urlquery - report: cp.tocallapp.com/t/clk

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	IP	Comment
content-signature-2.cdn.mozilla.net (1)	1152	No data	No data	34.160.144.191
www.wewillserv.com (3)	277919	No data	No data	51.68.85.158
139.59.49.76 (1)	0	2019-08-01 17:32:12 UTC	2022-10-22 08:45:20 UTC	139.59.49.76	Unknown ranking
cp.tocallapp.com (1)	0	2022-06-03 14:04:05 UTC	2022-10-25 12:03:56 UTC	104.21.89.104	Unknown ranking
contile.services.mozilla.com (1)	1114	2021-05-27 18:32:35 UTC	2022-10-25 04:39:04 UTC	34.117.237.239
push.services.mozilla.com (1)	2140	2019-05-26 10:52:39 UTC	2020-05-03 10:09:39 UTC	34.218.168.248
go.monetizer.mobi (5)	0	2016-04-21 22:02:55 UTC	2022-10-25 05:01:21 UTC	198.143.165.221	Unknown ranking
img-getpocket.cdn.mozilla.net (6)	1631	2019-03-04 20:37:34 UTC	2020-02-19 04:43:25 UTC	34.120.237.76
ocsp.godaddy.com (1)	698	2012-05-20 19:28:57 UTC	2020-05-02 20:58:10 UTC	192.124.249.22
myofferplus.com (1)	0	2021-11-06 17:30:32 UTC	2022-10-25 12:57:28 UTC	172.67.217.200	Unknown ranking
r3.o.lencr.org (7)	344	No data	No data	23.36.77.32
ocsp.digicert.com (7)	86	2012-06-27 22:09:06 UTC	2020-05-02 20:58:10 UTC	93.184.220.29
ocsp.sca1b.amazontrust.com (1)	1015	2019-02-26 19:05:58 UTC	2019-03-27 04:05:54 UTC	143.204.42.165
cdn.addlnk.com (2)	246074	2021-08-24 11:39:04 UTC	2022-10-25 11:59:38 UTC	172.67.191.221
aditmedia.g2afse.com (1)	61605	2021-04-14 15:59:45 UTC	2022-10-25 17:12:14 UTC	34.91.234.242
ad.marootrack.co (3)	0	2022-03-13 12:22:16 UTC	2022-10-25 16:01:19 UTC	65.60.58.179	Unknown ranking
so-glo.yoptv33.com (1)	0	No data	No data	52.28.59.112	Unknown ranking
admoustache.go2affise.com (1)	84756	2018-06-13 07:03:22 UTC	2022-10-25 11:59:35 UTC	34.147.1.177
surf.ueive.com (1)	199304	2022-06-03 22:26:39 UTC	2022-10-25 17:12:13 UTC	104.21.92.26
d0zi.com (2)	0	2022-06-05 17:32:29 UTC	2022-10-25 12:00:56 UTC	162.55.4.52	Unknown ranking

Scan Date	Severity	Indicator	Comment
2022-10-25	2	cp.tocallapp.com/t/clk	Malware
2022-10-25	2	ad.marootrack.co/proc.php?5dc9e6a7ca43b6770e430b216940d5e5f1fb2788	Malware

Date	UQ / IDS / BL	URL	IP
2022-11-21 04:49:52 +0000	0 - 0 - 3	play.pelishouse.me/episodes/the-walking-dead- (...)	172.67.157.224
2022-10-25 23:53:56 +0000	0 - 0 - 2	cp.tocallapp.com/t/clk	172.67.157.224
2022-10-20 19:51:55 +0000	0 - 0 - 5	ww1.pelishouse.me/episodes/la-casa-del-dragon-1x9/	172.67.157.224
2022-10-15 08:48:37 +0000	0 - 0 - 3	ww1.pelishouse.me/tag/seriesblanco/	172.67.157.224
2022-10-12 02:53:20 +0000	0 - 0 - 7	cp.tocallapp.com/t/clk	172.67.157.224

Date	UQ / IDS / BL	URL	IP
2023-01-29 13:35:30 +0000	0 - 2 - 1	b.game2723.com/gamexyz/3002/dd428b313f4ff686a (...)	188.114.97.1
2023-01-29 13:35:29 +0000	0 - 3 - 1	b.game2723.com/gamexyz/31/dd428b313f4ff686a4a (...)	188.114.96.1
2023-01-29 13:35:22 +0000	0 - 0 - 1	www.ipcishop.com/wp-admin/Soft_download/Setup.exe	172.67.176.222
2023-01-29 13:35:17 +0000	0 - 0 - 3	pyrd5.xyz/Open.exe	188.114.97.1
2023-01-29 13:35:04 +0000	0 - 2 - 0	ddlvid.com/download?link=twitter.com/i/status (...)	172.67.131.56

Date	UQ / IDS / BL	URL	IP
2022-10-25 23:53:56 +0000	0 - 0 - 2	cp.tocallapp.com/t/clk	172.67.157.224
2022-10-22 14:54:13 +0000	0 - 0 - 1	cp.tocallapp.com/t/clk	104.21.89.104
2022-10-12 02:53:20 +0000	0 - 0 - 7	cp.tocallapp.com/t/clk	172.67.157.224

Date	UQ / IDS / BL	URL	IP
2022-10-25 00:15:02 +0000	0 - 0 - 4	cp.nextmovedigital.com/t/clk	104.21.83.16
2022-10-23 23:48:03 +0000	0 - 0 - 1	695.novitrk4.com/smartlink?mongo_id=6355d293d (...)	188.240.52.20
2022-10-23 17:30:44 +0000	0 - 0 - 1	738.novitrk4.com/smartlink?mongo_id=63557a291 (...)	188.240.52.20
2022-10-22 18:19:41 +0000	0 - 0 - 1	continuetosite.com/go/4592349f-8d0d-4197-9c3e (...)	3.70.16.242
2022-10-12 04:58:37 +0000	0 - 0 - 1	m.lepetitdiary.com/?utm_medium=efbbdd747f282d (...)	184.154.10.250

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: df992311f130f15459739841de925c7eec2604d5a68ca6b2a67b6dc8d229212c 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "DF992311F130F15459739841DE925C7EEC2604D5A68CA6B2A67B6DC8D229212C" Last-Modified: Mon, 24 Oct 2022 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=4826 Expires: Wed, 26 Oct 2022 01:14:11 GMT Date: Tue, 25 Oct 2022 23:53:45 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: b3537658770790ad6cf0d727f0c0acd2 Sha1: 8365cadda05ef27b2ebd627d545e31886b512bde Sha256: df992311f130f15459739841de925c7eec2604d5a68ca6b2a67b6dc8d229212c
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 3a1d27ec3d034d6326b32f6054b6be46079a86a33e75d5a2a3796a0c4c5eadab 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 4903 Cache-Control: max-age=125949 Date: Tue, 25 Oct 2022 23:53:45 GMT Etag: "6357acdf-1d7" Expires: Thu, 27 Oct 2022 10:52:54 GMT Last-Modified: Tue, 25 Oct 2022 09:31:11 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: c2bba4cad162918b17858b60e909e4d9 Sha1: d9a1d4f7fb7635ab233ebbf776e6de1a2857032b Sha256: 3a1d27ec3d034d6326b32f6054b6be46079a86a33e75d5a2a3796a0c4c5eadab
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 9aeafc72c1a969243e1fc96f68ce18888034a749ee70582208bf814bd40b61a5 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "9AEAFC72C1A969243E1FC96F68CE18888034A749EE70582208BF814BD40B61A5" Last-Modified: Tue, 25 Oct 2022 02:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3190 Expires: Wed, 26 Oct 2022 00:46:55 GMT Date: Tue, 25 Oct 2022 23:53:45 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8db408c487f7d35bba323046736e8d3a Sha1: 01b91e2dce7c6d3de9adfe6ff4d38f9b24ab7db0 Sha256: 9aeafc72c1a969243e1fc96f68ce18888034a749ee70582208bf814bd40b61a5
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 34.160.144.191 HASH: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78 34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: VMEJ9C0cshV8oJ0j3ptle9bH+P7YLVFFPf5WuK2BwxDxkzgnTTpSDSvUhd4+hSftn2cUpIQ+xkI= x-amz-request-id: C76FHPMBVSN7DR0B content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Tue, 25 Oct 2022 23:09:07 GMT age: 2678 last-modified: Fri, 30 Sep 2022 18:50:55 GMT etag: "67d5a988edcda47bc3b3b3f65d32b4b6" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 67d5a988edcda47bc3b3b3f65d32b4b6 Sha1: d4f0e0da8b3690cc7da925026d3414b68c7d954f Sha256: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /t/clk HTTP/1.1 Host: cp.tocallapp.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: cp.tocallapp.com/t/clk FQDN: cp.tocallapp.com IP: 104.21.89.104 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 104.21.89.104 HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 25 Oct 2022 23:53:45 GMT Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: AWSALB=+7dt/rzbXF5upTRONmK+FeAP3nMmGmsyjxC8dNd4DubDgaOYsyKl8OXY3NbC+/THmqXUjqaChzseVyMM+S9cF0lyhsM03L1ZKf+pKYir4Bg+8bjJWGngjfouX7CQ; Expires=Tue, 01 Nov 2022 23:53:45 GMT; Path=/ AWSALBCORS=+7dt/rzbXF5upTRONmK+FeAP3nMmGmsyjxC8dNd4DubDgaOYsyKl8OXY3NbC+/THmqXUjqaChzseVyMM+S9cF0lyhsM03L1ZKf+pKYir4Bg+8bjJWGngjfouX7CQ; Expires=Tue, 01 Nov 2022 23:53:45 GMT; Path=/; SameSite=None Location: https://so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 Vary: Cookie, Origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nScup0K%2FjpTB1WKBUcbDkv3SaS25ttO%2BFRYG%2BQG0d1hvdQlHK1GkwkYSDQ5X%2FKhjqfvxGlF1g3kHcHmk7c1TMtFxodlR2feTChbGfYRUDU2okUtDLdMSwUOGB1jQnDKbuO9O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 75fedf9898c9b527-OSL alt-svc: h2=":443"; ma=60 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Alerts: Blocklists: - fortinet: Malware
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Tue, 25 Oct 2022 23:53:45 GMT content-length: 12 strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
POST / HTTP/1.1 Host: ocsp.sca1b.amazontrust.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sca1b.amazontrust.com/ FQDN: ocsp.sca1b.amazontrust.com IP: 143.204.42.165 HASH: d358b9e833267fd2260f8d191b17c9904a1ed236f764ae83b89b5c5425d1e79c 143.204.42.165 HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=142623 Date: Tue, 25 Oct 2022 23:53:45 GMT Etag: "63580128-1d7" Expires: Thu, 27 Oct 2022 15:30:48 GMT Last-Modified: Tue, 25 Oct 2022 15:30:48 GMT Server: nginx X-Cache: Miss from cloudfront Via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: rwQEkU2p2yy3avlv_tLxMime5fqhNp2Wr3QZDMKUxNxtOnI9DHKYuQ== --- Additional Info --- Magic: data Size: 471 Md5: 2a8ae8c0f656e3795704cd9d044bd9d0 Sha1: 0ca4840427d3b80faea1ea5061d76d4b18046c0b Sha256: d358b9e833267fd2260f8d191b17c9904a1ed236f764ae83b89b5c5425d1e79c
GET /t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 HTTP/1.1 Host: so-glo.yoptv33.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&r (...) FQDN: so-glo.yoptv33.com IP: 52.28.59.112 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 52.28.59.112 HTTP/2 302 Found content-type: text/html; charset=utf-8 date: Tue, 25 Oct 2022 23:53:45 GMT content-length: 0 location: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=c4a42714-6d21-427c-aac1-389e45cac2ac server: nginx/1.12.2 cache-control: no-transform x-frame-options: SAMEORIGIN vary: Cookie, Origin set-cookie: uip="[\"w9XJ73v\"\054 {\"oza51\": \"QA7xLjP\"}]:1onTjt:tuNch-Rvns5cWZEKroTTo6GUNks"; expires=Thu, 24 Nov 2022 23:53:45 GMT; Max-Age=2592000; Path=/ ydt_69a756d9a2a44370a5365f82fbdfa6e5="[\"c4a42714-6d21-427c-aac1-389e45cac2ac\"]:1onTjt:niVQSlOTZzGYAAaEqKXeT5bGCC4"; expires=Fri, 25 Nov 2022 01:53:45 GMT; Max-Age=2599200; Path=/; SameSite=None; Secure X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 608c78964412d5dc7025e9cbfaef345d448a29eae0f11257c49a41f274917b9a 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 5541 Cache-Control: max-age=121524 Date: Tue, 25 Oct 2022 23:53:45 GMT Etag: "63579918-1d7" Expires: Thu, 27 Oct 2022 09:39:09 GMT Last-Modified: Tue, 25 Oct 2022 08:06:48 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: 518ff04fd536958e285cf07aaf4a2786 Sha1: fa5dad2391c2a9957340bd629f0462db4f412a5c Sha256: 608c78964412d5dc7025e9cbfaef345d448a29eae0f11257c49a41f274917b9a
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: UEgKEelXD9/eRfmV/DGyMQ== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 34.218.168.248 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.218.168.248 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: 5IaJABkCSjehwMx6d/kH12zI17g= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/favicon.ico FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc 198.143.165.221 HTTP/2 200 OK content-type: image/x-icon server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT content-length: 1150 last-modified: Wed, 31 Jul 2019 07:48:51 GMT etag: "5d4147e3-47e" expires: Wed, 26 Oct 2022 23:53:46 GMT cache-control: max-age=86400 strict-transport-security: max-age=31536000; includeSubdomains; accept-ranges: bytes X-Firefox-Spdy: h2 --- Additional Info --- Magic: MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data Size: 1150 Md5: 91abe01116ab422c598e9c8af72cf4da Sha1: 0f2815fe8e067d48537ad168225ab4674271fa27 Sha256: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
GET /sw.js?v=1666742023937 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Service-Worker: script Connection: keep-alive Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Sec-Fetch-Dest: serviceworker Sec-Fetch-Mode: same-origin Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers	URL: go.monetizer.mobi/sw.js?v=1666742023937 FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 70d744bbd19a0cc35c8d9f1d8ba181c6cdc902f95799ac750da4adc3ad987b11 198.143.165.221 HTTP/2 200 OK content-type: application/javascript server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT content-length: 776 last-modified: Mon, 03 Oct 2022 07:40:54 GMT vary: Accept-Encoding etag: "633a9206-308" content-encoding: gzip content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline'; X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text Size: 776 Md5: f72a11763f13b05c1f2379d13387dd05 Sha1: 002fbf7672d3f4655b89b6413d160e4185ce9900 Sha256: 70d744bbd19a0cc35c8d9f1d8ba181c6cdc902f95799ac750da4adc3ad987b11
GET /proc.php?0dc2a01013c1a140c70ea63de34ad79be0fa1a11 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/proc.php?0dc2a01013c1a140c70ea63de34a (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 55a77a39ae3547525b6e4b8534c8e0761729532c93aaecf9c8028d402f9910a4 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:47 GMT location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797 vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info --- Magic: data Size: 6700 Md5: 7971abaf8689705071e0e1683f96264f Sha1: e41d48f3b3fb9bb37cf4bf262516111b35d0495e Sha256: 55a77a39ae3547525b6e4b8534c8e0761729532c93aaecf9c8028d402f9910a4
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84&eyeg=3d3df72b213fe811520eccc9840aec40&eyer=0.01643968353060854&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.85.158 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.85.158 HTTP/1.1 302 Found Date: Tue, 25 Oct 2022 23:53:47 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-transform Location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84&eyeg=3&eyer=0.01643968353060854&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84&eyeg=3&eyer=0.01643968353060854&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.85.158 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.85.158 HTTP/1.1 302 Found Date: Tue, 25 Oct 2022 23:53:47 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-transform Location: https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004629aa9c29e6cefe60de99c4f0ea16bc1025-202210-flb5467509-4538fM7158602492555558934sl_5467509-4538ff2dff0707fd87ea206e2246ee403274c76018781797-403c551a797 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc635673e-499c-4d9c-8bc5-a713fb19e221.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: be818a015fc9c745ea561a0b9c2aca6ba25ade24acd696fa651163d47b195371 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 13796 x-amzn-requestid: 90b1e032-78c6-499d-b564-f25c15e20304 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2OG0SoAMFx-w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568e-599d0f526fc6a01f77b67dcf;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:10 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: qxBQMJAnYNJVLBf5LSOTC7v3hPl9sh-G-OIqrK7d5KpdVITaQCcGMA== via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:47:18 GMT age: 7589 etag: "c3856686b98e1883133aa1824c496d34512769a0" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 13796 Md5: b946c4f2f177828cf7b76c5764e97157 Sha1: c3856686b98e1883133aa1824c496d34512769a0 Sha256: be818a015fc9c745ea561a0b9c2aca6ba25ade24acd696fa651163d47b195371
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4eccb336-aab3-4c45-986e-3d5c068fa95f.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: d17b83d8de3794b198bd371579ca3447639f53121eb463b6eb0a766fe7f0103c 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4545 x-amzn-requestid: 79cb9387-d637-49b8-9a2d-6d372c793b79 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2hFLUoAMFZpA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568f-4b5bd9d432820d313641ce7c;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:11 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: AZtv67bO63atc0XPPRa8j0DVq8srEip-Ucqx5OE2RdEcNrZuJOeOBw== via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 22:05:36 GMT age: 6491 etag: "619dff28900195c0d76692c6695c610c57fde4f2" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4545 Md5: 77f26048280036eede4e216d7ac2ed6f Sha1: 619dff28900195c0d76692c6695c610c57fde4f2 Sha256: d17b83d8de3794b198bd371579ca3447639f53121eb463b6eb0a766fe7f0103c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5fa5fdec-5335-427d-851c-6c86307c9c24.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: f2972481fbbb03204634e8b817d93f8dfd379033d0a7e20452d7bd4cc3920f99 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5272 x-amzn-requestid: 321c9e46-69e8-4c04-8dff-229330fb9886 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ackaiGANoAMF1YA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6354e776-0a0e8cb30a7f95105ac6e5be;Sampled=0 x-amzn-remapped-date: Sun, 23 Oct 2022 07:04:22 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: ujQxv1qlxxYt_giDzIsPT6nW6UUtULuasBhgZLlQfiwz-Bawk-WKbg== via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 02d90bf99fd6253b329a53c82f19e224.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 22:48:58 GMT age: 3889 etag: "5fb06917bfb86966f06a981e960ff51df4cc344e" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5272 Md5: 250f9d4a37cec1e47b62fc5fdb1ee0e1 Sha1: 5fb06917bfb86966f06a981e960ff51df4cc344e Sha256: f2972481fbbb03204634e8b817d93f8dfd379033d0a7e20452d7bd4cc3920f99
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4bb798f-68f7-40da-b8a2-df020464cf6a.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4effa7986e9e0f55c88caeefaa3d0523ad7496352c8caeaa1b6d7ef2e40138c4 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 12421 x-amzn-requestid: d1acf900-eae0-4c4a-9310-5cabb6cc53c9 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2hGsnoAMFXNA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568f-315abf3d30887d94198a14af;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:11 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: 6vw_9qHLCuynGyCBz_xUgy903P5zAdVijTMIZaozryR6fU4Yd0PC9w== via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:49:01 GMT age: 7486 etag: "940ab4fcf102e23bd3c66ea4ed884758884a3562" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 12421 Md5: bde3afce205445ff4d37fd7304d6703f Sha1: 940ab4fcf102e23bd3c66ea4ed884758884a3562 Sha256: 4effa7986e9e0f55c88caeefaa3d0523ad7496352c8caeaa1b6d7ef2e40138c4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9e9e44c-367f-4419-9232-a61ac0ceba8e.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: ad6a0705eed632a908e735a806657221852533eda9ae9978d8f1aeb4ad2ebb38 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 12703 x-amzn-requestid: 80a35fb9-0cfb-4fe9-9c04-bf8ba82f3d32 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2hEhuoAMF_xw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568f-3a4bd0df07d1e3cb7d66614c;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:11 GMT x-amz-cf-pop: SEA19-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: f86i0X9YJLer7qbPKoKQOx1H0VH34-89WY64hH5bpRhbwAsPj1b76w== via: 1.1 2241406ac19fffc8f35d6ddef8e22f56.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:49:00 GMT age: 7487 etag: "3934a64203860925a6e7ddd5c9ec1e23d6a4fb62" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 12703 Md5: 088f0f2074f83c6265c531c1aa94110b Sha1: 3934a64203860925a6e7ddd5c9ec1e23d6a4fb62 Sha256: ad6a0705eed632a908e735a806657221852533eda9ae9978d8f1aeb4ad2ebb38
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F146a58d8-e764-43d0-9812-6e8fd4a4ddf5.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4c4a5d1e0c9e0e2030f897dfd33200bf109060143e09a826d750c7b3f87cec17 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4678 x-amzn-requestid: 65ffc943-1dbc-457c-9572-c24f75d4c01c x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alK9NGhboAMF93w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63585854-3ff1da9f5aeba49e27d3d8d4;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:42:44 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: QnNW3Q-yaRrtYQ1qcmYmv9tHETKFb0IbMmxQQqBLJuHLjtLT89jidQ== via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 ead78c395f4bede3ec6cd7ea180e3d3a.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:53:00 GMT etag: "5d1dfb235e19f623699f0ad023df09d22ceb0645" age: 7247 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4678 Md5: 7b2c3f2a710323cabe8b60f067758182 Sha1: 5d1dfb235e19f623699f0ad023df09d22ceb0645 Sha256: 4c4a5d1e0c9e0e2030f897dfd33200bf109060143e09a826d750c7b3f87cec17
GET /favicon.ico HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/favicon.ico FQDN: www.wewillserv.com IP: 51.68.85.158 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.85.158 HTTP/1.1 204 No Content Server: openresty Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.godaddy.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 75 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.godaddy.com/ FQDN: ocsp.godaddy.com IP: 192.124.249.22 HASH: 0a611a01769f5287621619a02beb28039a59b333967bf82d192848d66bd04fa8 192.124.249.22 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: Sucuri/Cloudproxy Date: Tue, 25 Oct 2022 23:53:47 GMT Content-Length: 1777 Connection: keep-alive X-Sucuri-ID: 19022 Content-Transfer-Encoding: Binary Cache-Control: public, no-transform, must-revalidate Last-Modified: Tue, 25 Oct 2022 19:43:05 GMT Expires: Wed, 26 Oct 2022 19:43:05 GMT ETag: "4d4b77602f9a176bd4d303dad50107abc5da7610" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" --- Additional Info --- Magic: data Size: 1777 Md5: b21fd7025198f581376c2af0e0a70d98 Sha1: 4d4b77602f9a176bd4d303dad50107abc5da7610 Sha256: 0a611a01769f5287621619a02beb28039a59b333967bf82d192848d66bd04fa8
GET /sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004629aa9c29e6cefe60de99c4f0ea16bc1025-202210-flb5467509-4538fM7158602492555558934sl_5467509-4538ff2dff0707fd87ea206e2246ee403274c76018781797-403c551a797 HTTP/1.1 Host: admoustache.go2affise.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6 (...) FQDN: admoustache.go2affise.com IP: 34.147.1.177 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.147.1.177 HTTP/2 302 Found server: nginx date: Tue, 25 Oct 2022 23:53:47 GMT content-length: 0 location: https://myofferplus.com/rc/a91581ead4?affclick=6358770b8d162a0001b1e655&pubid=503 set-cookie: afclick=6358770b8d162a0001b1e655; expires=Wed, 25 Oct 2023 23:53:47 GMT; secure; SameSite=None access-control-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 841 Cache-Control: max-age=105318 Date: Tue, 25 Oct 2022 23:53:47 GMT Etag: "63576c28-117" Expires: Thu, 27 Oct 2022 05:09:05 GMT Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT Server: ECS (amb/6BBC) X-Cache: HIT Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 803a8292d7be7c9957c5eba0ac3852d6 Sha1: df65bfe9a331130c785a6ece9c01155bfb1a77a8 Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 841 Cache-Control: max-age=105318 Date: Tue, 25 Oct 2022 23:53:47 GMT Etag: "63576c28-117" Expires: Thu, 27 Oct 2022 05:09:05 GMT Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 803a8292d7be7c9957c5eba0ac3852d6 Sha1: df65bfe9a331130c785a6ece9c01155bfb1a77a8 Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663
GET /34363?click=pubea2c1d311dc74cdea17b16fb9a9e0546&pubid=ba8315b2 HTTP/1.1 Host: 139.59.49.76 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: 139.59.49.76/34363?click=pubea2c1d311dc74cdea17b16fb9a9 (...) FQDN: 139.59.49.76 IP: 139.59.49.76 HASH: b1bdef8e582602c2e13b0d16e76908e1c8a6977c5dbed23d80fadc71b07ab2e2 139.59.49.76 HTTP/1.1 302 Found content-type: text/html; charset=utf-8 x-powered-by: Express surrogate-control: no-store cache-control: no-store, no-cache, must-revalidate, proxy-revalidate pragma: no-cache expires: 0 location: https://surf.ueive.com/rc/736006a179?affclick=22J26052348A034363012829Kgf1o&pubid=34363 vary: Accept, Accept-Encoding content-length: 226 date: Tue, 25 Oct 2022 23:53:48 GMT --- Additional Info --- Magic: HTML document, ASCII text, with no line terminators Size: 226 Md5: 89feb99c6d847c4f1d5ff1acd9a16102 Sha1: 1861a4b58d0839b9437dc284afca897e67fa96c8 Sha256: b1bdef8e582602c2e13b0d16e76908e1c8a6977c5dbed23d80fadc71b07ab2e2
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Cache-Control: max-age=128965 Date: Tue, 25 Oct 2022 23:53:48 GMT Etag: "6357cbd1-118" Expires: Thu, 27 Oct 2022 11:43:13 GMT Last-Modified: Tue, 25 Oct 2022 11:43:13 GMT Server: nginx Content-Length: 280 --- Additional Info --- Magic: data Size: 280 Md5: 0c9d6163b47681383118edc49720642c Sha1: 3d93705ba1c506b81d10d2b89aa7665749269b8d Sha256: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 1 Cache-Control: max-age=128965 Date: Tue, 25 Oct 2022 23:53:49 GMT Etag: "6357cbd1-118" Expires: Thu, 27 Oct 2022 11:43:14 GMT Last-Modified: Tue, 25 Oct 2022 11:43:13 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 280 --- Additional Info --- Magic: data Size: 280 Md5: 0c9d6163b47681383118edc49720642c Sha1: 3d93705ba1c506b81d10d2b89aa7665749269b8d Sha256: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 843 Cache-Control: max-age=105318 Date: Tue, 25 Oct 2022 23:53:49 GMT Etag: "63576c28-117" Expires: Thu, 27 Oct 2022 05:09:07 GMT Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 803a8292d7be7c9957c5eba0ac3852d6 Sha1: df65bfe9a331130c785a6ece9c01155bfb1a77a8 Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663
GET /redirect.css HTTP/1.1 Host: cdn.addlnk.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://surf.ueive.com/ Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: cdn.addlnk.com/redirect.css FQDN: cdn.addlnk.com IP: 172.67.191.221 HASH: eb5ad8aa2ccbbbb88097189ede1c92fb6e8e2bfe442a67d450ec41debac92322 172.67.191.221 HTTP/2 200 OK content-type: text/css date: Tue, 25 Oct 2022 23:53:49 GMT cf-bgj: minify cf-polished: origSize=1680 etag: W/"3ae56d32551602b41f9046c14d1cfde2" last-modified: Wed, 13 Mar 2019 00:03:12 GMT x-amz-id-2: BUW6rlWHZvzQnvJHp4gBkVRIGc8DfdhWdOpgruWqMqu7ownlHIapox/IYSueiBqz+QseNtzP+2A= x-amz-request-id: KYXF7EGSHW20KRRM cf-cache-status: HIT age: 3082 report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=98bYLy0y%2FjHdZy8ROpBs%2BWveWw2gxTCo9NAY4YBpCbVNIgAKY2FGhT8dWMPVqkV6JC141eWUzT7p1iOUgSL2hXIakujQ0gDtRBYoQadpWuM7ROrCjmBQIqw4OV7XYlAtpw%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare cf-ray: 75fedfb1bd2bb4f1-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text, with very long lines (1242), with no line terminators Size: 708 Md5: 6b20b2b3d11ce2d484a859c7e8a15d20 Sha1: 060125e5557fc9c5b444d3b1561bef4280faa097 Sha256: eb5ad8aa2ccbbbb88097189ede1c92fb6e8e2bfe442a67d450ec41debac92322
GET /click?pid=930&offer_id=18720&sub1=pub80a44f669b04460cbee904aa5c412b9f&sub2=947fa8f5_34363 HTTP/1.1 Host: aditmedia.g2afse.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://surf.ueive.com/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: aditmedia.g2afse.com/click?pid=930&offer_id=18720&sub1= (...) FQDN: aditmedia.g2afse.com IP: 34.91.234.242 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.91.234.242 HTTP/2 302 Found server: nginx date: Tue, 25 Oct 2022 23:53:49 GMT content-length: 0 location: https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_947fa8f5_34363&cid=6358770d170ad10001472ca2 set-cookie: afclick=6358770d170ad10001472ca2; expires=Wed, 25 Oct 2023 23:53:49 GMT; secure; SameSite=None afoffers={"18720":1666742029}; expires=Wed, 25 Oct 2023 23:53:49 GMT; secure; SameSite=None access-control-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1 Host: ad.marootrack.co User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://ad.marootrack.co/?utm_term=7158602505440460893&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=fc31cb907912986e0de8c318af40f86d Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: ad.marootrack.co/favicon.ico FQDN: ad.marootrack.co IP: 65.60.58.179 HASH: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc 65.60.58.179 HTTP/2 200 OK content-type: image/x-icon server: nginx date: Tue, 25 Oct 2022 23:53:50 GMT content-length: 1150 last-modified: Wed, 31 Jul 2019 07:48:51 GMT etag: "5d4147e3-47e" expires: Wed, 26 Oct 2022 23:53:50 GMT cache-control: max-age=86400 strict-transport-security: max-age=31536000; includeSubdomains; accept-ranges: bytes X-Firefox-Spdy: h2 --- Additional Info --- Magic: MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data Size: 1150 Md5: 91abe01116ab422c598e9c8af72cf4da Sha1: 0f2815fe8e067d48537ad168225ab4674271fa27 Sha256: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
GET /rc/736006a179?affclick=22J26052348A034363012829Kgf1o&pubid=34363 HTTP/1.1 Host: surf.ueive.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: surf.ueive.com/rc/736006a179?affclick=22J26052348A03436 (...) FQDN: surf.ueive.com IP: 104.21.92.26 HASH: edc351a03cbcf9a0968bc51ae291bc0f3f32ba213fbb22fb131c990e5384fd78 104.21.92.26 HTTP/2 200 OK content-type: text/html; charset=utf-8 date: Tue, 25 Oct 2022 23:53:48 GMT set-cookie: AWSALB=URdlNgH+PHDUvYC49Q3sUs4eBQL4UeCQ8Ui2MbMrxngkBggQ5pzsfLXMwbzjH8X8HcPCIXti10MyTBw1vvEOokX1hjYWItvrAFJJJzVmnVpQhGwsU5sjQJuem0Fy; Expires=Tue, 01 Nov 2022 23:53:48 GMT; Path=/ AWSALBCORS=URdlNgH+PHDUvYC49Q3sUs4eBQL4UeCQ8Ui2MbMrxngkBggQ5pzsfLXMwbzjH8X8HcPCIXti10MyTBw1vvEOokX1hjYWItvrAFJJJzVmnVpQhGwsU5sjQJuem0Fy; Expires=Tue, 01 Nov 2022 23:53:48 GMT; Path=/; SameSite=None vary: Accept-Encoding, Accept-Language, Cookie content-language: en cf-cache-status: DYNAMIC report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9bBKpzysa%2FadVruTWaV7e6K07HayefCz7j1cMZeGJ7c2BuwEx1%2BhTZZr6yNidTvM2TwPF7Br88XY2ENDf2w0fT10TqZkA1BkBUbMGvUBaCxSywoC8w0GzZe%2BuMsFzdB%2FQA%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 75fedfb049cf0b65-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1531) Size: 5182 Md5: 07ce9ccd0f384203a6854fe7cef0224b Sha1: 519f290f8d2a96f26ad99ca76d4410f0fdb107f7 Sha256: edc351a03cbcf9a0968bc51ae291bc0f3f32ba213fbb22fb131c990e5384fd78
GET /go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505440460893&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 Host: d0zi.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://ad.marootrack.co/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505 (...) FQDN: d0zi.com IP: 162.55.4.52 HASH: da15f86e10396469758e1ab3e98e13d3bfa1454df83528f2fc3fb43144f47eef 162.55.4.52 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx/1.20.1 Date: Tue, 25 Oct 2022 23:53:51 GMT Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=31536000 --- Additional Info --- Magic: HTML document text\012- HTML document, ASCII text, with very long lines (65210), with CRLF line terminators Size: 745589 Md5: 6ba023703f7011d5fb117529f1454ec1 Sha1: 264bbc9919ed603b55195ea12ff47ee33bc01d8d Sha256: da15f86e10396469758e1ab3e98e13d3bfa1454df83528f2fc3fb43144f47eef
GET /favicon.ico HTTP/1.1 Host: d0zi.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505440460893&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin	URL: d0zi.com/favicon.ico FQDN: d0zi.com IP: 162.55.4.52 HASH: d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf 162.55.4.52 HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Server: nginx/1.20.1 Date: Tue, 25 Oct 2022 23:53:51 GMT Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip --- Additional Info --- Magic: data Size: 20 Md5: a4745abc5e7fdb89cc6df3069f3c6e69 Sha1: 74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed Sha256: d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /proc.php?5dc9e6a7ca43b6770e430b216940d5e5f1fb2788 HTTP/1.1 Host: ad.marootrack.co User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://ad.marootrack.co/?utm_term=7158602505440460893&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=fc31cb907912986e0de8c318af40f86d Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: ad.marootrack.co/proc.php?5dc9e6a7ca43b6770e430b216940d (...) FQDN: ad.marootrack.co IP: 65.60.58.179 HASH: 72369eac6f03c55a6b7c4f1faafcbe0574aabde1cc4819fbbd10f8a0666a2430 65.60.58.179 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:50 GMT location: https://d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505440460893&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0 vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3776), with no line terminators Size: 1622 Md5: 8b6893991a7e628de4c7c163825173f0 Sha1: 1855dbc65404840bd9209871050ac1d414eb6ed5 Sha256: 72369eac6f03c55a6b7c4f1faafcbe0574aabde1cc4819fbbd10f8a0666a2430 Alerts: Blocklists: - fortinet: Malware
GET /rc/a91581ead4?affclick=6358770b8d162a0001b1e655&pubid=503 HTTP/1.1 Host: myofferplus.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: myofferplus.com/rc/a91581ead4?affclick=6358770b8d162a00 (...) FQDN: myofferplus.com IP: 172.67.217.200 172.67.217.200 HTTP/2 200 OK content-type: text/html; charset=utf-8 date: Tue, 25 Oct 2022 23:53:47 GMT set-cookie: AWSALB=R2Rxy7ZCsPdf2bIer3k2JzWOoGXpy8aBish9bj1a/216tDuck1Sn5FmpzBgK0OqMZ6xptx+bqYNW7OkarjIxqXfoVhKIKKlBeqE7TxDMux6Xz72gK5zAaraTX3XA; Expires=Tue, 01 Nov 2022 23:53:47 GMT; Path=/ AWSALBCORS=R2Rxy7ZCsPdf2bIer3k2JzWOoGXpy8aBish9bj1a/216tDuck1Sn5FmpzBgK0OqMZ6xptx+bqYNW7OkarjIxqXfoVhKIKKlBeqE7TxDMux6Xz72gK5zAaraTX3XA; Expires=Tue, 01 Nov 2022 23:53:47 GMT; Path=/; SameSite=None vary: Accept-Encoding, Accept-Language, Cookie content-language: en cf-cache-status: DYNAMIC report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iDiRIEA0brCuQDg%2BAW%2F4qfh7JM9tu0IH5t5AAWA0IqndCFgdUOPlRMflE%2Bua%2BSEsrpysmBI6Lgsl7lyEb7EquRC6vvZwCPDqI3g4x5IhCFiX0eQRhveWmCMzJT8RYdqoRso%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 75fedfa8f82fb523-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info ---
GET /redirect.css HTTP/1.1 Host: cdn.addlnk.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://myofferplus.com/ Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: cdn.addlnk.com/redirect.css FQDN: cdn.addlnk.com IP: 172.67.191.221 172.67.191.221 HTTP/2 200 OK content-type: text/css date: Tue, 25 Oct 2022 23:53:47 GMT cf-bgj: minify cf-polished: origSize=1680 etag: W/"3ae56d32551602b41f9046c14d1cfde2" last-modified: Wed, 13 Mar 2019 00:03:12 GMT x-amz-id-2: BUW6rlWHZvzQnvJHp4gBkVRIGc8DfdhWdOpgruWqMqu7ownlHIapox/IYSueiBqz+QseNtzP+2A= x-amz-request-id: KYXF7EGSHW20KRRM cf-cache-status: HIT age: 3080 report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RDSTx9x4ZxPHigZVlBh%2BIgUm8vZOhZJmA2Hl6XuI2PFEw5VVOZzOqYGO%2Bno%2BMMXoXLYho0F3KEWWsSB7IBKYsNfJEEOVnFpGJh0CrotGlXdbHQWbvfr8NDF3ZroM5ae6qQ%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare cf-ray: 75fedfaa79c4b50b-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_947fa8f5_34363&cid=6358770d170ad10001472ca2 HTTP/1.1 Host: ad.marootrack.co User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://surf.ueive.com/ Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6 (...) FQDN: ad.marootrack.co IP: 65.60.58.179 65.60.58.179 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:49 GMT location: https://ad.marootrack.co/?utm_term=7158602505440460893&ver=4viyaptcjo vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: u=fc31cb907912986e0de8c318af40f86d; expires=Wed, 25-Oct-2023 23:53:49 GMT; Max-Age=31536000; path=/ strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=c4a42714-6d21-427c-aac1-389e45cac2ac HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d6 (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT location: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: u=83b47d2b9a3ed45c1fec656715940ee6; expires=Wed, 25-Oct-2023 23:53:46 GMT; Max-Age=31536000; path=/ strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=c4a42714-6d21-427c-aac1-389e45cac2ac Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/?utm_term=7158602492555558934&ver=4vi (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=utf-8 server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "DF992311F130F15459739841DE925C7EEC2604D5A68CA6B2A67B6DC8D229212C" 

                                        
                                            
Last-Modified: Mon, 24 Oct 2022 00:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=4826 

                                        
                                            
Expires: Wed, 26 Oct 2022 01:14:11 GMT 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:45 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    b3537658770790ad6cf0d727f0c0acd2

                                                Sha1:   8365cadda05ef27b2ebd627d545e31886b512bde

                                                Sha256: df992311f130f15459739841de925c7eec2604d5a68ca6b2a67b6dc8d229212c

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "9AEAFC72C1A969243E1FC96F68CE18888034A749EE70582208BF814BD40B61A5" 

                                        
                                            
Last-Modified: Tue, 25 Oct 2022 02:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=3190 

                                        
                                            
Expires: Wed, 26 Oct 2022 00:46:55 GMT 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:45 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    8db408c487f7d35bba323046736e8d3a

                                                Sha1:   01b91e2dce7c6d3de9adfe6ff4d38f9b24ab7db0

                                                Sha256: 9aeafc72c1a969243e1fc96f68ce18888034a749ee70582208bf814bd40b61a5

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.sca1b.amazontrust.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         143.204.42.165

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Content-Length: 471 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Cache-Control: max-age=142623 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:45 GMT 

                                        
                                            
Etag: "63580128-1d7" 

                                        
                                            
Expires: Thu, 27 Oct 2022 15:30:48 GMT 

                                        
                                            
Last-Modified: Tue, 25 Oct 2022 15:30:48 GMT 

                                        
                                            
Server: nginx 

                                        
                                            
X-Cache: Miss from cloudfront 

                                        
                                            
Via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront) 

                                        
                                            
X-Amz-Cf-Pop: OSL50-C1 

                                        
                                            
X-Amz-Cf-Id: rwQEkU2p2yy3avlv_tLxMime5fqhNp2Wr3QZDMKUxNxtOnI9DHKYuQ== 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   471

                                                Md5:    2a8ae8c0f656e3795704cd9d044bd9d0

                                                Sha1:   0ca4840427d3b80faea1ea5061d76d4b18046c0b

                                                Sha256: d358b9e833267fd2260f8d191b17c9904a1ed236f764ae83b89b5c5425d1e79c

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.digicert.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         93.184.220.29

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Age: 5541 

                                        
                                            
Cache-Control: max-age=121524 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:45 GMT 

                                        
                                            
Etag: "63579918-1d7" 

                                        
                                            
Expires: Thu, 27 Oct 2022 09:39:09 GMT 

                                        
                                            
Last-Modified: Tue, 25 Oct 2022 08:06:48 GMT 

                                        
                                            
Server: ECS (ska/F712) 

                                        
                                            
X-Cache: HIT 

                                        
                                            
Content-Length: 471 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   471

                                                Md5:    518ff04fd536958e285cf07aaf4a2786

                                                Sha1:   fa5dad2391c2a9957340bd629f0462db4f412a5c

                                                Sha256: 608c78964412d5dc7025e9cbfaef345d448a29eae0f11257c49a41f274917b9a

                                        
                                            GET /favicon.ico HTTP/1.1 

                                        
                                            
Host: go.monetizer.mobi

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 

                                        
                                            
Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         198.143.165.221

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/x-icon

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 25 Oct 2022 23:53:46 GMT 

                                        
                                            
content-length: 1150 

                                        
                                            
last-modified: Wed, 31 Jul 2019 07:48:51 GMT 

                                        
                                            
etag: "5d4147e3-47e" 

                                        
                                            
expires: Wed, 26 Oct 2022 23:53:46 GMT 

                                        
                                            
cache-control: max-age=86400 

                                        
                                            
strict-transport-security: max-age=31536000; includeSubdomains; 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data

                                                Size:   1150

                                                Md5:    91abe01116ab422c598e9c8af72cf4da

                                                Sha1:   0f2815fe8e067d48537ad168225ab4674271fa27

                                                Sha256: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

                                        
                                            GET /proc.php?0dc2a01013c1a140c70ea63de34ad79be0fa1a11 HTTP/1.1 

                                        
                                            
Host: go.monetizer.mobi

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 

                                        
                                            
Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         198.143.165.221

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html; charset=UTF-8

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-powered-by: PHP/8.1.9 

                                        
                                            
cache-control: no-store, no-cache, must-revalidate, max-age=0 

                                        
                                            
pragma: no-cache 

                                        
                                            
expires: Thu, 01 Jan 1970 00:00:00 GMT 

                                        
                                            
strict-transport-security: max-age=31536000; includeSubdomains; 

                                        
                                            
content-encoding: gzip 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   6700

                                                Md5:    7971abaf8689705071e0e1683f96264f

                                                Sha1:   e41d48f3b3fb9bb37cf4bf262516111b35d0495e

                                                Sha256: 55a77a39ae3547525b6e4b8534c8e0761729532c93aaecf9c8028d402f9910a4

                                        
                                            GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84&eyeg=3&eyer=0.01643968353060854&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi HTTP/1.1 

                                        
                                            
Host: www.wewillserv.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin

                                         51.68.85.158

                                        
                                            HTTP/1.1 302 Found

                                        

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
Content-Length: 0 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Cache-Control: no-transform 

                                        
                                            
Location: https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004629aa9c29e6cefe60de99c4f0ea16bc1025-202210-flb*5467509-4538f*M7158602492555558934*sl_5467509-4538f*f2dff0707fd87ea206e2246ee403274c76018781*797-403c551a*797 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" 

                                        
                                            
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=3690 

                                        
                                            
Expires: Wed, 26 Oct 2022 00:55:17 GMT 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    358ecd0ec047d700042e2a62f9847199

                                                Sha1:   7bf4c552f47536fe451dc6ccfb0930c592084ef9

                                                Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" 

                                        
                                            
Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=3690 

                                        
                                            
Expires: Wed, 26 Oct 2022 00:55:17 GMT 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    358ecd0ec047d700042e2a62f9847199

                                                Sha1:   7bf4c552f47536fe451dc6ccfb0930c592084ef9

                                                Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc635673e-499c-4d9c-8bc5-a713fb19e221.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 13796 

                                        
                                            
x-amzn-requestid: 90b1e032-78c6-499d-b564-f25c15e20304 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: alJ2OG0SoAMFx-w= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6358568e-599d0f526fc6a01f77b67dcf;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:10 GMT 

                                        
                                            
x-amz-cf-pop: HIO50-C1, SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: qxBQMJAnYNJVLBf5LSOTC7v3hPl9sh-G-OIqrK7d5KpdVITaQCcGMA== 

                                        
                                            
via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Tue, 25 Oct 2022 21:47:18 GMT 

                                        
                                            
age: 7589 

                                        
                                            
etag: "c3856686b98e1883133aa1824c496d34512769a0" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   13796

                                                Md5:    b946c4f2f177828cf7b76c5764e97157

                                                Sha1:   c3856686b98e1883133aa1824c496d34512769a0

                                                Sha256: be818a015fc9c745ea561a0b9c2aca6ba25ade24acd696fa651163d47b195371

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5fa5fdec-5335-427d-851c-6c86307c9c24.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 5272 

                                        
                                            
x-amzn-requestid: 321c9e46-69e8-4c04-8dff-229330fb9886 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: ackaiGANoAMF1YA= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6354e776-0a0e8cb30a7f95105ac6e5be;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Sun, 23 Oct 2022 07:04:22 GMT 

                                        
                                            
x-amz-cf-pop: SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: ujQxv1qlxxYt_giDzIsPT6nW6UUtULuasBhgZLlQfiwz-Bawk-WKbg== 

                                        
                                            
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 02d90bf99fd6253b329a53c82f19e224.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Tue, 25 Oct 2022 22:48:58 GMT 

                                        
                                            
age: 3889 

                                        
                                            
etag: "5fb06917bfb86966f06a981e960ff51df4cc344e" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   5272

                                                Md5:    250f9d4a37cec1e47b62fc5fdb1ee0e1

                                                Sha1:   5fb06917bfb86966f06a981e960ff51df4cc344e

                                                Sha256: f2972481fbbb03204634e8b817d93f8dfd379033d0a7e20452d7bd4cc3920f99

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9e9e44c-367f-4419-9232-a61ac0ceba8e.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 12703 

                                        
                                            
x-amzn-requestid: 80a35fb9-0cfb-4fe9-9c04-bf8ba82f3d32 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: alJ2hEhuoAMF_xw= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6358568f-3a4bd0df07d1e3cb7d66614c;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:11 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C1, SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: f86i0X9YJLer7qbPKoKQOx1H0VH34-89WY64hH5bpRhbwAsPj1b76w== 

                                        
                                            
via: 1.1 2241406ac19fffc8f35d6ddef8e22f56.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Tue, 25 Oct 2022 21:49:00 GMT 

                                        
                                            
age: 7487 

                                        
                                            
etag: "3934a64203860925a6e7ddd5c9ec1e23d6a4fb62" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   12703

                                                Md5:    088f0f2074f83c6265c531c1aa94110b

                                                Sha1:   3934a64203860925a6e7ddd5c9ec1e23d6a4fb62

                                                Sha256: ad6a0705eed632a908e735a806657221852533eda9ae9978d8f1aeb4ad2ebb38

                                        
                                            GET /favicon.ico HTTP/1.1 

                                        
                                            
Host: www.wewillserv.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin

                                         51.68.85.158

                                        
                                            HTTP/1.1 204 No Content

                                        

                                        
                                            
Server: openresty 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            GET /sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004629aa9c29e6cefe60de99c4f0ea16bc1025-202210-flb*5467509-4538f*M7158602492555558934*sl_5467509-4538f*f2dff0707fd87ea206e2246ee403274c76018781*797-403c551a*797 HTTP/1.1 

                                        
                                            
Host: admoustache.go2affise.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.147.1.177

                                        
                                            HTTP/2 302 Found

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
content-length: 0 

                                        
                                            
location: https://myofferplus.com/rc/a91581ead4?affclick=6358770b8d162a0001b1e655&pubid=503 

                                        
                                            
set-cookie: afclick=6358770b8d162a0001b1e655; expires=Wed, 25 Oct 2023 23:53:47 GMT; secure; SameSite=None 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.digicert.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         93.184.220.29

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Age: 841 

                                        
                                            
Cache-Control: max-age=105318 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
Etag: "63576c28-117" 

                                        
                                            
Expires: Thu, 27 Oct 2022 05:09:05 GMT 

                                        
                                            
Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT 

                                        
                                            
Server: ECS (ska/F712) 

                                        
                                            
X-Cache: HIT 

                                        
                                            
Content-Length: 279 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   279

                                                Md5:    803a8292d7be7c9957c5eba0ac3852d6

                                                Sha1:   df65bfe9a331130c785a6ece9c01155bfb1a77a8

                                                Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.digicert.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         93.184.220.29

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Cache-Control: max-age=128965 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:48 GMT 

                                        
                                            
Etag: "6357cbd1-118" 

                                        
                                            
Expires: Thu, 27 Oct 2022 11:43:13 GMT 

                                        
                                            
Last-Modified: Tue, 25 Oct 2022 11:43:13 GMT 

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 280 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   280

                                                Md5:    0c9d6163b47681383118edc49720642c

                                                Sha1:   3d93705ba1c506b81d10d2b89aa7665749269b8d

                                                Sha256: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.digicert.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         93.184.220.29

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Age: 843 

                                        
                                            
Cache-Control: max-age=105318 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:49 GMT 

                                        
                                            
Etag: "63576c28-117" 

                                        
                                            
Expires: Thu, 27 Oct 2022 05:09:07 GMT 

                                        
                                            
Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT 

                                        
                                            
Server: ECS (ska/F712) 

                                        
                                            
X-Cache: HIT 

                                        
                                            
Content-Length: 279 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   279

                                                Md5:    803a8292d7be7c9957c5eba0ac3852d6

                                                Sha1:   df65bfe9a331130c785a6ece9c01155bfb1a77a8

                                                Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663

                                        
                                            GET /click?pid=930&offer_id=18720&sub1=pub80a44f669b04460cbee904aa5c412b9f&sub2=947fa8f5_34363 HTTP/1.1 

                                        
                                            
Host: aditmedia.g2afse.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://surf.ueive.com/ 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.91.234.242

                                        
                                            HTTP/2 302 Found

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 25 Oct 2022 23:53:49 GMT 

                                        
                                            
content-length: 0 

                                        
                                            
location: https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_947fa8f5_34363&cid=6358770d170ad10001472ca2 

                                        
                                            
set-cookie: afclick=6358770d170ad10001472ca2; expires=Wed, 25 Oct 2023 23:53:49 GMT; secure; SameSite=None
afoffers={"18720":1666742029}; expires=Wed, 25 Oct 2023 23:53:49 GMT; secure; SameSite=None 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            GET /rc/736006a179?affclick=22J26052348A034363012829Kgf1o&pubid=34363 HTTP/1.1 

                                        
                                            
Host: surf.ueive.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         104.21.92.26

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html; charset=utf-8

                                        

                                        
                                            
date: Tue, 25 Oct 2022 23:53:48 GMT 

                                        
                                            
set-cookie: AWSALB=URdlNgH+PHDUvYC49Q3sUs4eBQL4UeCQ8Ui2MbMrxngkBggQ5pzsfLXMwbzjH8X8HcPCIXti10MyTBw1vvEOokX1hjYWItvrAFJJJzVmnVpQhGwsU5sjQJuem0Fy; Expires=Tue, 01 Nov 2022 23:53:48 GMT; Path=/
AWSALBCORS=URdlNgH+PHDUvYC49Q3sUs4eBQL4UeCQ8Ui2MbMrxngkBggQ5pzsfLXMwbzjH8X8HcPCIXti10MyTBw1vvEOokX1hjYWItvrAFJJJzVmnVpQhGwsU5sjQJuem0Fy; Expires=Tue, 01 Nov 2022 23:53:48 GMT; Path=/; SameSite=None 

                                        
                                            
vary: Accept-Encoding, Accept-Language, Cookie 

                                        
                                            
content-language: en 

                                        
                                            
cf-cache-status: DYNAMIC 

                                        
                                            
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9bBKpzysa%2FadVruTWaV7e6K07HayefCz7j1cMZeGJ7c2BuwEx1%2BhTZZr6yNidTvM2TwPF7Br88XY2ENDf2w0fT10TqZkA1BkBUbMGvUBaCxSywoC8w0GzZe%2BuMsFzdB%2FQA%3D%3D"}],"group":"cf-nel","max_age":604800} 

                                        
                                            
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} 

                                        
                                            
server: cloudflare 

                                        
                                            
cf-ray: 75fedfb049cf0b65-OSL 

                                        
                                            
content-encoding: br 

                                        
                                            
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1531)

                                                Size:   5182

                                                Md5:    07ce9ccd0f384203a6854fe7cef0224b

                                                Sha1:   519f290f8d2a96f26ad99ca76d4410f0fdb107f7

                                                Sha256: edc351a03cbcf9a0968bc51ae291bc0f3f32ba213fbb22fb131c990e5384fd78

                                        
                                            GET /favicon.ico HTTP/1.1 

                                        
                                            
Host: d0zi.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505440460893&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: same-origin

                                         162.55.4.52

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: text/html; charset=UTF-8

                                        

                                        
                                            
Server: nginx/1.20.1 

                                        
                                            
Date: Tue, 25 Oct 2022 23:53:51 GMT 

                                        
                                            
Transfer-Encoding: chunked 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Strict-Transport-Security: max-age=31536000 

                                        
                                            
Content-Encoding: gzip 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   20

                                                Md5:    a4745abc5e7fdb89cc6df3069f3c6e69

                                                Sha1:   74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed

                                                Sha256: d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf

                                        
                                            GET /rc/a91581ead4?affclick=6358770b8d162a0001b1e655&pubid=503 HTTP/1.1 

                                        
                                            
Host: myofferplus.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         172.67.217.200

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html; charset=utf-8

                                        

                                        
                                            
date: Tue, 25 Oct 2022 23:53:47 GMT 

                                        
                                            
set-cookie: AWSALB=R2Rxy7ZCsPdf2bIer3k2JzWOoGXpy8aBish9bj1a/216tDuck1Sn5FmpzBgK0OqMZ6xptx+bqYNW7OkarjIxqXfoVhKIKKlBeqE7TxDMux6Xz72gK5zAaraTX3XA; Expires=Tue, 01 Nov 2022 23:53:47 GMT; Path=/
AWSALBCORS=R2Rxy7ZCsPdf2bIer3k2JzWOoGXpy8aBish9bj1a/216tDuck1Sn5FmpzBgK0OqMZ6xptx+bqYNW7OkarjIxqXfoVhKIKKlBeqE7TxDMux6Xz72gK5zAaraTX3XA; Expires=Tue, 01 Nov 2022 23:53:47 GMT; Path=/; SameSite=None 

                                        
                                            
vary: Accept-Encoding, Accept-Language, Cookie 

                                        
                                            
content-language: en 

                                        
                                            
cf-cache-status: DYNAMIC 

                                        
                                            
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iDiRIEA0brCuQDg%2BAW%2F4qfh7JM9tu0IH5t5AAWA0IqndCFgdUOPlRMflE%2Bua%2BSEsrpysmBI6Lgsl7lyEb7EquRC6vvZwCPDqI3g4x5IhCFiX0eQRhveWmCMzJT8RYdqoRso%3D"}],"group":"cf-nel","max_age":604800} 

                                        
                                            
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} 

                                        
                                            
server: cloudflare 

                                        
                                            
cf-ray: 75fedfa8f82fb523-OSL 

                                        
                                            
content-encoding: br 

                                        
                                            
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                        
                                            GET /?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_947fa8f5_34363&cid=6358770d170ad10001472ca2 HTTP/1.1 

                                        
                                            
Host: ad.marootrack.co

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Referer: https://surf.ueive.com/ 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         65.60.58.179

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html; charset=UTF-8

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 25 Oct 2022 23:53:49 GMT 

                                        
                                            
location: https://ad.marootrack.co/?utm_term=7158602505440460893&ver=4viyaptcjo 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-powered-by: PHP/8.1.9 

                                        
                                            
cache-control: no-store, no-cache, must-revalidate, max-age=0 

                                        
                                            
pragma: no-cache 

                                        
                                            
expires: Thu, 01 Jan 1970 00:00:00 GMT 

                                        
                                            
set-cookie: u=fc31cb907912986e0de8c318af40f86d; expires=Wed, 25-Oct-2023 23:53:49 GMT; Max-Age=31536000; path=/ 

                                        
                                            
strict-transport-security: max-age=31536000; includeSubdomains; 

                                        
                                            
content-encoding: gzip 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                        
                                            GET /?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 

                                        
                                            
Host: go.monetizer.mobi

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=c4a42714-6d21-427c-aac1-389e45cac2ac 

                                        
                                            
Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: same-origin 

                                        
                                            
TE: trailers

                                         198.143.165.221

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: text/html; charset=utf-8

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Tue, 25 Oct 2022 23:53:46 GMT 

                                        
                                            
vary: Accept-Encoding 

                                        
                                            
x-powered-by: PHP/8.1.9 

                                        
                                            
cache-control: no-store, no-cache, must-revalidate, max-age=0 

                                        
                                            
pragma: no-cache 

                                        
                                            
expires: Thu, 01 Jan 1970 00:00:00 GMT 

                                        
                                            
strict-transport-security: max-age=31536000; includeSubdomains; 

                                        
                                            
content-encoding: gzip 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

URL	cp.tocallapp.com/t/clk
IP	172.67.157.224 (United States)
ASN	#13335 CLOUDFLARENET
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed	2022-10-25 23:53:56 UTC
Status	Loading report..
IDS alerts	0
Blocklist alert	2
urlquery alerts	No alerts detected
Tags	None

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: df992311f130f15459739841de925c7eec2604d5a68ca6b2a67b6dc8d229212c 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "DF992311F130F15459739841DE925C7EEC2604D5A68CA6B2A67B6DC8D229212C" Last-Modified: Mon, 24 Oct 2022 00:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=4826 Expires: Wed, 26 Oct 2022 01:14:11 GMT Date: Tue, 25 Oct 2022 23:53:45 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: b3537658770790ad6cf0d727f0c0acd2 Sha1: 8365cadda05ef27b2ebd627d545e31886b512bde Sha256: df992311f130f15459739841de925c7eec2604d5a68ca6b2a67b6dc8d229212c
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 3a1d27ec3d034d6326b32f6054b6be46079a86a33e75d5a2a3796a0c4c5eadab 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 4903 Cache-Control: max-age=125949 Date: Tue, 25 Oct 2022 23:53:45 GMT Etag: "6357acdf-1d7" Expires: Thu, 27 Oct 2022 10:52:54 GMT Last-Modified: Tue, 25 Oct 2022 09:31:11 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: c2bba4cad162918b17858b60e909e4d9 Sha1: d9a1d4f7fb7635ab233ebbf776e6de1a2857032b Sha256: 3a1d27ec3d034d6326b32f6054b6be46079a86a33e75d5a2a3796a0c4c5eadab
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 9aeafc72c1a969243e1fc96f68ce18888034a749ee70582208bf814bd40b61a5 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "9AEAFC72C1A969243E1FC96F68CE18888034A749EE70582208BF814BD40B61A5" Last-Modified: Tue, 25 Oct 2022 02:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3190 Expires: Wed, 26 Oct 2022 00:46:55 GMT Date: Tue, 25 Oct 2022 23:53:45 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8db408c487f7d35bba323046736e8d3a Sha1: 01b91e2dce7c6d3de9adfe6ff4d38f9b24ab7db0 Sha256: 9aeafc72c1a969243e1fc96f68ce18888034a749ee70582208bf814bd40b61a5
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 34.160.144.191 HASH: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78 34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: VMEJ9C0cshV8oJ0j3ptle9bH+P7YLVFFPf5WuK2BwxDxkzgnTTpSDSvUhd4+hSftn2cUpIQ+xkI= x-amz-request-id: C76FHPMBVSN7DR0B content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Tue, 25 Oct 2022 23:09:07 GMT age: 2678 last-modified: Fri, 30 Sep 2022 18:50:55 GMT etag: "67d5a988edcda47bc3b3b3f65d32b4b6" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 67d5a988edcda47bc3b3b3f65d32b4b6 Sha1: d4f0e0da8b3690cc7da925026d3414b68c7d954f Sha256: 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /t/clk HTTP/1.1 Host: cp.tocallapp.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: cp.tocallapp.com/t/clk FQDN: cp.tocallapp.com IP: 104.21.89.104 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 104.21.89.104 HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Date: Tue, 25 Oct 2022 23:53:45 GMT Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: AWSALB=+7dt/rzbXF5upTRONmK+FeAP3nMmGmsyjxC8dNd4DubDgaOYsyKl8OXY3NbC+/THmqXUjqaChzseVyMM+S9cF0lyhsM03L1ZKf+pKYir4Bg+8bjJWGngjfouX7CQ; Expires=Tue, 01 Nov 2022 23:53:45 GMT; Path=/ AWSALBCORS=+7dt/rzbXF5upTRONmK+FeAP3nMmGmsyjxC8dNd4DubDgaOYsyKl8OXY3NbC+/THmqXUjqaChzseVyMM+S9cF0lyhsM03L1ZKf+pKYir4Bg+8bjJWGngjfouX7CQ; Expires=Tue, 01 Nov 2022 23:53:45 GMT; Path=/; SameSite=None Location: https://so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 Vary: Cookie, Origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nScup0K%2FjpTB1WKBUcbDkv3SaS25ttO%2BFRYG%2BQG0d1hvdQlHK1GkwkYSDQ5X%2FKhjqfvxGlF1g3kHcHmk7c1TMtFxodlR2feTChbGfYRUDU2okUtDLdMSwUOGB1jQnDKbuO9O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 75fedf9898c9b527-OSL alt-svc: h2=":443"; ma=60 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Alerts: Blocklists: - fortinet: Malware
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Tue, 25 Oct 2022 23:53:45 GMT content-length: 12 strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
POST / HTTP/1.1 Host: ocsp.sca1b.amazontrust.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sca1b.amazontrust.com/ FQDN: ocsp.sca1b.amazontrust.com IP: 143.204.42.165 HASH: d358b9e833267fd2260f8d191b17c9904a1ed236f764ae83b89b5c5425d1e79c 143.204.42.165 HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=142623 Date: Tue, 25 Oct 2022 23:53:45 GMT Etag: "63580128-1d7" Expires: Thu, 27 Oct 2022 15:30:48 GMT Last-Modified: Tue, 25 Oct 2022 15:30:48 GMT Server: nginx X-Cache: Miss from cloudfront Via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-C1 X-Amz-Cf-Id: rwQEkU2p2yy3avlv_tLxMime5fqhNp2Wr3QZDMKUxNxtOnI9DHKYuQ== --- Additional Info --- Magic: data Size: 471 Md5: 2a8ae8c0f656e3795704cd9d044bd9d0 Sha1: 0ca4840427d3b80faea1ea5061d76d4b18046c0b Sha256: d358b9e833267fd2260f8d191b17c9904a1ed236f764ae83b89b5c5425d1e79c
GET /t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&rcode=R09&rseq=R09,R99,R98 HTTP/1.1 Host: so-glo.yoptv33.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: so-glo.yoptv33.com/t/clk?id=DQqT5fxjrUGKRmCl&rl=Dkxpn&r (...) FQDN: so-glo.yoptv33.com IP: 52.28.59.112 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 52.28.59.112 HTTP/2 302 Found content-type: text/html; charset=utf-8 date: Tue, 25 Oct 2022 23:53:45 GMT content-length: 0 location: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=c4a42714-6d21-427c-aac1-389e45cac2ac server: nginx/1.12.2 cache-control: no-transform x-frame-options: SAMEORIGIN vary: Cookie, Origin set-cookie: uip="[\"w9XJ73v\"\054 {\"oza51\": \"QA7xLjP\"}]:1onTjt:tuNch-Rvns5cWZEKroTTo6GUNks"; expires=Thu, 24 Nov 2022 23:53:45 GMT; Max-Age=2592000; Path=/ ydt_69a756d9a2a44370a5365f82fbdfa6e5="[\"c4a42714-6d21-427c-aac1-389e45cac2ac\"]:1onTjt:niVQSlOTZzGYAAaEqKXeT5bGCC4"; expires=Fri, 25 Nov 2022 01:53:45 GMT; Max-Age=2599200; Path=/; SameSite=None; Secure X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 608c78964412d5dc7025e9cbfaef345d448a29eae0f11257c49a41f274917b9a 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 5541 Cache-Control: max-age=121524 Date: Tue, 25 Oct 2022 23:53:45 GMT Etag: "63579918-1d7" Expires: Thu, 27 Oct 2022 09:39:09 GMT Last-Modified: Tue, 25 Oct 2022 08:06:48 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: 518ff04fd536958e285cf07aaf4a2786 Sha1: fa5dad2391c2a9957340bd629f0462db4f412a5c Sha256: 608c78964412d5dc7025e9cbfaef345d448a29eae0f11257c49a41f274917b9a
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: UEgKEelXD9/eRfmV/DGyMQ== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 34.218.168.248 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.218.168.248 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: 5IaJABkCSjehwMx6d/kH12zI17g= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/favicon.ico FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc 198.143.165.221 HTTP/2 200 OK content-type: image/x-icon server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT content-length: 1150 last-modified: Wed, 31 Jul 2019 07:48:51 GMT etag: "5d4147e3-47e" expires: Wed, 26 Oct 2022 23:53:46 GMT cache-control: max-age=86400 strict-transport-security: max-age=31536000; includeSubdomains; accept-ranges: bytes X-Firefox-Spdy: h2 --- Additional Info --- Magic: MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data Size: 1150 Md5: 91abe01116ab422c598e9c8af72cf4da Sha1: 0f2815fe8e067d48537ad168225ab4674271fa27 Sha256: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
GET /sw.js?v=1666742023937 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Service-Worker: script Connection: keep-alive Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Sec-Fetch-Dest: serviceworker Sec-Fetch-Mode: same-origin Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers	URL: go.monetizer.mobi/sw.js?v=1666742023937 FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 70d744bbd19a0cc35c8d9f1d8ba181c6cdc902f95799ac750da4adc3ad987b11 198.143.165.221 HTTP/2 200 OK content-type: application/javascript server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT content-length: 776 last-modified: Mon, 03 Oct 2022 07:40:54 GMT vary: Accept-Encoding etag: "633a9206-308" content-encoding: gzip content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline'; X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text Size: 776 Md5: f72a11763f13b05c1f2379d13387dd05 Sha1: 002fbf7672d3f4655b89b6413d160e4185ce9900 Sha256: 70d744bbd19a0cc35c8d9f1d8ba181c6cdc902f95799ac750da4adc3ad987b11
GET /proc.php?0dc2a01013c1a140c70ea63de34ad79be0fa1a11 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/proc.php?0dc2a01013c1a140c70ea63de34a (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 HASH: 55a77a39ae3547525b6e4b8534c8e0761729532c93aaecf9c8028d402f9910a4 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:47 GMT location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797 vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info --- Magic: data Size: 6700 Md5: 7971abaf8689705071e0e1683f96264f Sha1: e41d48f3b3fb9bb37cf4bf262516111b35d0495e Sha256: 55a77a39ae3547525b6e4b8534c8e0761729532c93aaecf9c8028d402f9910a4
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84&eyeg=3d3df72b213fe811520eccc9840aec40&eyer=0.01643968353060854&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.85.158 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.85.158 HTTP/1.1 302 Found Date: Tue, 25 Oct 2022 23:53:47 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-transform Location: https://www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84&eyeg=3&eyer=0.01643968353060854&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?sl=5467509-4538f&data1=Track1&data2=Track2&tag=M7158602492555558934&website=797-403c551a&placement=797&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84&eyeg=3&eyer=0.01643968353060854&eyei=0&eyew=1280&eyeh=939&eyetd=220&eyef=go.monetizer.mobi HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/?sl=5467509-4538f&data1=Track1&data2 (...) FQDN: www.wewillserv.com IP: 51.68.85.158 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.85.158 HTTP/1.1 302 Found Date: Tue, 25 Oct 2022 23:53:47 GMT Content-Length: 0 Connection: keep-alive Cache-Control: no-transform Location: https://admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004629aa9c29e6cefe60de99c4f0ea16bc1025-202210-flb5467509-4538fM7158602492555558934sl_5467509-4538ff2dff0707fd87ea206e2246ee403274c76018781797-403c551a797 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "E14317AACE5D64E9901867578379DD4DD4252B059070D37722F82EBB2E649D27" Last-Modified: Mon, 24 Oct 2022 21:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3690 Expires: Wed, 26 Oct 2022 00:55:17 GMT Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 358ecd0ec047d700042e2a62f9847199 Sha1: 7bf4c552f47536fe451dc6ccfb0930c592084ef9 Sha256: e14317aace5d64e9901867578379dd4dd4252b059070d37722f82ebb2e649d27
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc635673e-499c-4d9c-8bc5-a713fb19e221.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: be818a015fc9c745ea561a0b9c2aca6ba25ade24acd696fa651163d47b195371 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 13796 x-amzn-requestid: 90b1e032-78c6-499d-b564-f25c15e20304 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2OG0SoAMFx-w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568e-599d0f526fc6a01f77b67dcf;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:10 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: qxBQMJAnYNJVLBf5LSOTC7v3hPl9sh-G-OIqrK7d5KpdVITaQCcGMA== via: 1.1 d1151317ba32afe0e6370fd69fed222e.cloudfront.net (CloudFront), 1.1 e95ec8f1dc02e32f0cb9e113963ceb4e.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:47:18 GMT age: 7589 etag: "c3856686b98e1883133aa1824c496d34512769a0" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 13796 Md5: b946c4f2f177828cf7b76c5764e97157 Sha1: c3856686b98e1883133aa1824c496d34512769a0 Sha256: be818a015fc9c745ea561a0b9c2aca6ba25ade24acd696fa651163d47b195371
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4eccb336-aab3-4c45-986e-3d5c068fa95f.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: d17b83d8de3794b198bd371579ca3447639f53121eb463b6eb0a766fe7f0103c 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4545 x-amzn-requestid: 79cb9387-d637-49b8-9a2d-6d372c793b79 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2hFLUoAMFZpA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568f-4b5bd9d432820d313641ce7c;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:11 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: AZtv67bO63atc0XPPRa8j0DVq8srEip-Ucqx5OE2RdEcNrZuJOeOBw== via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 001e7070d795018d01b93988b9723742.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 22:05:36 GMT age: 6491 etag: "619dff28900195c0d76692c6695c610c57fde4f2" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4545 Md5: 77f26048280036eede4e216d7ac2ed6f Sha1: 619dff28900195c0d76692c6695c610c57fde4f2 Sha256: d17b83d8de3794b198bd371579ca3447639f53121eb463b6eb0a766fe7f0103c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5fa5fdec-5335-427d-851c-6c86307c9c24.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: f2972481fbbb03204634e8b817d93f8dfd379033d0a7e20452d7bd4cc3920f99 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 5272 x-amzn-requestid: 321c9e46-69e8-4c04-8dff-229330fb9886 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: ackaiGANoAMF1YA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6354e776-0a0e8cb30a7f95105ac6e5be;Sampled=0 x-amzn-remapped-date: Sun, 23 Oct 2022 07:04:22 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: ujQxv1qlxxYt_giDzIsPT6nW6UUtULuasBhgZLlQfiwz-Bawk-WKbg== via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 02d90bf99fd6253b329a53c82f19e224.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 22:48:58 GMT age: 3889 etag: "5fb06917bfb86966f06a981e960ff51df4cc344e" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 5272 Md5: 250f9d4a37cec1e47b62fc5fdb1ee0e1 Sha1: 5fb06917bfb86966f06a981e960ff51df4cc344e Sha256: f2972481fbbb03204634e8b817d93f8dfd379033d0a7e20452d7bd4cc3920f99
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4bb798f-68f7-40da-b8a2-df020464cf6a.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4effa7986e9e0f55c88caeefaa3d0523ad7496352c8caeaa1b6d7ef2e40138c4 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 12421 x-amzn-requestid: d1acf900-eae0-4c4a-9310-5cabb6cc53c9 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2hGsnoAMFXNA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568f-315abf3d30887d94198a14af;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:11 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: 6vw_9qHLCuynGyCBz_xUgy903P5zAdVijTMIZaozryR6fU4Yd0PC9w== via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:49:01 GMT age: 7486 etag: "940ab4fcf102e23bd3c66ea4ed884758884a3562" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 12421 Md5: bde3afce205445ff4d37fd7304d6703f Sha1: 940ab4fcf102e23bd3c66ea4ed884758884a3562 Sha256: 4effa7986e9e0f55c88caeefaa3d0523ad7496352c8caeaa1b6d7ef2e40138c4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb9e9e44c-367f-4419-9232-a61ac0ceba8e.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: ad6a0705eed632a908e735a806657221852533eda9ae9978d8f1aeb4ad2ebb38 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 12703 x-amzn-requestid: 80a35fb9-0cfb-4fe9-9c04-bf8ba82f3d32 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alJ2hEhuoAMF_xw= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6358568f-3a4bd0df07d1e3cb7d66614c;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:35:11 GMT x-amz-cf-pop: SEA19-C1, SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: f86i0X9YJLer7qbPKoKQOx1H0VH34-89WY64hH5bpRhbwAsPj1b76w== via: 1.1 2241406ac19fffc8f35d6ddef8e22f56.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:49:00 GMT age: 7487 etag: "3934a64203860925a6e7ddd5c9ec1e23d6a4fb62" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 12703 Md5: 088f0f2074f83c6265c531c1aa94110b Sha1: 3934a64203860925a6e7ddd5c9ec1e23d6a4fb62 Sha256: ad6a0705eed632a908e735a806657221852533eda9ae9978d8f1aeb4ad2ebb38
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F146a58d8-e764-43d0-9812-6e8fd4a4ddf5.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4c4a5d1e0c9e0e2030f897dfd33200bf109060143e09a826d750c7b3f87cec17 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4678 x-amzn-requestid: 65ffc943-1dbc-457c-9572-c24f75d4c01c x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: alK9NGhboAMF93w= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63585854-3ff1da9f5aeba49e27d3d8d4;Sampled=0 x-amzn-remapped-date: Tue, 25 Oct 2022 21:42:44 GMT x-amz-cf-pop: HIO50-C1, SEA73-P1 x-cache: Miss from cloudfront x-amz-cf-id: QnNW3Q-yaRrtYQ1qcmYmv9tHETKFb0IbMmxQQqBLJuHLjtLT89jidQ== via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 ead78c395f4bede3ec6cd7ea180e3d3a.cloudfront.net (CloudFront), 1.1 google date: Tue, 25 Oct 2022 21:53:00 GMT etag: "5d1dfb235e19f623699f0ad023df09d22ceb0645" age: 7247 cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4678 Md5: 7b2c3f2a710323cabe8b60f067758182 Sha1: 5d1dfb235e19f623699f0ad023df09d22ceb0645 Sha256: 4c4a5d1e0c9e0e2030f897dfd33200bf109060143e09a826d750c7b3f87cec17
GET /favicon.ico HTTP/1.1 Host: www.wewillserv.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin	URL: www.wewillserv.com/favicon.ico FQDN: www.wewillserv.com IP: 51.68.85.158 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 51.68.85.158 HTTP/1.1 204 No Content Server: openresty Date: Tue, 25 Oct 2022 23:53:47 GMT Connection: keep-alive --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.godaddy.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 75 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.godaddy.com/ FQDN: ocsp.godaddy.com IP: 192.124.249.22 HASH: 0a611a01769f5287621619a02beb28039a59b333967bf82d192848d66bd04fa8 192.124.249.22 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: Sucuri/Cloudproxy Date: Tue, 25 Oct 2022 23:53:47 GMT Content-Length: 1777 Connection: keep-alive X-Sucuri-ID: 19022 Content-Transfer-Encoding: Binary Cache-Control: public, no-transform, must-revalidate Last-Modified: Tue, 25 Oct 2022 19:43:05 GMT Expires: Wed, 26 Oct 2022 19:43:05 GMT ETag: "4d4b77602f9a176bd4d303dad50107abc5da7610" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" --- Additional Info --- Magic: data Size: 1777 Md5: b21fd7025198f581376c2af0e0a70d98 Sha1: 4d4b77602f9a176bd4d303dad50107abc5da7610 Sha256: 0a611a01769f5287621619a02beb28039a59b333967bf82d192848d66bd04fa8
GET /sl?id=5f0efd61dabed1d602e0fe6a&pid=503&sub1=330004629aa9c29e6cefe60de99c4f0ea16bc1025-202210-flb5467509-4538fM7158602492555558934sl_5467509-4538ff2dff0707fd87ea206e2246ee403274c76018781797-403c551a797 HTTP/1.1 Host: admoustache.go2affise.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: admoustache.go2affise.com/sl?id=5f0efd61dabed1d602e0fe6 (...) FQDN: admoustache.go2affise.com IP: 34.147.1.177 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.147.1.177 HTTP/2 302 Found server: nginx date: Tue, 25 Oct 2022 23:53:47 GMT content-length: 0 location: https://myofferplus.com/rc/a91581ead4?affclick=6358770b8d162a0001b1e655&pubid=503 set-cookie: afclick=6358770b8d162a0001b1e655; expires=Wed, 25 Oct 2023 23:53:47 GMT; secure; SameSite=None access-control-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 841 Cache-Control: max-age=105318 Date: Tue, 25 Oct 2022 23:53:47 GMT Etag: "63576c28-117" Expires: Thu, 27 Oct 2022 05:09:05 GMT Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT Server: ECS (amb/6BBC) X-Cache: HIT Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 803a8292d7be7c9957c5eba0ac3852d6 Sha1: df65bfe9a331130c785a6ece9c01155bfb1a77a8 Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 841 Cache-Control: max-age=105318 Date: Tue, 25 Oct 2022 23:53:47 GMT Etag: "63576c28-117" Expires: Thu, 27 Oct 2022 05:09:05 GMT Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 803a8292d7be7c9957c5eba0ac3852d6 Sha1: df65bfe9a331130c785a6ece9c01155bfb1a77a8 Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663
GET /34363?click=pubea2c1d311dc74cdea17b16fb9a9e0546&pubid=ba8315b2 HTTP/1.1 Host: 139.59.49.76 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: 139.59.49.76/34363?click=pubea2c1d311dc74cdea17b16fb9a9 (...) FQDN: 139.59.49.76 IP: 139.59.49.76 HASH: b1bdef8e582602c2e13b0d16e76908e1c8a6977c5dbed23d80fadc71b07ab2e2 139.59.49.76 HTTP/1.1 302 Found content-type: text/html; charset=utf-8 x-powered-by: Express surrogate-control: no-store cache-control: no-store, no-cache, must-revalidate, proxy-revalidate pragma: no-cache expires: 0 location: https://surf.ueive.com/rc/736006a179?affclick=22J26052348A034363012829Kgf1o&pubid=34363 vary: Accept, Accept-Encoding content-length: 226 date: Tue, 25 Oct 2022 23:53:48 GMT --- Additional Info --- Magic: HTML document, ASCII text, with no line terminators Size: 226 Md5: 89feb99c6d847c4f1d5ff1acd9a16102 Sha1: 1861a4b58d0839b9437dc284afca897e67fa96c8 Sha256: b1bdef8e582602c2e13b0d16e76908e1c8a6977c5dbed23d80fadc71b07ab2e2
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Cache-Control: max-age=128965 Date: Tue, 25 Oct 2022 23:53:48 GMT Etag: "6357cbd1-118" Expires: Thu, 27 Oct 2022 11:43:13 GMT Last-Modified: Tue, 25 Oct 2022 11:43:13 GMT Server: nginx Content-Length: 280 --- Additional Info --- Magic: data Size: 280 Md5: 0c9d6163b47681383118edc49720642c Sha1: 3d93705ba1c506b81d10d2b89aa7665749269b8d Sha256: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 1 Cache-Control: max-age=128965 Date: Tue, 25 Oct 2022 23:53:49 GMT Etag: "6357cbd1-118" Expires: Thu, 27 Oct 2022 11:43:14 GMT Last-Modified: Tue, 25 Oct 2022 11:43:13 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 280 --- Additional Info --- Magic: data Size: 280 Md5: 0c9d6163b47681383118edc49720642c Sha1: 3d93705ba1c506b81d10d2b89aa7665749269b8d Sha256: 68cd951434f442f360efb812347e81784cde429021262f6cbe209ee78e93e4c5
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 843 Cache-Control: max-age=105318 Date: Tue, 25 Oct 2022 23:53:49 GMT Etag: "63576c28-117" Expires: Thu, 27 Oct 2022 05:09:07 GMT Last-Modified: Tue, 25 Oct 2022 04:55:04 GMT Server: ECS (ska/F712) X-Cache: HIT Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 803a8292d7be7c9957c5eba0ac3852d6 Sha1: df65bfe9a331130c785a6ece9c01155bfb1a77a8 Sha256: 54e7df1072faea8a94f933d866e824e996724f4b07929f20883729455c45e663
GET /redirect.css HTTP/1.1 Host: cdn.addlnk.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://surf.ueive.com/ Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: cdn.addlnk.com/redirect.css FQDN: cdn.addlnk.com IP: 172.67.191.221 HASH: eb5ad8aa2ccbbbb88097189ede1c92fb6e8e2bfe442a67d450ec41debac92322 172.67.191.221 HTTP/2 200 OK content-type: text/css date: Tue, 25 Oct 2022 23:53:49 GMT cf-bgj: minify cf-polished: origSize=1680 etag: W/"3ae56d32551602b41f9046c14d1cfde2" last-modified: Wed, 13 Mar 2019 00:03:12 GMT x-amz-id-2: BUW6rlWHZvzQnvJHp4gBkVRIGc8DfdhWdOpgruWqMqu7ownlHIapox/IYSueiBqz+QseNtzP+2A= x-amz-request-id: KYXF7EGSHW20KRRM cf-cache-status: HIT age: 3082 report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=98bYLy0y%2FjHdZy8ROpBs%2BWveWw2gxTCo9NAY4YBpCbVNIgAKY2FGhT8dWMPVqkV6JC141eWUzT7p1iOUgSL2hXIakujQ0gDtRBYoQadpWuM7ROrCjmBQIqw4OV7XYlAtpw%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare cf-ray: 75fedfb1bd2bb4f1-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text, with very long lines (1242), with no line terminators Size: 708 Md5: 6b20b2b3d11ce2d484a859c7e8a15d20 Sha1: 060125e5557fc9c5b444d3b1561bef4280faa097 Sha256: eb5ad8aa2ccbbbb88097189ede1c92fb6e8e2bfe442a67d450ec41debac92322
GET /click?pid=930&offer_id=18720&sub1=pub80a44f669b04460cbee904aa5c412b9f&sub2=947fa8f5_34363 HTTP/1.1 Host: aditmedia.g2afse.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://surf.ueive.com/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: aditmedia.g2afse.com/click?pid=930&offer_id=18720&sub1= (...) FQDN: aditmedia.g2afse.com IP: 34.91.234.242 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.91.234.242 HTTP/2 302 Found server: nginx date: Tue, 25 Oct 2022 23:53:49 GMT content-length: 0 location: https://ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_947fa8f5_34363&cid=6358770d170ad10001472ca2 set-cookie: afclick=6358770d170ad10001472ca2; expires=Wed, 25 Oct 2023 23:53:49 GMT; secure; SameSite=None afoffers={"18720":1666742029}; expires=Wed, 25 Oct 2023 23:53:49 GMT; secure; SameSite=None access-control-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1 Host: ad.marootrack.co User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://ad.marootrack.co/?utm_term=7158602505440460893&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=fc31cb907912986e0de8c318af40f86d Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: ad.marootrack.co/favicon.ico FQDN: ad.marootrack.co IP: 65.60.58.179 HASH: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc 65.60.58.179 HTTP/2 200 OK content-type: image/x-icon server: nginx date: Tue, 25 Oct 2022 23:53:50 GMT content-length: 1150 last-modified: Wed, 31 Jul 2019 07:48:51 GMT etag: "5d4147e3-47e" expires: Wed, 26 Oct 2022 23:53:50 GMT cache-control: max-age=86400 strict-transport-security: max-age=31536000; includeSubdomains; accept-ranges: bytes X-Firefox-Spdy: h2 --- Additional Info --- Magic: MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data Size: 1150 Md5: 91abe01116ab422c598e9c8af72cf4da Sha1: 0f2815fe8e067d48537ad168225ab4674271fa27 Sha256: b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
GET /rc/736006a179?affclick=22J26052348A034363012829Kgf1o&pubid=34363 HTTP/1.1 Host: surf.ueive.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: surf.ueive.com/rc/736006a179?affclick=22J26052348A03436 (...) FQDN: surf.ueive.com IP: 104.21.92.26 HASH: edc351a03cbcf9a0968bc51ae291bc0f3f32ba213fbb22fb131c990e5384fd78 104.21.92.26 HTTP/2 200 OK content-type: text/html; charset=utf-8 date: Tue, 25 Oct 2022 23:53:48 GMT set-cookie: AWSALB=URdlNgH+PHDUvYC49Q3sUs4eBQL4UeCQ8Ui2MbMrxngkBggQ5pzsfLXMwbzjH8X8HcPCIXti10MyTBw1vvEOokX1hjYWItvrAFJJJzVmnVpQhGwsU5sjQJuem0Fy; Expires=Tue, 01 Nov 2022 23:53:48 GMT; Path=/ AWSALBCORS=URdlNgH+PHDUvYC49Q3sUs4eBQL4UeCQ8Ui2MbMrxngkBggQ5pzsfLXMwbzjH8X8HcPCIXti10MyTBw1vvEOokX1hjYWItvrAFJJJzVmnVpQhGwsU5sjQJuem0Fy; Expires=Tue, 01 Nov 2022 23:53:48 GMT; Path=/; SameSite=None vary: Accept-Encoding, Accept-Language, Cookie content-language: en cf-cache-status: DYNAMIC report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9bBKpzysa%2FadVruTWaV7e6K07HayefCz7j1cMZeGJ7c2BuwEx1%2BhTZZr6yNidTvM2TwPF7Br88XY2ENDf2w0fT10TqZkA1BkBUbMGvUBaCxSywoC8w0GzZe%2BuMsFzdB%2FQA%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 75fedfb049cf0b65-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1531) Size: 5182 Md5: 07ce9ccd0f384203a6854fe7cef0224b Sha1: 519f290f8d2a96f26ad99ca76d4410f0fdb107f7 Sha256: edc351a03cbcf9a0968bc51ae291bc0f3f32ba213fbb22fb131c990e5384fd78
GET /go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505440460893&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 Host: d0zi.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://ad.marootrack.co/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505 (...) FQDN: d0zi.com IP: 162.55.4.52 HASH: da15f86e10396469758e1ab3e98e13d3bfa1454df83528f2fc3fb43144f47eef 162.55.4.52 HTTP/1.1 302 Found Content-Type: text/html; charset=UTF-8 Server: nginx/1.20.1 Date: Tue, 25 Oct 2022 23:53:51 GMT Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=31536000 --- Additional Info --- Magic: HTML document text\012- HTML document, ASCII text, with very long lines (65210), with CRLF line terminators Size: 745589 Md5: 6ba023703f7011d5fb117529f1454ec1 Sha1: 264bbc9919ed603b55195ea12ff47ee33bc01d8d Sha256: da15f86e10396469758e1ab3e98e13d3bfa1454df83528f2fc3fb43144f47eef
GET /favicon.ico HTTP/1.1 Host: d0zi.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505440460893&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin	URL: d0zi.com/favicon.ico FQDN: d0zi.com IP: 162.55.4.52 HASH: d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf 162.55.4.52 HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Server: nginx/1.20.1 Date: Tue, 25 Oct 2022 23:53:51 GMT Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip --- Additional Info --- Magic: data Size: 20 Md5: a4745abc5e7fdb89cc6df3069f3c6e69 Sha1: 74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed Sha256: d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /proc.php?5dc9e6a7ca43b6770e430b216940d5e5f1fb2788 HTTP/1.1 Host: ad.marootrack.co User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://ad.marootrack.co/?utm_term=7158602505440460893&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 Cookie: u=fc31cb907912986e0de8c318af40f86d Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: ad.marootrack.co/proc.php?5dc9e6a7ca43b6770e430b216940d (...) FQDN: ad.marootrack.co IP: 65.60.58.179 HASH: 72369eac6f03c55a6b7c4f1faafcbe0574aabde1cc4819fbbd10f8a0666a2430 65.60.58.179 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:50 GMT location: https://d0zi.com/go.php?ad=6pvgwjuc578zbpcgxykd&sid=M7158602505440460893&pub=20961&pid=20961-37eddb7e-d856e882&c=0&app=unknown&br=Firefox&os=[[os]]&d=Mozilla+Firefox&ca=NO+WiFi&a=0 vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3776), with no line terminators Size: 1622 Md5: 8b6893991a7e628de4c7c163825173f0 Sha1: 1855dbc65404840bd9209871050ac1d414eb6ed5 Sha256: 72369eac6f03c55a6b7c4f1faafcbe0574aabde1cc4819fbbd10f8a0666a2430 Alerts: Blocklists: - fortinet: Malware
GET /rc/a91581ead4?affclick=6358770b8d162a0001b1e655&pubid=503 HTTP/1.1 Host: myofferplus.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: myofferplus.com/rc/a91581ead4?affclick=6358770b8d162a00 (...) FQDN: myofferplus.com IP: 172.67.217.200 172.67.217.200 HTTP/2 200 OK content-type: text/html; charset=utf-8 date: Tue, 25 Oct 2022 23:53:47 GMT set-cookie: AWSALB=R2Rxy7ZCsPdf2bIer3k2JzWOoGXpy8aBish9bj1a/216tDuck1Sn5FmpzBgK0OqMZ6xptx+bqYNW7OkarjIxqXfoVhKIKKlBeqE7TxDMux6Xz72gK5zAaraTX3XA; Expires=Tue, 01 Nov 2022 23:53:47 GMT; Path=/ AWSALBCORS=R2Rxy7ZCsPdf2bIer3k2JzWOoGXpy8aBish9bj1a/216tDuck1Sn5FmpzBgK0OqMZ6xptx+bqYNW7OkarjIxqXfoVhKIKKlBeqE7TxDMux6Xz72gK5zAaraTX3XA; Expires=Tue, 01 Nov 2022 23:53:47 GMT; Path=/; SameSite=None vary: Accept-Encoding, Accept-Language, Cookie content-language: en cf-cache-status: DYNAMIC report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iDiRIEA0brCuQDg%2BAW%2F4qfh7JM9tu0IH5t5AAWA0IqndCFgdUOPlRMflE%2Bua%2BSEsrpysmBI6Lgsl7lyEb7EquRC6vvZwCPDqI3g4x5IhCFiX0eQRhveWmCMzJT8RYdqoRso%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 75fedfa8f82fb523-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info ---
GET /redirect.css HTTP/1.1 Host: cdn.addlnk.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://myofferplus.com/ Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: cdn.addlnk.com/redirect.css FQDN: cdn.addlnk.com IP: 172.67.191.221 172.67.191.221 HTTP/2 200 OK content-type: text/css date: Tue, 25 Oct 2022 23:53:47 GMT cf-bgj: minify cf-polished: origSize=1680 etag: W/"3ae56d32551602b41f9046c14d1cfde2" last-modified: Wed, 13 Mar 2019 00:03:12 GMT x-amz-id-2: BUW6rlWHZvzQnvJHp4gBkVRIGc8DfdhWdOpgruWqMqu7ownlHIapox/IYSueiBqz+QseNtzP+2A= x-amz-request-id: KYXF7EGSHW20KRRM cf-cache-status: HIT age: 3080 report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RDSTx9x4ZxPHigZVlBh%2BIgUm8vZOhZJmA2Hl6XuI2PFEw5VVOZzOqYGO%2Bno%2BMMXoXLYho0F3KEWWsSB7IBKYsNfJEEOVnFpGJh0CrotGlXdbHQWbvfr8NDF3ZroM5ae6qQ%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare cf-ray: 75fedfaa79c4b50b-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_medium=56350e907b27b4e99d4ce73cf6c4424f6399e01a&utm_campaign=NewMainLink&1=930_947fa8f5_34363&cid=6358770d170ad10001472ca2 HTTP/1.1 Host: ad.marootrack.co User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: https://surf.ueive.com/ Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: ad.marootrack.co/?utm_medium=56350e907b27b4e99d4ce73cf6 (...) FQDN: ad.marootrack.co IP: 65.60.58.179 65.60.58.179 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:49 GMT location: https://ad.marootrack.co/?utm_term=7158602505440460893&ver=4viyaptcjo vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: u=fc31cb907912986e0de8c318af40f86d; expires=Wed, 25-Oct-2023 23:53:49 GMT; Max-Age=31536000; path=/ strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=c4a42714-6d21-427c-aac1-389e45cac2ac HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1	URL: go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d6 (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=UTF-8 server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT location: https://go.monetizer.mobi/?utm_term=7158602492555558934&ver=4viyaptcjo vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: u=83b47d2b9a3ed45c1fec656715940ee6; expires=Wed, 25-Oct-2023 23:53:46 GMT; Max-Age=31536000; path=/ strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---
GET /?utm_term=7158602492555558934&ver=4viyaptcjo&utm_content=e6c2c6dcd68fd49594fc9695a6a79597828bb8888e8f8ebdb2c6b0c4b6b78587b2bb88b0bdb68cbd82b280b3b6b6bcb4aaaba9a9aeafacada293a1919697f8f4848f9b8a8f9f89c09291898c87959de5cbfbf8cbcaffcec9f2f3f085848291f5cafac8f8fcf7fccdf3f3f2f5c6c7c4c5dae8edebe8ebebebebebe6e2e0efece61b84 HTTP/1.1 Host: go.monetizer.mobi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: https://go.monetizer.mobi/?utm_medium=ec4eee60be986151ad56a07d62a9c3fe7802b9db&utm_campaign=mainstream2021&1=1&cid=c4a42714-6d21-427c-aac1-389e45cac2ac Cookie: u=83b47d2b9a3ed45c1fec656715940ee6 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin TE: trailers	URL: go.monetizer.mobi/?utm_term=7158602492555558934&ver=4vi (...) FQDN: go.monetizer.mobi IP: 198.143.165.221 198.143.165.221 HTTP/2 200 OK content-type: text/html; charset=utf-8 server: nginx date: Tue, 25 Oct 2022 23:53:46 GMT vary: Accept-Encoding x-powered-by: PHP/8.1.9 cache-control: no-store, no-cache, must-revalidate, max-age=0 pragma: no-cache expires: Thu, 01 Jan 1970 00:00:00 GMT strict-transport-security: max-age=31536000; includeSubdomains; content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info ---

Overview

Domain Summary (20)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 172.67.157.224

Last 5 reports on ASN: CLOUDFLARENET

Last 3 reports on domain: tocallapp.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (16)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (47)

Overview

Domain Summary (20)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 172.67.157.224

Last 5 reports on ASN: CLOUDFLARENET

Last 3 reports on domain: tocallapp.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (16)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (47)

Network Intrusion Detection Systems