2oHch6sZDXUQWpbgf87s4-CitIcH3T5sOa1GUhdT6NRR0xrgfvt9zRIBWf-8vY9lS5hPMArJHBfc5HQhDaxJOelS9Qr-NxWRgPP2pmfvYXJqClpzL8Lz7VFKXpDg93frlsHCcHDatLE5DvSMV8KFpc5rQSpMa4aJsk6bV0hrYg7l7HPhY19eq6_Tq3tEi7pymvadn47MCr4C3wqaa2D_6co7LkOkFcj1RgQ8caN68Pf6mMvSvuswhw-R7-rcgfokmvv3rsHDfCG97yUiYYBDweHZXlIQfUgOCVBYoePMNHdtnjCqLlMeml9Y97tSQfXF3ssP6esg6wdbmhceQf5t3rn0cpn3sEGN8jOxfrB1lNXAAHlPzO8Rmo9cfAPqgejVIrehRGC0Wy4qwZ9KUUarbi3qQuL7xluBVUAx_YiZYfI31mcm3-K87U9Qz2e3owR_NiwMuSGHwUzUOiWSZ4MERqc-xHHFxNC1E927HtTVPUJlZQJfjIbJYOSXzm4qIjwxky0eLa_fv58kzvM4lem70uCFpQ4OLpCdykaf-SEJZRj4sC8OPzY9V_k44LoQN8-iDLKN_vYFy7zCzpgZp15I2ABNsl-Kcr0kIIvFC2fb5GfVL7drYCaHdS3LggtskMdZyFDPO2jhUmBjLIFEo-UoJ3rnB989orwr6rVqrIlo_-1ICs2csbkSkLxf2oa98pw-VDmwYu8vhVjJpsLm0BGzP1DfqZP2SZVu5NPqSq-h2rSoksoBqNG2LV3Zkk-L8FPCSjKZr_YsQ0yRxpJ6k8LlotqmtX7ErGSkvN2YlGY4HZ8X7cx-dM1QaxFxK0PHGpJGlCLAoWMnzoVZuce8ueVaQ0F217-cHwFJ-CDJF8T7C2wcJ1dqtoOgN9pzNxgl6S4oChQzOvrPE96Ym7CMGlXRdGMK-TkKMF_XSxG7q5c9lRJWHNr4s5bSTdWcYVZJciO9bgcuS1jIeAEiXnU3V3e-0UrBa8Hlo4g5B5l-WzpyvSQgi8ULZ9poHBVK_-RlV7Gqw1-DxjXT8_-DdPz2caHuvaL72dMI4AIfpS31EWedozOvh8r9L12xBlfBjiCHzE2vhWPSdr
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /aS/feedclick?s=HFz5zNIIs96fzq49jFkHXa3dDnCBF-q5GCJeMqQw6rmfy4DmN7HDEmPzN2c9f2E7_vAN-6p8GpmDZG8TCuTZ6pDoEwlyap2kfRCKBfBvVAEgI2e7QyUKkLtbz86wY80LHWVUL2gXgUyatsBFMaSTc1RQ5RxkQPBqyyTn3ctXNy_ZHKyd1JwjsDSFy7qEqffCfvqAl2vgIpPvwzLekFxFxC-DAyCTfQ4GVfL-kTfu2LjxpY1sAUxE0jOq03hBA5DPNOqJAs1oO87JLmB78bxK4-ct8bpK3AUBydUfKl_wqTPeNAKqVHKFAgkmbiModMcYxHl4RLmryjaMr02VaPXlXcWkqTVTV25DvxTz5J69_Qzb7VTYuPI_tS7uGRxCbZ77pjGJNo-Jgi1J3cZ02W3VGATjUZfAj0SW-7HcFsm4qau7h6ASO29wrz3i7ZbATtaeTDf0BmGJmbxjfA7f6eGuRQNOefYHY2iyVUU02ERcu6p47SO0XMsIbksnhy3P3FqdsFsDdv6quXnQIaIX2cycE86afBb5pZePL2JE2B_goyx_AZMt0XV1geH0tscpbrcUttRvT68Q_zraG9vjZNlzVT1-MTOHQ3uHZe0wayIpS7MvAZtP9v2JXtwJTCFzs8gl_8BrMqUeSdtVa8gs4GdDO4eFyTNAT29PpBuB3TLknumuaxqXyA-q3hG_JL2OEzUUz8bXNJxsuujBsmLUjZKptVv_yej5TCCduKOW_K6Wvr6h6RuGZN1ww_z049fcIhRuHrSkWmqREAhsgLbvnznxoKe7t249I6PbsOn5dE8IBo09teY7ZiQOXF0b_PhWfgb5Bq1z4yP6EiyFn7Xw9bllOEpqo-9mVIR6LXlORyXstG7NTDK5uLjkHJcXz_2oHch6sZDXUQWpbgf87s4-CitIcH3T5sOa1GUhdT6NRR0xrgfvt9zRIBWf-8vY9lS5hPMArJHBfc5HQhDaxJOelS9Qr-NxWRgPP2pmfvYXJqClpzL8Lz7VFKXpDg93frlsHCcHDatLE5DvSMV8KFpc5rQSpMa4aJsk6bV0hrYg7l7HPhY19eq6_Tq3tEi7pymvadn47MCr4C3wqaa2D_6co7LkOkFcj1RgQ8caN68Pf6mMvSvuswhw-R7-rcgfokmvv3rsHDfCG97yUiYYBDweHZXlIQfUgOCVBYoePMNHdtnjCqLlMeml9Y97tSQfXF3ssP6esg6wdbmhceQf5t3rn0cpn3sEGN8jOxfrB1lNXAAHlPzO8Rmo9cfAPqgejVIrehRGC0Wy4qwZ9KUUarbi3qQuL7xluBVUAx_YiZYfI31mcm3-K87U9Qz2e3owR_NiwMuSGHwUzUOiWSZ4MERqc-xHHFxNC1E927HtTVPUJlZQJfjIbJYOSXzm4qIjwxky0eLa_fv58kzvM4lem70uCFpQ4OLpCdykaf-SEJZRj4sC8OPzY9V_k44LoQN8-iDLKN_vYFy7zCzpgZp15I2ABNsl-Kcr0kIIvFC2fb5GfVL7drYCaHdS3LggtskMdZyFDPO2jhUmBjLIFEo-UoJ3rnB989orwr6rVqrIlo_-1ICs2csbkSkLxf2oa98pw-VDmwYu8vhVjJpsLm0BGzP1DfqZP2SZVu5NPqSq-h2rSoksoBqNG2LV3Zkk-L8FPCSjKZr_YsQ0yRxpJ6k8LlotqmtX7ErGSkvN2YlGY4HZ8X7cx-dM1QaxFxK0PHGpJGlCLAoWMnzoVZuce8ueVaQ0F217-cHwFJ-CDJF8T7C2wcJ1dqtoOgN9pzNxgl6S4oChQzOvrPE96Ym7CMGlXRdGMK-TkKMF_XSxG7q5c9lRJWHNr4s5bSTdWcYVZJciO9bgcuS1jIeAEiXnU3V3e-0UrBa8Hlo4g5B5l-WzpyvSQgi8ULZ9poHBVK_-RlV7Gqw1-DxjXT8_-DdPz2caHuvaL72dMI4AIfpS31EWedozOvh8r9L12xBlfBjiCHzE2vhWPSdr HTTP/1.1
Host: mybettermb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Tue, 06 Dec 2022 18:04:53 GMT
content-length: 0
set-cookie: rhid=82503124036; Max-Age=15552000; Expires=Sun, 04-Jun-2023 18:04:53 GMT; Domain=mybettermb.com; Path=/; SameSite=None; secure;
location: https://p201298.mybettermb.com/adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEixNQEx2h0FiPzQXddyXR1tu_sZNJpuWmqUzaeYhSjwo4wze4caGpDvAdDxfNZOFVxWfBO_Pgkf9Lj9hxf0SJk0tVfUbfcXAU2dgRsl_cISdhzavJEfo6eseVq4GY9uFdESEy041wghMrAgV2R4ubIyh-8XWjYI5uvZ0tvrAyc11VkHRUwGVzse4_hxqmBidZ34_EUBB7T3W5HBHAGI8aS9OC15oyJkVA0RYa9hQXLPnvYpQjImT0vw&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukO30EUWSClXeqC_FQH5MmyEwtPf_cLfUM19Jhv5z9cb0C43Ut8jylbZ_2ZDy1mwwWbc-qK0roxc7Q&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=6HrvxnDas3s&rr=1&abtg=0
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8a6e0ecc384dbfae8f97a1e8b3b14019
2588b9093cba23c787d79fb58ae6f68c9002b426
f779d6ee8d9974e2814bc1f373e43db9671dab47e2498ae91be97873f12de938
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F779D6EE8D9974E2814BC1F373E43DB9671DAB47E2498AE91BE97873F12DE938"
Last-Modified: Tue, 06 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4907
Expires: Tue, 06 Dec 2022 19:26:41 GMT
Date: Tue, 06 Dec 2022 18:04:54 GMT
Connection: keep-alive
qvikar.com/symantec/security/438203600
302 Found 0 B URL HTTP/2 qvikar.com/symantec/security/438203600
IP
ASN #46606 UNIFIEDLAYER-AS-1
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /symantec/security/438203600 HTTP/1.1
Host: qvikar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
location: https://www.clkmg.com/qvikar/symantec/security/438203600/
vary: User-Agent
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 06 Dec 2022 18:04:54 GMT
server: Apache
X-Firefox-Spdy: h2
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash 906fb5eb007cedf9b5d25ea157ea748c
36f6f7d5b2fa59c4aa6bd6d94431c7f725a111ad
e3505b5212373d4b90a5df6a11e1da411a8f11e74a90ba943ad821011b522c26
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:55 GMT
Content-Type: application/ocsp-response
Content-Length: 1423
Connection: keep-alive
Expires: Sat, 10 Dec 2022 17:10:18 GMT
ETag: "36f6f7d5b2fa59c4aa6bd6d94431c7f725a111ad"
Last-Modified: Tue, 06 Dec 2022 17:10:19 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1777
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7756f25cbe55b523-OSL
www.clkmg.com/qvikar/symantec/security/438203600/
302 Found 252 B URL HTTP/1.1 www.clkmg.com/qvikar/symantec/security/438203600/
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash f8e0d84321b2e3784347d18576532a0c
4618d65b989caf526cdd39434e52a42c74dd93ec
f886f67905fa02b7c13894be500f5a1736fe20542e0a57561444ce84be3824a5
GET /qvikar/symantec/security/438203600/ HTTP/1.1
Host: www.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 302 Found
Date: Tue, 06 Dec 2022 18:04:55 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 252
Connection: keep-alive
P3P: CP="This is not a P3P policy! See https://www.clkmg.com for more info."
Set-Cookie: alc=1; domain=.clkmg.com; expires=Tue Dec 6 18:05:00 2022; path=/;
lids=1537844-152399+; domain=.clkmg.com; expires=Wed Dec 6 18:04:55 2023; path=/;
Location: https://www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
Server: nginx
X-Permitted-Cross-Domain-Policies: none
X-CM-FE: httpfe-01.clickmagick.com
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
200 OK 1.4 kB URL HTTP/1.1 www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash fbf6005663528fbffb7fdf9c8fa995bc
de4dc1559fd1bd3026d94887738125a83b4012b6
972ee94dbdbea4c5e3a75afbb7d2b5ee9dd6e5558b8d09603491b51b7ccbb704
GET /err/?u=qvikar&l=symantec&s=A&e=403 HTTP/1.1
Host: www.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: alc=1; lids=1537844-152399+
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="This is not a P3P policy! See http://www.clkmg.com for more info."
Server: nginx
X-Permitted-Cross-Domain-Policies: none
X-CM-FE: httpfe-01.clickmagick.com
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cdn.clkmg.com/misc/css/style.css
200 OK 4.5 kB URL HTTP/1.1 cdn.clkmg.com/misc/css/style.css
IP
Hash e540f61448a0e598774be6738463a0c5
75c83228491705c9a412383803decd6878c3f163
263bd19121ab72d1db5109850141dd62598ee8d4240b4cbfb3bce40a85c5da3c
GET /misc/css/style.css HTTP/1.1
Host: cdn.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/
Cookie: alc=1; lids=1537844-152399+
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 4498
Connection: keep-alive
Date: Sat, 26 Nov 2022 05:16:13 GMT
Last-Modified: Sat, 06 Aug 2022 19:05:46 GMT
ETag: "62eebb8a-1192"
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Expires: Mon, 26 Dec 2022 05:16:13 GMT
Cache-Control: max-age=2592000, public, no-transform
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Via: 1.1 bb1da7862c4968b28920b91b324095c0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: x-de1zcuyvZg6WkQ4QKLet1Mommw7nQcELN3nSOI3hSBgsJJin66mg==
Age: 910122
cdn.clkmg.com/images/spacer.gif
200 OK 43 B URL HTTP/1.1 cdn.clkmg.com/images/spacer.gif
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash fc94fb0c3ed8a8f909dbc7630a0987ff
56d45f8a17f5078a20af9962c992ca4678450765
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
GET /images/spacer.gif HTTP/1.1
Host: cdn.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/
Cookie: alc=1; lids=1537844-152399+
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Date: Fri, 28 Oct 2022 02:17:27 GMT
Last-Modified: Thu, 23 Feb 2017 23:21:29 GMT
ETag: "58af6e79-2b"
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Expires: Thu, 26 Jan 2023 02:17:27 GMT
Cache-Control: max-age=7776000, public, no-transform
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Via: 1.1 c9f2a4d2bcd548d1a3cbe1617a22f216.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: DlStVNH2jMxQ5atP3KSj3cLhr39074piEJF_lueZMp95xHn2m6qH7A==
Age: 3426448
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash 381c37f6eb6d4b8451d9bbe5ef331154
cd6873e378a96305e0508267511398561fd6fc17
f264c136db5be98a37ff6939f9c6707ac1225b681e46a0da995cdae78489cbfd
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:56 GMT
Content-Type: application/ocsp-response
Content-Length: 1423
Connection: keep-alive
Expires: Sat, 10 Dec 2022 14:36:31 GMT
ETag: "cd6873e378a96305e0508267511398561fd6fc17"
Last-Modified: Tue, 06 Dec 2022 14:36:32 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7756f2613faab4ee-OSL
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash 381c37f6eb6d4b8451d9bbe5ef331154
cd6873e378a96305e0508267511398561fd6fc17
f264c136db5be98a37ff6939f9c6707ac1225b681e46a0da995cdae78489cbfd
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:56 GMT
Content-Type: application/ocsp-response
Content-Length: 1423
Connection: keep-alive
Expires: Sat, 10 Dec 2022 14:36:31 GMT
ETag: "cd6873e378a96305e0508267511398561fd6fc17"
Last-Modified: Tue, 06 Dec 2022 14:36:32 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7756f2613d3a0b3d-OSL
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash 381c37f6eb6d4b8451d9bbe5ef331154
cd6873e378a96305e0508267511398561fd6fc17
f264c136db5be98a37ff6939f9c6707ac1225b681e46a0da995cdae78489cbfd
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:56 GMT
Content-Type: application/ocsp-response
Content-Length: 1423
Connection: keep-alive
Expires: Sat, 10 Dec 2022 14:36:31 GMT
ETag: "cd6873e378a96305e0508267511398561fd6fc17"
Last-Modified: Tue, 06 Dec 2022 14:36:32 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7756f2613d76b523-OSL
cdn.clickmagick.com/images/logo.gif
200 OK 4.3 kB URL HTTP/2 cdn.clickmagick.com/images/logo.gif
IP
File type GIF image data, version 89a, 300 x 64\012- data
Hash 1bfe88368945f71f6b145f8fdc431c3f
2650030369e5c327d5eaf4a6b9fd175786bda751
b069053ff474120a849ba3e9f1d4110f4311608883e9ec1cdbe68e1b181dcc73
GET /images/logo.gif HTTP/1.1
Host: cdn.clickmagick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
content-length: 4252
date: Mon, 05 Dec 2022 18:35:21 GMT
last-modified: Wed, 27 Jul 2022 23:18:30 GMT
etag: "62e1c7c6-109c"
server: nginx
x-permitted-cross-domain-policies: none
x-frame-options: SAMEORIGIN
expires: Sun, 05 Mar 2023 18:35:21 GMT
cache-control: max-age=7776000, public, no-transform
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: nk-Wndn3rRe2WMyTEiP-xIbm9InMKk5VKeeRjivr0WqOGY0Q8obGsQ==
age: 84575
x-robots-tag: noindex
X-Firefox-Spdy: h2
cdn.clickmagick.com/misc/fonts/website/v3/Inter-Regular.woff
200 OK 149 kB URL HTTP/2 cdn.clickmagick.com/misc/fonts/website/v3/Inter-Regular.woff
IP
File type Web Open Font Format, TrueType, length 149344, version 0.0\012- data
Size 149 kB (149344 bytes)
Hash ea2c76b525641c2051cdf7d930e465ba
b3ffc2515b8429e92540e084fd6011f32b8df368
6ab2042219a7bbc2f5523d61ad24c9f1e3627f2cbb891669d981da8bb019c11e
GET /misc/fonts/website/v3/Inter-Regular.woff HTTP/1.1
Host: cdn.clickmagick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.clkmg.com
Connection: keep-alive
Referer: https://cdn.clkmg.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/font-woff
content-length: 149344
date: Mon, 05 Dec 2022 19:11:01 GMT
last-modified: Wed, 22 Jun 2022 15:39:23 GMT
etag: "62b337ab-24760"
server: nginx
x-permitted-cross-domain-policies: none
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: FaBSswLOqnU_21VQM4cpV4zkusdRK6c49-EkEKNRXyrX808YW3jQmw==
age: 82435
x-robots-tag: noindex
X-Firefox-Spdy: h2
cdn.clickmagick.com/misc/fonts/website/v3/Inter-Medium.woff
200 OK 158 kB URL HTTP/2 cdn.clickmagick.com/misc/fonts/website/v3/Inter-Medium.woff
IP
File type Web Open Font Format, TrueType, length 157888, version 0.0\012- data
Size 158 kB (157888 bytes)
Hash 6b5a42f0603ea013e7099c2160e007e7
1a817b28d15fba7537a6ac0ed28126589062f303
860f80f683dd2cca3acc4680a798cd8a1a8dd8d6a0e18312692d9504f3792242
GET /misc/fonts/website/v3/Inter-Medium.woff HTTP/1.1
Host: cdn.clickmagick.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.clkmg.com
Connection: keep-alive
Referer: https://cdn.clkmg.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/font-woff
content-length: 157888
date: Mon, 05 Dec 2022 19:11:01 GMT
last-modified: Wed, 22 Jun 2022 15:39:23 GMT
etag: "62b337ab-268c0"
server: nginx
x-permitted-cross-domain-policies: none
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: My6rnrop1tqMgZbaL2bx-NL6Hpkph7zuAsps3_-ROZwo-k2WpldEfw==
age: 82435
x-robots-tag: noindex
X-Firefox-Spdy: h2
www.clkmg.com/favicon.ico
200 OK 78 B URL HTTP/1.1 www.clkmg.com/favicon.ico
IP
File type MS Windows icon resource - 1 icon, 1x1, 2 colors\012- data
Hash c9e1efa761b83f4a25a07dc85c207f95
7c1df040d4119e1c1b4f875c362f363ad1f6ba13
91634633ca6d34044c356a9a0baa832f1927d8326e1ae1a95af22b864d30dd7f
GET /favicon.ico HTTP/1.1
Host: www.clkmg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.clkmg.com/err/?u=qvikar&l=symantec&s=A&e=403
Cookie: alc=1; lids=1537844-152399+
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2022 18:04:56 GMT
Content-Type: image/x-icon
Content-Length: 78
Last-Modified: Thu, 21 Apr 2022 16:32:44 GMT
Connection: keep-alive
ETag: "6261872c-4e"
Server: nginx
X-Permitted-Cross-Domain-Policies: none
Expires: Thu, 05 Jan 2023 18:04:56 GMT
Pragma: public
Cache-Control: max-age=2592000, public
Accept-Ranges: bytes
p201298.mybettermb.com/adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEixNQEx2h0FiPzQXddyXR1tu_sZNJpuWmqUzaeYhSjwo4wze4caGpDvAdDxfNZOFVxWfBO_Pgkf9Lj9hxf0SJk0tVfUbfcXAU2dgRsl_cISdhzavJEfo6eseVq4GY9uFdESEy041wghMrAgV2R4ubIyh-8XWjYI5uvZ0tvrAyc11VkHRUwGVzse4_hxqmBidZ34_EUBB7T3W5HBHAGI8aS9OC15oyJkVA0RYa9hQXLPnvYpQjImT0vw&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukO30EUWSClXeqC_FQH5MmyEwtPf_cLfUM19Jhv5z9cb0C43Ut8jylbZ_2ZDy1mwwWbc-qK0roxc7Q&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=6HrvxnDas3s&rr=1&abtg=0
200 OK 0 B URL HTTP/2 p201298.mybettermb.com/adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEixNQEx2h0FiPzQXddyXR1tu_sZNJpuWmqUzaeYhSjwo4wze4caGpDvAdDxfNZOFVxWfBO_Pgkf9Lj9hxf0SJk0tVfUbfcXAU2dgRsl_cISdhzavJEfo6eseVq4GY9uFdESEy041wghMrAgV2R4ubIyh-8XWjYI5uvZ0tvrAyc11VkHRUwGVzse4_hxqmBidZ34_EUBB7T3W5HBHAGI8aS9OC15oyJkVA0RYa9hQXLPnvYpQjImT0vw&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukO30EUWSClXeqC_FQH5MmyEwtPf_cLfUM19Jhv5z9cb0C43Ut8jylbZ_2ZDy1mwwWbc-qK0roxc7Q&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=6HrvxnDas3s&rr=1&abtg=0
IP
GET /adServe/domainClick?ai=zHPR75Zx-onygYaeN_ogCEQpriNLUhJP2vxnou0rQPghYzcek6I_ZIIYGzp5Xiss_eOxj-E7E9ujXs6r8LZhilE6RpPcl9LK-Enx24tEQ5BZoWkuQ42e36tUDjbfTsU3-1i2z5FN4Z7lC6UgTnJQKRpxE8D2wnnZ5fLrBmIK1IoZbYz551kewK5kC36FLeVmkcAiF6Zx6vCNG2LV3Zkk-Ggr8NZl9qhFIWAXlDtXQGo12ksI7M6aHpr3TVW_gItrAgu0EmEScZHDJb8jULvZYlVeGE7sFNBXiObrvv9lf46znmgkGZesCeQxm3fyDPT0AqM8rzIb-Pj0Y-mTO3fU_s2FObyfPd0rntvpDL1rWYdOIs3E02P7fV3DnEwaUqVj1aofU65Q9qh-FW7qmVWrLQFIIXioy0OisAjKIsa6aWJEKa4jS1IST8SPktY6xkxEixNQEx2h0FiPzQXddyXR1tu_sZNJpuWmqUzaeYhSjwo4wze4caGpDvAdDxfNZOFVxWfBO_Pgkf9Lj9hxf0SJk0tVfUbfcXAU2dgRsl_cISdhzavJEfo6eseVq4GY9uFdESEy041wghMrAgV2R4ubIyh-8XWjYI5uvZ0tvrAyc11VkHRUwGVzse4_hxqmBidZ34_EUBB7T3W5HBHAGI8aS9OC15oyJkVA0RYa9hQXLPnvYpQjImT0vw&ui=HFz5zNIIs96fzq49jFkHXcQzYObQGwwU7xf6tdOZukO30EUWSClXeqC_FQH5MmyEwtPf_cLfUM19Jhv5z9cb0C43Ut8jylbZ_2ZDy1mwwWbc-qK0roxc7Q&si=1&oref=e2905b67c440133e06d94d472902354c&optunit=g1X1rV7f4BpBS4YUfGI2rw&rb=6HrvxnDas3s&rr=1&abtg=0 HTTP/1.1
Host: p201298.mybettermb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ww2.mkkuei4kdsz.com/
Connection: keep-alive
Cookie: rhid=82503124036
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Tue, 06 Dec 2022 18:04:53 GMT
content-type: text/html;charset=ISO-8859-1
vary: Accept-Encoding
set-cookie: rhid=82503124036; Max-Age=15552000; Expires=Sun, 04-Jun-2023 18:04:53 GMT; Domain=mybettermb.com; Path=/; SameSite=None; secure;
loi=ad_857954_off_361683_aff_11454_cid_201298-MKKUEI4KDSZ.COM_ts_1670349893; Max-Age=3600; Expires=Tue, 06-Dec-2022 19:04:53 GMT; Domain=mybettermb.com; Path=/; SameSite=None; secure;
content-encoding: gzip
X-Firefox-Spdy: h2
64.225.91.73
95.101.11.115
93.184.220.29
64.190.63.136
104.18.20.226