3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
308 Permanent Redirect 164 B URL HTTP/1.1 3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
IP
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash f23c4815ecaef1588f16ac735c0e15d6
026bf8cdd5076014b6fc822878e0086eb44da556
43a81fb3d47b34e7d42d6b8444f592ed9251b8e57db8f67d32419aa40b1480d0
Analyzer Verdict Alert quad9 Sinkholed
GET /partners/casino-reg?cid=1796075641&pid=14628&sip=0 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 308 Permanent Redirect
Server: nginx
Date: Sat, 12 Nov 2022 06:20:55 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3d0727e32cd103ddd4b73f28c81758aa
197a7bf43d63723fc532c23c6dced68d5cc36652
d3f75d03561d6a47d19370292e821a86e58381466f0c69386a21175de55882ff
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D3F75D03561D6A47D19370292E821A86E58381466F0C69386A21175DE55882FF"
Last-Modified: Fri, 11 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7281
Expires: Sat, 12 Nov 2022 08:22:16 GMT
Date: Sat, 12 Nov 2022 06:20:55 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 4edf853c470fcec0ab277c78527f3c2d
de93530ce15337e671c488d9fe05e7091d4956f0
b9d7976b398b1243ff8a571ddd3975d3a1317d69101061bdb1a755b3b56620e6
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5733
Cache-Control: max-age=107165
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:55 GMT
Etag: "636e247f-1d7"
Expires: Sun, 13 Nov 2022 12:07:00 GMT
Last-Modified: Fri, 11 Nov 2022 10:31:27 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 5076aaa9f4ccd602540286ce0590cb9a
bbf7936a8413a564478971d9e19beb6338cbc869
00e3b967c579b0ccf709b78d497a43d95646b16eb50925fef1e2694c58f290b2
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "00E3B967C579B0CCF709B78D497A43D95646B16EB50925FEF1E2694C58F290B2"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2968
Expires: Sat, 12 Nov 2022 07:10:23 GMT
Date: Sat, 12 Nov 2022 06:20:55 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 4736bac84ca28f2b1e961159fb4ea098
1319612979f53896fcfeacd4215c2715d4951e4c
5e81213e111ddf68c7f884f72b4e06fc4dc95eb902c3cf0762236b2418840dba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Length, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 12 Nov 2022 05:44:09 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2206
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: HDm4Q3kDLW7tyTyPBFSUtOiEW+qWYY8kI9DcSX6kG5uZOsFxGoH3HU7LCWf7adILSyV1zfXFrtE=
x-amz-request-id: KKVA6ZXK35S54GW8
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 12 Nov 2022 05:50:08 GMT
age: 1847
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:55 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 2a6f221333f4d0633c5d492adf89f854
25ed6192d61c074841159c65f0778d0145092d95
5da5c0633b78d8356564ff7bbcdefd72455fd191025fd3a230a2a69dbd2f1af1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5DA5C0633B78D8356564FF7BBCDEFD72455FD191025FD3A230A2A69DBD2F1AF1"
Last-Modified: Thu, 10 Nov 2022 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21523
Expires: Sat, 12 Nov 2022 12:19:38 GMT
Date: Sat, 12 Nov 2022 06:20:55 GMT
Connection: keep-alive
cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js
200 OK 23 kB URL HTTP/1.1 cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js
IP
File type C source, ASCII text, with very long lines (539)
Hash bfcc64224f8c6e43e026afb16bd0f4f8
4b1a0dbd96c3047a917ba024690ffc4d544b8b00
c87358a7c76c044147379c9415f96488045b936666093c83fd0e57e08316548e
GET /js/11DAF087E87A3DFD/scarab-v2.js HTTP/1.1
Host: cdn.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Timing-Allow-Origin: *
Date: Sat, 12 Nov 2022 06:05:45 GMT
Cache-Control: max-age=3600,public
ETag: "aa53180343ab25d32aa7294158ca3216--gzip"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 2d5cbe05385a7f3bbffc8a562b8711f6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ibDdQYIiKrM0qk1jupKiAs_HsMhftDwG85vTmYyVQILb6Skf7gqcxw==
Age: 957
ocsp.digicert.com/
200 OK 279 B IP
Hash 85d88bfb8fca121bbd41e00f1f3b4369
063343a8a4707d752db8d8ea779d0d681fa1c214
98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 396
Cache-Control: max-age=106109
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 11:49:25 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash 85d88bfb8fca121bbd41e00f1f3b4369
063343a8a4707d752db8d8ea779d0d681fa1c214
98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=105713
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 11:42:49 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: nginx
Content-Length: 279
ocsp.digicert.com/
200 OK 279 B IP
Hash 85d88bfb8fca121bbd41e00f1f3b4369
063343a8a4707d752db8d8ea779d0d681fa1c214
98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2961
Cache-Control: max-age=108674
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 12:32:10 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: ECS (amb/6B7D)
X-Cache: HIT
Content-Length: 279
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash e7dc2623cb841be51d3e8857e015d8e1
cbfdb2a7b965598de893fef89d47e17763501acf
df1fc0809a603469e6abcf1f07a13d792550d68c862f80e38c00e47e9b233a5b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
static.scarabresearch.com/wpjs/wploader.js?ts=2758
200 OK 11 kB URL HTTP/1.1 static.scarabresearch.com/wpjs/wploader.js?ts=2758
IP
File type Unicode text, UTF-8 text, with very long lines (26064)
Hash 2fc56d9a611d59d8961e74c4e8714e57
462e72a7259c4e557713d4a0f83b1dfa01445735
8e7522a5ad89315f9b9f6de63b9f538cdd001eccab8620b5d28f92840cac3ad8
GET /wpjs/wploader.js?ts=2758 HTTP/1.1
Host: static.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 10 Oct 2022 11:09:48 GMT
x-amz-version-id: DzVXMgBeksdrQfAKjc.ckmkVhMlLjwqT
Server: AmazonS3
Content-Encoding: gzip
Date: Sat, 12 Nov 2022 05:21:48 GMT
Cache-Control: max-age=86400
ETag: W/"1bb200ba7add3c5d4bfb6f3822bfe5af"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 98794c1dec0d4e7b10ddf0faa094cf94.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: sTCw7_f1O8HeFFFjlrRUVYLVd1uSa_bPip-qBIido2UTbCc20TdjvQ==
Age: 3549
ocsp.digicert.com/
200 OK 279 B IP
Hash 85d88bfb8fca121bbd41e00f1f3b4369
063343a8a4707d752db8d8ea779d0d681fa1c214
98678a8eb4352c1bc39e2614002f876f6ea1d578671cee6514bbeeb7da7b158c
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 0
Cache-Control: max-age=105713
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Etag: "636e3539-117"
Expires: Sun, 13 Nov 2022 11:42:49 GMT
Last-Modified: Fri, 11 Nov 2022 11:42:49 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 279
rstat.rockmostbet.com/public/rstat_pixel_spa.js
200 OK 10 kB URL HTTP/2 rstat.rockmostbet.com/public/rstat_pixel_spa.js
IP
ASN #24940 Hetzner Online GmbH
Hash f1b5cdd115d84254efb1d1cce82933d7
05cd06e570be5aaeee38c3139bb8b77173d0ce7b
fd390c721adddf0b2b6e8e3a28fd3f072a4b95c7af5d1fc02c10c95ab2050d7c
GET /public/rstat_pixel_spa.js HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
content-type: application/javascript
etag: "rkzpry7y7"
last-modified: Mon, 07 Nov 2022 18:23:58 GMT
server: Caddy
x-content-type-options: nosniff
content-length: 10303
date: Sat, 12 Nov 2022 06:20:56 GMT
X-Firefox-Spdy: h2
static.scarabresearch.com/wpjs/wpes6.js?ts=2758
200 OK 32 kB URL HTTP/1.1 static.scarabresearch.com/wpjs/wpes6.js?ts=2758
IP
File type Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Hash 8556197358340ecd591d07b61ace7fe8
b3e6e986007c397c2526c04b57ef98516aff78df
54e461e5f6d78812d8be4e1aa6b703bba1a9c68ee233dba0cd84ff02ff1ae168
GET /wpjs/wpes6.js?ts=2758 HTTP/1.1
Host: static.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 10 Oct 2022 11:09:51 GMT
x-amz-version-id: B7kEOPd3f.UUaahYeIIXT30URW6wDjD.
Server: AmazonS3
Content-Encoding: gzip
Date: Sat, 12 Nov 2022 06:05:45 GMT
Cache-Control: max-age=86400
ETag: W/"aea14a7926cfb79f14472c23a4b1543b"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 98794c1dec0d4e7b10ddf0faa094cf94.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: pQ2K0rjdCmCI8QKW4DpVuP9q_kzTfL_ZlXjlh0GfNN6IgwvSPzWnXQ==
Age: 911
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash e7dc2623cb841be51d3e8857e015d8e1
cbfdb2a7b965598de893fef89d47e17763501acf
df1fc0809a603469e6abcf1f07a13d792550d68c862f80e38c00e47e9b233a5b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtag/js?id=G-HCZ6L6382W&l=dataLayer&cx=c
200 OK 79 kB URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-HCZ6L6382W&l=dataLayer&cx=c
IP
File type ASCII text, with very long lines (25492)
Hash b98320170c2d672bb117418959b6d034
e2a1c478c31ed638da60f1aec59c9984fcbdac02
0f5a6051db1e2e877d48ebbfbec21cd76b3dcd1cbcca5a51f57e087b64ebe797
GET /gtag/js?id=G-HCZ6L6382W&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 12 Nov 2022 06:20:56 GMT
expires: Sat, 12 Nov 2022 06:20:56 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 78727
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Cache-Control, Pragma, Last-Modified, ETag, Alert, Backoff, Content-Type, Retry-After, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 12 Nov 2022 05:24:59 GMT
cache-control: public,max-age=3600
age: 3357
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 14 kB IP
Hash 9e351c0a8b5407237ceb79e62ca05166
6ca4d2ec6846233b6b4e6ec83f0f3925bb9949fd
51a0e1dbd82f499ca8c8421da451a16c2da689e12b6441cf3bb5fc79428d9c2d
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5864
Cache-Control: max-age=102220
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Etag: "636e10ac-1d7"
Expires: Sun, 13 Nov 2022 10:44:36 GMT
Last-Modified: Fri, 11 Nov 2022 09:06:52 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
ocsp.sectigo.com/
200 OK 471 B IP
Hash 21817fa3c60612398404dbe75d383a1a
2d5e08988401c8d0adb24fb26987a0ee26544b4e
12cf02219c8cf9fe9b31f48e19ec88ff888a4ca87a7af1c47eff60a9c5865bfe
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 06:20:56 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Thu, 10 Nov 2022 18:25:29 GMT
Expires: Thu, 17 Nov 2022 18:25:28 GMT
Etag: "2d5e08988401c8d0adb24fb26987a0ee26544b4e"
Cache-Control: max-age=474871,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 768d2a24fff8fab8-OSL
rstat.rockmostbet.com/lib.js
200 OK 237 kB URL HTTP/2 rstat.rockmostbet.com/lib.js
IP
ASN #24940 Hetzner Online GmbH
File type Unicode text, UTF-8 text, with very long lines (29927), with LF, NEL line terminators
Size 237 kB (236698 bytes)
Hash 5953536f88f5f9eb795e19a918b55b96
b87cf538507577f4cbad23a7bd274efbabd9527b
a2bb592e40a09c6bb085e0baba4cab70bde877c3c9809786756fc574fb9fd1ef
GET /lib.js HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript
date: Sat, 12 Nov 2022 06:20:56 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997080776240005121; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 0
x-xss-protection: 1
content-length: 236698
X-Firefox-Spdy: h2
my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01
200 OK 697 B URL HTTP/2 my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01
IP
Hash 6425f508eacb60db81c6d0b38ae56a58
d27caed071b054a15ab2291a11a4bfe12e097d7a
e94404dcfeb2d07ed1a6c0ad4230d5bc5754c0c965736d4ebc3224af415094d0
GET /p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: text/javascript
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
www.google-analytics.com/analytics.js
200 OK 20 kB URL HTTP/2 www.google-analytics.com/analytics.js
IP
File type ASCII text, with very long lines (1325)
Hash 47e6f374ca946fddd5b59871b325736c
baa9282efc8785e84d247c3bff518eaa45f101c4
16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Sat, 12 Nov 2022 04:41:09 GMT
expires: Sat, 12 Nov 2022 06:41:09 GMT
cache-control: public, max-age=7200
age: 5987
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 1bb279167832b97b5e80041e8975740c
48d5f288978ea6717b16e0f96974a23603361cc2
894d4dd927851fb6078c3bd527e3f424c4e3ad3f6ebdfa7c0fee089e0ce044cd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4870
Cache-Control: max-age=167089
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Etag: "636f11f3-1d7"
Expires: Mon, 14 Nov 2022 04:45:45 GMT
Last-Modified: Sat, 12 Nov 2022 03:24:35 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
connect.facebook.net/en_US/fbevents.js
200 OK 27 kB URL HTTP/2 connect.facebook.net/en_US/fbevents.js
IP
File type ASCII text, with very long lines (64348)
Hash 0ac10debd3a9ea8147a26d045bb93e6e
ff45f3442508e8695f2303701682ebdb6e016464
5dee7b453b2c72c07ff1d62432493a044507835a8031ea62edf2fa7cc26219b9
GET /en_US/fbevents.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: uYCYsUSKNVi7XRwLOWupzQDb307sCb7fSu2xVKG+RPxy6+pZWQrrXU+9xURTAP8zeuGhl5SoGc1B91dcERRpeA==
priority: u=3,i
content-length: 27337
x-fb-trip-id: 1904183273
date: Sat, 12 Nov 2022 06:20:56 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/upload/spa/olympics.json?1668234056176
200 OK 995 B URL HTTP/2 3vsmdh0yz31vwcemst.com/upload/spa/olympics.json?1668234056176
IP
Hash b9584429f0fb9b2ea9c64d9fa68efbfc
41073da9db1808d9097f4ad43b8d656201de71ff
b96fcb4619ba8036661c7db34c6b278210d6bab5878b1d979e8587c2ee8d0440
Analyzer Verdict Alert quad9 Sinkholed
GET /upload/spa/olympics.json?1668234056176 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.1.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: application/json
last-modified: Sat, 05 Feb 2022 09:22:39 GMT
vary: Accept-Encoding
etag: W/"61fe41df-2d"
expires: Sat, 19 Nov 2022 06:20:56 GMT
cache-control: max-age=604800, public
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 1bb279167832b97b5e80041e8975740c
48d5f288978ea6717b16e0f96974a23603361cc2
894d4dd927851fb6078c3bd527e3f424c4e3ad3f6ebdfa7c0fee089e0ce044cd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4870
Cache-Control: max-age=167089
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:56 GMT
Etag: "636f11f3-1d7"
Expires: Mon, 14 Nov 2022 04:45:45 GMT
Last-Modified: Sat, 12 Nov 2022 03:24:35 GMT
Server: ECS (ska/F708)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: tvOeBCHGTXO0hKHrOHCtBA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: mCxsW4AxJx2jBOml5fS6EemwcIw=
rstat.rockmostbet.com/band/t4k.json?
200 OK 86 B URL HTTP/2 rstat.rockmostbet.com/band/t4k.json?
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash 49aa9d65c8007c22bda68b4059b0ed63
a7089d8c77ab27e642f12f450ab80283eb6dd84f
d40d516b42ed86708f03b5cbb7eed2b6a1ba1f6155c0875e0b97a3a73c72f019
POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 759
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Sat, 12 Nov 2022 06:20:56 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997080776240005121; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 78
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2
rstat.rockmostbet.com/band/t4k.json?
200 OK 86 B URL HTTP/2 rstat.rockmostbet.com/band/t4k.json?
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash aa278abb1301cd4e5c1d6bfb324b7ec4
d37d87ee2c633332f10612d2d9690975e6b87efc
66d4ae534061c3c33ccaeff55a967a569f977563336c125563db519ded503410
POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 672
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Sat, 12 Nov 2022 06:20:56 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997080776240005121; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 79
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2
mc.yandex.ru/metrika/tag.js
200 OK 89 kB URL HTTP/2 mc.yandex.ru/metrika/tag.js
IP
File type ASCII text, with very long lines (65536), with no line terminators
Hash cbbbe1837bcf420cbd661fb3b3e8a441
145e39b3899ecdaaeb4cbdcd99e1e5a6c43dae62
5aec3a4fa0055e6b8ca85d49347e6b86b78be0d80f65a4b80297ff6de911f927
GET /metrika/tag.js HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-length: 73397
date: Sat, 12 Nov 2022 06:20:56 GMT
access-control-allow-origin: *
etag: "63575841-11eb5"
expires: Sat, 12 Nov 2022 07:20:56 GMT
last-modified: Tue, 25 Oct 2022 06:30:09 GMT
cache-control: max-age=3600
content-encoding: br
content-type: application/javascript
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/connection/websocket
101 Switching Protocols 0 B URL HTTP/1.1 3vsmdh0yz31vwcemst.com/connection/websocket
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /connection/websocket HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://3vsmdh0yz31vwcemst.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 9hJuVpQcXG4G9g5p4D3QFw==
Connection: keep-alive, Upgrade
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Server: nginx
Date: Sat, 12 Nov 2022 06:20:57 GMT
Connection: upgrade
upgrade: websocket
sec-websocket-accept: xjdk2Y/vqo1r1IEScSGQafuuj2I=
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash a7d7a5379a732fc5eadab78de886cc31
6df8c63644e97bf57262415f24e270c718e1758b
c355159cc937a19485f62cc446530f319749237e147adbb2c5784d1d2c20ed64
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/recaptcha/api.js?onload=onloadcallback&render=explicit
200 OK 580 B URL HTTP/2 www.google.com/recaptcha/api.js?onload=onloadcallback&render=explicit
IP
File type ASCII text, with very long lines (909), with no line terminators
Hash 645839bb2a36f1b5337b8701d692b126
76f03a580d775a3dbd34f5dc4e7c2d4c18833cd5
70d059e2d878dadc8cf895cfa4dcebefbf7c7eef7771db6369f1e1a0539236d1
GET /recaptcha/api.js?onload=onloadcallback&render=explicit HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
expires: Sat, 12 Nov 2022 06:20:57 GMT
date: Sat, 12 Nov 2022 06:20:57 GMT
cache-control: private, max-age=300
content-type: text/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 580
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ac127eb994552f5336f473da4ba5474a
e18d0e62831dfd3f8976d43b46f4286657d6d504
3b0da5e281a6859bb3e0672a4c42b2aa22e121ac5e6ec37169999d90b580a892
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3B0DA5E281A6859BB3E0672A4C42B2AA22E121AC5E6EC37169999D90B580A892"
Last-Modified: Thu, 10 Nov 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6727
Expires: Sat, 12 Nov 2022 08:13:04 GMT
Date: Sat, 12 Nov 2022 06:20:57 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ac127eb994552f5336f473da4ba5474a
e18d0e62831dfd3f8976d43b46f4286657d6d504
3b0da5e281a6859bb3e0672a4c42b2aa22e121ac5e6ec37169999d90b580a892
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3B0DA5E281A6859BB3E0672A4C42B2AA22E121AC5E6EC37169999D90B580A892"
Last-Modified: Thu, 10 Nov 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6727
Expires: Sat, 12 Nov 2022 08:13:04 GMT
Date: Sat, 12 Nov 2022 06:20:57 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash e569acd833d180f3c2fba0919fbeb704
60a3121c9bf8e08a8a7fe70001c24b6f8c9981f5
994bee0670c93479c3e835985d24d7ce41fbc0a3013e173d79ea1ea5f63ac85c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
3vsmdh0yz31vwcemst.com/favicon.ico
200 OK 2.3 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/favicon.ico
IP
File type MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Hash 45c9a88c63d3d1c3325e177cfd48b4a3
0a183db15462ff7298b967baf4eda11c68d3f6b5
651ba9e0fc47abf40745c34a61028885070173ddc8a249cb823be9cfce0597ac
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.1.1126352818.1668234056
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: image/x-icon
last-modified: Wed, 09 Nov 2022 13:13:39 GMT
vary: Accept-Encoding
etag: W/"636ba783-1536"
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_set?testcookie=93oolqkqvarxqucsjmz3l
200 OK 0 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_set?testcookie=93oolqkqvarxqucsjmz3l
IP
ASN #44066 diva-e Datacenters GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /multiauth/test_cookie_set?testcookie=93oolqkqvarxqucsjmz3l HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-client-device-id,x-client-name,x-client-session,x-client-version,x-multiauth-version,x-requested-with
Referer: https://3vsmdh0yz31vwcemst.com/
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: a84eb217a0d8484593ed8c60bbce3cb9
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-length: 0
date: Sat, 12 Nov 2022 06:20:56 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=en-US&locales[]=en&domains[]=messages&fallback=1
200 OK 324 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=en-US&locales[]=en&domains[]=messages&fallback=1
IP
Size 324 kB (324416 bytes)
Hash bcd06209db5aa40d2c7344b3e5c5d0fa
79e2082b1a4828718fe909785c3c10a0678e20a9
7c30b2f1aaedebb78fdbd740ee682ea7e7f54c6b4beba33c303fd5e1ec3bc30a
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v2/translations?locales[]=en-US&locales[]=en&domains[]=messages&fallback=1 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Connection: keep-alive
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:57 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"a8586c2399ed5aa2f673a7c66d7a6762"
x-request-id: 19682d9ac333a9bd4df70fb1bef29eab
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:57 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_set?testcookie=93oolqkqvarxqucsjmz3l
200 OK 10 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_set?testcookie=93oolqkqvarxqucsjmz3l
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash f7f86d583c92292a7025fc1f25657a1f
92659f2f702a5b18d44a58055c6cd77173630ae2
3b9de8f3bb4d65ebe964703b38c9ce2f3b40a58b33484e6eed8f92bbd5f10a4f
GET /multiauth/test_cookie_set?testcookie=93oolqkqvarxqucsjmz3l HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: a689213699d9412daf756031009ced89
set-cookie: test_cooke_93oolqkqvarxqucsjmz3l=1; Max-Age=3600; SameSite=None; Secure
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 10
date: Sat, 12 Nov 2022 06:20:56 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
region1.google-analytics.com/g/collect?v=2&tid=G-HCZ6L6382W>m=2oeb90&_p=246575260&cid=1126352818.1668234056&ul=en-us&sr=1280x1024&_s=1&sid=1668234056&sct=1&seg=0&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&dt=&en=page_view&_fv=1&_nsi=1&_ss=1
204 No Content 0 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-HCZ6L6382W>m=2oeb90&_p=246575260&cid=1126352818.1668234056&ul=en-us&sr=1280x1024&_s=1&sid=1668234056&sct=1&seg=0&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&dt=&en=page_view&_fv=1&_nsi=1&_ss=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-HCZ6L6382W>m=2oeb90&_p=246575260&cid=1126352818.1668234056&ul=en-us&sr=1280x1024&_s=1&sid=1668234056&sct=1&seg=0&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&dt=&en=page_view&_fv=1&_nsi=1&_ss=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
date: Sat, 12 Nov 2022 06:20:57 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
my.rtmark.net/img.gif?f=sync&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01&ttl=&rurl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0
200 OK 43 B URL HTTP/2 my.rtmark.net/img.gif?f=sync&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01&ttl=&rurl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
GET /img.gif?f=sync&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01&ttl=&rurl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:57 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=7421e778cd1b4ee1a186bfbfa994a15a; expires=Sun, 12 Nov 2023 06:20:57 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
mc.yandex.ru/metrika/advert.gif
200 OK 43 B URL HTTP/2 mc.yandex.ru/metrika/advert.gif
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
GET /metrika/advert.gif HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Sat, 12 Nov 2022 06:20:57 GMT
access-control-allow-origin: *
etag: "63575841-2b"
expires: Sat, 12 Nov 2022 07:20:57 GMT
accept-ranges: bytes
last-modified: Tue, 25 Oct 2022 06:30:09 GMT
cache-control: max-age=3600
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=messages&fallback=1
200 OK 821 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=messages&fallback=1
IP
File type JSON data\012- , ASCII text, with very long lines (65536), with no line terminators
Size 821 kB (820708 bytes)
Hash ca0222fff47b9704bbc091d7d61fc754
733ec254e611b47826b71b707a8f3f2dff4f4146
0ebc0b9490e1bb5a33b47f51ffaf8160a9d2f91450ab2219fe6c55de61a51575
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v2/translations?locales[]=bn&domains[]=messages&fallback=1 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Connection: keep-alive
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:57 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"be9ecd30a2d743b87d943eca1e0ac33c"
x-request-id: a6a841454f7b7cf1f90270d2b2a49f84
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:57 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash e3f9965225cba49c71506d7dee4c1647
d1d30248236cfe679fa182860d69634d30f5b0ca
8a2641a2fa1026f8893b4acf7f7c78c633a1408779f3063c87ad292729300d97
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
mc.yandex.ru/watch/37954615/1?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062056%3Aet%3A1668234057%3Ac%3A1%3Arn%3A225637047%3Arqn%3A1%3Au%3A1668234057580897556%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A1%2C224%2C30%2C0%2C383%2C0%2C%2C556%2C4%2C%2C%2C%2C1248%3Ans%3A1668234054694%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668234057%3At%3Amostbet_title&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29
200 OK 419 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062056%3Aet%3A1668234057%3Ac%3A1%3Arn%3A225637047%3Arqn%3A1%3Au%3A1668234057580897556%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A1%2C224%2C30%2C0%2C383%2C0%2C%2C556%2C4%2C%2C%2C%2C1248%3Ans%3A1668234054694%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668234057%3At%3Amostbet_title&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29
IP
File type JSON data\012- , ASCII text, with very long lines (419), with no line terminators
Hash 83e7586fca9cecac1c6f2ea81b47e95f
9acc0ac33c96a9f2cb252787ba1e34695d0226b5
56c58df9fd63c10e0fa8b185814c2ec8972906d9fdd9cdaf8d3d345d46a6f21b
GET /watch/37954615/1?wmode=7&page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062056%3Aet%3A1668234057%3Ac%3A1%3Arn%3A225637047%3Arqn%3A1%3Au%3A1668234057580897556%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A1%2C224%2C30%2C0%2C383%2C0%2C%2C556%2C4%2C%2C%2C%2C1248%3Ans%3A1668234054694%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1668234057%3At%3Amostbet_title&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29 HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Referer: https://3vsmdh0yz31vwcemst.com/
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 419
date: Sat, 12 Nov 2022 06:20:57 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Sat, 12-Nov-2022 06:20:57 GMT
last-modified: Sat, 12-Nov-2022 06:20:57 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: application/json; charset=utf-8
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash e3f9965225cba49c71506d7dee4c1647
d1d30248236cfe679fa182860d69634d30f5b0ca
8a2641a2fa1026f8893b4acf7f7c78c633a1408779f3063c87ad292729300d97
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
mostauthor.com/multiauth/test_cookie_get?testcookie=9vnw56ds37bu22rwq6v7t
200 OK 0 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_get?testcookie=9vnw56ds37bu22rwq6v7t
IP
ASN #44066 diva-e Datacenters GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /multiauth/test_cookie_get?testcookie=9vnw56ds37bu22rwq6v7t HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-client-device-id,x-client-name,x-client-session,x-client-version,x-multiauth-version,x-requested-with
Referer: https://3vsmdh0yz31vwcemst.com/
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: e91ba8be22bb42e99f2a3b17c6f6cefc
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-length: 0
date: Sat, 12 Nov 2022 06:20:57 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_get?testcookie=93oolqkqvarxqucsjmz3l
200 OK 0 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_get?testcookie=93oolqkqvarxqucsjmz3l
IP
ASN #44066 diva-e Datacenters GmbH
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /multiauth/test_cookie_get?testcookie=93oolqkqvarxqucsjmz3l HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-client-device-id,x-client-name,x-client-session,x-client-version,x-multiauth-version,x-requested-with
Referer: https://3vsmdh0yz31vwcemst.com/
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: c9d6057185bb415ab03b0a799d7dd9c2
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-length: 0
date: Sat, 12 Nov 2022 06:20:57 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_get?testcookie=9vnw56ds37bu22rwq6v7t
200 OK 21 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_get?testcookie=9vnw56ds37bu22rwq6v7t
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash caf33483167cc6a28994a501b478f8df
8b80faf52bdfda242a8a7c2d2cff45a26c43d031
070bf1d4556043cf533cca3e374c72481fb31525f9254c46a37031fb35f69f0e
GET /multiauth/test_cookie_get?testcookie=9vnw56ds37bu22rwq6v7t HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Cookie: test_cooke_9vnw56ds37bu22rwq6v7t=1; test_cooke_93oolqkqvarxqucsjmz3l=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: 041c7c9915df43da90a2fe52a36e70d8
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 21
date: Sat, 12 Nov 2022 06:20:57 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
mostauthor.com/multiauth/test_cookie_get?testcookie=93oolqkqvarxqucsjmz3l
200 OK 21 B URL HTTP/2 mostauthor.com/multiauth/test_cookie_get?testcookie=93oolqkqvarxqucsjmz3l
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash caf33483167cc6a28994a501b478f8df
8b80faf52bdfda242a8a7c2d2cff45a26c43d031
070bf1d4556043cf533cca3e374c72481fb31525f9254c46a37031fb35f69f0e
GET /multiauth/test_cookie_get?testcookie=93oolqkqvarxqucsjmz3l HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Cookie: test_cooke_9vnw56ds37bu22rwq6v7t=1; test_cooke_93oolqkqvarxqucsjmz3l=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: f385648758c243e2a01d2f205b0d1b87
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 21
date: Sat, 12 Nov 2022 06:20:57 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
www.facebook.com/tr/?id=2109311049329438&ev=PageView&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&rl=&if=false&ts=1668234057056&sw=1280&sh=1024&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1668234057055.784379697&it=1668234056356&coo=false&rqm=GET
200 OK 0 B URL HTTP/2 www.facebook.com/tr/?id=2109311049329438&ev=PageView&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&rl=&if=false&ts=1668234057056&sw=1280&sh=1024&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1668234057055.784379697&it=1668234056356&coo=false&rqm=GET
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tr/?id=2109311049329438&ev=PageView&dl=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&rl=&if=false&ts=1668234057056&sw=1280&sh=1024&v=2.9.89&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1668234057055.784379697&it=1668234056356&coo=false&rqm=GET HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/plain
access-control-allow-origin:
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400
date: Sat, 12 Nov 2022 06:20:57 GMT
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 23dd8b12572b78e5d32d491b3d0d9d32
718c3e3abcc55c295c72e5ee4e5441fe5acc1363
f72c359246ea96d4f28bbc5aee8d4d24fcba9f47dfc691693f6c49e370d9b103
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 23dd8b12572b78e5d32d491b3d0d9d32
718c3e3abcc55c295c72e5ee4e5441fe5acc1363
f72c359246ea96d4f28bbc5aee8d4d24fcba9f47dfc691693f6c49e370d9b103
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=292176747&uid=0&gjid=1713087486&_gid=2142265892.1668234056&_u=YADAAEABAAAAACAEK~&z=464892297
200 OK 4 B URL HTTP/2 stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=292176747&uid=0&gjid=1713087486&_gid=2142265892.1668234056&_u=YADAAEABAAAAACAEK~&z=464892297
IP
File type ASCII text, with no line terminators
Hash 48c0473b7821185d937e685216e2168b
3743e47f8a429a5e87b86cb582d78940733d9d2e
570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=292176747&uid=0&gjid=1713087486&_gid=2142265892.1668234056&_u=YADAAEABAAAAACAEK~&z=464892297 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 12 Nov 2022 06:20:57 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=1690444412&uid=0&gjid=1961128350&_gid=2142265892.1668234056&_u=YADAAEAAAAAAACAEK~&z=1372158848
200 OK 4 B URL HTTP/2 stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=1690444412&uid=0&gjid=1961128350&_gid=2142265892.1668234056&_u=YADAAEAAAAAAACAEK~&z=1372158848
IP
File type ASCII text, with no line terminators
Hash 48c0473b7821185d937e685216e2168b
3743e47f8a429a5e87b86cb582d78940733d9d2e
570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=1690444412&uid=0&gjid=1961128350&_gid=2142265892.1668234056&_u=YADAAEAAAAAAACAEK~&z=1372158848 HTTP/1.1
Host: stats.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 0
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 12 Nov 2022 06:20:57 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
last-modified: Sun, 17 May 1998 03:00:00 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 23dd8b12572b78e5d32d491b3d0d9d32
718c3e3abcc55c295c72e5ee4e5441fe5acc1363
f72c359246ea96d4f28bbc5aee8d4d24fcba9f47dfc691693f6c49e370d9b103
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4b46bbcd35c85c4678b0e3e409bba3bc
bb0705335e28414345ad5fcdd61104cf2fbbbbc4
6c3df7e6d0a8491fe24c03df2ccba059ba2f84155a680a4a22f217d3870cff95
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4b46bbcd35c85c4678b0e3e409bba3bc
bb0705335e28414345ad5fcdd61104cf2fbbbbc4
6c3df7e6d0a8491fe24c03df2ccba059ba2f84155a680a4a22f217d3870cff95
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 09 Nov 2022 14:07:32 GMT
expires: Thu, 09 Nov 2023 14:07:32 GMT
cache-control: public, max-age=31536000
age: 231206
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash fb29db48daab83bcaed56b72093619cc
e0e0a09d729ffb1c41411419768896f1e1eb3346
08e24124f809f1ab7e6960355efcb419e13dd5fb6063c31caf04e11ebdb7a5cf
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "08E24124F809F1AB7E6960355EFCB419E13DD5FB6063C31CAF04E11EBDB7A5CF"
Last-Modified: Fri, 11 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5683
Expires: Sat, 12 Nov 2022 07:55:41 GMT
Date: Sat, 12 Nov 2022 06:20:58 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe6fac57d-aa5c-42c2-904b-58aa73c59975.jpeg
200 OK 4.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe6fac57d-aa5c-42c2-904b-58aa73c59975.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 701700f42e1b0e528a63c3bd2a4c54e7
a3af603900538ea10e094981d298a0b37d0ab896
c84ac2d3524eb950a433aa01e1226d995d87948452e4e135a4661094923ca465
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe6fac57d-aa5c-42c2-904b-58aa73c59975.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4268
x-amzn-requestid: 19d2f4e7-b6c1-4093-b54c-70a9a476ad89
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhSEwYIAMFg7Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-6e2f5a6147153e5c32cc4499;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: RPDkAR4fjBR89lWuee42HxnCGQv_vd6tWbOavmEsGCkZeKwjW_99Dg==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 707e733794d52100fde0ab21bf0b1462.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:44:57 GMT
age: 30961
etag: "a3af603900538ea10e094981d298a0b37d0ab896"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg
200 OK 8.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 084ca839d34b15916cd2f5034440a1ef
7764777ce9a862c1590712ef33032df72edefffd
b8893d7f327f88316cb909ded7fd8f4e1809190a7da807677785bf953f6e33fb
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b650f84-0cd0-4921-bc04-f0ea0459e4d1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 8482
x-amzn-requestid: 79e5e211-afc8-4531-b361-6f6f3386f16e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhUGJsIAMF7Mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-5a0ba4a93eba91c81ba3a9bc;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: uZ6Nth8jaUp7GXRXknKB8k90AgzBj4Yv3YfduSF7yajyFESb9oOh3A==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 ead78c395f4bede3ec6cd7ea180e3d3a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:51:45 GMT
age: 30553
etag: "7764777ce9a862c1590712ef33032df72edefffd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facfcee70-832e-4f2d-8fc7-55d2bfff651e.jpeg
200 OK 8.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facfcee70-832e-4f2d-8fc7-55d2bfff651e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash eac2ed4bece6282c8273a58a88371e2e
2d90ff66079e8ffbaaa367a6bfc08927e7cc424d
aea97fd7d90302edcb3e0c08507d682e02166e8ddd4d082fc4f5435af438594c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Facfcee70-832e-4f2d-8fc7-55d2bfff651e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 8633
x-amzn-requestid: 8bdfbfbb-5193-4c62-ba1b-c906f7548676
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhSEC1oAMF8tw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-39b4c2954dbc8e4c40a2c9d8;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: lxrfhO5oOGvECIrlZYKsfXOTZZksAIIHAafyRM-FdRXAaBVZs5cEQA==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 22:04:43 GMT
age: 29775
etag: "2d90ff66079e8ffbaaa367a6bfc08927e7cc424d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg
200 OK 6.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash faa8e3cf2ab3c1d53a1735def5bb7476
ccc1ec5ebb5090c6255dcb1e8899e95cdd91e12f
e81a8fa312ec478871427f1d04ba7fe563573c683809153f75dec8df979d6efe
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F073ec866-b693-4f96-82bf-76ba051797c9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6577
x-amzn-requestid: b4587cfb-6041-453c-9e74-fa35ecd31448
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMjIGHRoAMF26g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec147-29e7ec741b0e6f6f674aef75;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:23 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 2y97S3ITb7MLXuIIAQfCCKjgvOXisdCT5mod7OD588LOhPCy_OrUXQ==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 22:02:21 GMT
age: 29917
etag: "ccc1ec5ebb5090c6255dcb1e8899e95cdd91e12f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cd5bdc050716bb76afe8090fc81617e7
5109c156b180727767fc03c411190ccc0d3fb5fc
9b13e7838946c6654dda17886c2ca8d42de934acb93f4bddb1008dfa1bd1ea99
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4af930b9-b854-4316-8425-07c6aa06477a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11715
x-amzn-requestid: 20e508bd-6568-4225-9bee-c683a49d44f6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdMhUHkpIAMFfJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec13b-7dc726b94a37fc667e2e6646;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:40:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: Lp5eW92D8SbFtcQLk-LRSaSKNMNFYCW7XTALdNdrJxN6ebgdH8_1Dw==
via: 1.1 da5952aa802df39905ceb16592e9698a.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 21:42:55 GMT
age: 31083
etag: "5109c156b180727767fc03c411190ccc0d3fb5fc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84f5d648-d178-4f63-98ef-7a2f4504174e.jpeg
200 OK 7.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84f5d648-d178-4f63-98ef-7a2f4504174e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 93d01c3c2422df3f7994d3496069dc37
96a4243e7f538fdd4e0aec4f39b058a08a4898e9
1fbc7efb3dfb058984abf1fbe60021212ff1bca8e366f03b1752c615e5249e55
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F84f5d648-d178-4f63-98ef-7a2f4504174e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7493
x-amzn-requestid: 077e815e-bbfc-472c-9d22-a9f0e7cda511
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bdNDhGYvIAMFygQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636ec216-3a8a5a6f41b8ade53ff48dce;Sampled=0
x-amzn-remapped-date: Fri, 11 Nov 2022 21:43:50 GMT
x-amz-cf-pop: YVR50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: OLdVee-O7P-RLfbeaNBvTK8UX-hcx51-athqqaRuIzrtlIAPxw3BPg==
via: 1.1 feda34dcbf6a00e232656b7983c2c7f0.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 11 Nov 2022 22:00:37 GMT
age: 30021
etag: "96a4243e7f538fdd4e0aec4f39b058a08a4898e9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.godaddy.com/
200 OK 1.8 kB IP
Hash 1feb8b208396305dc26615608179fe22
7db07ae69237df86d590c3223d2689e79c740667
3ca4aa314b832765d02785d93898198519d131018d2ca23a16f373f12dbd6de3
POST / HTTP/1.1
Host: ocsp.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Sat, 12 Nov 2022 06:20:58 GMT
Content-Type: application/ocsp-response
Content-Length: 1777
Connection: keep-alive
X-Sucuri-ID: 19041
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Fri, 11 Nov 2022 19:24:28 GMT
Expires: Sat, 12 Nov 2022 19:24:28 GMT
ETag: "7db07ae69237df86d590c3223d2689e79c740667"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
code.jivosite.com/widget/3bcOoG4MqH
200 OK 5.9 kB URL HTTP/2 code.jivosite.com/widget/3bcOoG4MqH
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (17132), with no line terminators
Hash 5d544f68adb5df61f02dd184132c6668
1762651e6ff01d0025e519c8fddf8fe86943582f
8a7b7b408a6b58e3614c065e0568696384f680dfeaf7b71bfa7ebee7641a6117
GET /widget/3bcOoG4MqH HTTP/1.1
Host: code.jivosite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:58 GMT
content-type: application/javascript
content-length: 5938
access-control-allow-origin: *
cache-control: max-age=7200
content-encoding: br
etag: "636cf1b8-1732"
expires: Fri, 11 Nov 2022 11:26:24 GMT
last-modified: Thu, 10 Nov 2022 12:42:32 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-12T05:18:51+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jivosite.com/script/widget/config/3bcOoG4MqH
200 OK 3.4 kB URL HTTP/2 code.jivosite.com/script/widget/config/3bcOoG4MqH
IP
ASN #199524 G-Core Labs S.A.
File type JSON data\012- , ASCII text, with very long lines (11431), with no line terminators
Hash d46f3e82169f9c4e8d38eb5228b3edd1
b441cacbf5deb96e7800a10c1d500ddfd4994dd4
2ab8e615e3f4940075e549c6855a68966b7520c272aec099cdfda7badf0145b0
GET /script/widget/config/3bcOoG4MqH HTTP/1.1
Host: code.jivosite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:58 GMT
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=7200
content-encoding: gzip
expires: Sat, 12 Nov 2022 08:12:30 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-12T06:12:30+00:00
x-id: am3-up-gc95
X-Firefox-Spdy: h2
mostauthor.com/multiauth/ping
401 Unauthorized 35 B URL HTTP/2 mostauthor.com/multiauth/ping
IP
ASN #44066 diva-e Datacenters GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash 0d996c3fba12286419cc5490ecc262f2
8d763a6d6dc7b73504e259d6755a91215cc90a77
89ee31619ad837c48dfe0eeb3bd1e65d8c372d8b73c1f1e345c6dd91aca7f25f
GET /multiauth/ping HTTP/1.1
Host: mostauthor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
X-Multiauth-Version: authy
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Cookie: test_cooke_9vnw56ds37bu22rwq6v7t=1; test_cooke_93oolqkqvarxqucsjmz3l=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 401 Unauthorized
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
access-control-allow-headers: authorization,x-client-device-id,x-client-name,content-type,x-client-session,x-client-version,x-requested-with,x-multiauth-version,x-multiauth-logout-reason,x-multiauth-disabled-reason,x-client-platform
access-control-max-age: 600
x-session-fingerprint: 669e0f1a552f422c8ba74476189d1924
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
content-type: application/json
content-length: 35
date: Sat, 12 Nov 2022 06:20:57 GMT
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=promo&domains[]=validators&fallback=1
200 OK 342 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v2/translations?locales[]=bn&domains[]=promo&domains[]=validators&fallback=1
IP
Size 342 kB (342330 bytes)
Hash 609356a6bda903505e2388f6422cdc5b
94b04a8f48994fbe465e8e65a14af1948d176ab3
dab7c63f4650e1ba61a60f4b5b182a590cb6b7f2df3c6acde2e19343fe48e5f6
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v2/translations?locales[]=bn&domains[]=promo&domains[]=validators&fallback=1 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Connection: keep-alive
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=1668234057580897556; _ym_d=1668234057; _ym_isad=2; _fbp=fb.1.1668234057055.784379697
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:58 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"be9ecd30a2d743b87d943eca1e0ac33c"
x-request-id: 95450a2b0b56101d2ff1a2769651045a
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash aca2e38eee453679f022dba5cf64555b
1c9f6f5e9ed1272e9edcc958e7cc2dec61f793df
ea8bc6a82c3243813e137066ca5b659192f72ac69690f9ea4dcb668624baf586
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:58 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash aca2e38eee453679f022dba5cf64555b
1c9f6f5e9ed1272e9edcc958e7cc2dec61f793df
ea8bc6a82c3243813e137066ca5b659192f72ac69690f9ea4dcb668624baf586
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:58 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=292176747&_u=YADAAEABAAAAACAEK~&z=984771097
200 OK 42 B URL HTTP/2 www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=292176747&_u=YADAAEABAAAAACAEK~&z=984771097
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=292176747&_u=YADAAEABAAAAACAEK~&z=984771097 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 12 Nov 2022 06:20:58 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=1690444412&_u=YADAAEAAAAAAACAEK~&z=771078568
200 OK 42 B URL HTTP/2 www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=1690444412&_u=YADAAEAAAAAAACAEK~&z=771078568
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-79409907-1&cid=1126352818.1668234056&jid=1690444412&_u=YADAAEAAAAAAACAEK~&z=771078568 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 12 Nov 2022 06:20:58 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash aca2e38eee453679f022dba5cf64555b
1c9f6f5e9ed1272e9edcc958e7cc2dec61f793df
ea8bc6a82c3243813e137066ca5b659192f72ac69690f9ea4dcb668624baf586
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 12 Nov 2022 06:20:58 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 05 Nov 2022 12:31:58 GMT
expires: Sun, 05 Nov 2023 12:31:58 GMT
cache-control: public, max-age=31536000
age: 582540
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
rstat.rockmostbet.com/band/t4k.json?
200 OK 86 B URL HTTP/2 rstat.rockmostbet.com/band/t4k.json?
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash ed11a7443845bc83385f047bf9d1b4c9
ac8c721208339cd869562a68f07b2ff9f28b4925
3672d26ef09cd480a89f95596b0d0418353543a0a6ef86e24f72701f54f4bfad
POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1057
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Sat, 12 Nov 2022 06:20:58 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997080776240005121; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 10
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
200 OK 15 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15340, version 1.0\012- data
Hash 19b7a0adfdd4f808b53af7e2ce2ad4e5
81d5d4c7b5035ad10cce63cf7100295e0c51fdda
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
GET /s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15340
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 12 Nov 2022 01:26:23 GMT
expires: Sun, 12 Nov 2023 01:26:23 GMT
cache-control: public, max-age=31536000
age: 17675
last-modified: Mon, 16 Oct 2017 17:33:16 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Hash 285467176f7fe6bb6a9c6873b3dad2cc
ea04e4ff5142ddd69307c183def721a160e0a64e
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Nov 2022 21:46:16 GMT
expires: Fri, 10 Nov 2023 21:46:16 GMT
cache-control: public, max-age=31536000
age: 117282
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A1001860726%3Arqn%3A4%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-2)clc(0-0-0)rqnt(4)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A1001860726%3Arqn%3A4%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-2)clc(0-0-0)rqnt(4)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A1001860726%3Arqn%3A4%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-2)clc(0-0-0)rqnt(4)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 75
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Sat, 12 Nov 2022 06:20:58 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Sat, 12-Nov-2022 06:20:58 GMT
last-modified: Sat, 12-Nov-2022 06:20:58 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A2044%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A163499949%3Arqn%3A2%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C3273%2C3273%2C%2C%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)clc(0-0-0)rqnt(2)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A2044%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A163499949%3Arqn%3A2%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C3273%2C3273%2C%2C%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)clc(0-0-0)rqnt(2)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afp%3A2044%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A163499949%3Arqn%3A2%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C3273%2C3273%2C%2C%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)clc(0-0-0)rqnt(2)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 69
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Sat, 12 Nov 2022 06:20:58 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Sat, 12-Nov-2022 06:20:58 GMT
last-modified: Sat, 12-Nov-2022 06:20:58 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A192216917%3Arqn%3A5%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(5)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A192216917%3Arqn%3A5%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(5)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A192216917%3Arqn%3A5%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-3)clc(0-0-0)rqnt(5)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Sat, 12 Nov 2022 06:20:58 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Sat, 12-Nov-2022 06:20:58 GMT
last-modified: Sat, 12-Nov-2022 06:20:58 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A386348947%3Arqn%3A3%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(3)aw(1)ecs(1)rqnl(1)ti(2)
200 OK 43 B URL HTTP/2 mc.yandex.ru/watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A386348947%3Arqn%3A3%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(3)aw(1)ecs(1)rqnl(1)ti(2)
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/37954615/1?page-url=https%3A%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&charset=utf-8&hittoken=1668234057_b29473fe9d41993f792c57ea6823ddf0f2147e0b2dca945197de9b2dbd04eaec&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3Ahc77qkb9hqc2jb24budq4%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A921%3Acn%3A1%3Adp%3A0%3Als%3A1389032470590%3Ahid%3A356450594%3Az%3A0%3Ai%3A20221112062057%3Aet%3A1668234058%3Ac%3A1%3Arn%3A386348947%3Arqn%3A3%3Au%3A1668234057580897556%3Aw%3A1280x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1668234054694%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1668234058&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(3)aw(1)ecs(1)rqnl(1)ti(2) HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 187
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-length: 43
date: Sat, 12 Nov 2022 06:20:58 GMT
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-allow-credentials: true
pragma: no-cache
x-xss-protection: 1; mode=block
expires: Sat, 12-Nov-2022 06:20:58 GMT
last-modified: Sat, 12-Nov-2022 06:20:58 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-type: image/gif
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
node-sber1-az1-6.jivosite.com/widget/status/561276/3bcOoG4MqH?rnd=0.6261462062645513
200 OK 4.0 kB URL HTTP/2 node-sber1-az1-6.jivosite.com/widget/status/561276/3bcOoG4MqH?rnd=0.6261462062645513
IP
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (3374), with no line terminators
Hash c065cae88c8ac9331fe9b994e31c4990
dc8fccf91ee2e1fd700a4ca598be0b3d8991340e
249a48a2fbd9449ff44efd0a053992b0310a27239acdf0112cf89bb6a56b0e43
GET /widget/status/561276/3bcOoG4MqH?rnd=0.6261462062645513 HTTP/1.1
Host: node-sber1-az1-6.jivosite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-max-age: 1728000
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: X-Geoip, X-Botmode
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors 'none';
content-type: application/json; charset=utf-8
pragma: no-cache
server: foxy/2.0.1
x-botmode: no
x-frame-options: DENY
x-geoip: NO;03;Oslo (Alna District)
content-length: 4034
date: Sat, 12 Nov 2022 06:20:58 GMT
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/favicon.png
200 OK 2.8 kB URL HTTP/2 3vsmdh0yz31vwcemst.com/favicon.png
IP
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data
Hash f8cbfde8f3484f7a5f02189742f0f110
3eb0cec3e65d6cb0cc2744b5fa57ded1afb6e4d4
70504d4dc047aeac702b31e9290e9f5553e901d07d3844269cd966042988159a
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.png HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=1668234057580897556; _ym_d=1668234057; _ym_isad=2; _fbp=fb.1.1668234057055.784379697; _ym_visorc=b; multiAuthThirdPartyEnabled=true
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:59 GMT
content-type: image/png
content-length: 2810
last-modified: Wed, 09 Nov 2022 13:13:39 GMT
etag: "636ba783-afa"
accept-ranges: bytes
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 222dd7fd7dd02b06b0baa4ef35c45441
eeaae6b9558994d6e6955ab08528af2f54ea61ac
6624a87968a6a6071a1471a60c5e0e47a084ca099d0853560fb48701f3e0dd22
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6624A87968A6A6071A1471A60C5E0E47A084CA099D0853560FB48701F3E0DD22"
Last-Modified: Thu, 10 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5138
Expires: Sat, 12 Nov 2022 07:46:40 GMT
Date: Sat, 12 Nov 2022 06:21:02 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 222dd7fd7dd02b06b0baa4ef35c45441
eeaae6b9558994d6e6955ab08528af2f54ea61ac
6624a87968a6a6071a1471a60c5e0e47a084ca099d0853560fb48701f3e0dd22
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6624A87968A6A6071A1471A60C5E0E47A084CA099D0853560FB48701F3E0DD22"
Last-Modified: Thu, 10 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5138
Expires: Sat, 12 Nov 2022 07:46:40 GMT
Date: Sat, 12 Nov 2022 06:21:02 GMT
Connection: keep-alive
ocsp2.globalsign.com/gsalphasha2g2
200 OK 1.4 kB URL HTTP/1.1 ocsp2.globalsign.com/gsalphasha2g2
IP
Hash 843dc39f358c7ba17566b4f53630c1cc
e412093010f1163637d332fc4978b4827fc826f9
9de01070790ccdb1d9bb566892891a55cd4a2948fe9c24e74b0d3e82260ad78d
POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 12 Nov 2022 06:21:03 GMT
Content-Type: application/ocsp-response
Content-Length: 1423
Connection: keep-alive
Expires: Wed, 16 Nov 2022 04:36:27 GMT
ETag: "e412093010f1163637d332fc4978b4827fc826f9"
Last-Modified: Sat, 12 Nov 2022 04:36:28 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3262
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 768d2a53ef28fabc-OSL
code.jivo.ru/js/bundle_ru_RU.js?rand=1668155689
200 OK 313 kB URL HTTP/2 code.jivo.ru/js/bundle_ru_RU.js?rand=1668155689
IP
ASN #199524 G-Core Labs S.A.
File type Unicode text, UTF-8 text, with very long lines (61072), with no line terminators
Size 313 kB (313381 bytes)
Hash cf0ef636b81a8f3645f3479b66d38be2
166fbf64584df44f003a7ea78bddb536026b76af
1e55701c5b7114e8b10d722d86dd6b3931e7d4179fabc6637fb9308ca18d5162
GET /js/bundle_ru_RU.js?rand=1668155689 HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:21:04 GMT
content-type: application/javascript
content-length: 313381
access-control-allow-origin: *
cache-control: max-age=86400
content-encoding: br
etag: "636cf212-4c825"
last-modified: Thu, 10 Nov 2022 12:44:02 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-11T08:35:00+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jivo.ru/css/ff9b6aa/widget.css
200 OK 55 kB URL HTTP/2 code.jivo.ru/css/ff9b6aa/widget.css
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (65536), with no line terminators
Hash 1d0e2e9ca558df4902c4a3b074b31c4d
db7ad6ee6ec1b81b0c20a10a01ebd0ee311673e7
961550e51d443bcbbe4deb9cfabe6632093f0a22418efd333fe4d4754acc1bc9
GET /css/ff9b6aa/widget.css HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:21:04 GMT
content-type: text/css
content-length: 54697
cache-control: max-age=864000
content-encoding: br
etag: "636cf1fb-d5a9"
expires: Sun, 20 Nov 2022 13:27:23 GMT
last-modified: Thu, 10 Nov 2022 12:43:39 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-10T13:27:23+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jivo.ru/css/ff9b6aa/omnichannelMenu.widget.css
200 OK 946 B URL HTTP/2 code.jivo.ru/css/ff9b6aa/omnichannelMenu.widget.css
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (3072), with no line terminators
Hash 54aae6819ea34eec8a760164a2687ec1
3d0f31f6358c3e64070c13f96986c5c7be2a140c
24dd4132e43f4ec35621fc382eb561b97160f4e8094c4eece6a716a0dfaa4d22
GET /css/ff9b6aa/omnichannelMenu.widget.css HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:21:04 GMT
content-type: text/css
content-length: 946
cache-control: max-age=864000
content-encoding: gzip
etag: "636cf1fb-3b2"
expires: Sun, 20 Nov 2022 13:27:24 GMT
last-modified: Thu, 10 Nov 2022 12:43:39 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-10T13:27:24+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
code.jivo.ru/js/ff9b6aa/omnichannelMenu.js
200 OK 3.1 kB URL HTTP/2 code.jivo.ru/js/ff9b6aa/omnichannelMenu.js
IP
ASN #199524 G-Core Labs S.A.
File type ASCII text, with very long lines (11729), with no line terminators
Hash 9f217604f6d2c5d8e28693a122c0d843
ec45d51615cde7b96de2c3baa4c47f8c24a82fb4
4922ceb0b72ca8ec25b06d8cbc681cc2c4f290f1eb83f05373a4bb002b5ecb2f
GET /js/ff9b6aa/omnichannelMenu.js HTTP/1.1
Host: code.jivo.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:21:04 GMT
content-type: application/javascript
content-length: 3110
access-control-allow-origin: *
cache-control: max-age=86400
content-encoding: br
etag: "636cf1fb-c26"
last-modified: Thu, 10 Nov 2022 12:43:39 GMT
vary: Accept-Encoding
via: 1.1 sharxy
x-geo-shard: sber1
cache: HIT
x-cached-since: 2022-11-11T13:27:27+00:00
x-id: am3-up-gc95
accept-ranges: bytes
X-Firefox-Spdy: h2
rstat.rockmostbet.com/band/t4k.json?
200 OK 86 B URL HTTP/2 rstat.rockmostbet.com/band/t4k.json?
IP
ASN #24940 Hetzner Online GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash e9ac33eda0e25550be64d6f407c5128e
582c18f33eaa069568c483c0059ca2580690b84f
05adc862693f14b2fbd0a2d37d8ae2383c30eb2ca56d8ce699d609eb5f4964a8
POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 912
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://3vsmdh0yz31vwcemst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Sat, 12 Nov 2022 06:21:04 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=6997080776240005121; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 16
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/websocket/credentials
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/websocket/credentials
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/websocket/credentials HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.1.1126352818.1668234056
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: f63e53d1009ae2398dd97f0b79e4c327
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:56 GMT
set-cookie: PHPSESSID=mnk439rhk079nbmqffvus1h0mi; expires=Mon, 12-Dec-2022 06:20:56 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Sun, 13-Nov-2022 06:20:56 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Sat, 19-Nov-2022 06:20:56 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/settings
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/settings
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/settings HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.1.1126352818.1668234056
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 3568d39c4566e3661138ded0c6226b44
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:56 GMT
set-cookie: PHPSESSID=h6kas3ausob900pdq7r0ljfenr; expires=Mon, 12-Dec-2022 06:20:56 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Sun, 13-Nov-2022 06:20:56 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Sat, 19-Nov-2022 06:20:56 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/logo
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/logo
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/logo HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.1.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"9dfab82e3b4ec3d36c2d3f40883172cf"
x-request-id: 76e1b14d95ddcc32f42bebd2be3e130a
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:56 GMT
set-cookie: PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; expires=Mon, 12-Dec-2022 06:20:56 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Sun, 13-Nov-2022 06:20:56 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Sat, 19-Nov-2022 06:20:56 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
front.cdn-mb.com/spa-static/1.4.1006/static/css/main.687ea28c.chunk.css
200 OK 0 B URL HTTP/2 front.cdn-mb.com/spa-static/1.4.1006/static/css/main.687ea28c.chunk.css
IP
GET /spa-static/1.4.1006/static/css/main.687ea28c.chunk.css HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: text/css
last-modified: Wed, 09 Nov 2022 13:23:04 GMT
vary: Accept-Encoding
etag: W/"636ba9b8-54"
expires: Sat, 12 Nov 2022 07:26:38 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 10458
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KbuzzNa1Oxvlt6rfRQLczDBbcVxmkNqlAyYv4pcZdpEFdXQnmXKPJUYSylVnKZYLQsqo6TI2WeLG%2BCE4PaNimbF9tz5pHqCmkWFrgtjjHcEPIOPHnOaUjm34KifmAbYwDhD0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 768d2a234eccb511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.googletagmanager.com/gtm.js?id=GTM-5PMSX62
200 OK 0 B URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-5PMSX62
IP
GET /gtm.js?id=GTM-5PMSX62 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 12 Nov 2022 06:20:56 GMT
expires: Sat, 12 Nov 2022 06:20:56 GMT
cache-control: private, max-age=900
last-modified: Sat, 12 Nov 2022 06:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 55946
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/footer_links
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/footer_links
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/footer_links HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=1668234057580897556; _ym_d=1668234057; _ym_isad=2; _fbp=fb.1.1668234057055.784379697
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:57 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: b8cfe0aba57ed27ab45d8d75309365f6
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:57 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
webchannel-content.eservice.emarsys.net/customer/799213038/campaigns?url=https:%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&prev_url=&lang=en&uli=false
200 OK 0 B URL HTTP/2 webchannel-content.eservice.emarsys.net/customer/799213038/campaigns?url=https:%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&prev_url=&lang=en&uli=false
IP
GET /customer/799213038/campaigns?url=https:%2F%2F3vsmdh0yz31vwcemst.com%2Fpartners%2Fcasino-reg%3Fcid%3D1796075641%26pid%3D14628%26sip%3D0&prev_url=&lang=en&uli=false HTTP/1.1
Host: webchannel-content.eservice.emarsys.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3vsmdh0yz31vwcemst.com
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 06:21:02 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: *
content-type: application/json
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /partners/casino-reg?cid=1796075641&pid=14628&sip=0 HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:55 GMT
content-type: text/html
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
front.cdn-mb.com/spa-static/1.4.1006/static/js/30.5d5a8d2f.chunk.js
200 OK 0 B URL HTTP/2 front.cdn-mb.com/spa-static/1.4.1006/static/js/30.5d5a8d2f.chunk.js
IP
GET /spa-static/1.4.1006/static/js/30.5d5a8d2f.chunk.js HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: application/javascript
last-modified: Wed, 09 Nov 2022 13:23:04 GMT
vary: Accept-Encoding
etag: W/"636ba9b8-7ac65"
expires: Sat, 12 Nov 2022 07:26:38 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 10457
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z%2BSxKHQC42vjvEHhffq60YMBivXl%2BHpznKuEM%2BC1hnFqEdCUrw1gbXPc%2BEyehhqcFTnZs8ZPFcP2KCtHu9aBx%2FhH6mBiyAWUgxlcA9FOh%2BS71%2BAtHxqv%2F8z04WoF9f1uIclK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 768d2a231eaeb511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
front.cdn-mb.com/spa-static/1.4.1006/static/js/main.f903f749.chunk.js
200 OK 0 B URL HTTP/2 front.cdn-mb.com/spa-static/1.4.1006/static/js/main.f903f749.chunk.js
IP
GET /spa-static/1.4.1006/static/js/main.f903f749.chunk.js HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: application/javascript
last-modified: Wed, 09 Nov 2022 13:23:04 GMT
vary: Accept-Encoding
etag: W/"636ba9b8-5bdb8"
expires: Sat, 12 Nov 2022 07:26:38 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 10458
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6w8qq6nUvgDghNIG9wWlDeNlnxyPxkHCYx6GbilmfGa0Ag0lP%2BlYZXp0A5gx9YNYvqHp2nI0rBw5Lj6a0mpNKtqLpLN%2FDPwCT2fRzjpovs4q6yIKiiqmQ3%2FR9rb0OvbGYAbp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 768d2a234ecfb511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/countries.json
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/countries.json
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/countries.json HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.1.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:56 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"673cc9ac1dd309a2337a50697b331f09"
x-request-id: 3bd49fc210e9bbb29cc2a06b52ee970f
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:56 GMT
set-cookie: PHPSESSID=l026o4ii3dlc2684ib7ml3ag45; expires=Mon, 12-Dec-2022 06:20:56 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Sun, 13-Nov-2022 06:20:56 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Sat, 19-Nov-2022 06:20:56 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/auth/providers
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/auth/providers
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/auth/providers HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=1668234057580897556; _ym_d=1668234057; _ym_isad=2; _fbp=fb.1.1668234057055.784379697; _ym_visorc=b; multiAuthThirdPartyEnabled=true
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:58 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 4cdcb2cfd5c156b1d75a97babba56a2e
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
3vsmdh0yz31vwcemst.com/api/v1/currencies.json
200 OK 0 B URL HTTP/2 3vsmdh0yz31vwcemst.com/api/v1/currencies.json
IP
Analyzer Verdict Alert quad9 Sinkholed
GET /api/v1/currencies.json HTTP/1.1
Host: 3vsmdh0yz31vwcemst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1006
x-client-session: j5p0fxxkm7kfqro5inev
x-client-device-id: wyi4oxddrfwf26gln37w
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://3vsmdh0yz31vwcemst.com/partners/casino-reg?cid=1796075641&pid=14628&sip=0
Cookie: theme=desktop; _ga_HCZ6L6382W=GS1.1.1668234056.1.0.1668234056.0.0.0; _ga=GA1.2.1126352818.1668234056; cid=1796075641; prid=most_partner.1796075641; pid=14628; sip=0; PHPSESSID=v5cstmtv5qilfkruhgo4rovgn3; lunetics_locale=bn; tz=Europe%2FOslo; rst-uid=6997080776240005121; _gid=GA1.2.2142265892.1668234056; _gaclientid=1126352818.1668234056; _gasessionid=20221112|04018760; _gahitid=1668234056344; _gat_UA-79409907-1=1; _gat_UA-137363802-1=1; _gat=1; _ym_uid=1668234057580897556; _ym_d=1668234057; _ym_isad=2; _fbp=fb.1.1668234057055.784379697; _ym_visorc=b; multiAuthThirdPartyEnabled=true
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 12 Nov 2022 06:20:58 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
etag: W/"9a06c38e7d784277059aaa21439f7869"
x-request-id: b3f8daab56c0143d633e53c86420d439
vary: Accept-Encoding, Accept-Language
expires: Sat, 12 Nov 2022 06:20:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Montserrat:400,700,800|Roboto:400,500,700,900|Ubuntu:700,700i&display=swap&subset=cyrillic,vietnamese
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Montserrat:400,700,800|Roboto:400,500,700,900|Ubuntu:700,700i&display=swap&subset=cyrillic,vietnamese
IP
GET /css?family=Montserrat:400,700,800|Roboto:400,500,700,900|Ubuntu:700,700i&display=swap&subset=cyrillic,vietnamese HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://front.cdn-mb.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 12 Nov 2022 06:20:57 GMT
date: Sat, 12 Nov 2022 06:20:57 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
35.159.51.213
54.230.111.21
104.18.21.226
92.223.126.57
139.45.195.8
23.36.76.226
31.13.72.36
93.158.134.119
188.72.107.240