52ca3.rfedcc.wy5532.com/
200 OK 484 B IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (484), with no line terminators
Hash a20a878d265e0b2a22b0e2b11ab29860
433a807961ab709590c76239dd90ab5e1b23aa1d
e5e952955326d0a63a0625015cbc6b9302b8123c50fe1c208d60f6245cd0f484
Analyzer Verdict Alert fortinet Malware
GET / HTTP/1.1
Host: 52ca3.rfedcc.wy5532.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: sid=fe9641ea-71ec-11ed-9dba-fea6f2d9510b
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 484
content-type: text/html; charset=utf-8
date: Fri, 02 Dec 2022 03:54:06 GMT
server: nginx
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3bbb845b153026fc5332dd4506585b57
3cad200fac28fd00f34ce6ef79373e661e188743
6035871c0de6ff2d120921461207cfa32bc286e1fe78849ce74815ffbb9ff950
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16404
Expires: Fri, 02 Dec 2022 08:27:31 GMT
Date: Fri, 02 Dec 2022 03:54:07 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 0c748388899e8a8d3680355da2ea5020
903c620cd137613daafb0da0508c37b2f4a67212
39eab80e022a9a1732872d9926b0ace80f818ec5c535e36a18b539ea63786fb2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6129
Cache-Control: max-age=116354
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:07 GMT
Etag: "63888270-1d7"
Expires: Sat, 03 Dec 2022 12:13:21 GMT
Last-Modified: Thu, 01 Dec 2022 10:31:12 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 02 Dec 2022 03:19:50 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2057
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 55b4c61a1e99001307750e3647fe1102
7559f9f6770b7d3f45b723167062096312641e08
39f6bb64420bcfc8f0b010168fd35b67732984cd0698409f04d5ae40410422aa
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10669
Expires: Fri, 02 Dec 2022 06:51:56 GMT
Date: Fri, 02 Dec 2022 03:54:07 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 9SMqK6DB4xTkq4UEa2FdhPhHmUKGTbHIho58DhKgnOn0eQLg93EBoKG3KJomUieMl5yccedbgkA=
x-amz-request-id: BASM3M0K21NCVT7Z
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 02 Dec 2022 03:45:57 GMT
age: 490
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 02 Dec 2022 03:54:07 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
52ca3.rfedcc.wy5532.com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2OTk2MDQ0NiwiaWF0IjoxNjY5OTUzMjQ2LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc21kcjhhcGlnMjB2bTFuNms0aG5nNDUiLCJuYmYiOjE2Njk5NTMyNDYsInRzIjoxNjY5OTUzMjQ2OTA5OTIxfQ.Yhlb008E5CgYoDwUIYljC5XuT1sB1gv9ToKbmPGmR-E&sid=fe9641ea-71ec-11ed-9dba-fea6f2d9510b
302 Found 11 B URL HTTP/1.1 52ca3.rfedcc.wy5532.com/?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2OTk2MDQ0NiwiaWF0IjoxNjY5OTUzMjQ2LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc21kcjhhcGlnMjB2bTFuNms0aG5nNDUiLCJuYmYiOjE2Njk5NTMyNDYsInRzIjoxNjY5OTUzMjQ2OTA5OTIxfQ.Yhlb008E5CgYoDwUIYljC5XuT1sB1gv9ToKbmPGmR-E&sid=fe9641ea-71ec-11ed-9dba-fea6f2d9510b
IP
File type ASCII text, with no line terminators
Hash 32682312d17c7cbf18e73594f5570319
60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
GET /?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2OTk2MDQ0NiwiaWF0IjoxNjY5OTUzMjQ2LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc21kcjhhcGlnMjB2bTFuNms0aG5nNDUiLCJuYmYiOjE2Njk5NTMyNDYsInRzIjoxNjY5OTUzMjQ2OTA5OTIxfQ.Yhlb008E5CgYoDwUIYljC5XuT1sB1gv9ToKbmPGmR-E&sid=fe9641ea-71ec-11ed-9dba-fea6f2d9510b HTTP/1.1
Host: 52ca3.rfedcc.wy5532.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://52ca3.rfedcc.wy5532.com/
Cookie: sid=fe9641ea-71ec-11ed-9dba-fea6f2d9510b
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Fri, 02 Dec 2022 03:54:07 GMT
location: http://dipaka-ead.com/zcvisitor/f88a3748-71f4-11ed-beeb-0a53e8088ba9/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=62c492c0-3b47-11ed-a49b-0a918cbcbb97
server: nginx
set-cookie: sid=fe9641ea-71ec-11ed-9dba-fea6f2d9510b; path=/; domain=.wy5532.com; expires=Wed, 20 Dec 2090 07:08:14 GMT; max-age=2147483647; HttpOnly
52ca3.rfedcc.wy5532.com/favicon.ico
404 Not Found 9 B URL HTTP/1.1 52ca3.rfedcc.wy5532.com/favicon.ico
IP
File type ASCII text, with no line terminators
Hash d8f4a1993546cc4b850cde3599e27aec
094b763b4cfcc0b05e5d040581cd513c3ca08067
907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9
GET /favicon.ico HTTP/1.1
Host: 52ca3.rfedcc.wy5532.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://52ca3.rfedcc.wy5532.com/
Cookie: sid=fe9641ea-71ec-11ed-9dba-fea6f2d9510b
HTTP/1.1 404 Not Found
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 9
date: Fri, 02 Dec 2022 03:54:07 GMT
server: nginx
dipaka-ead.com/zcvisitor/f88a3748-71f4-11ed-beeb-0a53e8088ba9/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=62c492c0-3b47-11ed-a49b-0a918cbcbb97
200 1.1 kB URL HTTP/1.1 dipaka-ead.com/zcvisitor/f88a3748-71f4-11ed-beeb-0a53e8088ba9/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=62c492c0-3b47-11ed-a49b-0a918cbcbb97
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash b4effff642fbd00d7ed9e35d285e2a84
53eff6df45822c2406144e0011606bd054e7524e
8026b9d9ce7aeb85b5cf68e0102a213b565e380dc08f48ffaf0c1c5cd26aa85c
GET /zcvisitor/f88a3748-71f4-11ed-beeb-0a53e8088ba9/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=62c492c0-3b47-11ed-a49b-0a918cbcbb97 HTTP/1.1
Host: dipaka-ead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://52ca3.rfedcc.wy5532.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200
Date: Fri, 02 Dec 2022 03:54:07 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: JEzftdBZ
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 02 Dec 2022 03:08:57 GMT
cache-control: public,max-age=3600
age: 2710
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 1f88399f3fdd89dbb9ca1229cb67143a
325c9dbfd932cf9a6fb9fab2dd8e27083f55a9a3
831ecd45dcd2d5ae2ae86cd63ea5e94ecd85281b7e51054af5df9a6386fb8d79
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6124
Cache-Control: max-age=111285
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:08 GMT
Etag: "63886ea9-1d7"
Expires: Sat, 03 Dec 2022 10:48:53 GMT
Last-Modified: Thu, 01 Dec 2022 09:06:49 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 471
dipaka-ead.com/zcredirect?visitid=f88a3748-71f4-11ed-beeb-0a53e8088ba9&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
200 994 B URL HTTP/1.1 dipaka-ead.com/zcredirect?visitid=f88a3748-71f4-11ed-beeb-0a53e8088ba9&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (454)
Hash 9e6debc6dbe83d3bb499b3d28175a2e3
e6e0a150474d4b7c288185fe333343b224caa9e3
fa5190c1b204f7634598998eeeb641cd1bf213f03e2ae283a19596c7e76000c9
GET /zcredirect?visitid=f88a3748-71f4-11ed-beeb-0a53e8088ba9&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false HTTP/1.1
Host: dipaka-ead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://dipaka-ead.com/zcvisitor/f88a3748-71f4-11ed-beeb-0a53e8088ba9/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=62c492c0-3b47-11ed-a49b-0a918cbcbb97
Upgrade-Insecure-Requests: 1
HTTP/1.1 200
Date: Fri, 02 Dec 2022 03:54:08 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
redirected: JS
Server: naUnaoyZ
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: patfpsOJlbQYKP6AjV6E7Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 2cNWMxAiWt7T/XNMolXIj+xbkMw=
dipaka-ead.com/favicon.ico
404 653 B URL HTTP/1.1 dipaka-ead.com/favicon.ico
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators
Hash ba2732b1b2fa2626ffaa15f62f9e7d66
203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe
879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8
GET /favicon.ico HTTP/1.1
Host: dipaka-ead.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://dipaka-ead.com/zcredirect?visitid=f88a3748-71f4-11ed-beeb-0a53e8088ba9&type=js&browserWidth=1280&browserHeight=939&iframeDetected=false&webdriverDetected=false
HTTP/1.1 404
Date: Fri, 02 Dec 2022 03:54:08 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 653
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Language: en
Server: HxTslgCZ
cartining-specute.com/zp-redirect?target=https%3A%2F%2Fbustygirls4u.com%2Ftds%2Fae%3FtdsId%3Ds8655tok_r%26tds_campaign%3Ds8655tok%26utm_sub%3Dopnfnl%26s1%3Dps%26utm_source%3Dint%26affid%3D497f5345%26subid%3D%26clickid%3Dw4uui56cgdupgjsk2ujlo4c0%26subid2%3Dw4uui56cgdupgjsk2ujlo4c0&caid=8500be2f-30a7-4684-a7e7-f51ce3b821c4&zpid=f88a3748-71f4-11ed-beeb-0a53e8088ba9&cid=w4uui56cgdupgjsk2ujlo4c0&rt=R
302 Found 0 B URL HTTP/2 cartining-specute.com/zp-redirect?target=https%3A%2F%2Fbustygirls4u.com%2Ftds%2Fae%3FtdsId%3Ds8655tok_r%26tds_campaign%3Ds8655tok%26utm_sub%3Dopnfnl%26s1%3Dps%26utm_source%3Dint%26affid%3D497f5345%26subid%3D%26clickid%3Dw4uui56cgdupgjsk2ujlo4c0%26subid2%3Dw4uui56cgdupgjsk2ujlo4c0&caid=8500be2f-30a7-4684-a7e7-f51ce3b821c4&zpid=f88a3748-71f4-11ed-beeb-0a53e8088ba9&cid=w4uui56cgdupgjsk2ujlo4c0&rt=R
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /zp-redirect?target=https%3A%2F%2Fbustygirls4u.com%2Ftds%2Fae%3FtdsId%3Ds8655tok_r%26tds_campaign%3Ds8655tok%26utm_sub%3Dopnfnl%26s1%3Dps%26utm_source%3Dint%26affid%3D497f5345%26subid%3D%26clickid%3Dw4uui56cgdupgjsk2ujlo4c0%26subid2%3Dw4uui56cgdupgjsk2ujlo4c0&caid=8500be2f-30a7-4684-a7e7-f51ce3b821c4&zpid=f88a3748-71f4-11ed-beeb-0a53e8088ba9&cid=w4uui56cgdupgjsk2ujlo4c0&rt=R HTTP/1.1
Host: cartining-specute.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://dipaka-ead.com/
Cookie: cc-v4=11OYzRyOR9nRuOPJqdX1erYkBWTSAZ%2F2diSsOO3Q8xHo6uWVV3JtDSZWciRyivhI0YpucJcDe9nYiiO3zbczWZtMRMpO%2B0imGon620R4kSaLLp08RZMMuDxGpRgyTp3bd0JR%2BCB1TKVVUXdZpUVPUw%3D%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Fri, 02 Dec 2022 03:54:08 GMT
content-length: 0
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://bustygirls4u.com/tds/ae?tdsId=s8655tok_r&tds_campaign=s8655tok&utm_sub=opnfnl&s1=ps&utm_source=int&affid=497f5345&subid=&clickid=w4uui56cgdupgjsk2ujlo4c0&subid2=w4uui56cgdupgjsk2ujlo4c0
pragma: no-cache
set-cookie: cc-v4=2V0q6p7lsti7tsnjRL3caFHXmxEd%2B4jjoEfkwgD3LVG9nuSF8f%2FceJSYuaOt8kfZmkF%2F8Cpg9wgBOfFnDYvfonL3obq3nJ8w6HASDbLkPtudN3y7aEGfAdm8LXKAMpH7V%2BWV6uhs%2FhaLuX85aITMWQ%3D%3D; Max-Age=31536000; Expires=Sat, 02-Dec-2023 03:54:08 GMT; Domain=cartining-specute.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash 1d4be734999e1e3b60a148567fa64b2e
4761d403071e9948e07a855a3d1a185839735ac1
79be8d19e934121a73a3c3ae533cb6a568a42be09a95bebe899721440cc2023a
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Fri, 02 Dec 2022 03:54:08 GMT
Etag: "638806bf-1d7"
Last-Modified: Fri, 02 Dec 2022 03:02:27 GMT
Server: ECS (bsa/EB15)
X-Cache: Miss from cloudfront
Via: 1.1 db0992ba349fc51d5151ec8330e36c28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: edsiWmNIcmfnBDfAi5bUiCRidzrpV3ZXO5RCAKG08E2C4b5TPyORWg==
Age: 3102
bustygirls4u.com/bridge/intg.js?v=8
200 OK 317 B URL HTTP/2 bustygirls4u.com/bridge/intg.js?v=8
IP
File type ASCII text, with very long lines (316)
Hash d9bd6d4fe07232e0fcae03c7e68d4e81
4a7e1c2e8cc35c2ff31c71175095f4b1a2b8c17b
0ad2eb2d6a74f3d18026ab24c088ca7c561a742fd870e44045db9d823ac0a3c6
GET /bridge/intg.js?v=8 HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
Cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; dm=fe450dd0d1dadc615429144d33241f42
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
content-type: application/javascript; charset=UTF-8
content-length: 317
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
x-robots-tag: noindex
accept-ranges: bytes
cache-control: public, max-age=3600
last-modified: Thu, 01 Dec 2022 08:41:36 GMT
etag: W/"13d-184ccd92e00"
vary: Accept-Encoding
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 14 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
File type ASCII text, with very long lines (48316), with no line terminators
Hash 2e46e3b0807c19e0ee85603dd4ba3f72
cb55679976d9a5d9933f291218b8ff0f95ebdc17
87a3f839cfc8bca3368a7dec7c5ff14e5f613928e899b601292b5a1f1bd5dc05
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1333611
expires: Wed, 22 Nov 2023 03:54:09 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YNuupnVF8%2B3ZO%2FKjiqi2CWEYRxKOrCqI2msois4gJrxcU7fix4KA1t1EHWM2YA9zZpxnl9FTo2G7nKshlG3Nd01hYnhZvqroe4nxjZY7JBfeSq9MaFieSgesysZt3tQP1LOt0K64"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 77311ea14bf6b4f3-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
bustygirls4u.com/bridge/ao_loader.js
200 OK 836 B URL HTTP/2 bustygirls4u.com/bridge/ao_loader.js
IP
File type ASCII text, with very long lines (835)
Hash 9c129816fdafb5e9525563ba64018bd7
79dfb5a385a3583a597716ac4b1e1649e9b9994d
43d06cd88d872d0f1ab73eda7cf55805382dfd0d56bb90aad3398c72a5bb4acf
GET /bridge/ao_loader.js HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
Cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; dm=fe450dd0d1dadc615429144d33241f42
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
content-type: application/javascript; charset=UTF-8
content-length: 836
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
x-robots-tag: noindex
accept-ranges: bytes
cache-control: public, max-age=3600
last-modified: Thu, 01 Dec 2022 08:41:36 GMT
etag: W/"344-184ccd92e00"
vary: Accept-Encoding
X-Firefox-Spdy: h2
bustygirls4u.com/ufis/main.js?ippContent=null&wpContent=null&pwaContent=null&doc_location=https%3A%2F%2Fbustygirls4u.com%2Fjump%3Futm_content%3D%26utm_source%3Dint%26_tgUrl%3DaHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw%26tds_cid%3D65336b02e35fb401d49d330edae5c932cba5a085%26data2%3Dw4uui56cgdupgjsk2ujlo4c0%26dci%3Df49047e25c1943bd563e56fca94cf50963960ba6%26s1%3Dps%26tds_oid%3D21682%26id%3D21682%26tds_ac_id%3Ds8655tok%26tds_campaign%3Db1727pos%26tds_rt%3D%26s3%3Dw4uui56cgdupgjsk2ujlo4c0%26tds_id%3Db1727pos_jump_a_1598613018653%26utm_campaign%3D497f5345%26tds_ao%3D1%26tds_host%3Dbustygirls4u.com&uaDataValues={}
200 OK 199 B URL HTTP/2 bustygirls4u.com/ufis/main.js?ippContent=null&wpContent=null&pwaContent=null&doc_location=https%3A%2F%2Fbustygirls4u.com%2Fjump%3Futm_content%3D%26utm_source%3Dint%26_tgUrl%3DaHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw%26tds_cid%3D65336b02e35fb401d49d330edae5c932cba5a085%26data2%3Dw4uui56cgdupgjsk2ujlo4c0%26dci%3Df49047e25c1943bd563e56fca94cf50963960ba6%26s1%3Dps%26tds_oid%3D21682%26id%3D21682%26tds_ac_id%3Ds8655tok%26tds_campaign%3Db1727pos%26tds_rt%3D%26s3%3Dw4uui56cgdupgjsk2ujlo4c0%26tds_id%3Db1727pos_jump_a_1598613018653%26utm_campaign%3D497f5345%26tds_ao%3D1%26tds_host%3Dbustygirls4u.com&uaDataValues={}
IP
Hash cd4ae55f3af545b5863f65b73a6a7b80
a85fca461d97f90eaf52246b95974eeabba27c20
ae4475effcb2e8533194b150ee30b2472c1cb7498b2c83a764718d962deaa84f
GET /ufis/main.js?ippContent=null&wpContent=null&pwaContent=null&doc_location=https%3A%2F%2Fbustygirls4u.com%2Fjump%3Futm_content%3D%26utm_source%3Dint%26_tgUrl%3DaHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw%26tds_cid%3D65336b02e35fb401d49d330edae5c932cba5a085%26data2%3Dw4uui56cgdupgjsk2ujlo4c0%26dci%3Df49047e25c1943bd563e56fca94cf50963960ba6%26s1%3Dps%26tds_oid%3D21682%26id%3D21682%26tds_ac_id%3Ds8655tok%26tds_campaign%3Db1727pos%26tds_rt%3D%26s3%3Dw4uui56cgdupgjsk2ujlo4c0%26tds_id%3Db1727pos_jump_a_1598613018653%26utm_campaign%3D497f5345%26tds_ao%3D1%26tds_host%3Dbustygirls4u.com&uaDataValues={} HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
Cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; dm=fe450dd0d1dadc615429144d33241f42
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
content-type: text/javascript; charset=utf-8
content-length: 199
server: nginx
x-powered-by: Express
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
etag: W/"c7-qF/KRh2X+Q6vUiRrlZdO6ruifCA"
vary: Accept-Encoding
X-Firefox-Spdy: h2
cdn3reference.com/landings/21682/images/girl.jpg
200 OK 36 kB URL HTTP/2 cdn3reference.com/landings/21682/images/girl.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 500x743, components 3\012- data
Hash 1da3fabcb472c476642ab2053739cb68
7e1e11f5219f0c63d699dcec11a529cd0b1deee6
cf8adb43aefee06727a4b762ec61a9b90191504c6b02c6e20ff888d3cbd00c46
GET /landings/21682/images/girl.jpg HTTP/1.1
Host: cdn3reference.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 35512
server: nginx
last-modified: Mon, 25 Dec 2017 15:36:05 GMT
accept-ranges: bytes
date: Fri, 02 Dec 2022 03:54:09 GMT
cache-control: public, max-age=604800
etag: "8ab8-5612beca0c340"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: D7XTjkop8KL-L01eaR5M9Uvls-Kd2TAqY_VnIwbmgKQMJdDZp5x5Tw==
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15269
Expires: Fri, 02 Dec 2022 08:08:38 GMT
Date: Fri, 02 Dec 2022 03:54:09 GMT
Connection: keep-alive
cdn3reference.com/landings/21682/css/3d95f33ffffbc2b4e53efb057b72ae6f.css
200 OK 1.5 kB URL HTTP/2 cdn3reference.com/landings/21682/css/3d95f33ffffbc2b4e53efb057b72ae6f.css
IP
Hash dbc7f8eceff7a2b6744a7fe37452a05a
0b2d58cc0f93068e1da5458f8e3a7baf6802d541
191649b58b78d0055b83796e0b27fa962920de6499d2131b1172e049ca0a28b3
GET /landings/21682/css/3d95f33ffffbc2b4e53efb057b72ae6f.css HTTP/1.1
Host: cdn3reference.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css
server: nginx
date: Fri, 02 Dec 2022 03:54:09 GMT
last-modified: Mon, 25 Dec 2017 15:36:46 GMT
content-encoding: gzip
etag: W/"a72-5612bef125f80"
x-cache: Miss from cloudfront
via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 1ijAdc5DDVtdvcgrJwB3J4okHNNoXBXF21_GbYejNRraiPZIIuabfw==
X-Firefox-Spdy: h2
cdn3reference.com/js/dc_img.js?v=8
200 OK 827 B URL HTTP/2 cdn3reference.com/js/dc_img.js?v=8
IP
Hash cbcb0e5513bfecbc2f84f7e3bd62a17d
a967d8e877dd6e5c1fa01877f1e916845584a25b
53c16657902ee03968ad2d48765be9656b6f838a1438f74719dfcc9290e2d89e
GET /js/dc_img.js?v=8 HTTP/1.1
Host: cdn3reference.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript
server: nginx
date: Fri, 02 Dec 2022 03:54:09 GMT
last-modified: Thu, 29 Oct 2020 09:19:39 GMT
content-encoding: gzip
etag: W/"1e8-5b2cbc78da216"
x-cache: Miss from cloudfront
via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 1Bgn-VH5LNle4ZUI2A_y5WHXfKCHW05mU-ULkqHfCoVdRYdiinD8Pg==
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15269
Expires: Fri, 02 Dec 2022 08:08:38 GMT
Date: Fri, 02 Dec 2022 03:54:09 GMT
Connection: keep-alive
bustygirls4u.com/tds/ae?tdsId=s8655tok_r&tds_campaign=s8655tok&utm_sub=opnfnl&s1=ps&utm_source=int&affid=497f5345&subid=&clickid=w4uui56cgdupgjsk2ujlo4c0&subid2=w4uui56cgdupgjsk2ujlo4c0
302 Found 503 B URL HTTP/2 bustygirls4u.com/tds/ae?tdsId=s8655tok_r&tds_campaign=s8655tok&utm_sub=opnfnl&s1=ps&utm_source=int&affid=497f5345&subid=&clickid=w4uui56cgdupgjsk2ujlo4c0&subid2=w4uui56cgdupgjsk2ujlo4c0
IP
Hash ecab83d593cc540b02689be5be7abc8a
81cda579b7b9b22332b85266b0126585f3d3f73f
d469c5adb69f261084b016f8e24edf8b69b62d9f930ca2d85cf35375e2303ecc
GET /tds/ae?tdsId=s8655tok_r&tds_campaign=s8655tok&utm_sub=opnfnl&s1=ps&utm_source=int&affid=497f5345&subid=&clickid=w4uui56cgdupgjsk2ujlo4c0&subid2=w4uui56cgdupgjsk2ujlo4c0 HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://dipaka-ead.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Fri, 02 Dec 2022 03:54:09 GMT
location: https://bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
accept-ch: UA, Platform, Model, Mobile, Arch
set-cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; Max-Age=31536000; Domain=.bustygirls4u.com; Path=/; Expires=Sat, 02 Dec 2023 03:54:09 GMT; Secure; SameSite=None
dm=fe450dd0d1dadc615429144d33241f42; Max-Age=432000; Path=/; Expires=Wed, 07 Dec 2022 03:54:09 GMT
X-Firefox-Spdy: h2
bustygirls4u.com/bridge/frodi_data.js
200 OK 6.6 kB URL HTTP/2 bustygirls4u.com/bridge/frodi_data.js
IP
Hash faba3eb0f86d6aa3670bef8eb46c3843
f4509da8c131b2ea187b00a831d8917420c89b73
115b5c04739a74183668039e95c96063f776726f37816af1b6d53b923f01a40f
GET /bridge/frodi_data.js HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
Cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; dm=fe450dd0d1dadc615429144d33241f42
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
content-type: application/javascript; charset=UTF-8
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
x-robots-tag: noindex
accept-ranges: bytes
cache-control: public, max-age=3600
last-modified: Thu, 01 Dec 2022 08:41:36 GMT
etag: W/"19f8-184ccd92e00"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe0842726-801f-4648-a54d-c0cb2cf5348a.jpeg
200 OK 5.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe0842726-801f-4648-a54d-c0cb2cf5348a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 89502a302863c914b4de5e8c6a7f6846
898d50ac6e372609656fccee27de3d036bc0281c
9bc1f83d570d70b7e17e5de7a1546885851431ea989d915852ae7130387c422f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe0842726-801f-4648-a54d-c0cb2cf5348a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5675
x-amzn-requestid: a47e049a-6f76-4af4-8064-fd7722bcfb17
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGepGYEIAMFeQw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-09e13afe27c4dc5b44e828be;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: U_3ah2pFrsQl9IVVqm9EVI99FnF79b9zOUFVBGX966JAjkDg6UF--A==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:47:56 GMT
age: 21973
etag: "898d50ac6e372609656fccee27de3d036bc0281c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb30f254-1327-487b-a297-00361bfd5c02.jpeg
200 OK 7.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb30f254-1327-487b-a297-00361bfd5c02.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cd78aa69439c995167f32b8a41a1f4f6
d07d6145182f312f3ed86ecf96b4ffa175416fa0
3b08cf3fad31ee0cf3ee25abc2484fb4283543865a42dfc568b14f9856fd3bb5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbb30f254-1327-487b-a297-00361bfd5c02.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7722
x-amzn-requestid: 8d7c4800-6c06-43ed-afa1-94840d42f591
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGy2Gr1IAMFWeQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891e78-429ae3135d47e3b020c4c7a1;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:36:56 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Z8thSamrCRejcAcQEGAp4WpSMzMEvstuZtVpKAjiCH4dyJyf1yihBA==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 f9d716a351f14a0ac1fac2449734849a.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:50:11 GMT
age: 21838
etag: "d07d6145182f312f3ed86ecf96b4ffa175416fa0"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F937deb9c-e12c-486f-bf82-4833aed00836.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F937deb9c-e12c-486f-bf82-4833aed00836.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d08081e2dd562ef50e4e98ebc0136698
b5118bca37feda2ada3001199dc1d80ac6d2aacc
5160333e0cfd338b3887972d0a5c0f817ef88b70b7eb78e4e25d153a85e3478f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F937deb9c-e12c-486f-bf82-4833aed00836.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11443
x-amzn-requestid: 21469d81-ee4b-47f3-8877-b6658b3ea8b8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfHDHE4zoAMFvfw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891ee0-5b39eddd703ea04e6a1355f8;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:38:40 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ArJSu5jI0RrZj3QtJp6oI6Yvf9LCWrYqU0HRIl8U8xJjdeOaJEe2yg==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:20:07 GMT
age: 20042
etag: "b5118bca37feda2ada3001199dc1d80ac6d2aacc"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg
200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 498ab4412ed5cf977bc23e4e870894b0
23753fe8af09ec8ffa10eed4d201a71833885c99
036042656f15e42b4d1537c45f5b8e7190c70305fa9a69c1287c6739ad0b7122
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa07af64d-c287-4b0a-9677-9a1000422afc.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7334
x-amzn-requestid: a6b8b420-8394-496b-8be8-26dee52e3887
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoHJOoAMF75g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-0b38d07f518c8b3134457df2;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 17nFm7AQdmRYS_af-EJ4XBVw8l3YudcphlpcZMveuVjvjhhYdkAQsw==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 22:33:10 GMT
age: 19259
etag: "23753fe8af09ec8ffa10eed4d201a71833885c99"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg
200 OK 2.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b47431190f34eccf0a6efb98e2a32b7d
9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704
08d3b6be354cafb70c20e6865788cb375adbf88d47711651fe1a3b855094daf2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6b6b798b-d396-454d-9d5b-17b47827e4ad.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 2942
x-amzn-requestid: ed26679f-cd56-477f-9914-f9afbcaaeea6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfGeoGFYoAMFWgA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63891df7-4ec6bebe21656d5026456994;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 21:34:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Fw6nrporwF27NW0-vXpaolW79nDXLF2RyS-lqhhp1osHt7q98VpI3g==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 21:34:47 GMT
age: 22762
etag: "9fc7ab3a4eb2d36fd6df7e0267a26a47627d1704"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 05917f7542a781275c12d43562be1507
1ea730e7e2b5a84fb0341ef9a64b141a4dd469b3
2f24492a077b583bd9dfe049c16c60b219d950712879f187ff2160214df9bd0e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 3519a58310eefa01756f0440e2acd7dd
50153382830684a6abb653dc7b4e41d7c7e386b5
5f321e771fa62d9f794339006752655316cdb6e8d69bc23e1d0e3c8bc526f12e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn3reference.com/landings/21682/js/5253a72c66c176f0bd4b48a71c340612.js
200 OK 34 kB URL HTTP/2 cdn3reference.com/landings/21682/js/5253a72c66c176f0bd4b48a71c340612.js
IP
Hash f40943c6aabea01f9930d8eba7a35747
2422fc3bc59bb531249dc71b69cde33734811268
8f23443aef5586cd6d589a9ad57d3c26e759af2ce27a9a2b23f5e7cd8de01759
GET /landings/21682/js/5253a72c66c176f0bd4b48a71c340612.js HTTP/1.1
Host: cdn3reference.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript
server: nginx
date: Fri, 02 Dec 2022 03:54:09 GMT
last-modified: Mon, 25 Dec 2017 15:36:46 GMT
content-encoding: gzip
etag: W/"17cf2-5612bef125f80"
x-cache: Miss from cloudfront
via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: IhtB-EGcxZspiHPSTzB_GUq5t1DoWmOEdQAzg7K2l6mIksbpTwiVOw==
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 980f31229421fd11df958496bea34502
648e03f048e6741beb1d4e10099b1429b79e4f00
887d1a1020b73fa3221c168713525f99474ac02fa10e251b5b23f6c0c519afce
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 27002fde234e78c7bde340bc621e933f
1bdbe4f1861601b9300101a1e6b3c143ce077e03
48d453fd9ded729e4775519885c13140e44421fe5a8c07fc464c9a354a04ef8f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtm.js?id=GTM-KMSJRW&l=adsLayer
200 OK 50 kB URL HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-KMSJRW&l=adsLayer
IP
File type ASCII text, with very long lines (4073)
Hash b2c9e17a4c99cd8d66404a929c999fb8
fdc641ba7fb33741a1171d57847cda4f0f3105b8
0493702d79ec8f6749707af9ed89060d5b619a92bcb42140f7bcc60631c4ac44
GET /gtm.js?id=GTM-KMSJRW&l=adsLayer HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 02 Dec 2022 03:54:10 GMT
expires: Fri, 02 Dec 2022 03:54:10 GMT
cache-control: private, max-age=900
last-modified: Fri, 02 Dec 2022 03:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 49818
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
200 OK 45 kB URL HTTP/2 fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
File type Web Open Font Format (Version 2), TrueType, length 44856, version 1.0\012- data
Hash 565ce506190ad3af920b40baf1794cec
ad3cba5d06100e09449a864d3b5e58403b478b3d
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
GET /s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://bustygirls4u.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 44856
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Nov 2022 18:52:41 GMT
expires: Tue, 28 Nov 2023 18:52:41 GMT
cache-control: public, max-age=31536000
age: 291689
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 188c50963e7939b1f26a31dbcb8c8200
859416e6148ea6618584e53604efcf072bb989cc
3a313cd3c1693a886bfbf6ffc6fbac78f87e6ded2b9a7749553444ada65ce36e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 27002fde234e78c7bde340bc621e933f
1bdbe4f1861601b9300101a1e6b3c143ce077e03
48d453fd9ded729e4775519885c13140e44421fe5a8c07fc464c9a354a04ef8f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 02 Dec 2022 03:54:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.sca1b.amazontrust.com/
200 OK 471 B URL HTTP/1.1 ocsp.sca1b.amazontrust.com/
IP
Hash ad082c7e5975bdc4d9e3c1074573931a
c2dc2dfe14cce44daa802eab8f53ab58cfb44794
8a9240d3edee77cf8ea9a86c04fd1c3446d495d925902e66c35b8c9c909e0bad
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=146550
Date: Fri, 02 Dec 2022 03:54:10 GMT
Etag: "63891058-1d7"
Expires: Sat, 03 Dec 2022 20:36:40 GMT
Last-Modified: Thu, 01 Dec 2022 20:36:40 GMT
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 db0992ba349fc51d5151ec8330e36c28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: c6KDCMlq_W3uEJAM5gg_pAxkvqhrdyT30piWdWWhWMZ1aSjUQ6MPdQ==
cdn3reference.com/images/jump-favicon.ico
200 OK 0 B URL HTTP/2 cdn3reference.com/images/jump-favicon.ico
IP
GET /images/jump-favicon.ico HTTP/1.1
Host: cdn3reference.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: image/vnd.microsoft.icon
server: nginx
date: Fri, 02 Dec 2022 03:54:10 GMT
last-modified: Fri, 05 Dec 2014 08:28:50 GMT
cache-control: public, max-age=604800
content-encoding: gzip
etag: W/"47e-50973ddc33480"
x-cache: Miss from cloudfront
via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: bo1g0g7WQM2OKrUXkOzkJ0yrhG37F8W8MmqO29J-QodKvFD_uHjMVw==
X-Firefox-Spdy: h2
bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
200 OK 0 B URL HTTP/2 bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
IP
GET /jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://dipaka-ead.com/
Connection: keep-alive
Cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; dm=fe450dd0d1dadc615429144d33241f42
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
content-type: text/html; charset=UTF-8
server: nginx
content-encoding: br
X-Firefox-Spdy: h2
bustygirls4u.com/integration.js
200 OK 0 B URL HTTP/2 bustygirls4u.com/integration.js
IP
GET /integration.js HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
Cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; dm=fe450dd0d1dadc615429144d33241f42
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
content-type: text/javascript; charset=utf-8
server: nginx
x-powered-by: Express
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
etag: W/"713-KaQGZfSM2+uTQY8Sm+tSBLT4Qso"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Open+Sans:400,700
200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Open+Sans:400,700
IP
GET /css?family=Open+Sans:400,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://cdn3reference.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 02 Dec 2022 03:54:09 GMT
date: Fri, 02 Dec 2022 03:54:09 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
bustygirls4u.com/tds/interlayer?handler=FrodiData
200 OK 0 B URL HTTP/2 bustygirls4u.com/tds/interlayer?handler=FrodiData
IP
POST /tds/interlayer?handler=FrodiData HTTP/1.1
Host: bustygirls4u.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json; charset=utf-8
Content-Length: 1625
Origin: https://bustygirls4u.com
Connection: keep-alive
Referer: https://bustygirls4u.com/jump?utm_content=&utm_source=int&_tgUrl=aHR0cHM6Ly9idXN0eWdpcmxzNHUuY29tL3Rkcy9hZS90Zy9zL2YwNTE0ODBiN2Y5YTMzYjU0YzM5MDFjYmFmZTBmNDU2P19fdD0xNjY5OTUzMjQ5MDY3Jl9fbD0zNjAw&tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&data2=w4uui56cgdupgjsk2ujlo4c0&dci=f49047e25c1943bd563e56fca94cf50963960ba6&s1=ps&tds_oid=21682&id=21682&tds_ac_id=s8655tok&tds_campaign=b1727pos&tds_rt=&s3=w4uui56cgdupgjsk2ujlo4c0&tds_id=b1727pos_jump_a_1598613018653&utm_campaign=497f5345&tds_ao=1&tds_host=bustygirls4u.com
Cookie: dci=f49047e25c1943bd563e56fca94cf50963960ba6; dm=fe450dd0d1dadc615429144d33241f42
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:09 GMT
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
accept-ch: UA, Platform, Model, Mobile, Arch
X-Firefox-Spdy: h2
retarget2core.com/43fbb6270523e1760fa5f0d2579dea07/ac3fc68831981c704535980c826941a5?tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&dci=f49047e25c1943bd563e56fca94cf50963960ba6&j_type=open&jump=21682&jump_name=
200 OK 0 B URL HTTP/2 retarget2core.com/43fbb6270523e1760fa5f0d2579dea07/ac3fc68831981c704535980c826941a5?tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&dci=f49047e25c1943bd563e56fca94cf50963960ba6&j_type=open&jump=21682&jump_name=
IP
GET /43fbb6270523e1760fa5f0d2579dea07/ac3fc68831981c704535980c826941a5?tds_cid=65336b02e35fb401d49d330edae5c932cba5a085&dci=f49047e25c1943bd563e56fca94cf50963960ba6&j_type=open&jump=21682&jump_name= HTTP/1.1
Host: retarget2core.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bustygirls4u.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 02 Dec 2022 03:54:10 GMT
content-type: image/gif
server: nginx
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
accept-ch: UA, Platform, Model, Mobile, Arch
set-cookie: dci=9b93a2d0ca88fd30442070a82c451e9e756efe96; Max-Age=31536000; Domain=.retarget2core.com; Path=/; Expires=Sat, 02 Dec 2023 03:54:10 GMT; Secure; SameSite=None
X-Firefox-Spdy: h2
172.93.103.102
95.101.11.115
52.28.18.152
93.184.220.29
104.17.25.14