urlquery - report: quartzfiles.com/show.php

Fully Qualifying Domain Name	Rank	First Seen	Last Seen	IP	Comment
content-signature-2.cdn.mozilla.net (1)	1152	No data	No data	34.160.144.191
contile.services.mozilla.com (1)	1114	2021-05-27 18:32:35 UTC	2022-11-26 05:33:16 UTC	34.117.237.239
mr.macgsapptrck.com (1)	0	No data	No data	34.91.234.242	Unknown ranking
cdntechone.com (1)	64371	2021-12-24 17:09:58 UTC	2022-11-26 05:44:03 UTC	172.67.149.153
ocsp.globalsign.com (1)	2075	2012-07-20 17:46:16 UTC	2020-05-02 20:58:10 UTC	104.18.20.226
ocsp.digicert.com (4)	86	2012-05-21 07:02:23 UTC	2020-05-02 20:58:10 UTC	93.184.220.29
finnan2you.com (1)	0	2021-08-24 10:45:50 UTC	2022-11-26 09:11:52 UTC	139.45.197.238	Unknown ranking
my.rtmark.net (1)	9054	2017-08-22 14:11:49 UTC	2022-11-26 05:56:01 UTC	139.45.195.8
e1.o.lencr.org (2)	6159	No data	No data	23.36.76.226
img-getpocket.cdn.mozilla.net (5)	1631	2018-06-21 23:36:00 UTC	2020-02-19 04:43:25 UTC	34.120.237.76
datatechonert.com (1)	46154	2021-12-24 16:44:17 UTC	2022-11-26 11:18:33 UTC	139.45.195.253
mostprofitsurvey.top (2)	0	2022-03-01 14:46:40 UTC	2022-11-26 15:45:59 UTC	104.21.14.43	Unknown ranking
firefox.settings.services.mozilla.com (2)	867	2020-06-04 20:08:41 UTC	2022-11-26 05:33:20 UTC	34.102.187.140
ocsp.sectigo.com (2)	487	2019-11-29 11:50:24 UTC	2021-09-17 20:05:40 UTC	172.64.155.188
mc.yandex.ru (11)	2672	2012-05-21 09:38:30 UTC	2022-11-26 05:59:03 UTC	77.88.21.119
itcleffaom.com (1)	72236	2021-07-29 11:48:44 UTC	2022-11-26 06:01:25 UTC	139.45.197.237
r3.o.lencr.org (11)	344	No data	No data	23.36.77.32
push.services.mozilla.com (1)	2140	2014-10-24 08:27:06 UTC	2020-05-03 10:09:39 UTC	52.41.201.177
quartzfiles.com (1)	0	2017-06-10 21:47:24 UTC	2022-11-25 20:49:44 UTC	104.21.40.235	Unknown ranking

Scan Date	Severity	Indicator	Comment
2022-11-26	2	quartzfiles.com/show.php	Malware
2022-11-26	2	mostprofitsurvey.top/js/_global-config-sd.82962a7b.js	Phishing

Scan Date	Severity	Indicator	Comment
2022-11-26	2	finnan2you.com	Sinkholed
2022-11-26	2	datatechonert.com	Sinkholed
2022-11-26	2	itcleffaom.com	Sinkholed

Date	UQ / IDS / BL	URL	IP
2023-01-18 18:45:11 +0000	0 - 0 - 3	quartzfiles.com/1252590	104.21.40.235
2022-11-26 15:47:17 +0000	0 - 0 - 5	quartzfiles.com/show.php	104.21.40.235
2022-11-25 14:35:05 +0000	0 - 0 - 4	quartzfiles.com/show.php	104.21.40.235
2022-11-05 19:26:19 +0000	0 - 0 - 86	quartzfiles.com/show.php?l=0&u=917826&id=3955 (...)	104.21.40.235
2022-10-25 21:29:43 +0000	0 - 0 - 2	quartzfiles.com/show.php	104.21.40.235

Date	UQ / IDS / BL	URL	IP
2023-02-01 22:00:28 +0000	0 - 1 - 0	cdn.discordapp.com/attachments/10550955401294 (...)	162.159.134.233
2023-02-01 22:00:28 +0000	0 - 1 - 0	cdn.discordapp.com/attachments/10688216952107 (...)	162.159.135.233
2023-02-01 22:00:19 +0000	0 - 0 - 1	nine3app.xyz/acaf8d68/	188.114.96.1
2023-02-01 21:58:59 +0000	0 - 1 - 1	go.games-universe.online/	188.114.96.1
2023-02-01 21:58:42 +0000	0 - 1 - 0	www.universalbreezy.com/	188.114.96.1

Date	UQ / IDS / BL	URL	IP
2023-01-18 18:45:11 +0000	0 - 0 - 3	quartzfiles.com/1252590	104.21.40.235
2022-12-24 14:46:39 +0000	0 - 0 - 3	quartzfiles.com/1299700	172.67.140.1
2022-11-26 15:47:17 +0000	0 - 0 - 5	quartzfiles.com/show.php	104.21.40.235
2022-11-25 14:35:05 +0000	0 - 0 - 4	quartzfiles.com/show.php	104.21.40.235
2022-11-05 19:26:19 +0000	0 - 0 - 86	quartzfiles.com/show.php?l=0&u=917826&id=3955 (...)	104.21.40.235

Date	UQ / IDS / BL	URL	IP
2023-01-27 20:48:42 +0000	0 - 1 - 6	froyomobile.com/show.php	104.21.0.179
2023-01-23 06:56:00 +0000	0 - 0 - 4	finnan2you.com/link?z=5149721&var=100_2049&ym (...)	139.45.197.238
2023-01-22 05:18:54 +0000	0 - 0 - 4	tundrafile.com/show.php	104.21.82.43
2023-01-19 07:58:02 +0000	0 - 3 - 4	tundrafile.com/show.php	104.21.82.43
2023-01-15 08:32:26 +0000	0 - 1 - 4	playabledownloads.com/show.php	104.18.27.174

Request	Response
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 164d11173045b569cafb32e300e4c1ec6d6ab177fd34d0414cc40c541268779f 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "164D11173045B569CAFB32E300E4C1EC6D6AB177FD34D0414CC40C541268779F" Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=4812 Expires: Sat, 26 Nov 2022 17:07:18 GMT Date: Sat, 26 Nov 2022 15:47:06 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: a9f1d4d98705c281fed3b60343463200 Sha1: db6f8aa98d2eda4e5473b116a222c3055568bb78 Sha256: 164d11173045b569cafb32e300e4c1ec6d6ab177fd34d0414cc40c541268779f
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 8c72a45737c2eeddf328b0ed3236f3243551d904e94ec9dd7254972ebfb9229e 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 6020 Cache-Control: max-age=159862 Date: Sat, 26 Nov 2022 15:47:06 GMT Etag: "6381eaec-1d7" Expires: Mon, 28 Nov 2022 12:11:28 GMT Last-Modified: Sat, 26 Nov 2022 10:31:08 GMT Server: ECS (ska/F719) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: 15b59d5e62caedb4bec3ba6724906c1e Sha1: 960f801e608a56fdd11449f4face29f62cad2b21 Sha256: 8c72a45737c2eeddf328b0ed3236f3243551d904e94ec9dd7254972ebfb9229e
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 5ea71ce6dd9e927f9bb3f97f59cc1ac7dc25a949024815965b29bc5835614786 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "5EA71CE6DD9E927F9BB3F97F59CC1AC7DC25A949024815965B29BC5835614786" Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=14809 Expires: Sat, 26 Nov 2022 19:53:55 GMT Date: Sat, 26 Nov 2022 15:47:06 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 71f9c681a82440fd55e76c780a20e55d Sha1: 3147768cfbcdd06e0c6e69684292e68e99917a80 Sha256: 5ea71ce6dd9e927f9bb3f97f59cc1ac7dc25a949024815965b29bc5835614786
GET /v1/ HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/ FQDN: firefox.settings.services.mozilla.com IP: 34.102.187.140 HASH: 6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152 34.102.187.140 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 939 via: 1.1 google date: Sat, 26 Nov 2022 15:17:32 GMT cache-control: public,max-age=3600 age: 1774 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (939), with no line terminators Size: 939 Md5: d130218d0e2841f39c99610fe1a2ab90 Sha1: 29fbe1e177ee55c7a61ae0a206afff271cf5f945 Sha256: 6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: content-signature-2.cdn.mozilla.net/chains/remote-setti (...) FQDN: content-signature-2.cdn.mozilla.net IP: 34.160.144.191 HASH: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5 34.160.144.191 HTTP/2 200 OK content-type: binary/octet-stream x-amz-id-2: tLYECE1joTLU8aDwMh+M2aKJv4e3769fTFZSBoH6x/bVdhmcpGnIi8zUX/88k9XuB9OrYLEq1vg= x-amz-request-id: Z8EJM1RE02GE66VS content-disposition: attachment accept-ranges: bytes server: AmazonS3 content-length: 5348 via: 1.1 google date: Sat, 26 Nov 2022 15:41:16 GMT age: 350 last-modified: Thu, 10 Nov 2022 09:21:27 GMT etag: "9ebddc2b260d081ebbefee47c037cb28" cache-control: public,max-age=3600 alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: PEM certificate\012- , ASCII text Size: 5348 Md5: 9ebddc2b260d081ebbefee47c037cb28 Sha1: 492bad62a7ca6a74738921ef5ae6f0be5edebf39 Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /v1/tiles HTTP/1.1 Host: contile.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: contile.services.mozilla.com/v1/tiles FQDN: contile.services.mozilla.com IP: 34.117.237.239 HASH: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3 34.117.237.239 HTTP/2 200 OK content-type: application/json server: nginx date: Sat, 26 Nov 2022 15:47:06 GMT content-length: 12 strict-transport-security: max-age=31536000 via: 1.1 google alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: 23e88fb7b99543fb33315b29b1fad9d6 Sha1: a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /show.php HTTP/1.1 Host: quartzfiles.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1	URL: quartzfiles.com/show.php FQDN: quartzfiles.com IP: 104.21.40.235 HASH: 2d63f80aad14515f3a5551c84f49c4c10cf251cc1270491b6842c243227e8551 104.21.40.235 HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Sat, 26 Nov 2022 15:47:06 GMT Transfer-Encoding: chunked Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2B6fStJ25wJIKLQduREUSJiTYktGm68BTARbjlCkY60SgNawiQSxN49jL7SyTRFcUdKdJkAXzzYxfo3C1cfM3hdtxstHsOACyq2Nx15SdkrdMNhA6FaL%2B2a3n4KqaGciN0g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7703c2bc4d17b50b-OSL Content-Encoding: gzip alt-svc: h2=":443"; ma=60 --- Additional Info --- Magic: HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Size: 337 Md5: a0f36ec732e961ec9b9940e1bfd51d28 Sha1: 1e16a81bb00e02fddae727c61adfbf23bacff656 Sha256: 2d63f80aad14515f3a5551c84f49c4c10cf251cc1270491b6842c243227e8551 Alerts: Blocklists: - fortinet: Malware
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 Host: firefox.settings.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: firefox.settings.services.mozilla.com/v1/buckets/main/c (...) FQDN: firefox.settings.services.mozilla.com IP: 34.102.187.140 HASH: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300 34.102.187.140 HTTP/2 200 OK content-type: application/json access-control-allow-origin: * access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'; strict-transport-security: max-age=31536000 x-content-type-options: nosniff content-length: 329 via: 1.1 google date: Sat, 26 Nov 2022 15:08:54 GMT cache-control: public,max-age=3600 age: 2292 last-modified: Fri, 25 Mar 2022 17:45:46 GMT etag: "1648230346554" alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (329), with no line terminators Size: 329 Md5: 0333b0655111aa68de771adfcc4db243 Sha1: 63f295a144ac87a7c8e23417626724eeca68a7eb Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: a616c1e54e896576601e6107c1814adbebf35364d8ed807cdd89ac36b8200c88 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 1940 Cache-Control: max-age=150724 Date: Sat, 26 Nov 2022 15:47:07 GMT Etag: "6381d72b-1d7" Expires: Mon, 28 Nov 2022 09:39:11 GMT Last-Modified: Sat, 26 Nov 2022 09:06:51 GMT Server: ECS (ska/F719) X-Cache: HIT Content-Length: 471 --- Additional Info --- Magic: data Size: 471 Md5: d3df71aab146eefc49acb608796aab63 Sha1: 8401892995193919376dfcd798b09c8261579454 Sha256: a616c1e54e896576601e6107c1814adbebf35364d8ed807cdd89ac36b8200c88
POST / HTTP/1.1 Host: ocsp.sectigo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sectigo.com/ FQDN: ocsp.sectigo.com IP: 172.64.155.188 HASH: b3f60b95aab26d3e1b533ec66128814ba2a68bec92a2ee95d4980e0d80756907 172.64.155.188 HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Sat, 26 Nov 2022 15:47:07 GMT Content-Length: 471 Connection: keep-alive Last-Modified: Wed, 23 Nov 2022 12:57:02 GMT Expires: Wed, 30 Nov 2022 12:57:01 GMT Etag: "b8f9fdef1ef2b82da81da306fdd2ed97e4d4ac7e" Cache-Control: max-age=334793,s-maxage=1800,public,no-transform,must-revalidate X-CCACDN-Proxy-ID: mcdpinlb3 X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7703c2c13edeb506-OSL --- Additional Info --- Magic: data Size: 471 Md5: 0ea07a345ebc12130610f93539bd0aff Sha1: b8f9fdef1ef2b82da81da306fdd2ed97e4d4ac7e Sha256: b3f60b95aab26d3e1b533ec66128814ba2a68bec92a2ee95d4980e0d80756907
GET /click?pid=100&offer_id=15265&sub1=1180287500&sub2=100_2049 HTTP/1.1 Host: mr.macgsapptrck.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Referer: http://quartzfiles.com/ Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: mr.macgsapptrck.com/click?pid=100&offer_id=15265&sub1=1 (...) FQDN: mr.macgsapptrck.com IP: 34.91.234.242 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 34.91.234.242 HTTP/2 302 Found server: nginx date: Sat, 26 Nov 2022 15:47:07 GMT content-length: 0 location: https://finnan2you.com/link?z=5149721&var=100_2049&ymid=638234fbf8af41000129671a x-adjust-use-original-forwarded-for: 1 set-cookie: afclick=638234fbf8af41000129671a; expires=Sun, 26 Nov 2023 15:47:07 GMT; secure; SameSite=None afoffers={"15265":1669477627}; expires=Sun, 26 Nov 2023 15:47:07 GMT; secure; SameSite=None access-control-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1 Host: push.services.mozilla.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Sec-WebSocket-Version: 13 Origin: wss://push.services.mozilla.com/ Sec-WebSocket-Protocol: push-notification Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: MeOIHVTNihNe3ERo0C9Zjg== Connection: keep-alive, Upgrade Sec-Fetch-Dest: websocket Sec-Fetch-Mode: websocket Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Upgrade: websocket	URL: push.services.mozilla.com/ FQDN: push.services.mozilla.com IP: 52.41.201.177 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 52.41.201.177 HTTP/1.1 101 Switching Protocols Connection: Upgrade Upgrade: websocket Sec-WebSocket-Accept: /9RhZw+B4z1slMbvVz93g6QKGqI= --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: eab446c8feb0821966afc6c6c9da1f78c87de3a2a96f0c22a547ba910027a92d 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "EAB446C8FEB0821966AFC6C6C9DA1F78C87DE3A2A96F0C22A547BA910027A92D" Last-Modified: Sat, 26 Nov 2022 11:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=14509 Expires: Sat, 26 Nov 2022 19:48:56 GMT Date: Sat, 26 Nov 2022 15:47:07 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8f2bff5937344e1ea9d03c4db79af670 Sha1: b1beef16998585df8b916d32058f1ffdac300dab Sha256: eab446c8feb0821966afc6c6c9da1f78c87de3a2a96f0c22a547ba910027a92d
GET /link?z=5149721&var=100_2049&ymid=638234fbf8af41000129671a HTTP/1.1 Host: finnan2you.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://quartzfiles.com/ Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: finnan2you.com/link?z=5149721&var=100_2049&ymid=638234f (...) FQDN: finnan2you.com IP: 139.45.197.238 HASH: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 139.45.197.238 HTTP/2 302 Found server: nginx date: Sat, 26 Nov 2022 15:47:07 GMT content-length: 0 location: https://mostprofitsurvey.top/finance-survey.html?offer_id=5917&z=5149721&s=620396472460128777&b=13455311&campaignid=5712225&var=100_2049&ymid=620396472460128777&var_3={var_3}&geo=NO&city=oslo&theme=finance__jochem&ntr=1&testinapp=5047085 access-control-allow-credentials: true access-control-allow-origin: access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding pragma: no-cache cache-control: no-store, no-cache, must-revalidate, max-age=0 expires: Tue, 11 Jan 1994 10:00:00 GMT x-trace-id: b9aa015880dacc3eb00d410d552179fd link: <https://mostprofitsurvey.top>; rel="dns-prefetch preconnect" referrer-policy: no-referrer set-cookie: OAID=aa817959e0174c6d804099f16fa6b5f1; expires=Sun, 26 Nov 2023 15:47:07 GMT oaidts=1669477627; expires=Sun, 26 Nov 2023 15:47:07 GMT OXCCLK=5712225.1; expires=Sun, 26 Nov 2023 15:47:07 GMT allcnt=1; expires=Sun, 26 Nov 2023 15:47:07 GMT strict-transport-security: max-age=1 x-content-type-options: nosniff timing-allow-origin: * X-Firefox-Spdy: h2 --- Additional Info --- Magic: Size: 0 Md5: d41d8cd98f00b204e9800998ecf8427e Sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Alerts: Blocklists: - quad9: Sinkholed
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 009092f48ba1ba54dea1daf127d2b4ef38a2e54f803eb19b0f44d33ad88eaa19 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Cache-Control: max-age=93000 Date: Sat, 26 Nov 2022 15:47:07 GMT Etag: "6380fd43-117" Expires: Sun, 27 Nov 2022 17:37:09 GMT Last-Modified: Fri, 25 Nov 2022 17:37:07 GMT Server: nginx Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 9ed5f9f0f97da1a4336be4b5458696d6 Sha1: 1ddaf3d2685132a32a8df87bb90cfe81b3f9315f Sha256: 009092f48ba1ba54dea1daf127d2b4ef38a2e54f803eb19b0f44d33ad88eaa19
POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.digicert.com/ FQDN: ocsp.digicert.com IP: 93.184.220.29 HASH: 009092f48ba1ba54dea1daf127d2b4ef38a2e54f803eb19b0f44d33ad88eaa19 93.184.220.29 HTTP/1.1 200 OK Content-Type: application/ocsp-response Accept-Ranges: bytes Age: 1 Cache-Control: max-age=93000 Date: Sat, 26 Nov 2022 15:47:08 GMT Etag: "6380fd43-117" Expires: Sun, 27 Nov 2022 17:37:09 GMT Last-Modified: Fri, 25 Nov 2022 17:37:07 GMT Server: ECS (ska/F719) X-Cache: HIT Content-Length: 279 --- Additional Info --- Magic: data Size: 279 Md5: 9ed5f9f0f97da1a4336be4b5458696d6 Sha1: 1ddaf3d2685132a32a8df87bb90cfe81b3f9315f Sha256: 009092f48ba1ba54dea1daf127d2b4ef38a2e54f803eb19b0f44d33ad88eaa19
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 985c784aaaadd96a2ebca14a7ba2673ace9303de6262fccd24e771890d3b952f 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "43BBB48A1A37A33C18036773457C75408E907C1FD7297A42152AEE29F396066E" Last-Modified: Thu, 24 Nov 2022 05:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6755 Expires: Sat, 26 Nov 2022 17:39:43 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 15601 Md5: ffe749acdaefe9c5a04ead27615c1a83 Sha1: 71d030558b2ad443de0b2a3e49cb2f2c8c63220d Sha256: 985c784aaaadd96a2ebca14a7ba2673ace9303de6262fccd24e771890d3b952f
GET /gid.js HTTP/1.1 Host: my.rtmark.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: my.rtmark.net/gid.js FQDN: my.rtmark.net IP: 139.45.195.8 HASH: df6c12275096410c35e28cd296b71af38902cb779c76cd63064ff859a700b688 139.45.195.8 HTTP/2 200 OK content-type: application/json; charset=utf-8 server: nginx date: Sat, 26 Nov 2022 15:47:08 GMT content-length: 65 access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token access-control-expose-headers: Authorization access-control-allow-credentials: true set-cookie: ID=27dc16bbac394c6f8e6634e22d05e46d; expires=Sun, 26 Nov 2023 15:47:08 GMT; secure; SameSite=None strict-transport-security: max-age=1 x-content-type-options: nosniff timing-allow-origin: , X-Firefox-Spdy: h2 --- Additional Info --- Magic: data Size: 6127 Md5: e3660836df08ccfc639b001769d5928f Sha1: 778a1d14adf0c00a172191811a78ce1e8e435ab4 Sha256: df6c12275096410c35e28cd296b71af38902cb779c76cd63064ff859a700b688
POST / HTTP/1.1 Host: e1.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: e1.o.lencr.org/ FQDN: e1.o.lencr.org IP: 23.36.76.226 HASH: 74fc8c0fdadec91149a34b36659d430f6d0f163613182528efe40fb317c2e730 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 345 ETag: "54D2B755BFBFEDFC4DA722A3260099C671FFB2449458266C99FAEFD2429A2869" Last-Modified: Fri, 25 Nov 2022 13:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5688 Expires: Sat, 26 Nov 2022 17:21:56 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 53369 Md5: 9cb8d5841fdfe29eb27f4f9e36b93827 Sha1: 04873b720a5a9494a2badd575219aaf94282729f Sha256: 74fc8c0fdadec91149a34b36659d430f6d0f163613182528efe40fb317c2e730
POST / HTTP/1.1 Host: e1.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: e1.o.lencr.org/ FQDN: e1.o.lencr.org IP: 23.36.76.226 HASH: 54d2b755bfbfedfc4da722a3260099c671ffb2449458266c99faefd2429a2869 23.36.76.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 345 ETag: "54D2B755BFBFEDFC4DA722A3260099C671FFB2449458266C99FAEFD2429A2869" Last-Modified: Fri, 25 Nov 2022 13:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5688 Expires: Sat, 26 Nov 2022 17:21:56 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 345 Md5: 68745a2ce5202b74813ec9b5bf58c1c8 Sha1: f342c1a18d2797b4b9733b6f7fa1b9b340117440 Sha256: 54d2b755bfbfedfc4da722a3260099c671ffb2449458266c99faefd2429a2869
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7626 Expires: Sat, 26 Nov 2022 17:54:14 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8bb181e3f5ca898c6e31a8efc2e28291 Sha1: eda3a91f8e2cbc5467da08ad85e6f6a30702b66c Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7626 Expires: Sat, 26 Nov 2022 17:54:14 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8bb181e3f5ca898c6e31a8efc2e28291 Sha1: eda3a91f8e2cbc5467da08ad85e6f6a30702b66c Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7626 Expires: Sat, 26 Nov 2022 17:54:14 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8bb181e3f5ca898c6e31a8efc2e28291 Sha1: eda3a91f8e2cbc5467da08ad85e6f6a30702b66c Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7626 Expires: Sat, 26 Nov 2022 17:54:14 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8bb181e3f5ca898c6e31a8efc2e28291 Sha1: eda3a91f8e2cbc5467da08ad85e6f6a30702b66c Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7626 Expires: Sat, 26 Nov 2022 17:54:14 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: 8bb181e3f5ca898c6e31a8efc2e28291 Sha1: eda3a91f8e2cbc5467da08ad85e6f6a30702b66c Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F34ec689c-96b7-450b-b77e-e0ecb4d89c3c.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 4b0ffde427085c796a7a5823604b29a4af43dbb93e99ec41f34feb37f52ac7d9 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9049 x-amzn-requestid: 6cbd9639-c29d-4ff4-8091-3168f64f4c78 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: cLVVGHzKoAMFSuA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-638135ba-100ea4235fdf1df8491041c8;Sampled=0 x-amzn-remapped-date: Fri, 25 Nov 2022 21:38:02 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: utbUF-6Z7rMqPNdRKHJyI-IZoyTy6HpkNBY-60xcZ-6NDXBz1XN6-Q== via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google date: Fri, 25 Nov 2022 21:48:40 GMT age: 64708 etag: "3d32bff85cb7ec118c4496d0c3802829fdc9af3b" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 9049 Md5: c8dc4b8a7e9f7f4f84f0da568b43392b Sha1: 3d32bff85cb7ec118c4496d0c3802829fdc9af3b Sha256: 4b0ffde427085c796a7a5823604b29a4af43dbb93e99ec41f34feb37f52ac7d9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8f5318cc-4728-4160-afd1-9d20b79b7de9.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 7076aaeaa5aa2631f868ed11ea7c221d13d6f0c27af6c73de1896465bfc0fbea 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 9914 x-amzn-requestid: 4db4ed29-20b4-4ca7-8835-2463d0989d5b x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: cLVVFHQYIAMFc4Q= x-content-type-options: nosniff x-amzn-trace-id: Root=1-638135b9-613da006118724124e345b29;Sampled=0 x-amzn-remapped-date: Fri, 25 Nov 2022 21:38:01 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Hit from cloudfront x-amz-cf-id: qKxrYxVsJWOXAbrn6IpwLycF3rknFLkQeDyKOLq5WyflvTLeUjg_Lg== via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google date: Fri, 25 Nov 2022 22:18:42 GMT age: 62906 etag: "47fac81a2dd809df5c42ca1362f71d553572d2b1" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: data Size: 13119 Md5: 4402fd493d3c8df5ba927ad51e05ce3a Sha1: ab303503258c5c127e259d6e5a98c6d231862ea2 Sha256: 7076aaeaa5aa2631f868ed11ea7c221d13d6f0c27af6c73de1896465bfc0fbea
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc537c2d0-d011-4ed0-a5d4-5f5d2190c49b.webp HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 68916ab1e11cfed168d9c341031320e71c5902596528142c620a9956dcfe648d 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4366 x-amzn-requestid: ce25f5ab-0c92-431e-ae4e-618829594a74 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: cLVNZFjHoAMFXLg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-63813588-6a3a8dff70e717011e3a0606;Sampled=0 x-amzn-remapped-date: Fri, 25 Nov 2022 21:37:12 GMT x-amz-cf-pop: HIO50-C1, SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: CkXSlYXZ0DFVjVSVin4Km3_9nETFtQ8Qf6f2V5kjuwoCejVH3Qk0Qg== via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google date: Fri, 25 Nov 2022 21:47:48 GMT age: 64760 etag: "8665e5f3026f2c2b9505eb139c478f4d359851c3" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: data Size: 5056 Md5: 2cfa02a7f77325cff667d13c95bba102 Sha1: 655ad3fd029fdc3679ccf91c7a18626d4006daad Sha256: 68916ab1e11cfed168d9c341031320e71c5902596528142c620a9956dcfe648d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 4309 x-amzn-requestid: a22b4d7e-e208-4bda-81c2-d13e6463380e x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: blE0hGNioAMF_Tg= x-content-type-options: nosniff x-amzn-trace-id: Root=1-6371e81c-1b13846866f56a0e47675e56;Sampled=0 x-amzn-remapped-date: Mon, 14 Nov 2022 07:02:52 GMT x-amz-cf-pop: SEA73-P1 x-cache: Hit from cloudfront x-amz-cf-id: 0sYKpJWi2Tv9Atz3PYXm5j7kmncAOxjcLcK4hgAkJ5b4pNMDmjdB6g== via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google date: Sat, 26 Nov 2022 02:19:43 GMT age: 48445 etag: "126771b86638108050cf57c0d12faa27f80f0edb" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 4309 Md5: 841a4b110022a99ddea6f7bf66df0fa1 Sha1: 126771b86638108050cf57c0d12faa27f80f0edb Sha256: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db
GET /stattag.js HTTP/1.1 Host: cdntechone.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: cdntechone.com/stattag.js FQDN: cdntechone.com IP: 172.67.149.153 HASH: c9f8349e2a1a95df5039a9929f97f7a891b394bcfbb2abfbfdeee3ada8df102c 172.67.149.153 HTTP/2 200 OK content-type: application/javascript date: Sat, 26 Nov 2022 15:47:08 GMT last-modified: Wed, 23 Nov 2022 15:07:35 GMT etag: W/"637e3737-3284" link: <https://datatechone.com/>; rel=preconnect; crossorigin, <https://datatechonert.com/>; rel=preconnect; crossorigin cache-control: max-age=14400 cf-cache-status: HIT age: 5465 report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OM4U4zQhy%2BEVzzh6EkAAmvRtFhryej70MNo3a4B0yy7CiTfT2KWGlOtosERVU1w%2FMbacQS6YWnS%2Bvylck8QMd1QekevHMRd6RVZZh1jucjpgvbKF42KQuNbvD7GVhscxlQ%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare cf-ray: 7703c2cb0f000afa-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info --- Magic: ASCII text, with very long lines (12932), with no line terminators Size: 21034 Md5: d6a173fd6d146b76cfd08f50e105630a Sha1: f59bd5356a8dddf07f80c7ddff238bf6bf97edec Sha256: c9f8349e2a1a95df5039a9929f97f7a891b394bcfbb2abfbfdeee3ada8df102c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf04cc9f-ee4b-42fd-914f-cd86b9dc30eb.jpeg HTTP/1.1 Host: img-getpocket.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: null Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: img-getpocket.cdn.mozilla.net/296x148/filters:format(jp (...) FQDN: img-getpocket.cdn.mozilla.net IP: 34.120.237.76 HASH: 19db42201d0fa059f680d890ede6683c04e893e6308a2256d0203f826a7f34de 34.120.237.76 HTTP/2 200 OK content-type: image/jpeg server: nginx content-length: 3502 x-amzn-requestid: ca3f2610-e03c-48a7-abb3-fbbab76f63d2 x-xss-protection: 1; mode=block access-control-allow-origin: * strict-transport-security: max-age=63072000; includeSubdomains; preload x-frame-options: DENY content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' x-amz-apigw-id: cCvYUHO5IAMFqDA= x-content-type-options: nosniff x-amzn-trace-id: Root=1-637dc5ce-7e36137711dc4668278c1c94;Sampled=0 x-amzn-remapped-date: Wed, 23 Nov 2022 07:03:42 GMT x-amz-cf-pop: SEA19-C2 x-cache: Miss from cloudfront x-amz-cf-id: SRN-oOfa8Z0mQZFYkWAv32XFiXChfGjfwZkfWz-IzHubwrKgzwoTxQ== via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google date: Sat, 26 Nov 2022 03:55:38 GMT age: 42690 etag: "61f9bed607e81606be78285596acdc5e0e4f4994" cache-control: max-age=3600,public,public alt-svc: clear X-Firefox-Spdy: h2 --- Additional Info --- Magic: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Size: 3502 Md5: a783df85f30f9c555f9df6b99f61744d Sha1: 61f9bed607e81606be78285596acdc5e0e4f4994 Sha256: 19db42201d0fa059f680d890ede6683c04e893e6308a2256d0203f826a7f34de
POST /gseccovsslca2018 HTTP/1.1 Host: ocsp.globalsign.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 79 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.globalsign.com/gseccovsslca2018 FQDN: ocsp.globalsign.com IP: 104.18.20.226 HASH: 711a049e3884dd7db79df9c1ca68dfe9726a8a241a3c1de122ab3e0525501b80 104.18.20.226 HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Sat, 26 Nov 2022 15:47:08 GMT Content-Length: 937 Connection: keep-alive Expires: Wed, 30 Nov 2022 14:00:10 GMT ETag: "f139ab1a0ccc6a93d362f118bba31c839f267c3e" Last-Modified: Sat, 26 Nov 2022 14:00:11 GMT Cache-Control: public, no-transform, must-revalidate, s-maxage=3600 CF-Cache-Status: HIT Age: 2953 Accept-Ranges: bytes Vary: Accept-Encoding Server: cloudflare CF-RAY: 7703c2cbab120afe-OSL --- Additional Info --- Magic: data Size: 937 Md5: 2ef52f0a27044dea01b83a5a47413942 Sha1: f139ab1a0ccc6a93d362f118bba31c839f267c3e Sha256: 711a049e3884dd7db79df9c1ca68dfe9726a8a241a3c1de122ab3e0525501b80
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: 6d289c05e813615ba7d0663c6af866a77d2fae21e578493995ab23491f58a546 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C91C2CC9226397D0278426D69FD59551FCEB5202F3E4CB169B5CDDF80D0981A8" Last-Modified: Thu, 24 Nov 2022 18:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=8890 Expires: Sat, 26 Nov 2022 18:15:18 GMT Date: Sat, 26 Nov 2022 15:47:08 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 3491 Md5: 52a48e6036675749d750518da68c5d63 Sha1: 10c1844b0ebbff3fa19a82e75231e34b088f8025 Sha256: 6d289c05e813615ba7d0663c6af866a77d2fae21e578493995ab23491f58a546
GET /metrika/tag.js HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site	URL: mc.yandex.ru/metrika/tag.js FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 2729cfe8b2f5142cf99734cbb4e1a3c6cd35868d279cd796db49ef62742ef993 77.88.21.119 HTTP/2 200 OK content-type: application/javascript content-length: 73267 date: Sat, 26 Nov 2022 15:47:08 GMT access-control-allow-origin: * etag: "637f41b2-11e33" expires: Sat, 26 Nov 2022 16:47:08 GMT last-modified: Thu, 24 Nov 2022 13:04:34 GMT cache-control: max-age=3600 content-encoding: br strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: Unicode text, UTF-8 (with BOM) text, with very long lines (587) Size: 73267 Md5: 1d79426653c3b55939eaec59a2ce8ef5 Sha1: c6db0314df7a4e5c08047f6306e0b79a1ad3bab2 Sha256: 2729cfe8b2f5142cf99734cbb4e1a3c6cd35868d279cd796db49ef62742ef993
POST / HTTP/1.1 Host: ocsp.sectigo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: ocsp.sectigo.com/ FQDN: ocsp.sectigo.com IP: 172.64.155.188 HASH: 3cf34029e6a112320130d154ac1291e49bcb4a80f0caaf84309456986f0adc77 172.64.155.188 HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Sat, 26 Nov 2022 15:47:09 GMT Content-Length: 471 Connection: keep-alive Last-Modified: Fri, 25 Nov 2022 13:33:17 GMT Expires: Fri, 02 Dec 2022 13:33:16 GMT Etag: "374a72c3026ea1fa5defd1e8eb7be2ca7184dfd5" Cache-Control: max-age=509767,s-maxage=1800,public,no-transform,must-revalidate X-CCACDN-Proxy-ID: mcdpinlb3 X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 7703c2cc5de4b506-OSL --- Additional Info --- Magic: data Size: 471 Md5: c910a44bf58b708c25d146fd52adb8e9 Sha1: 374a72c3026ea1fa5defd1e8eb7be2ca7184dfd5 Sha256: 3cf34029e6a112320130d154ac1291e49bcb4a80f0caaf84309456986f0adc77
POST /log/add?cid=eacf36da-c06d-4d71-90cc-88e30cd4240a HTTP/1.1 Host: datatechonert.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: text/plain;charset=UTF-8 Content-Length: 1220 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: datatechonert.com/log/add?cid=eacf36da-c06d-4d71-90cc-8 (...) FQDN: datatechonert.com IP: 139.45.195.253 HASH: 21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed 139.45.195.253 HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Server: nginx/1.19.10 Date: Sat, 26 Nov 2022 15:47:09 GMT Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: https://mostprofitsurvey.top Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match Access-Control-Allow-Credentials: true --- Additional Info --- Magic: JSON data\012- , ASCII text, with no line terminators Size: 12 Md5: adb4650bfc9d2a73d4dd69583b0ceb14 Sha1: 1ce399d6e936232aaf2192cd7903a279c5015f22 Sha256: 21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed Alerts: Blocklists: - quad9: Sinkholed
GET /metrika/advert.gif HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/metrika/advert.gif FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: * etag: "637f41b2-2b" expires: Sat, 26 Nov 2022 16:47:09 GMT accept-ranges: bytes last-modified: Thu, 24 Nov 2022 13:04:34 GMT cache-control: max-age=3600 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
GET /watch/66423859?wmode=7&page-url=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&site-info=%7B%7D&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afp%3A209%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A419470722%3Arqn%3A1%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C81%2C0%2C%2C0%2C%2C120%2C2%2C%2C%2C%2C268%3Ans%3A1669477628258%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859?wmode=7&page-url=https%3A%2 (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: ea13855daad6174834a765dd2b8f089d334b62973b7600a5390a7e4d3b2df12c 77.88.21.119 HTTP/2 302 Found location: /watch/66423859/1?wmode=7&page-url=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&site-info=%7B%7D&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afp%3A209%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A419470722%3Arqn%3A1%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C0%2C81%2C0%2C%2C0%2C%2C120%2C2%2C%2C%2C%2C268%3Ans%3A1669477628258%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money%21&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29fip%281%29rqnl%281%29ti%282%29 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top set-cookie: yandexuid=8966651711669477629; Expires=Sun, 26-Nov-2023 15:47:09 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure yuidss=8966651711669477629; Expires=Sun, 26-Nov-2023 15:47:09 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure yabs-sid=2325883121669477629; Path=/; SameSite=None; Secure i=OcGh89uiviFfCc68zCE6rszk29FMpXhLtik2go3faLG3kK1//dyympIF7ijwHJ3YrFr8ee0+sP8JX4hSdF5eW55w/wA=; Expires=Tue, 23-Nov-2032 15:47:03 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly; SameSite=None ymex=1701013629.yc.1669477629#1701013629.yrts.1669477629#1701013629.yrtsi.1669477629; Expires=Sun, 26-Nov-2023 15:47:09 GMT; Domain=.yandex.ru; Path=/; SameSite=None; Secure access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: JSON data\012- , ASCII text, with very long lines (400), with no line terminators Size: 400 Md5: 5428ab6ba7fb1568e21362920dce051d Sha1: 4fbc9d5dfba5dd0523dd1fd2ec0034cafe7a9ad2 Sha256: ea13855daad6174834a765dd2b8f089d334b62973b7600a5390a7e4d3b2df12c
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonSurveyStart&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A489915592%3Arqn%3A2%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C809%2C809%2C1%2C%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(2)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 76 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonAdexCall&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A428665223%3Arqn%3A3%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(3)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 16 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonNotificationPermission&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A566912365%3Arqn%3A6%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(6)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 53 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonStepChange&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A563912856%3Arqn%3A5%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(5)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 43 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonTrafficQualityCheck&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A489016697%3Arqn%3A8%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(8)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 50 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonUnique&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A1035206505%3Arqn%3A4%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(4)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 37 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonGetIppRotate&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A1062066995%3Arqn%3A9%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(9)aw(1)ecs(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 218 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonAdexLoad&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A942010641%3Arqn%3A7%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(7)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 Host: mc.yandex.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 16 Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site TE: trailers	URL: mc.yandex.ru/watch/66423859/1?page-url=goal%3A%2F%2Fmos (...) FQDN: mc.yandex.ru IP: 77.88.21.119 HASH: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 77.88.21.119 HTTP/2 200 OK content-type: image/gif content-length: 43 date: Sat, 26 Nov 2022 15:47:09 GMT access-control-allow-origin: https://mostprofitsurvey.top access-control-allow-credentials: true pragma: no-cache x-xss-protection: 1; mode=block expires: Sat, 26-Nov-2022 15:47:09 GMT last-modified: Sat, 26-Nov-2022 15:47:09 GMT cache-control: private, no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000 X-Firefox-Spdy: h2 --- Additional Info --- Magic: GIF image data, version 89a, 1 x 1\012- data Size: 43 Md5: df3e567d6f16d040326c7a0ea29a4f41 Sha1: ea7df583983133b62712b5e73bffbcd45cc53736 Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache	URL: r3.o.lencr.org/ FQDN: r3.o.lencr.org IP: 23.36.77.32 HASH: c7900d95b0c264ad3b48062670dfeda6e68d7a7f70897230d57be8a3bbb2391f 23.36.77.32 HTTP/1.1 200 OK Content-Type: application/ocsp-response Server: nginx Content-Length: 503 ETag: "C7900D95B0C264AD3B48062670DFEDA6E68D7A7F70897230D57BE8A3BBB2391F" Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15349 Expires: Sat, 26 Nov 2022 20:03:04 GMT Date: Sat, 26 Nov 2022 15:47:15 GMT Connection: keep-alive --- Additional Info --- Magic: data Size: 503 Md5: df2881ad97dab4e85615625a44f34cfb Sha1: 9a58ffc39be0679942c7a62f7fe0fd3d52b41337 Sha256: c7900d95b0c264ad3b48062670dfeda6e68d7a7f70897230d57be8a3bbb2391f
GET /js/_global-config-sd.82962a7b.js HTTP/1.1 Host: mostprofitsurvey.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin TE: trailers	URL: mostprofitsurvey.top/js/_global-config-sd.82962a7b.js FQDN: mostprofitsurvey.top IP: 104.21.14.43 104.21.14.43 HTTP/2 200 OK content-type: application/javascript date: Sat, 26 Nov 2022 15:47:08 GMT cf-bgj: minify etag: W/"63809bf7-16d" last-modified: Fri, 25 Nov 2022 10:41:59 GMT vary: Accept-Encoding cache-control: max-age=14400 cf-cache-status: HIT age: 571 report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8BVLthsIqN4OpXT6fto73MM3o9X0CwIfvWL5ApYvEy%2BCI5f%2Fwv1QFOB%2BGZocEZpF4Grr4MsNpOcxObYsoLm3NTZMnbn%2F4Jyz9H16OzefSjvRpwV12BhIwQwDh%2FMMxIgAmpRoSk12ZQ%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 7703c2c84945b50f-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info --- Alerts: Blocklists: - fortinet: Phishing
GET /rotate?zz=4292523;4326653;5128285;4949467&var=5149721&ymid=100_2049&uid=27dc16bbac394c6f8e6634e22d05e46d HTTP/1.1 Host: itcleffaom.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: https://mostprofitsurvey.top Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site	URL: itcleffaom.com/rotate?zz=4292523;4326653;5128285;494946 (...) FQDN: itcleffaom.com IP: 139.45.197.237 139.45.197.237 HTTP/2 200 OK content-type: application/javascript server: nginx date: Sat, 26 Nov 2022 15:47:08 GMT x-trace-id: 4599eec0eee719033eb3018f1cdbadea pragma: no-cache expires: Tue, 11 Jan 1994 10:00:00 GMT cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0 vary: Origin access-control-allow-origin: https://mostprofitsurvey.top access-control-expose-headers: Link access-control-allow-credentials: true access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding set-cookie: OAID=27dc16bbac394c6f8e6634e22d05e46d; expires=Sun, 26 Nov 2023 15:47:08 GMT; path=/; secure; SameSite=None strict-transport-security: max-age=1 x-content-type-options: nosniff timing-allow-origin: , content-encoding: gzip X-Firefox-Spdy: h2 --- Additional Info --- Alerts: Blocklists: - quad9: Sinkholed
GET /finance-survey.html?offer_id=5917&z=5149721&s=620396472460128777&b=13455311&campaignid=5712225&var=100_2049&ymid=620396472460128777&var_3={var_3}&geo=NO&city=oslo&theme=finance__jochem&ntr=1&testinapp=5047085 HTTP/1.1 Host: mostprofitsurvey.top User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site	URL: mostprofitsurvey.top/finance-survey.html?offer_id=5917& (...) FQDN: mostprofitsurvey.top IP: 104.21.14.43 104.21.14.43 HTTP/2 200 OK content-type: text/html date: Sat, 26 Nov 2022 15:47:08 GMT last-modified: Fri, 25 Nov 2022 10:41:59 GMT vary: Accept-Encoding cf-cache-status: DYNAMIC report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2LmcbGDf152Vb62OHym3vbFC1nulgtiomhIHfMsckuxL51U3gGFz9%2FDD%2BbhEuJmSvNlJpRYmFJV%2FVVsT6WU%2FEDg4nBoTzrCGCmPYI%2Fx9M16k997vvC135dydpaHj%2Flbh%2FH8rUlAZ1g%3D%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 7703c2c79850b50f-OSL content-encoding: br alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 X-Firefox-Spdy: h2 --- Additional Info ---

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "164D11173045B569CAFB32E300E4C1EC6D6AB177FD34D0414CC40C541268779F" 

                                        
                                            
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=4812 

                                        
                                            
Expires: Sat, 26 Nov 2022 17:07:18 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:06 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    a9f1d4d98705c281fed3b60343463200

                                                Sha1:   db6f8aa98d2eda4e5473b116a222c3055568bb78

                                                Sha256: 164d11173045b569cafb32e300e4c1ec6d6ab177fd34d0414cc40c541268779f

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "5EA71CE6DD9E927F9BB3F97F59CC1AC7DC25A949024815965B29BC5835614786" 

                                        
                                            
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=14809 

                                        
                                            
Expires: Sat, 26 Nov 2022 19:53:55 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:06 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    71f9c681a82440fd55e76c780a20e55d

                                                Sha1:   3147768cfbcdd06e0c6e69684292e68e99917a80

                                                Sha256: 5ea71ce6dd9e927f9bb3f97f59cc1ac7dc25a949024815965b29bc5835614786

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 

                                        
                                            
Host: content-signature-2.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.160.144.191

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: binary/octet-stream

                                        

                                        
                                            
x-amz-id-2: tLYECE1joTLU8aDwMh+M2aKJv4e3769fTFZSBoH6x/bVdhmcpGnIi8zUX/88k9XuB9OrYLEq1vg= 

                                        
                                            
x-amz-request-id: Z8EJM1RE02GE66VS 

                                        
                                            
content-disposition: attachment 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
server: AmazonS3 

                                        
                                            
content-length: 5348 

                                        
                                            
via: 1.1 google 

                                        
                                            
date: Sat, 26 Nov 2022 15:41:16 GMT 

                                        
                                            
age: 350 

                                        
                                            
last-modified: Thu, 10 Nov 2022 09:21:27 GMT 

                                        
                                            
etag: "9ebddc2b260d081ebbefee47c037cb28" 

                                        
                                            
cache-control: public,max-age=3600 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  PEM certificate\012- , ASCII text

                                                Size:   5348

                                                Md5:    9ebddc2b260d081ebbefee47c037cb28

                                                Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39

                                                Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.digicert.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         93.184.220.29

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Age: 1940 

                                        
                                            
Cache-Control: max-age=150724 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:07 GMT 

                                        
                                            
Etag: "6381d72b-1d7" 

                                        
                                            
Expires: Mon, 28 Nov 2022 09:39:11 GMT 

                                        
                                            
Last-Modified: Sat, 26 Nov 2022 09:06:51 GMT 

                                        
                                            
Server: ECS (ska/F719) 

                                        
                                            
X-Cache: HIT 

                                        
                                            
Content-Length: 471 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   471

                                                Md5:    d3df71aab146eefc49acb608796aab63

                                                Sha1:   8401892995193919376dfcd798b09c8261579454

                                                Sha256: a616c1e54e896576601e6107c1814adbebf35364d8ed807cdd89ac36b8200c88

                                        
                                            GET /click?pid=100&offer_id=15265&sub1=1180287500&sub2=100_2049 HTTP/1.1 

                                        
                                            
Host: mr.macgsapptrck.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Referer: http://quartzfiles.com/ 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Sec-Fetch-Dest: document 

                                        
                                            
Sec-Fetch-Mode: navigate 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.91.234.242

                                        
                                            HTTP/2 302 Found

                                        

                                        
                                            
server: nginx 

                                        
                                            
date: Sat, 26 Nov 2022 15:47:07 GMT 

                                        
                                            
content-length: 0 

                                        
                                            
location: https://finnan2you.com/link?z=5149721&var=100_2049&ymid=638234fbf8af41000129671a 

                                        
                                            
x-adjust-use-original-forwarded-for: 1 

                                        
                                            
set-cookie: afclick=638234fbf8af41000129671a; expires=Sun, 26 Nov 2023 15:47:07 GMT; secure; SameSite=None
afoffers={"15265":1669477627}; expires=Sun, 26 Nov 2023 15:47:07 GMT; secure; SameSite=None 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  

                                                Size:   0

                                                Md5:    d41d8cd98f00b204e9800998ecf8427e

                                                Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "EAB446C8FEB0821966AFC6C6C9DA1F78C87DE3A2A96F0C22A547BA910027A92D" 

                                        
                                            
Last-Modified: Sat, 26 Nov 2022 11:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=14509 

                                        
                                            
Expires: Sat, 26 Nov 2022 19:48:56 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:07 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    8f2bff5937344e1ea9d03c4db79af670

                                                Sha1:   b1beef16998585df8b916d32058f1ffdac300dab

                                                Sha256: eab446c8feb0821966afc6c6c9da1f78c87de3a2a96f0c22a547ba910027a92d

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.digicert.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         93.184.220.29

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Accept-Ranges: bytes 

                                        
                                            
Cache-Control: max-age=93000 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:07 GMT 

                                        
                                            
Etag: "6380fd43-117" 

                                        
                                            
Expires: Sun, 27 Nov 2022 17:37:09 GMT 

                                        
                                            
Last-Modified: Fri, 25 Nov 2022 17:37:07 GMT 

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 279 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   279

                                                Md5:    9ed5f9f0f97da1a4336be4b5458696d6

                                                Sha1:   1ddaf3d2685132a32a8df87bb90cfe81b3f9315f

                                                Sha256: 009092f48ba1ba54dea1daf127d2b4ef38a2e54f803eb19b0f44d33ad88eaa19

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "43BBB48A1A37A33C18036773457C75408E907C1FD7297A42152AEE29F396066E" 

                                        
                                            
Last-Modified: Thu, 24 Nov 2022 05:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=6755 

                                        
                                            
Expires: Sat, 26 Nov 2022 17:39:43 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:08 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   15601

                                                Md5:    ffe749acdaefe9c5a04ead27615c1a83

                                                Sha1:   71d030558b2ad443de0b2a3e49cb2f2c8c63220d

                                                Sha256: 985c784aaaadd96a2ebca14a7ba2673ace9303de6262fccd24e771890d3b952f

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: e1.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.76.226

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 345 

                                        
                                            
ETag: "54D2B755BFBFEDFC4DA722A3260099C671FFB2449458266C99FAEFD2429A2869" 

                                        
                                            
Last-Modified: Fri, 25 Nov 2022 13:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=5688 

                                        
                                            
Expires: Sat, 26 Nov 2022 17:21:56 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:08 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   53369

                                                Md5:    9cb8d5841fdfe29eb27f4f9e36b93827

                                                Sha1:   04873b720a5a9494a2badd575219aaf94282729f

                                                Sha256: 74fc8c0fdadec91149a34b36659d430f6d0f163613182528efe40fb317c2e730

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" 

                                        
                                            
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=7626 

                                        
                                            
Expires: Sat, 26 Nov 2022 17:54:14 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:08 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    8bb181e3f5ca898c6e31a8efc2e28291

                                                Sha1:   eda3a91f8e2cbc5467da08ad85e6f6a30702b66c

                                                Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" 

                                        
                                            
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=7626 

                                        
                                            
Expires: Sat, 26 Nov 2022 17:54:14 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:08 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    8bb181e3f5ca898c6e31a8efc2e28291

                                                Sha1:   eda3a91f8e2cbc5467da08ad85e6f6a30702b66c

                                                Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0" 

                                        
                                            
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=7626 

                                        
                                            
Expires: Sat, 26 Nov 2022 17:54:14 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:08 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    8bb181e3f5ca898c6e31a8efc2e28291

                                                Sha1:   eda3a91f8e2cbc5467da08ad85e6f6a30702b66c

                                                Sha256: 0e943aacb4a46480ab031ef294a0e089976ec125c331c15116b6c79f6b0f2ff0

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8f5318cc-4728-4160-afd1-9d20b79b7de9.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 9914 

                                        
                                            
x-amzn-requestid: 4db4ed29-20b4-4ca7-8835-2463d0989d5b 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: cLVVFHQYIAMFc4Q= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-638135b9-613da006118724124e345b29;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Fri, 25 Nov 2022 21:38:01 GMT 

                                        
                                            
x-amz-cf-pop: HIO50-C1, SEA19-C2 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: qKxrYxVsJWOXAbrn6IpwLycF3rknFLkQeDyKOLq5WyflvTLeUjg_Lg== 

                                        
                                            
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Fri, 25 Nov 2022 22:18:42 GMT 

                                        
                                            
age: 62906 

                                        
                                            
etag: "47fac81a2dd809df5c42ca1362f71d553572d2b1" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   13119

                                                Md5:    4402fd493d3c8df5ba927ad51e05ce3a

                                                Sha1:   ab303503258c5c127e259d6e5a98c6d231862ea2

                                                Sha256: 7076aaeaa5aa2631f868ed11ea7c221d13d6f0c27af6c73de1896465bfc0fbea

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 4309 

                                        
                                            
x-amzn-requestid: a22b4d7e-e208-4bda-81c2-d13e6463380e 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: blE0hGNioAMF_Tg= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-6371e81c-1b13846866f56a0e47675e56;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Mon, 14 Nov 2022 07:02:52 GMT 

                                        
                                            
x-amz-cf-pop: SEA73-P1 

                                        
                                            
x-cache: Hit from cloudfront 

                                        
                                            
x-amz-cf-id: 0sYKpJWi2Tv9Atz3PYXm5j7kmncAOxjcLcK4hgAkJ5b4pNMDmjdB6g== 

                                        
                                            
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Sat, 26 Nov 2022 02:19:43 GMT 

                                        
                                            
age: 48445 

                                        
                                            
etag: "126771b86638108050cf57c0d12faa27f80f0edb" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   4309

                                                Md5:    841a4b110022a99ddea6f7bf66df0fa1

                                                Sha1:   126771b86638108050cf57c0d12faa27f80f0edb

                                                Sha256: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf04cc9f-ee4b-42fd-914f-cd86b9dc30eb.jpeg HTTP/1.1 

                                        
                                            
Host: img-getpocket.cdn.mozilla.net

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Origin: null 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site

                                         34.120.237.76

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/jpeg

                                        

                                        
                                            
server: nginx 

                                        
                                            
content-length: 3502 

                                        
                                            
x-amzn-requestid: ca3f2610-e03c-48a7-abb3-fbbab76f63d2 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
strict-transport-security: max-age=63072000; includeSubdomains; preload 

                                        
                                            
x-frame-options: DENY 

                                        
                                            
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' 

                                        
                                            
x-amz-apigw-id: cCvYUHO5IAMFqDA= 

                                        
                                            
x-content-type-options: nosniff 

                                        
                                            
x-amzn-trace-id: Root=1-637dc5ce-7e36137711dc4668278c1c94;Sampled=0 

                                        
                                            
x-amzn-remapped-date: Wed, 23 Nov 2022 07:03:42 GMT 

                                        
                                            
x-amz-cf-pop: SEA19-C2 

                                        
                                            
x-cache: Miss from cloudfront 

                                        
                                            
x-amz-cf-id: SRN-oOfa8Z0mQZFYkWAv32XFiXChfGjfwZkfWz-IzHubwrKgzwoTxQ== 

                                        
                                            
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google 

                                        
                                            
date: Sat, 26 Nov 2022 03:55:38 GMT 

                                        
                                            
age: 42690 

                                        
                                            
etag: "61f9bed607e81606be78285596acdc5e0e4f4994" 

                                        
                                            
cache-control: max-age=3600,public,public 

                                        
                                            
alt-svc: clear 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

                                                Size:   3502

                                                Md5:    a783df85f30f9c555f9df6b99f61744d

                                                Sha1:   61f9bed607e81606be78285596acdc5e0e4f4994

                                                Sha256: 19db42201d0fa059f680d890ede6683c04e893e6308a2256d0203f826a7f34de

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "C91C2CC9226397D0278426D69FD59551FCEB5202F3E4CB169B5CDDF80D0981A8" 

                                        
                                            
Last-Modified: Thu, 24 Nov 2022 18:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=8890 

                                        
                                            
Expires: Sat, 26 Nov 2022 18:15:18 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:08 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   3491

                                                Md5:    52a48e6036675749d750518da68c5d63

                                                Sha1:   10c1844b0ebbff3fa19a82e75231e34b088f8025

                                                Sha256: 6d289c05e813615ba7d0663c6af866a77d2fae21e578493995ab23491f58a546

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: ocsp.sectigo.com

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 83 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         172.64.155.188

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:09 GMT 

                                        
                                            
Content-Length: 471 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Last-Modified: Fri, 25 Nov 2022 13:33:17 GMT 

                                        
                                            
Expires: Fri, 02 Dec 2022 13:33:16 GMT 

                                        
                                            
Etag: "374a72c3026ea1fa5defd1e8eb7be2ca7184dfd5" 

                                        
                                            
Cache-Control: max-age=509767,s-maxage=1800,public,no-transform,must-revalidate 

                                        
                                            
X-CCACDN-Proxy-ID: mcdpinlb3 

                                        
                                            
X-Frame-Options: SAMEORIGIN 

                                        
                                            
CF-Cache-Status: DYNAMIC 

                                        
                                            
Server: cloudflare 

                                        
                                            
CF-RAY: 7703c2cc5de4b506-OSL 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   471

                                                Md5:    c910a44bf58b708c25d146fd52adb8e9

                                                Sha1:   374a72c3026ea1fa5defd1e8eb7be2ca7184dfd5

                                                Sha256: 3cf34029e6a112320130d154ac1291e49bcb4a80f0caaf84309456986f0adc77

                                        
                                            GET /metrika/advert.gif HTTP/1.1 

                                        
                                            
Host: mc.yandex.ru

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: image/avif,image/webp,*/* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: image 

                                        
                                            
Sec-Fetch-Mode: no-cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                         77.88.21.119

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/gif

                                        

                                        
                                            
content-length: 43 

                                        
                                            
date: Sat, 26 Nov 2022 15:47:09 GMT 

                                        
                                            
access-control-allow-origin: * 

                                        
                                            
etag: "637f41b2-2b" 

                                        
                                            
expires: Sat, 26 Nov 2022 16:47:09 GMT 

                                        
                                            
accept-ranges: bytes 

                                        
                                            
last-modified: Thu, 24 Nov 2022 13:04:34 GMT 

                                        
                                            
cache-control: max-age=3600 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  GIF image data, version 89a, 1 x 1\012- data

                                                Size:   43

                                                Md5:    df3e567d6f16d040326c7a0ea29a4f41

                                                Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736

                                                Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

                                        
                                            POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonSurveyStart&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A489915592%3Arqn%3A2%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C809%2C809%2C1%2C%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(2)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 

                                        
                                            
Host: mc.yandex.ru

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/x-www-form-urlencoded 

                                        
                                            
Content-Length: 76 

                                        
                                            
Origin: https://mostprofitsurvey.top 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                         77.88.21.119

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/gif

                                        

                                        
                                            
content-length: 43 

                                        
                                            
date: Sat, 26 Nov 2022 15:47:09 GMT 

                                        
                                            
access-control-allow-origin: https://mostprofitsurvey.top 

                                        
                                            
access-control-allow-credentials: true 

                                        
                                            
pragma: no-cache 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
expires: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
last-modified: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
cache-control: private, no-cache, no-store, must-revalidate, max-age=0 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  GIF image data, version 89a, 1 x 1\012- data

                                                Size:   43

                                                Md5:    df3e567d6f16d040326c7a0ea29a4f41

                                                Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736

                                                Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

                                        
                                            POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonNotificationPermission&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A566912365%3Arqn%3A6%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(6)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 

                                        
                                            
Host: mc.yandex.ru

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/x-www-form-urlencoded 

                                        
                                            
Content-Length: 53 

                                        
                                            
Origin: https://mostprofitsurvey.top 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                         77.88.21.119

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/gif

                                        

                                        
                                            
content-length: 43 

                                        
                                            
date: Sat, 26 Nov 2022 15:47:09 GMT 

                                        
                                            
access-control-allow-origin: https://mostprofitsurvey.top 

                                        
                                            
access-control-allow-credentials: true 

                                        
                                            
pragma: no-cache 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
expires: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
last-modified: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
cache-control: private, no-cache, no-store, must-revalidate, max-age=0 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  GIF image data, version 89a, 1 x 1\012- data

                                                Size:   43

                                                Md5:    df3e567d6f16d040326c7a0ea29a4f41

                                                Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736

                                                Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

                                        
                                            POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonTrafficQualityCheck&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A489016697%3Arqn%3A8%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(8)aw(1)fip(1)rqnl(1)ti(2) HTTP/1.1 

                                        
                                            
Host: mc.yandex.ru

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/x-www-form-urlencoded 

                                        
                                            
Content-Length: 50 

                                        
                                            
Origin: https://mostprofitsurvey.top 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                         77.88.21.119

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/gif

                                        

                                        
                                            
content-length: 43 

                                        
                                            
date: Sat, 26 Nov 2022 15:47:09 GMT 

                                        
                                            
access-control-allow-origin: https://mostprofitsurvey.top 

                                        
                                            
access-control-allow-credentials: true 

                                        
                                            
pragma: no-cache 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
expires: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
last-modified: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
cache-control: private, no-cache, no-store, must-revalidate, max-age=0 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  GIF image data, version 89a, 1 x 1\012- data

                                                Size:   43

                                                Md5:    df3e567d6f16d040326c7a0ea29a4f41

                                                Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736

                                                Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

                                        
                                            POST /watch/66423859/1?page-url=goal%3A%2F%2Fmostprofitsurvey.top%2FonGetIppRotate&page-ref=https%3A%2F%2Fmostprofitsurvey.top%2Ffinance-survey.html%3Foffer_id%3D5917%26z%3D5149721%26s%3D620396472460128777%26b%3D13455311%26campaignid%3D5712225%26var%3D100_2049%26ymid%3D620396472460128777%26var_3%3D%257Bvar_3%257D%26geo%3DNO%26city%3Doslo%26theme%3Dfinance__jochem%26ntr%3D1%26testinapp%3D5047085%26utm_campaign%3D100_2049%26utm_medium%3D5149721%26utm_source%3Dzd_5712225%26utm_term%3D13455311%26utm_content%3Dzd_public_v2&charset=utf-8&hittoken=1669477629_3af84ece966e5dc09a094fb23c6e424aa500b9457306f821c731565c587b6e60&browser-info=ar%3A1%3Agdpr%3A14%3Avf%3Ahbzj7lpjz3smdgzs1sf0c%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A923%3Acn%3A1%3Adp%3A0%3Als%3A654587631511%3Ahid%3A685435765%3Az%3A0%3Ai%3A20221126154709%3Aet%3A1669477629%3Ac%3A1%3Arn%3A1062066995%3Arqn%3A9%3Au%3A1669477629855657804%3Aw%3A1268x939%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aeu%3A1%3Ans%3A1669477628258%3Aadb%3A2%3Afip%3Aa81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-a81f3b9bcdd80a361c14af38dc09b309-4bd84c89c35a312599d807af285e7b5f-4335742423629acc806791d3e9f585f3-5b56a9f28e63b1a76c5f94a136cc484e-61b9878bbce18de73aafc8582a198c0c-e9c964637c807fcca817e718cc2d1338-a81f3b9bcdd80a361c14af38dc09b309-c6d7b47b2dcff33f80cab17f3a360d0b-2facd2c41a0047c68391f933b930bc3a%3Arqnl%3A1%3Ast%3A1669477629%3At%3ATwo%20simple%20steps%20to%20make%20money!&t=gdpr(14)mc(g-7)clc(0-0-0)rqnt(9)aw(1)ecs(1)fip(1)rqnl(1)ti(2) HTTP/1.1 

                                        
                                            
Host: mc.yandex.ru

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate, br 

                                        
                                            
Content-Type: application/x-www-form-urlencoded 

                                        
                                            
Content-Length: 218 

                                        
                                            
Origin: https://mostprofitsurvey.top 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Sec-Fetch-Dest: empty 

                                        
                                            
Sec-Fetch-Mode: cors 

                                        
                                            
Sec-Fetch-Site: cross-site 

                                        
                                            
TE: trailers

                                         77.88.21.119

                                        
                                            HTTP/2 200 OK 

                                        
                                            
content-type: image/gif

                                        

                                        
                                            
content-length: 43 

                                        
                                            
date: Sat, 26 Nov 2022 15:47:09 GMT 

                                        
                                            
access-control-allow-origin: https://mostprofitsurvey.top 

                                        
                                            
access-control-allow-credentials: true 

                                        
                                            
pragma: no-cache 

                                        
                                            
x-xss-protection: 1; mode=block 

                                        
                                            
expires: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
last-modified: Sat, 26-Nov-2022 15:47:09 GMT 

                                        
                                            
cache-control: private, no-cache, no-store, must-revalidate, max-age=0 

                                        
                                            
strict-transport-security: max-age=31536000 

                                        
                                            
X-Firefox-Spdy: h2 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  GIF image data, version 89a, 1 x 1\012- data

                                                Size:   43

                                                Md5:    df3e567d6f16d040326c7a0ea29a4f41

                                                Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736

                                                Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

                                        
                                            POST / HTTP/1.1 

                                        
                                            
Host: r3.o.lencr.org

                                        

                                        
                                            
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 

                                        
                                            
Accept: */* 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
Content-Type: application/ocsp-request 

                                        
                                            
Content-Length: 85 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache

                                         23.36.77.32

                                        
                                            HTTP/1.1 200 OK 

                                        
                                            
Content-Type: application/ocsp-response

                                        

                                        
                                            
Server: nginx 

                                        
                                            
Content-Length: 503 

                                        
                                            
ETag: "C7900D95B0C264AD3B48062670DFEDA6E68D7A7F70897230D57BE8A3BBB2391F" 

                                        
                                            
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC 

                                        
                                            
Cache-Control: public, no-transform, must-revalidate, max-age=15349 

                                        
                                            
Expires: Sat, 26 Nov 2022 20:03:04 GMT 

                                        
                                            
Date: Sat, 26 Nov 2022 15:47:15 GMT 

                                        
                                            
Connection: keep-alive 

                                        
                                            
 

                                        
                                        
                                            

                                            --- Additional Info ---

                                            
                                                Magic:  data

                                                Size:   503

                                                Md5:    df2881ad97dab4e85615625a44f34cfb

                                                Sha1:   9a58ffc39be0679942c7a62f7fe0fd3d52b41337

                                                Sha256: c7900d95b0c264ad3b48062670dfeda6e68d7a7f70897230d57be8a3bbb2391f

URL	quartzfiles.com/show.php
IP	104.21.40.235 ()
ASN	#13335 CLOUDFLARENET
UserAgent	Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed	2022-11-26 15:47:17 UTC
Status	Loading report..
IDS alerts	0
Blocklist alert	5
urlquery alerts	No alerts detected
Tags	None

Overview

Domain Summary (19)

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 104.21.40.235

Last 5 reports on ASN: CLOUDFLARENET

Last 5 reports on domain: quartzfiles.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (22)

Executed Evals (1)

#1 JavaScript::Eval (size: 80) - SHA256: 1c6703b04b1c007d768c295ebf10ec7f0eba9f4095e65f17a3ee79d0460c2110

Executed Writes (1)

#1 JavaScript::Write (size: 4) - SHA256: b1ab1e892617f210425f658cf1d361b5489028c8771b56d845fe1c62c1fbc8b0

HTTP Transactions (50)

Overview

Domain Summary (19)

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro

Blocklists

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 104.21.40.235

Last 5 reports on ASN: CLOUDFLARENET

Last 5 reports on domain: quartzfiles.com

Last 5 reports with similar screenshot

JavaScript

Executed Scripts (22)

Executed Evals (1)

#1 JavaScript::Eval (size: 80) - SHA256: 1c6703b04b1c007d768c295ebf10ec7f0eba9f4095e65f17a3ee79d0460c2110

Executed Writes (1)

#1 JavaScript::Write (size: 4) - SHA256: b1ab1e892617f210425f658cf1d361b5489028c8771b56d845fe1c62c1fbc8b0

HTTP Transactions (50)

Network Intrusion Detection Systems