offergate-apps-1205.com/1-ama2p-hfb-biic-d1yk
302 Found 0 B URL HTTP/1.1 offergate-apps-1205.com/1-ama2p-hfb-biic-d1yk
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Phishing
GET /1-ama2p-hfb-biic-d1yk HTTP/1.1
Host: offergate-apps-1205.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Server: openresty
Date: Sat, 10 Sep 2022 20:13:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.0.8
Set-Cookie: visitId=9wk44ow4gsco4ww8; expires=Sun, 25-Sep-2022 20:13:31 GMT; Max-Age=1296000; path=/
location: https://www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 91dd975a7b17b2922dd23c0e49314e40
57a2ece1e3cee7c4ebf927f2ba92f52cac395fe2
09966873bbf317f8910c59544cfde2a6d46e8acd2905797cc7c85c6b4d18ea8a
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Content-Type, Alert, Backoff, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sat, 10 Sep 2022 20:06:52 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 a2b4f68a89fc87406bff22c95fc07fba.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: pGokvmJmWTtFSM40zeiB9SOmb0BruncJlR51FkMrYhADWJhCscWrow==
Age: 399
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 76d5eb597558e3dee0d99719d17e71e0
f3a0f3932fa8059f27dc9422d523b938fa9a7d09
d16de6cc9eb0e1297f53dc1137bb764bf5c21a7727be32ad05afebd1fe9501ed
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D16DE6CC9EB0E1297F53DC1137BB764BF5C21A7727BE32AD05AFEBD1FE9501ED"
Last-Modified: Sat, 10 Sep 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14289
Expires: Sun, 11 Sep 2022 00:11:40 GMT
Date: Sat, 10 Sep 2022 20:13:31 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain
IP
File type PEM certificate\012- , ASCII text
Hash 742edb4038f38bc533514982f3d2e861
cc3a20c8dc2a8c632ef9387a2744253f1e3fdef1
b6bfa49d3d135035701231db2fffc0c0643444394009a94c6a1b4d829d6b8345
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-09-23-18-04.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 20 Aug 2022 23:18:05 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sat, 10 Sep 2022 07:17:13 GMT
etag: "742edb4038f38bc533514982f3d2e861"
x-cache: Hit from cloudfront
via: 1.1 8e6dce34fd223e0c9d89fd938d1784a2.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: RBja1GggtTSk86yE3yLtG1pQxNECopspXmfxf7YGtMa_Et67j4oLuQ==
age: 46579
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 10 Sep 2022 20:13:31 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.user-shield.com/new/vpn-is-required-v2/assets/icons.jpg
200 OK 2.3 kB URL HTTP/2 www.user-shield.com/new/vpn-is-required-v2/assets/icons.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 130x33, components 3\012- data
Hash 023f4e546359d8d934feca7280734ca9
7d3d0f9a253a96491b29ed1c8a54f1438616a1de
7d5e6ab47f0350a75bfe0b5b431320f5d4c9b83fb242de7e1014e3097ec4ecfe
GET /new/vpn-is-required-v2/assets/icons.jpg HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:32 GMT
content-type: image/jpeg
content-length: 2270
cf-bgj: h2pri
etag: "023f4e546359d8d934feca7280734ca9"
last-modified: Wed, 01 Jun 2022 06:02:21 GMT
x-amz-id-2: 7xMrVhTQgbHx3SFRplfGaksVTiwbavizY3COkOrbv64O2p/BQ791wydAIsGKyeTBYIx7vjDdXXM=
x-amz-request-id: X4P83SVKF3S8AX8Q
cache-control: max-age=259200
cf-cache-status: HIT
age: 1759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aNhOo8xL5pbtR9xUvfqwgdhtggNzCBIGqcpUW%2Bkhd1hRcmD69O0uzJ7zagPNaAq2Yx6IIYfwcMKXoc%2BjdBdFzIofaHYq0PzyR7MhB7k%2FazbSgSZJNE4LpABdQPvbkIdtDkrhmhs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 748ad3230a300b51-OSL
X-Firefox-Spdy: h2
www.user-shield.com/new/vpn-is-required-v2/assets/background.jpg
200 OK 53 kB URL HTTP/2 www.user-shield.com/new/vpn-is-required-v2/assets/background.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 740x1600, components 3\012- data
Hash d9c160cdf387dbad88bf3862072e2593
682d1572c405d3e307e127884788f3bc28518918
55b39e0443cb0436fd8ee4c860ba541685d8ea440f1d2769ed382375b942696f
GET /new/vpn-is-required-v2/assets/background.jpg HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/new/vpn-is-required-v2/assets/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:32 GMT
content-type: image/jpeg
content-length: 52948
cf-bgj: h2pri
etag: "d9c160cdf387dbad88bf3862072e2593"
last-modified: Wed, 01 Jun 2022 06:02:20 GMT
x-amz-id-2: nWhQ2kTs2DGf/IAgJr8eNsM7Zpw+KO2jmwkAHEmzpnSMjwGvHfI5tRa4EY4segCZSuW+yNPxF1I=
x-amz-request-id: HW4W9G66MQMP6YP2
cache-control: max-age=259200
cf-cache-status: HIT
age: 1762
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AlA4RY4VKOiIjHz3XN9H2Axv547EzpMVViyTaS92F9sWrHzGvJL4mA0Jquh7B560%2Fibh%2FRsAXCEoKhZf0nxe0GJ6YgYz3uRGtD0NAeEpOikSI2Viwl6%2FgF%2FmNmM7AfWAOOd9O1Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 748ad3238aad0b51-OSL
X-Firefox-Spdy: h2
www.user-shield.com/new/vpn-is-required-v2/favicon.ico
200 OK 0 B URL HTTP/2 www.user-shield.com/new/vpn-is-required-v2/favicon.ico
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /new/vpn-is-required-v2/favicon.ico HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:32 GMT
content-type: image/x-icon
content-length: 0
x-amz-id-2: wjwIuEIT4vVjnWp82xuu8r7tA6+5vncrotvpu1+ZQ/Nkcj4/g1Ev7v0oCVVOn9DTePTLF6XrBZ8=
x-amz-request-id: DKFV1HXDYGF17V6Y
last-modified: Wed, 01 Jun 2022 06:02:18 GMT
etag: "d41d8cd98f00b204e9800998ecf8427e"
cache-control: max-age=259200
cf-cache-status: HIT
age: 1760
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y%2BylJvsYC5Qgk%2F5DClOoUi4hchu4YK7zFO8Pwl4Qyn%2B5lWOH4LmHQylSoNurraFoc0cRY0yLDLHzvj%2Fuo%2B16H9gvV2xt%2B88hQUJ7xGa1eKXcHbeiNzii9Yf2XUm%2FjKqytKag%2F8Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 748ad323dae90b51-OSL
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 4a8b934802b39ce62326f039ac83cd96
dbfe44bfbec869b99291881ce7c2539d34d7ca9c
c1d5a7058b585d2207c7162b7d0ed62443426b9b2e1262391ad3118884bda651
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5024
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 10 Sep 2022 20:13:32 GMT
Last-Modified: Sat, 10 Sep 2022 18:49:48 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 471
cdn.taboola.com/libtrc/unip/1260992/tfa.js
200 OK 18 kB URL HTTP/2 cdn.taboola.com/libtrc/unip/1260992/tfa.js
IP
File type ASCII text, with very long lines (58435)
Hash 63e8b1892cf797007a0dea3fa2499093
38c8ca84bf7228b1beb200fdafacc25629e6e541
eb4468f8a3b753d86c8acfad523c39203723475277300f0f3ca4865a9e0906bb
GET /libtrc/unip/1260992/tfa.js HTTP/1.1
Host: cdn.taboola.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 5PMIobWcD285lCIYKu4VzTKPLeKJPcmBZNTXGdBGOVXC6Yu0KlAnGipDoSVBulvZY60imzcKhxI=
x-amz-request-id: Z6HYPYYQV2PFVV2X
x-amz-replication-status: PENDING
last-modified: Sun, 04 Sep 2022 11:12:45 GMT
etag: "ba87095ce0bffa74b3b2978a4904e5ca"
x-amz-version-id: 9_AmqiYAfL.nLO.Yxh.LQbgXfP3sou8w
content-type: application/javascript; charset=utf-8
server: AmazonS3
content-encoding: gzip
accept-ranges: bytes
date: Sat, 10 Sep 2022 20:13:32 GMT
via: 1.1 varnish
age: 14
x-served-by: cache-bma1634-BMA
x-cache: HIT
x-cache-hits: 1
x-timer: S1662840812.366041,VS0,VE1
cache-control: private,max-age=14401
vary: Accept-Encoding
abp: 14
content-length: 17932
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sat, 10 Sep 2022 19:56:07 GMT
Cache-Control: max-age=3600
Expires: Sat, 10 Sep 2022 20:00:14 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: 3cY0BgK8FnzQpViU14colbnfvOUSNWpLOrWyNK56JIkZM3FIQV9hdw==
Age: 1045
connect.facebook.net/en_US/fbevents.js
200 OK 27 kB URL HTTP/2 connect.facebook.net/en_US/fbevents.js
IP
File type ASCII text, with very long lines (64348)
Hash 8e7e24fb3539746aa8b869558f589615
d8086d86bbd5cfacc3b6a5ef14aa917830e137dd
7304497ee417a664bdea67d7307ca36a36013556b927c3ea5bca6c04b66236ef
GET /en_US/fbevents.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: OqEd28Lnati22XfpXfKG1YExTXjJaZeyA9EUssOHrKGcQt6qNvYeR3eA827Ag+1G//49BoJvq9qn1YecpB4eUg==
content-length: 26737
x-fb-trip-id: 1679558926
date: Sat, 10 Sep 2022 20:13:32 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 4a8b934802b39ce62326f039ac83cd96
dbfe44bfbec869b99291881ce7c2539d34d7ca9c
c1d5a7058b585d2207c7162b7d0ed62443426b9b2e1262391ad3118884bda651
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5024
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 10 Sep 2022 20:13:32 GMT
Last-Modified: Sat, 10 Sep 2022 18:49:48 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 471
connect.facebook.net/signals/config/262165081659310?v=2.9.79&r=stable
200 OK 87 kB URL HTTP/2 connect.facebook.net/signals/config/262165081659310?v=2.9.79&r=stable
IP
File type ASCII text, with very long lines (64471)
Hash cda3bdb60ec887d06218eb987487b777
3f9e5e804ed67c8d4d9c70a9a0fa8df5caaf16a2
5a566462b0d617d2891a5362fc5737ccb4dead26aa31dc1ab7868124fce8d7ba
GET /signals/config/262165081659310?v=2.9.79&r=stable HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: dHvc8TcyPfsM86l5hTW8DUN+3cK+xFxQxk4mzBPbM6ILLGVmjANSTajVNNj48eBchjXeVABEK31Hbm6c43G8NA==
priority: u=3,i
content-length: 86805
x-fb-trip-id: 1679558926
date: Sat, 10 Sep 2022 20:13:32 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash 36fe04277220227ba5ecfe7d2ff1d9d9
2eb9f6560336248cc45c1cd66d87505b5ebdf5d4
94f8f2f8f3b67db18825ea48740ff0ce218d7156fe851d6b023ef43b6bee4f7f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5219
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 10 Sep 2022 20:13:32 GMT
Last-Modified: Sat, 10 Sep 2022 18:46:33 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 471
www.facebook.com/tr/?id=262165081659310&ev=PageView&dl=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8&rl=&if=false&ts=1662840802485&sw=1280&sh=1024&v=2.9.79&r=stable&ec=0&o=30&fbp=fb.1.1662840802484.1824382894&it=1662840802361&coo=false&rqm=GET
200 OK 44 B URL HTTP/2 www.facebook.com/tr/?id=262165081659310&ev=PageView&dl=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8&rl=&if=false&ts=1662840802485&sw=1280&sh=1024&v=2.9.79&r=stable&ec=0&o=30&fbp=fb.1.1662840802484.1824382894&it=1662840802361&coo=false&rqm=GET
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash b798f4ce7359fd815df4bdf76503b295
f8cc6addf1707ad236ad9970b0a48f9733d07da5
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
GET /tr/?id=262165081659310&ev=PageView&dl=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8&rl=&if=false&ts=1662840802485&sw=1280&sh=1024&v=2.9.79&r=stable&ec=0&o=30&fbp=fb.1.1662840802484.1824382894&it=1662840802361&coo=false&rqm=GET HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: image/gif
date: Sat, 10 Sep 2022 20:13:32 GMT
expires: Sat, 10 Sep 2022 20:13:32 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
cache-control: no-cache, must-revalidate, max-age=0
set-cookie:
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 44
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: xadhzB3ojniKzgl+cS1Qjg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: IWCzveqbLVyrQcQ26ttfzpStSS0=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 477fd76de0b69553430d504fe527cc06
88fe80a099e610212f27427ae6fd5b4e03b3df16
f27bc8051a23fbe811318b8d49f5d27e3e992962a0e72f5d30a4790fe4f42748
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F27BC8051A23FBE811318B8D49F5D27E3E992962A0E72F5D30A4790FE4F42748"
Last-Modified: Sat, 10 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13900
Expires: Sun, 11 Sep 2022 00:05:14 GMT
Date: Sat, 10 Sep 2022 20:13:34 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 477fd76de0b69553430d504fe527cc06
88fe80a099e610212f27427ae6fd5b4e03b3df16
f27bc8051a23fbe811318b8d49f5d27e3e992962a0e72f5d30a4790fe4f42748
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F27BC8051A23FBE811318B8D49F5D27E3E992962A0E72F5D30A4790FE4F42748"
Last-Modified: Sat, 10 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13900
Expires: Sun, 11 Sep 2022 00:05:14 GMT
Date: Sat, 10 Sep 2022 20:13:34 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 477fd76de0b69553430d504fe527cc06
88fe80a099e610212f27427ae6fd5b4e03b3df16
f27bc8051a23fbe811318b8d49f5d27e3e992962a0e72f5d30a4790fe4f42748
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F27BC8051A23FBE811318B8D49F5D27E3E992962A0E72F5D30A4790FE4F42748"
Last-Modified: Sat, 10 Sep 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13900
Expires: Sun, 11 Sep 2022 00:05:14 GMT
Date: Sat, 10 Sep 2022 20:13:34 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdde1c872-426a-4aec-b295-a2cac8b36edf.webp
200 OK 4.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdde1c872-426a-4aec-b295-a2cac8b36edf.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 71bafbee3867c04c3712ff98a123d52c
ccf471cd30f5aa96f4e5fdb9e0fbbcdbb475a0bf
58ff1700e0b125caefb73719e2b3d734b2fbcc5ed1aabe5a11bb73b43edab831
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdde1c872-426a-4aec-b295-a2cac8b36edf.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4477
x-amzn-requestid: bbdca46e-5628-4faf-a0fe-ea1b5b39ac2a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YNjzaHrIoAMF-iA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-631bb348-567e946e7cf77f2e11c17c97;Sampled=0
x-amzn-remapped-date: Fri, 09 Sep 2022 21:42:32 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: a0AyKhmYA7WPwciU2nTXwyChZV_riw1QsqI_giBIcdZhi3Nz4jM0Sw==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 a3bd0eb50c22e4d5fbda56a30b96002c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Sep 2022 21:59:11 GMT
age: 80063
etag: "ccf471cd30f5aa96f4e5fdb9e0fbbcdbb475a0bf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4e8861b-4d5e-4f2e-8b1c-e85d23f02c52.jpeg
200 OK 8.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4e8861b-4d5e-4f2e-8b1c-e85d23f02c52.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2b83fa95ed30533299bc754adaced672
27eda8377e1c00c53fb66b4e2fa4f0dd6c7020af
bc59e5ba6abafd8e7b10d6f8ae2269cbf739a4b28f9cbbf3adfc29a9195e6985
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe4e8861b-4d5e-4f2e-8b1c-e85d23f02c52.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8626
x-amzn-requestid: af5e61ab-4f7b-4b03-8413-5d750b17e0df
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YLj9TH7vIAMFVMg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-631ae6bb-309144fb6e02564c4fcdb966;Sampled=0
x-amzn-remapped-date: Fri, 09 Sep 2022 07:09:47 GMT
x-amz-cf-pop: SEA73-P2
x-cache: Hit from cloudfront
x-amz-cf-id: 3gzR4efCGz9QsLoxAMuTUgBAwEc5WdyHBhw_wRPGmfnS9SWm-0vE7w==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 a8e5d5aeee6eacca5c379e5059b1f68c.cloudfront.net (CloudFront), 1.1 google
date: Sat, 10 Sep 2022 07:27:32 GMT
age: 45962
etag: "27eda8377e1c00c53fb66b4e2fa4f0dd6c7020af"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0bedecf7-d9af-4aa7-88b0-94b2a33f9e1a.jpeg
200 OK 9.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0bedecf7-d9af-4aa7-88b0-94b2a33f9e1a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 7ade70e6dbcfb3ca1765f95112671e69
3768753be084c0e0fc268be5b192d02d769114b6
9670a3bf2476ba193cfeb3153c1254bdcfc980a28503dda0d9b398a3a59f53f4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0bedecf7-d9af-4aa7-88b0-94b2a33f9e1a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9766
x-amzn-requestid: 720a4111-91de-4672-88c8-f40db517c07d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YHsjRE13oAMFbCA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63195ae1-288f1f5456bf4d146dcf774c;Sampled=0
x-amzn-remapped-date: Thu, 08 Sep 2022 03:00:49 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: HwwG0Hjf8uZn1AtbLU_wKs3w9lict3tRP31XQY6tIxDz9KDNaBMAqw==
via: 1.1 000f4a2f631bace380a0afa747a82482.cloudfront.net (CloudFront), 1.1 4f3feb5c4393987d42d1971d404d7cea.cloudfront.net (CloudFront), 1.1 google
date: Sat, 10 Sep 2022 04:00:05 GMT
age: 58409
etag: "3768753be084c0e0fc268be5b192d02d769114b6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6c7c5434-1873-4130-a7ce-78209ce54bf0.jpeg
200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6c7c5434-1873-4130-a7ce-78209ce54bf0.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 15249f3dafdd1690bc87ebb4fa6d518d
f930fcb22325e28592bc39b0b1974f5197c19afd
a0b9e88c78e85a037363e0b0e4e03478718f8715fe69e72bfd159922eca28301
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6c7c5434-1873-4130-a7ce-78209ce54bf0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10950
x-amzn-requestid: 435fc2f4-fbcb-4eec-81d8-a23154dcec61
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YFUwZEfvIAMFjCQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63186802-2348a4000430702d4e9ea132;Sampled=0
x-amzn-remapped-date: Wed, 07 Sep 2022 09:44:34 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ORlM8dFTc_iThvJghFakY86D3ToJ5TCmP8Ip2PcvXCCkSKKHpWQ0Zw==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Sep 2022 22:12:29 GMT
age: 79265
etag: "f930fcb22325e28592bc39b0b1974f5197c19afd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e72c2e9-6d47-42ac-9514-316cd8f8f6c5.jpeg
200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e72c2e9-6d47-42ac-9514-316cd8f8f6c5.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash e8f11aeba65478b039cfb4100aa23435
88db17a82ea0207ccb4826c2961875c5106b427a
6f6ec5922ec54d824e7f933de87608c5a763da119ae9461d99c6525649b1a9af
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5e72c2e9-6d47-42ac-9514-316cd8f8f6c5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8676
x-amzn-requestid: 64a58aa8-8321-4c91-98fe-dbf97996c513
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YNiuZEjnIAMFRFg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-631bb18f-77b635593b202d7d3cd0ac84;Sampled=0
x-amzn-remapped-date: Fri, 09 Sep 2022 21:35:11 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Hit from cloudfront
x-amz-cf-id: VWwNSpFvcDq3nrn91QvYjrJX5hLjp96vrKgZzR-pOdrdHx7MlcagGQ==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 d1d67b07408bba8c682597d8303642e2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Sep 2022 22:13:43 GMT
age: 79191
etag: "88db17a82ea0207ccb4826c2961875c5106b427a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb150ddb5-18a6-405d-8041-cdea0c0e6a85.jpeg
200 OK 8.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb150ddb5-18a6-405d-8041-cdea0c0e6a85.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d21a3e07583d9fad4104b6457f7915e7
fdc9453562f993e2545ca99731a7741e748b6082
8ea38264c82c6b544447079cc92eae70d0968a070ba39022af0e18c498916338
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb150ddb5-18a6-405d-8041-cdea0c0e6a85.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8266
x-amzn-requestid: 3411ec4b-ac18-4b4e-8876-c99b94d3a4a3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: YNitWEjhIAMFWpw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-631bb188-4d9e496e7ff141b46748d850;Sampled=0
x-amzn-remapped-date: Fri, 09 Sep 2022 21:35:04 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P2
x-cache: Hit from cloudfront
x-amz-cf-id: vyV1_onImxuLNGp4UI1W5grcuVW3LHJFJjvmO0VXU-OYorF6RVcoDw==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 7d01bcfcfe27ce0b8979cf621dd081de.cloudfront.net (CloudFront), 1.1 google
date: Fri, 09 Sep 2022 21:50:11 GMT
age: 80603
etag: "fdc9453562f993e2545ca99731a7741e748b6082"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
trc-events.taboola.com/1260992/log/3/unip?en=pre_d_eng_tb&tos=1552&scd=100&ssd=1&est=1662840802349&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1662840803902&vi=1662840802345&ri=6e6675c1726cfa6f3455600b8024abf8&ref=null&cv=20220904-2-RELEASE&item-url=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8
204 No Content 0 B URL HTTP/2 trc-events.taboola.com/1260992/log/3/unip?en=pre_d_eng_tb&tos=1552&scd=100&ssd=1&est=1662840802349&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1662840803902&vi=1662840802345&ri=6e6675c1726cfa6f3455600b8024abf8&ref=null&cv=20220904-2-RELEASE&item-url=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8
IP
ASN #200478 Taboola.com ltd
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /1260992/log/3/unip?en=pre_d_eng_tb&tos=1552&scd=100&ssd=1&est=1662840802349&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1662840803902&vi=1662840802345&ri=6e6675c1726cfa6f3455600b8024abf8&ref=null&cv=20220904-2-RELEASE&item-url=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8 HTTP/1.1
Host: trc-events.taboola.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.user-shield.com
Connection: keep-alive
Referer: https://www.user-shield.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
server: nginx
date: Sat, 10 Sep 2022 20:13:34 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.user-shield.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
X-Firefox-Spdy: h2
trc-events.taboola.com/1260992/log/3/unip?en=pre_d_eng_tb&tos=4554&scd=100&ssd=1&est=1662840802349&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1662840806905&vi=1662840802345&ri=6e6675c1726cfa6f3455600b8024abf8&ref=null&cv=20220904-2-RELEASE&item-url=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8
204 No Content 0 B URL HTTP/2 trc-events.taboola.com/1260992/log/3/unip?en=pre_d_eng_tb&tos=4554&scd=100&ssd=1&est=1662840802349&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1662840806905&vi=1662840802345&ri=6e6675c1726cfa6f3455600b8024abf8&ref=null&cv=20220904-2-RELEASE&item-url=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8
IP
ASN #200478 Taboola.com ltd
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /1260992/log/3/unip?en=pre_d_eng_tb&tos=4554&scd=100&ssd=1&est=1662840802349&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1662840806905&vi=1662840802345&ri=6e6675c1726cfa6f3455600b8024abf8&ref=null&cv=20220904-2-RELEASE&item-url=https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8 HTTP/1.1
Host: trc-events.taboola.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.user-shield.com
Connection: keep-alive
Referer: https://www.user-shield.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sat, 10 Sep 2022 20:13:37 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://www.user-shield.com
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
X-Firefox-Spdy: h2
www.user-shield.com/common/common_src.js
200 OK 0 B URL HTTP/2 www.user-shield.com/common/common_src.js
IP
GET /common/common_src.js HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:32 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=3905
etag: W/"029d36c0dea23ad90087937a9a2b6997"
last-modified: Tue, 28 Jun 2022 11:31:35 GMT
x-amz-id-2: 2WOOxEah5tB4/CXQutDXWwDXbjgp6ElYzAaHI52PvV6VjHlvzJtOWE6tI2iWiNiAGoYrtCF5SwA=
x-amz-request-id: T1DQ6N7FQYSTQVPM
cache-control: max-age=259200
cf-cache-status: HIT
age: 5908
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pxd2C3%2BctNpjFwLQFlbcqjSiZrgqUVekce2XrkQYAIOxsii1jNRwsC4v2yc2BAr%2BhhS3C4RgoyNV%2BWZ2XnNvpfQiOipwBQa8t0anfXm5KqQrfXNJUSxFJlOQK2FxNw5AgzhDcK0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 748ad3238ab20b51-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.user-shield.com/common/jquery-3.4.1.min.js
200 OK 0 B URL HTTP/2 www.user-shield.com/common/jquery-3.4.1.min.js
IP
GET /common/jquery-3.4.1.min.js HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:32 GMT
content-type: application/javascript
x-amz-id-2: JLLWtKR96/d2PfXhCYXo3U3nbzs7+KvzkNKF/k3LI5nXSM5AKZVJq3N7j8M66FUHs9K6uEiMN08=
x-amz-request-id: T1DK8733HX3G1HEA
last-modified: Tue, 28 Jun 2022 11:31:38 GMT
etag: W/"220afd743d9e9643852e31a135a9f3ae"
cache-control: max-age=259200
cf-cache-status: HIT
age: 6842
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J4Lzs11uyaFHeRjIzoPMV%2Fi1j9xO26d5ajDATulmqfyNqfQjQ8tOC9a59iE%2F24fVpInq7%2Bg1qm4q4PDwe0eGd4o8YU7xnUfgrf%2Fyvss2LJhBtjf2YkSA%2FodQwISHwSEhSjD1I2M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 748ad3238ab60b51-OSL
content-encoding: br
X-Firefox-Spdy: h2
trc.taboola.com/1260992/trc/3/json?tim=1662840802353&data=%7B%22id%22%3A873%2C%22ii%22%3A%22%2Fnew%2Fvpn-is-required-v2%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1662840802345%2C%22cv%22%3A%2220220904-2-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtakoomiltd2-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1662840802352%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A100%2C%22supv%22%3Atrue%7D%7D&pubit=i
200 OK 0 B URL HTTP/2 trc.taboola.com/1260992/trc/3/json?tim=1662840802353&data=%7B%22id%22%3A873%2C%22ii%22%3A%22%2Fnew%2Fvpn-is-required-v2%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1662840802345%2C%22cv%22%3A%2220220904-2-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtakoomiltd2-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1662840802352%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A100%2C%22supv%22%3Atrue%7D%7D&pubit=i
IP
GET /1260992/trc/3/json?tim=1662840802353&data=%7B%22id%22%3A873%2C%22ii%22%3A%22%2Fnew%2Fvpn-is-required-v2%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1662840802345%2C%22cv%22%3A%2220220904-2-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtakoomiltd2-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1662840802352%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fnew%2Fvpn-is-required-v2%2F%3Fcy_platform%3Dmobile%26cy_platform_type%3Daf%26appid%3Did886492891%26af_prt%3Dtakoomi%26pid%3Doffergatepro_int%26c%3DCPI%26af_channel%3D1StepNew%26af_siteid%3D23988_%26af_click_lookback%3D7d%26clickid%3D9wk44ow4gsco4ww8%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A100%2C%22supv%22%3Atrue%7D%7D&pubit=i HTTP/1.1
Host: trc.taboola.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
content-encoding: gzip
accept-ranges: bytes
date: Sat, 10 Sep 2022 20:13:32 GMT
via: 1.1 varnish
x-served-by: cache-bma1634-BMA
x-cache: MISS
x-cache-hits: 0
x-timer: S1662840812.484278,VS0,VE92
vary: Accept-Encoding
x-vcl-time-ms: 92
X-Firefox-Spdy: h2
www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
200 OK 0 B URL HTTP/2 www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
IP
GET /new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8 HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:31 GMT
content-type: text/html
x-amz-id-2: xfwa0HbVYFU7EmkhvQtSIiv4EK7RDxuw0K0/lxyycY0+zhUq8Px99hhiQqtFv0QO5LL7gBg6Aak=
x-amz-request-id: TJV53SSJSYT0N3YF
last-modified: Wed, 01 Jun 2022 06:02:19 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LQP3fUV%2FLOyJt0efEXukQFDsRhWeWhyozUaGO1jozH6Q2MpiyaZPHQfN1O69E50Fi5cAuhYtgL%2Bf1IjSFEKq2pTXJ2VFG5eim6A3UYEhjdPH2HtFloBti%2F2N4QNVLiDeU73tD%2BI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 748ad322093a0b51-OSL
content-encoding: br
X-Firefox-Spdy: h2
www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
200 OK 0 B URL HTTP/2 www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
IP
GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:32 GMT
content-type: application/javascript
last-modified: Tue, 06 Sep 2022 17:30:56 GMT
etag: W/"631783d0-302c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w0W1WpOqEcTcAoY0bNLjFquEI1E4Djqy9lLHQIVFjbPFVcBO%2BSNW5LZrPhhfiMuwNlRYO%2BsjZNdFXPzW3cKLyBQJK5bfBAShsEP4%2FIoj%2FtBYMnLkVx3J2X9if3v%2BPOFiVXW9S9o%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 748ad3230a320b51-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Mon, 12 Sep 2022 20:13:32 GMT
cache-control: max-age=172800, public
content-encoding: gzip
X-Firefox-Spdy: h2
www.user-shield.com/new/vpn-is-required-v2/assets/style.css
200 OK 0 B URL HTTP/2 www.user-shield.com/new/vpn-is-required-v2/assets/style.css
IP
GET /new/vpn-is-required-v2/assets/style.css HTTP/1.1
Host: www.user-shield.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.user-shield.com/new/vpn-is-required-v2/?cy_platform=mobile&cy_platform_type=af&appid=id886492891&af_prt=takoomi&pid=offergatepro_int&c=CPI&af_channel=1StepNew&af_siteid=23988_&af_click_lookback=7d&clickid=9wk44ow4gsco4ww8
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Sat, 10 Sep 2022 20:13:32 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=42001
etag: W/"9398fcee6c94e20eacd817f23af88527"
last-modified: Wed, 01 Jun 2022 06:02:23 GMT
x-amz-id-2: vpfoE6tyOwJ7sOVwiSZXJo75QA62eguhNwNr6F2cKjTPpaLMfANoP2TW8Zud4ksLSCWpbhyRSCM=
x-amz-request-id: KVR8XMMB3PZE7ECB
cache-control: max-age=259200
cf-cache-status: HIT
age: 1762
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NI9w%2FwQfTdzYcBdm5TUpDa4i%2BUWUwsxbki0JnDu9wjnBJLgeZoKY2ou0%2FdSN%2FW9eP2N4Si%2FmK%2Fvn%2B9pIRZbuCO%2Bsf6UXM%2FMP0VzEUcPD6SRVBmssUBd%2FmSjhug31e8wkVoDTYGI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 748ad3230a2f0b51-OSL
content-encoding: br
X-Firefox-Spdy: h2
88.208.46.156
157.240.200.14
35.86.38.2
93.184.220.29
23.33.119.27
151.101.85.44
0.0.0.0